sergiotarxz/libvips
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

block huge tile_size in tiff load

Browse Source 
fuzzed tiffs can give huge and mysterious values for tile_size
This commit is contained in:
John Cupitt 2019-08-09 16:32:35 +01:00
parent ccea473b0e
commit 765a416ca7
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libvips/foreign/tiff2vips.c
View File

@ -2197,6 +2197,18 @@ rtiff_header_read( Rtiff *rtiff, RtiffHeader *header )
header->tile_size = TIFFTileSize( rtiff->tiff );
header->tile_row_size = TIFFTileRowSize( rtiff->tiff );
/* Fuzzed TIFFs can give crazy values for tile_size. Sanity
* check at 100mb per tile.
*/
if( header->tile_size <= 0 ||
header->tile_size > 100 * 1000 * 1000 ||
header->tile_row_size <= 0 ||
header->tile_row_size > 100 * 1000 * 1000 ) {
vips_error( "tiff2vips",
"%s", _( "tile size out of range" ) );
return( -1 );
}
/* Stop some compiler warnings.
*/
header->rows_per_strip = 0;