From 86f02f7c70862a0954bfe8133736d352db978eaa Mon Sep 17 00:00:00 2001 From: Eric Soroos Date: Fri, 8 Jan 2021 18:45:42 +0100 Subject: [PATCH] Fix negative size read in TiffDecode.c * Caught by oss-fuzz runs * CVE-2021-25290 --- ...-0c7e0e8e11ce787078f00b5b0ca409a167f070e0.tif | Bin 0 -> 2529 bytes ...-1185209cf7655b5aed8ae5e77784dfdd18ab59e9.tif | Bin 0 -> 1931 bytes ...-338516dbd2f0e83caddb8ce256c22db3bd6dc40f.tif | Bin 0 -> 4682 bytes ...-4f085cc12ece8cde18758d42608bed6a2a2cfb1c.tif | Bin 0 -> 4050 bytes ...-86214e58da443d2b80820cff9677a38a33dcbbca.tif | Bin 0 -> 286 bytes ...-f46f5b2f43c370fe65706c11449f567ecc345e74.tif | Bin 0 -> 1844 bytes Tests/test_tiff_crashes.py | 8 +++++++- src/libImaging/TiffDecode.c | 4 ++++ 8 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 Tests/images/crash-0c7e0e8e11ce787078f00b5b0ca409a167f070e0.tif create mode 100644 Tests/images/crash-1185209cf7655b5aed8ae5e77784dfdd18ab59e9.tif create mode 100644 Tests/images/crash-338516dbd2f0e83caddb8ce256c22db3bd6dc40f.tif create mode 100644 Tests/images/crash-4f085cc12ece8cde18758d42608bed6a2a2cfb1c.tif create mode 100644 Tests/images/crash-86214e58da443d2b80820cff9677a38a33dcbbca.tif create mode 100644 Tests/images/crash-f46f5b2f43c370fe65706c11449f567ecc345e74.tif diff --git a/Tests/images/crash-0c7e0e8e11ce787078f00b5b0ca409a167f070e0.tif b/Tests/images/crash-0c7e0e8e11ce787078f00b5b0ca409a167f070e0.tif new file mode 100644 index 0000000000000000000000000000000000000000..5275075e9177155cfa0fcc91bb783e237116ddba GIT binary patch literal 2529 zcmbVO4OA0X7QV?OnM^=oAPCVw5)wcVFkldffMS3M7L=%{Sa*pbLJ)`n1QIohg- zP;sjk*{)iUBK{!ww_-)BQni9WMg0E(Sx~`6ZB`4WZ`_-L=Pwr|dz`@K8gz2ANJ z%$X!I(gWB4UJ);3&d2bj%t-preaRX9A_O9>ojy(&05~`6ZQv z7W>^r?OKoxAd@fvenkE%vV{nbWdd+ex)J#W$Znw6H01Xq&qe+V{a=L;p?ZbD~IF`qxt-`!K{Ba_JlZh^r8zCqqoWWH1p8bJ`2 z7M2cU#yI$j_#)rmyiDJM0Cmr#QR^!8E}5JE7ocMdCJSd191BEjw5DDsjLyKAOa_`b zEuTimfI%{CL_VP`+gLU3Y~cE?E&D55Jo9j~o$A_i$&_Uo9}}E$_71%9F0O79-92P} zQ~d)1<%&#g;!Isu=3H&YT-|DIs&mLhKlh-?ky+Zb5ROn7L;+#CI!znw9KI+r;*W|| znOXWYl{P(5o1sl~4w3!}H%y(Sov%yNI*0g5rBmcSzH%R#5Z$Fda+&P^$P3dY>9TaW zl+5odFed|5NLQmn{lGWtQKEF1U@YTBIaaxJCJU`sO*R5tRw(GLs z$90N~$FpsCe~Rmmu_2rLo`hXFsFD7Gy?b`(9#K+ws`uiiJWlq*IR{b#jAchK-T)r; z5hq|IS|}(D`Q}nN+1b+pgSo1~N7&lP!hf{lbpd?H?bIGVQ#IsrC~&WHevhWTT2W|q zFlBe5PleU?+|IJA`2$CJ%aZQ-F!JxNuMNDsykeM@v8ZzOqejKYY}^E0i({fU{H??$ zX?;NOX0f3&p<|A?PFN}^dy^efzV*bk64l(EtU;@&xaJ9^JvmP0=T5|QL`0Rw723sg zlKVOTtE_ju7j; zhT=rA4Hc_`w%*+kQY7Jfg$?>A^mNu;yzdc^koUzw&#}0qbKp*?OO9q!*W;6?J40Gi zi&cWpgE!^WG>p>U%pZN=5uI}=xlM8P%$x%r1I_#u6~N5?$ziyAm)yy)YR|py;cGnG zPR@}k-OY8wy$YqhvFCn)Q{&C(l_hJAcjY`-5Z|jwouoJ1$iMd1uP?49X6v;bC%o4s z%a+QyR@scFO}7nyQLELH|7H%AVvaC0@J2m>L zu>S*1WAn52Z4*|u7ChW(0>8}eDz8t*omYtMM4!lTMw*+YJgG@_>eTG{-hGvqrd>Z& zqz~PDtL?MFUeVH?=ed(J=XL8^Gj`{#{qFClw=J33;rfGjL3hU3W}`Bt|6uj8jx^(} zGYKmv-EMxswGY}%?g)yF4_kT&_?+I!gO!7-+Ou)R=jL`Dn4USoGw^=ptH$bo#){6h zzBtyj>X>`KW1*=Veay}P$p&lMeT?P|bdrXVG}BG6#As-PkuV)j#VXa&sbha|+mU*2 zxV?10S9|E|F0Zmp83QxEFWDy8uFP#nC@ygk>rY;M9jB{Lzryw-kCaP2luj>q+NKSz@~&)*4{H(2cIIE%s_4BmW1Di` zh~j#+c*}Op-TLJ3Yk8`(Ch#rWCSH#XUZ01TL?{LRUk)vKaW<;L#-r%g>9f4hvIufi z`IY2pY7ThSn)10o8r!y#IfiZT89800i&%WJfNO(a zlIOl@D~R3lFgX8fAOu-ig1R8}4E<%<`98^WJl+tt-r-C}XP zBu|Cij?JUh=vPV?oNzS3g^Gboxjjyyj^~ra<)T7f?eh;@HfdN5Ov4Bm0GLJ-UO%+00iPwxryXt!upqd9Myk|et?bW z#xdZqob)2bzE8u93}7{|3>Jv+21pWVB_S5cBgFq9jv+bpjEVGFNRmL0{!LFNJqa5J zLh>Gc6m^U@;E2mcajH#>97VNLNDso+o^W}OjB2BQE9Tno^H-4W1oyxBR524OPqo5A zh?*Kkj)2h!siYfW_e(wlv8d*$hM4bXq>-+af-8zndpGJNbmDUn0M@Fst1YnwaB5G1R))Jh<6|!UHcf0G&`9p-%uPA<%$|#sXcPV(8Diga%8n<#}BaG{XC( z+YLcXL$LG!ScLotA_D3SSOADH{Vn7$2qpAwgWLw03i&)_1VRSmt06kpF{8_eEvU%= zjKeFmQUQ>d1JFeS;F>i6Su6m4vxgJg0_$#tG425Hw!?a#01yxWz``y7^u+*NiU6P~ z3f7JWU@8WHvkCA#8367PIO+FGcMshxkaf=cAA3ZJi~=7(z~S&XECG+l>+2JUWU2v~ zL?T-l8E>T0Ev*=IOB&6Z#bp5{#=?7M@do1d`!N%Vk3XRdj;_w80A_)fEqUfFx2Cav|V)fvpQQ7bu z=ow;-m@eKpW6^%RO$yaDzv?2vcE|TWnS}g0$J%-z^&5SnshPQj<)#nq>>bz~E|2f# z?&0%^(AUpD;8SsESa`(l$j@V9f2dHh5{VNvnPlG3u%lIoh;Gj(Ur zNqZ%~@PAB^Go&%zlQ+Zc6=D6xEfnT9fqCiMHwrBhVx4zv;E?97AZ%#h-W@HnmJw@~ zf=9UMVea)a{BGrB`-~4Sdh-?ewO6A*%d|*jH1iUwz;~W#?02=cZa`Af>zI7vBV!8g z1#h3DfBJWm`I|kI#y;+AsRkxBE+ds6WxONyAL(bLnGmD5^s$MvbDzqV5FtCOm3Xl^%ipY=|76&AY0iG6 z9d{kQW8&i!`54H2N7o|a)@jXCH;lDFp<#Zhhaec2;MKSzMAV|Z?ho?P6me)0(IZ3jmgBZMA^QBvij0qqz|nF<=7<6paL5oXct zS){=OxDE!VZ4iC^vvXcw)5W!sD7jD2__ld1(mkt+^aUU_eUuWt*CmtAO!M15bk3?! zkXJrTdZEqrUYYK_#`TF2)ZZIaGPQ`y@{`%eES6-t;6-L3HMmL zs73BKsBsSaT~>ZGk#Qqr+?xDNz|sp*5K~Lz%TL9ZmkP7Bs&ONm=khl1yTNEJ(uzw; zv73@=(AIB8=#uYDem(3p;dZLe1DCcieLZcUSyum=!8_o0xB*#B$i4g7>Y@_{pYuBF zpgdQV!`O@xmH;%8Iy}^YTo2C-&)` z3@s9v3MlC%S{2*B@+)75ysl)4eMEv%(jUfeQDS5PZ>ME)}QT>Q(dz6 zd}WHzghx5kRXMfzG)_1S)f9y#c z@wg?~U=oyVFTK$kE>ixnOW7>j{r9&f7%%B%2IJ=4e>`)jBB7;B@_S47Z0Mc2tmql8 zgkO9(<^Xs|jfhOQ|Ey`u*LlBN+vW!WhhiT%h~}kbwSipD%tI{qc~z`ewP;txHcFsv z0{tr2nvy6zhl|`ZvJ)Kq@b}nQq5)Oh(JtsZ>n$x#3R literal 0 HcmV?d00001 diff --git a/Tests/images/crash-338516dbd2f0e83caddb8ce256c22db3bd6dc40f.tif b/Tests/images/crash-338516dbd2f0e83caddb8ce256c22db3bd6dc40f.tif new file mode 100644 index 0000000000000000000000000000000000000000..344d62b277a85e4dd8262d31b175958efd0e768f GIT binary patch literal 4682 zcmdUvcUV)&8i&6m6hQ_`VoSZP8??i_HDd!M`PefGaQc{1lc-~8sxS7ye=MH{97z;plt z2?&UmqK@#Do6tKEF$p~%p+D)XT^g~}SC&GoNRSx)N-yH?zS{9QGruw!@%LXf^@!EJ z+VS;#5#w5A^s-KqL}~#PPvDgZlp%5Ldxmdhk&&H>1Q(~{r6mz1NRpBg5=fnn#z8_+a>hJ^6;evx6zTbi%7z&` z4^LUJvh>DxKD7c3qX^bU8QGcNtEkRexJXlLv9_^^=`u5O3p;xUM<-_&S6{!?{sDnO z!PH1BDmsQ1%jR&Cc*!a2Hf3(k+OqYBZMk{7@(XtVv}f;;qsNY)C^~tn_}uvm7k@3g zbh*6pX4S3RcYeEj?{QuIlcx>O8lN}4Yi?<6Ywzgn>iPY1Z(skw;FlphE&|$xf3*J^ zmm-RbC?P?TkjCR85P9fNQk0OKXCO6Wg|{>%QE9$m#uVk1I}exMkXc~lBls?YRVzDF z!?!5@A9)3Kdfr{nBJCjVjmAD@cU1QrKv1TUmFip1Dd z#F>cWd7K2?ERUwoe_yNxX%fZ^hlhm5N}Q5 zVu(rZh_jMt7!PqhVvTq%orZW2u`(T_umL2{VFwKkMvXzNk64c7=VOQ13LSX4=m{J# zfjL+*@)N+0nUKPwMaOW+TGYj419NjTvNOhu$2c4vFA6n|!ipr@G3f~uMhd`K%=j#r zf#;Ttl5A>VZfdGysEg7+-X;Wj-450G-n@!^ofI=p~uhkRcnThY07!D`FLQjv!;wuGBkTO;f zRBlEjjYDHH$TY^ERrqgCo8SYEWBVF`(lHSzhwH-hYGojOcmNVgQ-Ksxh(-wGb#s^T z2mIs(%xxdr_lVK>X#Z~=F$cX8*|cafZnpFBBU8DoB%INiz&lBh1qDzBRhR<{Knrxh z5SD=@*n$JNf+zSv5QG60Vt@`T;6WN>Ko9F)NoxB<7}KGeVy zcmZ#r6}mwH{Vf$x%s;7b$jQo?ap#9UqxKyx+-tgOOJ&f z439ET@O1Ia^L*u{>6Pg9Pj4x2FYkTcZ9WD*X+C#+m3+f}i+%h3R{G`my;!Zan!CEv zU%@}b|CIkgfPFx2z}rB*!1TcTL9>ErL6?H1gZ+a~1oy3RSd+h|HN+$&E97aYW@vKg z-LP3<@nKiP6~Zau=hsTE4Om;eR!H%r9HI0@xJ2xa5K!%?yQ$rgwvoFcJF(?hF4i8k zJSsP;BYJssUUX-SO-w<|dzu|>FRdrmIrd=eK%8e>QJgqFAijh?g}#=4nK6SA$Eae? zVJ0(c6P6@oCA>|vNX$Qo@=W#24VlfGoi?A&lFwpgU8*s!DX+Dvz4qAV@r^qBy4&?G_4l86JgI%U z`suTVkcPL1ypx=pKHb^+EB&{*PK8FMP87^gs|O zXzgM3h=1SyS@m;KuW@f>pI6`OetQ4#z_vlv!INLizT6oK7-}Ep38jTUjVvB17rBXE zis@ppm6QDn_f;5&5=r4utYyh$D;Ew%Co?E?Z25eLKo`gGl{6093uF0G=n3)Id}}i@ z`dR7Ws{bmtL)Q+=7r%7oTN_NGv!`${KN=mW4D}6+EcBOI=o^y_mRT4YTNqC^&mox> z<&Ux0=wg{~t#4>Jnbwm=Iyb3V~fc`Eu&g z-qukcik*k&sD;>V%hnEBpSZf|=;`D9^9>$%E~F`pmfCz^@h9uM z6wNIcI^*dTO&XgQ6%5_$8fljO<(cFnTX|K-l#*1LU27?M+9q9oXH||L*D5RSkn|_cv~;6(#Z{;2xOJTiyH_8rGdq`_Vsf>*+N|!Tl^8O63=1hPOAYh)dIpxg zIeXBN)>-~@#oR6QTh|TlT2b~KvkhUWHV#+1evm%&DXhTr`epe!ySnNteGBJZZOP*= zd7qN9o+K*}ur{`tojUumBwDIJMPsW0mVHi1^CW45^wVo4q+Q-OFFR%%A8twgDMWqb zH=#_ywQ8c_nFR6;$W`W$PNdxE{uHY6a-o*5XqH8fikWZrV}}mTzSN5m#fqhmzOS(S zWnEsl`5N6K)BUS=w%nhp9_)BKkHS=|Ttq6~cxYNxznVaPNzt^;*~UjMu8-^?Jb!fU)v!{mg>YCy|YHTVq??{ofU7(S^ zr0Px+=HcJ^xP9mLobzqj7p#tmgq{nq40W5=sx4Z5nia8w+aJlR{eG^3Y1CReSNTVa zNMcH}*BM8rQtN%yA~^OKeduYI`oPx|MWTG`-?%GB+`A zQ-#TybSYVR8Qm>)Ly|6*2Bs@dU$T|HXD%TZ4T)XJLhWB3=f{>F=#8$SEG(|DtD!ms z{xsdt$$NiZy&P#rT<_96h3^@mi~(Wwk(*_|?c-U!s46~r&XTm>;JS_8FY0%`8_EjU zRd?X*Y#p7pE00Pd-ye^xCOl>Oy)yM!`KvM~^q;Av3&e0X{1_G#u|?5#DgBd+!X_dD)FJw`KZBF!0_? zEx=E|zTRZp)f|t#=UC@!y7~N;_V;&GU+tH_{OHq(=dBlQnD2WpZXY^WQ2y(-q5aIo zKFzTkug{Pzfc3Twx3%^28?-MM%$7f(XY+ZvU6WMi>$wf&->=zI)wW%qcIe}y+8aw{ zs!ghA)mC~O^E>mfqi%h_~=C|3odemTEC zcq?Ch-2vlkW`&;=gef@#zGA>i4)H7bO%}yzHhQ0pT81Brdc;t(S=-VmcXw5`iWr{g z4ZmqxGjcH3(sD>8j4Xy6X7x}&{vN(m(Qj{WaeGHRJoLUq_t`wIPN;?MuPBB?dq)Bm4j%0uI{N&uK$xT18~#DmDO&w5LbRB__2I|VicJ2KqT%c?wf^0wYMoLF%fz6| T?|*bELLzInhh(yaEK@2|njzbib;y=I3Mq^T zWn!#}7Fn{#SjIAD=6>&pkN^Rb zB3vMT^BCObfEfwb-SCV2t>=N6`!{pLEQsLzC(0Vk`+nLT zQgHTM{}%{O{2xJZAUV0Xd3Nyb+yy(-?D@5|NDfXU7Z)cd>>UN$0jD6>-b1PVc zu(q+iV0Y2p!QI2t%lmI1-=N@->!D%cH*Vj#8;iSlKQ1XbC6)N-aa#J5y!?W~qNl|r z)z4ql)YiSMCxv``=vRC7j~0wxi)_DULqiy`{;T5sesXOt%83g59w%1XeNi^!1h27pugQm3HVbb-Re0zb0eX=LRp3`iQL6>F zwkl$o6*uX{VY8%bGr1uY+~v17otlHsRygau4Y|-5;`B1+I+oVH<`}?#qG(@8Z3Z^+ zl(^UPKzt&OQ|QI9?tpG1s?73F=dT768dc>#L>(A~p(A2~t1r95C5Ls|4S45WoKnXP zMKvQtG$$*2=oo%A#W`_#t%+=e44&j{wB&NOv~BT5&y_UEj1YIvsJ;5%96ppF0)b+q z@N}u*m(Yrmi?ipA$o!aE~_nS#8kv=WDWs^*OW?xm1rEpiOtfmQ=a)>G8)&i4KGZmwj8#|&506Ifq|pLnrnHO87c0HF*TZG*sd^Hs zh2)+hZ}NO>szj!oYppjWsOL^bJa&{|y<_qco2VQo%B~%J1CoS;k%i%J=9ipAzQ`W6 zW{c@Ai)dRD`b=hmGa_m(mk3sMA0X>JyOHdob4j^KGt)M4lCn#}!L&Wu4TEYqf-H&2 z;d{G|qVX#f@!ch;KdFiKT5}~PUdqn$ao=TpkA2~+(KNp9JdaLS6xZ&ZSrRS{5jHb& z7Sy0!PNDr{ev2}<>vU$qxs0S`q7>eCjCopK_|Z3=h);MvMR=kAgw3>)_Piy5{w6wk zlrBg1-NbkEqgJZP7_}c&Qo;{(JvhQA&X$>)RT*Yb4`$l6jr)F`t5Ln|?~*rSxZ&iz_KjHFQ^cEEIT95g#!&Uo|aH)d~kYy^g4ohCsPXzNh_V zoYMDl_w0hBoul{De9+n3$)YOp_0lgvC{GatDjGL#6^R>?rL(go`z&3Cis#e!S{xz_ z^S1NSkziv%8)av6d|*H$t}($fy*luD&pZ}8Ila&!`ZbfkzI&-~B8^W`jd z_r6i&rD{;cdRr{>ZOXc4`r{=!DM55}Ym;2WnIn6v{XXxlIva)rsJ&tD=lH@0pWAn2 z75zQGdZK;Gx_~Q6UEgZFF2Q!P?yeW+o0@(m>0t%O!=U!w5whMm|Iu~r^k8YNPP(CF z6Xtwae$LkneM!u|@OfRCt;FWDTKf^#!Y9ac3e&5o>5;Pmfej@3X7*3Tpy2XjS6J8! zI!_milDvHQn;l*E>WI$A=X@V(yS+Ch?Ts%h2B)U1gO7I~2z_P{#p@TXcd| zG2Zk*;MDOapI;}=j+Jz(_HER5@RhzE))6X;(QI8pYU_NTz(YXy@%KE3D@mQX@9$+< z5Jn>&f2_+bx-V)4{uIJ?ZKrsU+*j5o3)eqwXmY9`V}6 zkpnWQ_z1h1GW7c8YHyQt}R%O5YUnAs9{iMU@e8TZwG zQQ70~!~+KQwZ-2< z_FT*6wx!v}DN)Ewybt}ecpU<*2Iw&yjxDtr)ZC;v7^#LHalI6jJ0I;( zc7g5eFItyJy!bim15a1~@vTu5ZBb14*%nd!c)`vJJFBddrSl;QOVOih>&gf7-stnC zxVoixXS~r>NcEAEz4~)F)4T0m;z#~8?3lvS20hN&z=D@G={>?R+SwdQ z9fg05wlufTr?0MH1;a>u1WL8v1hG-98ZYf+;E2K8_mQ2VQm<`=@&)iqEMvIGeaC$I zo~GmsCI<|TpuJT5Kd|Z`5OY2lcnbF|vp96JiZ+46P4w|LA?|#xAnFcCK+rN^bq;+E_@Bb`qHA zSbsos!8h?nnhhBWhgCT%8J`?*me6D!Ry8i4k@WhhXM2y;ektR!)>ZA@e9>|w+IncK zvPgLXJ%I$R?S7oTCOS<$ZK^{^wl0`>cGY73^e_zQ87JxQD1R$=cWUtGz%pic-1 z$=rWR|{eHK4t-!-(Hv`Q@Iaz@^5^H5uw);#v z>r4hJMVoBs1`4P98eRtz9b;X~)TlD7Z=VjHk9Csr`b-#d@(X&UkaWJO)Y?SJHQxQm z?kJtDYaKeAl6i49E1Rp%s)yqoXB)ep^m*R#mPa0y&YfH_l88l1Uip}7Vx7=XLAAHN zxfJ)+tJce9Jyt-1$1(_Sx8Kt=v$$S+j)+TrtUi#%q)MLA7^VniP2*R-taWUd zm_=uso7!H^el^nZzMFp|WAJ&ezG{J7n&ir9ZJh~iDvdOzQ`uFOTJVA1n|ex;{%yms znr8Y~^Ckc#9(5Evf?60b`>|o?pvpPJj(Qv+$(uZjC(@qe%yFAb%X6EK`awW`9iG9d zZG!|${Dk<$o|glHb_r=z;1NGOIZ=ofW2qd>Q=k1R`Eh?~wSHyWji(`r_NO%a-%SkN zT1sdqyL8Hm1e!0rk}UIeP?GbYrqd}OiDP*uZ`!|d&)NQ#Hcmd-GVVGiMkwF?^|V4E zU9&;!M+Yu>N)ENWBB?gtAxV#yR=?xxaOPs$g}Bg1Or6CMUL`TVR+*bz(wlb4vk!Sz z%SxtSi>ET}_YG0H)L-vH=KYRp25s4549D)d>AOaczyO9XEffNL2!1gbLz@*41 z{XGO8R~n|VRASgtUqad35J;e47*ptVUz(c0xb2!+`Lc@Dz_vpx+sFz6&a)868S1_q zjco2Be)?_Xo-HY3D-XX) z#wT{(me`8IVw0Jz)h)(eU#U5PZSuCXZB!Z-N7o<0r8`5QgMw|8V#g>1lNnnsEZ!>% z)#MGP)`v}fGTTf9yZn5<5=UM^^JjHP_+Pv6y22q5nmxNT*z_e0>_gZtPH zDV8iLZ}eFQGs~p~vwcWch5d-)GGi6%($)%rp&AI}=k<&wY@wz|^l1qAn=Rtnv75}> z>;`}G+R4g!WibeZKB5n>aLN!!3}&5U=3?KtpeM_iYVZ_L5SaZdb;~6Iy`--S??g$o z_ZV9p+em`|EBp~Vh5DYLu!!zwD$ri({lScT)GAcfgPoYczQV3M+`~%T$Wm|8&R!B= zh9_)TL%_2#2it-b8`CX`M60Z-O>TFwmm$z|S6)vo>Csz)2m}UIwnxVxL7DqG%kbRSuy8v+Eh-BvbN2HQJyjJmm*z(z0$(IN4l zr&?kc7}PhUIU#m^0xPL0fce+@Q>I)MyblzsB6?*}XJ`RiCb*xiXt9xn6@(90I?GOW zGjE=eH`*hd+XDc21{8{kZaAuykZoiS}H%pM(b&&CSJ7a4Eg zXV0>2$1k&wVefS~u?uMiV6&>djs zF^Dj+GJx#-2E@hf>fCMX26l7DXq96#Zje!cIr-xMx6vT25Kyf--5sz;{>SjMvaG>ikJW!$Zjy-${07)SR1tk)HcQ( z4b(Ja+|VxqYD4Z}=xjy^z#juZ9n_Y7SO6si2A~)mF!YhY_~COHFb9vUGZaB1epm)i z12GBVW&*%0rI7UyH88&j;))SdhI)8}X$k;O z;T4o90CHOZ)HDDtI{}dG2Ecs=oY*qh*9+$O0N@<}`>h3l&j(;86aZ2L0Oy1Nly8B( z;{cdQ0N_j_+)n|3^97vrhh?~jVHSELAN~(tKcF85YXA|CC*W~J0)apx5ltzm8HG%y z*jawG0Clim=;&ZiqdB>G(4AbCy3%Nj74A!yd$QT=g>)b8O4ce5FE-2Y5`;t|QOFcq zGc#M3GtHUxzfIo;7Q)lxkPikA{=pCo)&z$q5J{$Fm~h>~@Ec(9f)2FUH1SPE7uxeWRP1 z{qybIyq;9-;l@wUg9Aj>`?knLcJtkR9q6SsEvu*QS^DMtWYPTK2>LRen^IG9>;9pc z;zG|EhF6TeDlf(1s*HGdH`jJl`{Qkq&!Wt`-;|EE5D2;VmrT1})m6r;<6BvU-J85( zEs{6g8)JX(%{>?w{I)N>wsf$w(N#YPziu<25`hKs1dF%;3>Cpr5&aOLU=iqGsUQI8 z+^YrVI6=vab1&1PLg=z&M3uFtOe7zv+%nuK%V_^}S$jnNjgXdKU0mj`wy)XYLQb;U zJaVav)y4{q?|NqD-=E62->X~QF)p$h+D7dhe?-pdovCCi?}VNFp&^5xzM+uzMp}`w zxRdLn9F%*ER}Jlo*0vokJiEVd%(^C6#`|)nsg>A*zu;S1{c-oWFs=NGcX3T-dr;=J zfXsf6hDMdSmifrhmC*ySWJ81h zk*Jo(zw}kA!mFyh17AhFn$L)x+MT-pA+Me+YO?kEXOP5yALO{*M*5Y?T3H&;>dvf> zL|frnec65J)sdrL{GJsM%TOYx#k;9pcHM7#c+M0jrJY9SQdFZ!?MOM4-T#V*HU~xL zK9z76TxL)E_X+}u=fZUd#UKF4TjD{R_{d;Vf^H)K&*2w!!?zvdINbJv_GL zM7jD+vtJA{$$S=6a2xXk8Im%0P91X)#oZjyY}*){S}zI=ug6H2xK&?V96Hk6zi19s zBo0d%72=S$t;^{T%S!L&)pnubGW%r{^OxUS#)ZWAT})qcv9>W^%e~`W|4x&nP;z%C z+jN!FEeleE+_$RdcS@PZ$yxr9tu)-K{1m23%BjS#V$6-?`-JH)p$$nQSizWo@3FbK#2_p0Ar0Pxihdgv==s9zO9VX;q+xe0W zv#1~tzpuP5TfhTgv@nbkDT$Cc5ZQu2$GoT893^>6IqBql*Y6tNt+?5g+3$N@Zf+HJ zfT5^WMhgb|LI*C?h#sA_!ul)DJ33x#7+ZA^74Yn9loc > state->eof) { + TIFFError("_tiffReadProc", "Invalid Read at loc %d, eof: %d", state->loc, state->eof); + return 0; + } to_read = min(size, min(state->size, (tsize_t)state->eof) - (tsize_t)state->loc); TRACE(("to_read: %d\n", (int)to_read));