python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-02-13 01:50:48 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix OOB Read in tif_dirinfo.c

Browse Source 
==3330==    at 0xBD4110C: _TIFFSetupFields (tif_dirinfo.c:327)

Passing in a stack allocated array is going to fail, as a reference
is retained to the name and used later when flushing the Tiff to
the file.
This commit is contained in:
Eric Soroos 2020-12-27 17:04:45 +01:00
parent 2d7c543a2f
commit a39d7c4fcf
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/libImaging/TiffDecode.c
View File

@ -573,7 +573,6 @@ int ImagingLibTiffEncodeInit(ImagingCodecState state, char *filename, int fp) {
int ImagingLibTiffMergeFieldInfo(ImagingCodecState state, TIFFDataType field_type, int key, int is_var_length){
// Refer to libtiff docs (http://www.simplesystems.org/libtiff/addingtags.html)
TIFFSTATE *clientstate = (TIFFSTATE *)state->context;
char field_name[10];
uint32 n;
int status = 0;
@ -586,7 +585,7 @@ int ImagingLibTiffMergeFieldInfo(ImagingCodecState state, TIFFDataType field_typ
int passcount = 0;
TIFFFieldInfo info[] = {
{ key, readcount, writecount, field_type, FIELD_CUSTOM, 1, passcount, field_name }
{ key, readcount, writecount, field_type, FIELD_CUSTOM, 1, passcount, "CustomField" }
};
if (is_var_length) {