Andrew Murray
0835be95cb
Added comment
2023-06-05 15:07:11 +10:00
Andrew Murray
e45da2ae17
Do not close provided file handles with libtiff
2023-06-05 11:07:09 +10:00
Andrew Murray
93e5fd4b40
Initialize libtiff buffer
2022-10-29 12:02:03 +03:00
Andrew Murray
34f61d6d2d
Updated redirected URLs
2022-09-23 22:13:50 +10:00
Andrew Murray
e613271776
Fixed typo
2022-08-27 18:48:47 +10:00
Andrew Murray
40a918d274
Set readcount to TIFF_VARIABLE for a variable number of values
2022-05-28 20:14:05 +10:00
Andrew Murray
c692fb42f8
Fixed comparison warnings
2022-01-18 14:19:43 +11:00
Miloš Komarčević
fa66d150e2
Enable strip chopping for large TIFFs
2021-07-01 00:43:56 +10:00
Andrew Murray
e00af259d8
Use PRIu64 to fix format warning
2021-06-11 18:27:36 +10:00
Andrew Murray
8099d01349
Fixed typo
2021-05-19 23:32:00 +10:00
Andrew Murray
11d1458316
Replaced uint16 and uint32 with uint16_t and uint32_t to resolve TIFF deprecations
2021-05-01 00:51:39 +10:00
Eric Soroos
87934e22d0
Fix for crash-0da0
2021-03-31 23:24:30 +02:00
Eric Soroos
45530d5ce1
fixes crash-74d2
2021-03-31 22:23:57 +02:00
Konstantin Kopachev
19a815dd73
Remove redundant check
...
It's duplicated inside following call of TIFFReadTile
2021-03-29 11:27:50 -07:00
Konstantin Kopachev
52ecf1b142
Stop guessing strip size and pass expected size
2021-03-28 15:03:37 +02:00
Konstantin Kopachev
ab24c98491
Add sanity check for memory overruns
2021-03-28 15:03:37 +02:00
Konstantin Kopachev
1c295bf43c
Check for dimensions and sizes to fit into int
2021-03-28 15:03:37 +02:00
Konstantin Kopachev
e438046201
Refactor into smaller functions
2021-03-28 15:03:37 +02:00
Konstantin Kopachev
4dd288c66c
unify reading of YCbCr Tiffs
2021-03-28 15:03:37 +02:00
Konstantin Kopachev
4c2dfadf26
Swap pixel values on Big Endian
2021-03-28 15:03:37 +02:00
Konstantin Kopachev
169bb4842f
only use TIFFReadRGBA* in case of o_jpeg compression
2021-03-28 15:03:37 +02:00
Eric Soroos
f2020eeab4
UINT8 -> int for plane
2021-03-28 15:03:37 +02:00
Eric Soroos
b1d3f0d5c2
not
2021-03-28 15:03:37 +02:00
Eric Soroos
c9ea87ecfd
Use flag instead of recalculating
2021-03-28 15:03:37 +02:00
Eric Soroos
fda638befe
Planes should be int, not uint
2021-03-28 15:03:37 +02:00
nulano
daf7b6546e
remove double pointer
2021-03-28 15:03:37 +02:00
nulano
a921c01102
correct TIFFTAG_PLANARCONFIG size
2021-03-28 15:03:37 +02:00
Eric Soroos
77a1a9aba3
initialize the unpackers
2021-03-28 15:03:37 +02:00
Eric Soroos
64500434c2
Implementation for PlanarConfiguration=2 Tiffs, manually merged from f566c8a
2021-03-28 15:03:37 +02:00
Andrew Murray
68b655f3f0
Updated format specifiers
2021-03-10 20:43:16 +11:00
Luke Granger-Brown
852fd170f8
Fix -Wformat error in TiffDecode
...
src/libImaging/TiffDecode.c: In function ‘_tiffReadProc’:
src/libImaging/TiffDecode.c:59:58: error: format ‘%d’ expects argument of type ‘int’, but argument 3 has type ‘toff_t’ {aka ‘long unsigned int’} [-Werror=format=]
src/libImaging/TiffDecode.c:59:67: error: format ‘%d’ expects argument of type ‘int’, but argument 4 has type ‘toff_t’ {aka ‘long unsigned int’} [-Werror=format=]
2021-03-03 13:30:28 +00:00
Eric Soroos
cbdce6c5d0
Fix for CVE-2021-25291
...
* Invalid tile boundaries lead to OOB Read in TiffDecode.c, in TiffReadRGBATile
* Check the tile validity before attempting to read.
2021-03-01 19:04:48 +11:00
Eric Soroos
86f02f7c70
Fix negative size read in TiffDecode.c
...
* Caught by oss-fuzz runs
* CVE-2021-25290
2021-03-01 19:04:42 +11:00
Eric Soroos
3fee28eb94
Incorrect error code checking in TiffDecode.c
...
* since Pillow 8.1.0
* CVE-2021-25289
2021-03-01 18:51:13 +11:00
Andrew Murray
46b7e86bab
Format with ClangFormat
2021-01-03 14:17:51 +11:00
wiredfool
45a62e91b1
Rework ReadTile
...
* Don't malloc for the swap line, just shuffle backwards
* Ensure that im->pixelsize is sanity checked
* Ensure that we're using the right size for the buffer from TiffReadRGBATile
2021-01-02 20:37:48 +11:00
wiredfool
eb8c1206d6
Fix CVE-2020-35654 - OOB Write in TiffDecode.c
...
* In some circumstances with some versions of libtiff (4.1.0+), there
could be a 4 byte out of bound write when decoding a YCbCr tiff.
* The Pillow code dates to 6.0.0
* Found and reported through Tidelift
2021-01-02 20:37:48 +11:00
Andrew Murray
6b21a96578
Changed readcount so that _TIFFSetGetType can identify the type
2020-12-30 11:57:05 +11:00
Eric Soroos
a39d7c4fcf
Fix OOB Read in tif_dirinfo.c
...
==3330== at 0xBD4110C: _TIFFSetupFields (tif_dirinfo.c:327)
Passing in a stack allocated array is going to fail, as a reference
is retained to the name and used later when flushing the Tiff to
the file.
2020-12-28 15:00:48 +01:00
Hugo van Kemenade
e58baa0c09
Merge pull request #4756 from nulano/warn-tiff
...
Fix TiffDecode comparison warnings
2020-10-14 17:33:05 +03:00
nulano
3cabcf242f
fix libtiff in MSYS2
2020-08-30 04:31:46 +02:00
nulano
21533e4deb
tiff comparison warnings
2020-07-02 16:14:07 +02:00
Hugo van Kemenade
c00fdc7e30
Fix typos
...
Co-Authored-By: Andrew Murray <3112309+radarhere@users.noreply.github.com>
2020-04-01 11:02:44 +03:00
Eric Soroos
b8d4ce1a59
Avoid uninitialized read
2020-04-01 11:02:36 +03:00
Eric Soroos
6b842f4ec0
Ensure that Tiff's concept of Strip and Tilesize matches Pillow's
2020-04-01 11:02:33 +03:00
Andrew Murray
b9c68540dc
Overflow checks for realloc for tiff decoding
2020-01-02 15:24:46 +11:00
Christoph Gohlke
b37f12a5f8
Initialize rows_per_strip when RowsPerStrip tag is missing
2019-08-20 16:07:07 -07:00
Oliver Tonnhofer
2af4026201
Improve encoding of TIFF tags ( #3861 )
...
* Improve encoding of TIFF tags
- Pass tagtype from v2 directory to libtiff encoder, instead of
autodetecting type.
- Use explicit types. E.g. uint32_t for TIFF_LONG to fix issues on
platforms with 64bit longs.
- Add support for multiple values (arrays). Requires type in v2
directory and values must be passed as a tuple.
- Add support for signed types (e.g. TIFFTypes.TIFF_SIGNED_SHORT).
Co-authored-by: Andrew Murray <radarhere@users.noreply.github.com>
2019-06-30 21:48:19 +03:00
Christoph Gohlke
129df60c48
Use unsigned int to store TIFF IFD offsets
2019-06-27 15:09:31 -07:00
Christoph Gohlke
a78341e26c
Fix potential null pointer is passed into memcpy
2019-06-25 14:23:20 -07:00