Commit Graph

289 Commits

Author SHA1 Message Date
Konstantin Kopachev
4dd288c66c unify reading of YCbCr Tiffs 2021-03-28 15:03:37 +02:00
Konstantin Kopachev
4c2dfadf26 Swap pixel values on Big Endian 2021-03-28 15:03:37 +02:00
Konstantin Kopachev
169bb4842f only use TIFFReadRGBA* in case of o_jpeg compression 2021-03-28 15:03:37 +02:00
Eric Soroos
f2020eeab4 UINT8 -> int for plane 2021-03-28 15:03:37 +02:00
Eric Soroos
b1d3f0d5c2 not 2021-03-28 15:03:37 +02:00
Eric Soroos
c9ea87ecfd Use flag instead of recalculating 2021-03-28 15:03:37 +02:00
Eric Soroos
fda638befe Planes should be int, not uint 2021-03-28 15:03:37 +02:00
nulano
daf7b6546e remove double pointer 2021-03-28 15:03:37 +02:00
nulano
a921c01102 correct TIFFTAG_PLANARCONFIG size 2021-03-28 15:03:37 +02:00
Eric Soroos
77a1a9aba3 initialize the unpackers 2021-03-28 15:03:37 +02:00
Eric Soroos
64500434c2 Implementation for PlanarConfiguration=2 Tiffs, manually merged from f566c8a 2021-03-28 15:03:37 +02:00
Konstantin Kopachev
0018685a8e Add Tests and support for Planar Tiff Images 2021-03-28 15:03:37 +02:00
wiredfool
3addd7df4e
Merge pull request #5062 from nulano/fribidi-link
Dynamically link FriBiDi instead of Raqm
2021-03-27 16:29:04 +00:00
Andrew Murray
a4a38b805b Removed return value of build_distance_tables 2021-03-27 14:47:11 +11:00
Andrew Murray
f91f93e246
Merge pull request #5305 from lukegb/bug/format-strings
Fix -Wformat error in TiffDecode
2021-03-11 22:34:17 +11:00
Andrew Murray
68b655f3f0
Updated format specifiers 2021-03-10 20:43:16 +11:00
Hugo van Kemenade
3a27118d76
Merge pull request #5183 from radarhere/rectangle
Only draw each rectangle outline pixel once
2021-03-07 12:25:45 +02:00
Luke Granger-Brown
852fd170f8 Fix -Wformat error in TiffDecode
src/libImaging/TiffDecode.c: In function ‘_tiffReadProc’:
src/libImaging/TiffDecode.c:59:58: error: format ‘%d’ expects argument of type ‘int’, but argument 3 has type ‘toff_t’ {aka ‘long unsigned int’} [-Werror=format=]
src/libImaging/TiffDecode.c:59:67: error: format ‘%d’ expects argument of type ‘int’, but argument 4 has type ‘toff_t’ {aka ‘long unsigned int’} [-Werror=format=]
2021-03-03 13:30:28 +00:00
wiredfool
c477bed95f
Merge pull request #5280 from cgohlke/patch-1
Fix suspicious sequence of types castings
2021-03-01 20:19:26 +00:00
Eric Soroos
cbdce6c5d0 Fix for CVE-2021-25291
* Invalid tile boundaries lead to OOB Read in TiffDecode.c, in TiffReadRGBATile
* Check the tile validity before attempting to read.
2021-03-01 19:04:48 +11:00
Eric Soroos
86f02f7c70 Fix negative size read in TiffDecode.c
* Caught by oss-fuzz runs
* CVE-2021-25290
2021-03-01 19:04:42 +11:00
Eric Soroos
4853e522bd Fix OOB read in SgiRleDecode.c
* From Pillow 4.3.0->8.1.0
* CVE-2021-25293
2021-03-01 19:04:19 +11:00
Eric Soroos
3fee28eb94 Incorrect error code checking in TiffDecode.c
* since Pillow 8.1.0
* CVE-2021-25289
2021-03-01 18:51:13 +11:00
Christoph Gohlke
71f48e19b9
Use unsigned size_t 2021-02-24 08:15:25 -08:00
Christoph Gohlke
48ac517c8d
Fix suspicious sequence of types castings 2021-02-24 07:02:42 -08:00
Andrew Murray
c0ee869c2c Only draw each rectangle outline pixel once 2021-02-22 07:48:58 +11:00
Andrew Murray
c8ca4b909a Added braces 2021-02-13 11:32:52 +11:00
nulano
8bc1ff35b4 use FriBiDi shim in Raqm 2021-01-05 00:03:52 +11:00
Andrew Murray
46b7e86bab Format with ClangFormat 2021-01-03 14:17:51 +11:00
Andrew Murray
c8dd1c8422
Merge pull request #5175 from radarhere/tiff
Fix TIFF OOB Write error
2021-01-02 21:13:28 +11:00
wiredfool
45a62e91b1 Rework ReadTile
* Don't malloc for the swap line, just shuffle backwards
* Ensure that im->pixelsize is sanity checked
* Ensure that we're using the right size for the buffer from TiffReadRGBATile
2021-01-02 20:37:48 +11:00
wiredfool
eb8c1206d6 Fix CVE-2020-35654 - OOB Write in TiffDecode.c
* In some circumstances with some versions of libtiff (4.1.0+), there
  could be a 4 byte out of bound write when decoding a YCbCr tiff.
* The Pillow code dates to 6.0.0
* Found and reported through Tidelift
2021-01-02 20:37:48 +11:00
Eric Soroos
9a2c9f722f Make the SGI code return -1 as an error flag, error in state 2021-01-02 20:10:02 +11:00
Eric Soroos
7e95c63fa7 Fix for SGI Decode buffer overrun CVE-2020-35655
* Independently found by a contributor and sent to Tidelift, and by Google's OSS Fuzz.
2021-01-02 20:09:58 +11:00
Hugo van Kemenade
07bbc46589
Merge pull request #5149 from wiredfool/gif_write_oob_read 2021-01-02 10:14:17 +02:00
Eric Soroos
250e42f7f8 Bad Rebase 2020-12-30 11:07:58 +01:00
Andrew Murray
6b21a96578 Changed readcount so that _TIFFSetGetType can identify the type 2020-12-30 11:57:05 +11:00
Eric Soroos
a39d7c4fcf Fix OOB Read in tif_dirinfo.c
==3330==    at 0xBD4110C: _TIFFSetupFields (tif_dirinfo.c:327)

Passing in a stack allocated array is going to fail, as a reference
is retained to the name and used later when flushing the Tiff to
the file.
2020-12-28 15:00:48 +01:00
Eric Soroos
d96945b7c8 Fix Out of bounds read when saving GIF of xsize=1 2020-12-27 16:01:26 +01:00
Andrew Murray
cf530b8d9c
Merge pull request #5111 from cgohlke/patch-3
Fix dereferencing of potential null pointers
2020-12-27 12:21:09 +11:00
Andrew Murray
51b8137924
Changed style for consistency 2020-12-26 21:49:40 +11:00
Andrew Murray
8eaf9e7cb7 Fixed warning assigning to "unsigned char *" from "char *" 2020-12-24 10:47:06 +11:00
Andrew Murray
36dc83e3ac Fixed comparison between unsigned int and int 2020-12-22 16:07:32 +11:00
Andrew Murray
26e5929617 Fixed comparison between int and unsigned long 2020-12-22 16:06:44 +11:00
Christoph Gohlke
fd14616dbb
Return ImagingError_MemoryError 2020-12-19 19:37:05 -08:00
Christoph Gohlke
15dd7aef9f
Return ImagingError_MemoryError 2020-12-19 19:35:21 -08:00
Christoph Gohlke
fd4b0609ef
Fix dereferencing of potential null pointers 2020-12-19 15:58:25 -08:00
Hugo van Kemenade
1cb3e2f742
Merge pull request #4918 from gofr/4825-jpeg-16-bit-qt 2020-10-14 17:58:12 +03:00
Hugo van Kemenade
e58baa0c09
Merge pull request #4756 from nulano/warn-tiff
Fix TiffDecode comparison warnings
2020-10-14 17:33:05 +03:00
Hugo van Kemenade
15c339470d
Merge pull request #4523 from xtsm/ellipse
Implemented another ellipse drawing algorithm
2020-10-11 18:04:34 +03:00