current/SOURCES/tiff-4.0.3-CVE-2012-4564.diff

Index: tools/ppm2tiff.c
===================================================================
RCS file: /cvs/maptools/cvsroot/libtiff/tools/ppm2tiff.c,v
--- tools/ppm2tiff.c~   10 Apr 2010 19:22:34 -0000      1.16
+++ tools/ppm2tiff.c    31 Oct 2012 06:25:13 -0000
@@ -89,6 +89,7 @@ 
        int c;
        extern int optind;
        extern char* optarg;
+       tsize_t scanline_size;
 
        if (argc < 2) {
            fprintf(stderr, "%s: Too few arguments\n", argv[0]);
@@ -237,8 +238,16 @@ 
        }
        if (TIFFScanlineSize(out) > linebytes)
                buf = (unsigned char *)_TIFFmalloc(linebytes);
-       else
-               buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
+       else {
+               scanline_size = TIFFScanlineSize(out);
+               if (scanline_size != 0)
+                       buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
+               else {
+                       fprintf(stderr, "%s: scanline size overflow\n",infile);
+                       (void) TIFFClose(out);
+                       exit(-2);                                       
+                       }
+               }
        if (resolution > 0) {
                TIFFSetField(out, TIFFTAG_XRESOLUTION, resolution);
                TIFFSetField(out, TIFFTAG_YRESOLUTION, resolution);
1	Index: tools/ppm2tiff.c
2	===================================================================
3	RCS file: /cvs/maptools/cvsroot/libtiff/tools/ppm2tiff.c,v
4	--- tools/ppm2tiff.c~ 10 Apr 2010 19:22:34 -0000 1.16
5	+++ tools/ppm2tiff.c 31 Oct 2012 06:25:13 -0000
6	@@ -89,6 +89,7 @@
7	int c;
8	extern int optind;
9	extern char* optarg;
10	+ tsize_t scanline_size;
11
12	if (argc < 2) {
13	fprintf(stderr, "%s: Too few arguments\n", argv[0]);
14	@@ -237,8 +238,16 @@
15	}
16	if (TIFFScanlineSize(out) > linebytes)
17	buf = (unsigned char *)_TIFFmalloc(linebytes);
18	- else
19	- buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
20	+ else {
21	+ scanline_size = TIFFScanlineSize(out);
22	+ if (scanline_size != 0)
23	+ buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
24	+ else {
25	+ fprintf(stderr, "%s: scanline size overflow\n",infile);
26	+ (void) TIFFClose(out);
27	+ exit(-2);
28	+ }
29	+ }
30	if (resolution > 0) {
31	TIFFSetField(out, TIFFTAG_XRESOLUTION, resolution);
32	TIFFSetField(out, TIFFTAG_YRESOLUTION, resolution);