Return-Path: <awaresystems.be+caf_=filtered=awaresystems.be@gmail.com>
Delivered-To: filtered@awaresystems.be
Received: from mx-k.one.com (mx-k.one.com [91.198.169.58])
	by mail6.local.one.com (Postfix) with ESMTP id D1D413007782EB
	for <filtered@awaresystems.be>; Tue, 30 Dec 2014 21:45:21 +0000 (UTC)
X-Virus-Scanned: by one.com
Received-SPF: pass (mx-k: domain of awaresystems.be+caf_=filtered=awaresystems.be@gmail.com designates 209.85.215.49 as permitted sender)
X-Greylist: whitelisted by SQLgrey-1.8.0-rc2
Received: from mail-la0-f49.google.com (mail-la0-f49.google.com [209.85.215.49])
	by mx-k.one.com (Postfix) with ESMTP id 8A14911DB7C0
	for <filtered@awaresystems.be>; Tue, 30 Dec 2014 21:45:21 +0000 (UTC)
Received: by mail-la0-f49.google.com with SMTP id hs14so12901005lab.22
        for <filtered@awaresystems.be>; Tue, 30 Dec 2014 13:45:21 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-original-authentication-results:delivered-to:delivered-to
         :message-id:date:from:user-agent:mime-version:to:content-type
         :subject:precedence:list-id:list-unsubscribe:list-archive:list-post
         :list-help:list-subscribe:sender:errors-to;
        bh=tqUdDVuEY53uzW8fCaaYFk2ZWsQhlhVJD85IzLBi2YA=;
        b=gZucq2ytCTzL372MrgBSl9oyXnyhml+BvSqmpOtOxH2A/zE0IZkDJOJgwyatdzXDPc
         nRm4boQY9RxVb8maHDwMSn4/+mrnNyRy4EdBvCSRvi8FHfd2h3FDj2etBjcYuxKgE5lE
         Zre/UY9yLzR4PYSV2Jo0SHPmKtr0T92cmmz8ToEiHtlui8Xjz1x4Z+9q3uHdF3O4hwAn
         vNv7ERZvdJbtXysbBZSq3UnSXwRfyfrsmSrJivvTED3Z3Eh1LIEtYCstBCsDIAboU6su
         LFQM6srpuFHY8tL3Rma80el0CCx0TjkGsnx/zabD9G+dN7WFOnFhnNmURE8e3HVX74Nw
         m6Wg==
X-Original-Authentication-Results: mx.google.com;       spf=none (google.com: tiff-bounces@lists.maptools.org does not designate permitted sender hosts) smtp.mail=tiff-bounces@lists.maptools.org
X-Received: by 10.112.211.130 with SMTP id nc2mr63926995lbc.0.1419975921269;
        Tue, 30 Dec 2014 13:45:21 -0800 (PST)
X-Forwarded-To: filtered@awaresystems.be
X-Forwarded-For: awaresystems.be@gmail.com filtered@awaresystems.be
Delivered-To: awaresystems.be@gmail.com
Received: by 10.114.181.147 with SMTP id dw19csp2323034ldc;
        Tue, 30 Dec 2014 13:45:20 -0800 (PST)
X-Received: by 10.152.161.168 with SMTP id xt8mr64058788lab.35.1419975919485;
        Tue, 30 Dec 2014 13:45:19 -0800 (PST)
Authentication-Results: mx.google.com;
       spf=none (google.com: tiff-bounces@lists.maptools.org does not designate permitted sender hosts) smtp.mail=tiff-bounces@lists.maptools.org
Received-SPF: none (google.com: tiff-bounces@lists.maptools.org does not designate permitted sender hosts) client-ip=91.198.169.248;
Received: by 10.152.105.137 with POP3 id gm9mf14500983lab.25;
        Tue, 30 Dec 2014 13:45:18 -0800 (PST)
X-Gmail-Fetch-Info: info@awaresystems.be 1 pop.awaresystems.be 110 info@awaresystems.be
Delivered-To: info@awaresystems.be
Received: from mx-q.one.com (mx-q.one.com [91.198.169.248])
	by mail6.local.one.com (Postfix) with ESMTP id A6179300302EA9
	for <info@awaresystems.be>; Tue, 30 Dec 2014 20:45:43 +0000 (UTC)
X-Greylist: domain auto-whitelisted by SQLgrey-1.8.0-rc2
Received: from lists.maptools.org (ks365428.kimsufi.com [94.23.4.142])
	by mx-q.one.com (Postfix) with ESMTP id 5B27A4C7E1
	for <info@awaresystems.be>; Tue, 30 Dec 2014 20:45:43 +0000 (UTC)
Received: from [10.1.0.241] (localhost.localdomain [127.0.0.1])
	by lists.maptools.org (Postfix) with ESMTP id 5610A35C052;
	Tue, 30 Dec 2014 15:44:53 -0500 (EST)
Received: from mail-la0-f52.google.com (mail-la0-f52.google.com
	[209.85.215.52])
	by lists.maptools.org (Postfix) with ESMTPS id EFECB35C025
	for <tiff@lists.maptools.org>; Tue, 30 Dec 2014 15:41:24 -0500 (EST)
Received: by mail-la0-f52.google.com with SMTP id hs14so13248812lab.11
	for <tiff@lists.maptools.org>; Tue, 30 Dec 2014 12:41:31 -0800 (PST)
X-Received: by 10.152.23.164 with SMTP id n4mr62234609laf.77.1419972091242;
	Tue, 30 Dec 2014 12:41:31 -0800 (PST)
Received: from ?IPv6:2a00:1370:8000:eff::3c6b? ([2a00:1370:8000:eff::3c6b])
	by mx.google.com with ESMTPSA id w8sm10878373lad.17.2014.12.30.12.41.30
	for <tiff@lists.maptools.org>
	(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
	Tue, 30 Dec 2014 12:41:30 -0800 (PST)
Message-ID: <54A30DF9.4090109@gmail.com>
Date: Tue, 30 Dec 2014 23:41:29 +0300
From: "Yuriy M. Kaminskiy" <yumkam@gmail.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
	rv:24.0) Gecko/20100101 Thunderbird/24.6.0
MIME-Version: 1.0
To: tiff@lists.maptools.org
Content-Type: multipart/mixed; boundary="------------080306080100080406040303"
Subject: [Tiff] [PATCH] tif_luv, tif_pixarlog,
 ppm2tiff: get rid of duplicates of TIFFSafeMultiply
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

This is a multi-part message in MIME format.
--------------080306080100080406040303
Content-Type: text/plain; charset=KOI8-R
Content-Transfer-Encoding: 7bit

While fixing that, I noticed some very WTF code: add_ms in
libtiff/tif_pixarlog.c and checkAdd64 in tools/tiff2pdf.c
I'm not sure what are they trying to do, but I'm pretty sure they are doing it
WRONG and both cannot possibly work, due to different reasons. Please take a
look or two.



--------------080306080100080406040303
Content-Type: text/x-diff;
 name="deduplicate-safe-multiply.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="deduplicate-safe-multiply.patch"

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
NotDashEscaped: You need GnuPG to verify this message

From: Yuriy M. Kaminskiy <yumkam@gmail.com>
Subject: tif_luv, tif_pixarlog, ppm2tiff: get rid of duplicates of TIFFSafeMultiply

Index: tiff-4.0.x-20141227/libtiff/tif_luv.c
===================================================================
--- tiff-4.0.x-20141227.orig/libtiff/tif_luv.c	2014-12-30 22:58:02.804597893 +0300
+++ tiff-4.0.x-20141227/libtiff/tif_luv.c	2014-12-30 23:00:42.640095713 +0300
@@ -1208,17 +1208,6 @@ LogL16GuessDataFmt(TIFFDirectory *td)
 	return (SGILOGDATAFMT_UNKNOWN);
 }
 
-static tmsize_t
-multiply_ms(tmsize_t m1, tmsize_t m2)
-{
-	tmsize_t bytes = m1 * m2;
-
-	if (m1 && bytes / m1 != m2)
-		bytes = 0;
-
-	return bytes;
-}
-
 static int
 LogL16InitState(TIFF* tif)
 {
@@ -1248,10 +1237,10 @@ LogL16InitState(TIFF* tif)
 		return (0);
 	}
         if( isTiled(tif) )
-            sp->tbuflen = multiply_ms(td->td_tilewidth, td->td_tilelength);
+            sp->tbuflen = TIFFSafeMultiply(tmsize_t, td->td_tilewidth, td->td_tilelength);
         else
-            sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_rowsperstrip);
-	if (multiply_ms(sp->tbuflen, sizeof (int16)) == 0 ||
+            sp->tbuflen = TIFFSafeMultiply(tmsize_t, td->td_imagewidth, td->td_rowsperstrip);
+	if (TIFFSafeMultiply(tmsize_t, sp->tbuflen, sizeof (int16)) == 0 ||
 	    (sp->tbuf = (uint8*) _TIFFmalloc(sp->tbuflen * sizeof (int16))) == NULL) {
 		TIFFErrorExt(tif->tif_clientdata, module, "No space for SGILog translation buffer");
 		return (0);
@@ -1348,10 +1337,10 @@ LogLuvInitState(TIFF* tif)
 		return (0);
 	}
         if( isTiled(tif) )
-            sp->tbuflen = multiply_ms(td->td_tilewidth, td->td_tilelength);
+            sp->tbuflen = TIFFSafeMultiply(tmsize_t, td->td_tilewidth, td->td_tilelength);
         else
-            sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_rowsperstrip);
-	if (multiply_ms(sp->tbuflen, sizeof (uint32)) == 0 ||
+            sp->tbuflen = TIFFSafeMultiply(tmsize_t, td->td_imagewidth, td->td_rowsperstrip);
+	if (TIFFSafeMultiply(tmsize_t, sp->tbuflen, sizeof (uint32)) == 0 ||
 	    (sp->tbuf = (uint8*) _TIFFmalloc(sp->tbuflen * sizeof (uint32))) == NULL) {
 		TIFFErrorExt(tif->tif_clientdata, module, "No space for SGILog translation buffer");
 		return (0);
Index: tiff-4.0.x-20141227/libtiff/tif_pixarlog.c
===================================================================
--- tiff-4.0.x-20141227.orig/libtiff/tif_pixarlog.c	2014-12-30 22:58:02.864596908 +0300
+++ tiff-4.0.x-20141227/libtiff/tif_pixarlog.c	2014-12-30 23:16:09.812097595 +0300
@@ -633,17 +633,7 @@ PixarLogGuessDataFmt(TIFFDirectory *td)
 	return guess;
 }
 
-static tmsize_t
-multiply_ms(tmsize_t m1, tmsize_t m2)
-{
-	tmsize_t bytes = m1 * m2;
-
-	if (m1 && bytes / m1 != m2)
-		bytes = 0;
-
-	return bytes;
-}
-
+/* XXX does this work? tmsize_t is signed type and signed overflow result is not defined */
 static tmsize_t
 add_ms(tmsize_t m1, tmsize_t m2)
 {
@@ -683,8 +673,9 @@ PixarLogSetupDecode(TIFF* tif)
 
 	sp->stride = (td->td_planarconfig == PLANARCONFIG_CONTIG ?
 	    td->td_samplesperpixel : 1);
-	tbuf_size = multiply_ms(multiply_ms(multiply_ms(sp->stride, td->td_imagewidth),
-				      td->td_rowsperstrip), sizeof(uint16));
+	tbuf_size = TIFFSafeMultiply(tmsize_t, td->td_imagewidth, sp->stride);
+	tbuf_size = TIFFSafeMultiply(tmsize_t, tbuf_size, td->td_rowsperstrip);
+	tbuf_size = TIFFSafeMultiply(tmsize_t, tbuf_size, sizeof(uint16));
 	/* add one more stride in case input ends mid-stride */
 	tbuf_size = add_ms(tbuf_size, sizeof(uint16) * sp->stride);
 	if (tbuf_size == 0)
@@ -883,8 +874,9 @@ PixarLogSetupEncode(TIFF* tif)
 
 	sp->stride = (td->td_planarconfig == PLANARCONFIG_CONTIG ?
 	    td->td_samplesperpixel : 1);
-	tbuf_size = multiply_ms(multiply_ms(multiply_ms(sp->stride, td->td_imagewidth),
-				      td->td_rowsperstrip), sizeof(uint16));
+	tbuf_size = TIFFSafeMultiply(tmsize_t, td->td_imagewidth, sp->stride);
+	tbuf_size = TIFFSafeMultiply(tmsize_t, tbuf_size, td->td_rowsperstrip);
+	tbuf_size = TIFFSafeMultiply(tmsize_t, tbuf_size, sizeof(uint16));
 	if (tbuf_size == 0)
 		return (0);  /* TODO: this is an error return without error report through TIFFErrorExt */
 	sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size);
Index: tiff-4.0.x-20141227/tools/ppm2tiff.c
===================================================================
--- tiff-4.0.x-20141227.orig/tools/ppm2tiff.c	2014-12-30 22:47:52.748094718 +0300
+++ tiff-4.0.x-20141227/tools/ppm2tiff.c	2014-12-30 23:20:59.076095939 +0300
@@ -48,6 +48,7 @@
 #endif
 
 #include "tiffio.h"
+#include "tiffiop.h"
 
 #ifndef HAVE_GETOPT
 extern int getopt(int, char**, char*);
@@ -72,17 +73,6 @@ BadPPM(char* file)
 	exit(-2);
 }
 
-static tmsize_t
-multiply_ms(tmsize_t m1, tmsize_t m2)
-{
-	tmsize_t bytes = m1 * m2;
-
-	if (m1 && bytes / m1 != m2)
-		bytes = 0;
-
-	return bytes;
-}
-
 int
 main(int argc, char* argv[])
 {
@@ -253,7 +243,7 @@ main(int argc, char* argv[])
 	switch (bpp) {
 		case 1:
 			/* if round-up overflows, result will be zero, OK */
-			linebytes = (multiply_ms(spp, w) + (8 - 1)) / 8;
+			linebytes = (TIFFSafeMultiply(tmsize_t, w, spp) + (8 - 1)) / 8;
 			if (rowsperstrip == (uint32) -1) {
 				TIFFSetField(out, TIFFTAG_ROWSPERSTRIP, h);
 			} else {
@@ -262,7 +252,7 @@ main(int argc, char* argv[])
 			}
 			break;
 		case 8:
-			linebytes = multiply_ms(spp, w);
+			linebytes = TIFFSafeMultiply(tmsize_t, w, spp);
 			TIFFSetField(out, TIFFTAG_ROWSPERSTRIP,
 			    TIFFDefaultStripSize(out, rowsperstrip));
 			break;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iF4EAREIAAYFAlSjDOsACgkQKZn9iF16KMPhqwD8DfwCjdAAc7jtLt1bLCDLSGLP
9KJQmS9qdiEjACYG+mAA/AttBVO282JYRXAnXG4FrC0hnCk5wA7mxXSKHkcqu9+j
=Lns4
-----END PGP SIGNATURE-----

--------------080306080100080406040303
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
--------------080306080100080406040303--
