Return-Path: <tiff-bounces@lists.maptools.org>
Delivered-To: even.rouault@free.fr
Received: from relay7-d.mail.gandi.net (mx26-g26.priv.proxad.net [172.20.243.96])
	by toaster12-g26.priv.proxad.net (Postfix) with ESMTP id B49B8CA0B48
	for <even.rouault@free.fr>; Mon, 23 Apr 2018 18:21:22 +0200 (CEST)
Received: from relay7-d.mail.gandi.net ([217.70.183.200])
	by mx1-g20.free.fr (MXproxy) with ESMTPS for even.rouault@free.fr
	(version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256);
	Mon, 23 Apr 2018 18:21:22 +0200 (CEST)
X-ProXaD-SC: state=HAM score=0
X-ProXaD-Cause: (null)
Received: from spool.mail.gandi.net (spool3.mail.gandi.net [217.70.178.212])
	by relay7-d.mail.gandi.net (Postfix) with ESMTP id 6EF1C20009
	for <even.rouault@free.fr>; Mon, 23 Apr 2018 18:21:25 +0200 (CEST)
Received: from lists.maptools.org (ks365428.kimsufi.com [94.23.4.142])
	by spool.mail.gandi.net (Postfix) with ESMTP id 9A09BAC0858
	for <even.rouault@spatialys.com>; Mon, 23 Apr 2018 18:21:21 +0200 (CEST)
Received: from [10.1.0.241] (localhost.localdomain [127.0.0.1])
	by lists.maptools.org (Postfix) with ESMTP id C105A35C058;
	Mon, 23 Apr 2018 11:20:27 -0500 (EST)
Received: from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net
	[217.70.183.194])
	by lists.maptools.org (Postfix) with ESMTPS id 814E735C056
	for <tiff@lists.maptools.org>; Mon, 23 Apr 2018 11:17:20 -0500 (EST)
X-Originating-IP: 90.169.233.126
Received: from even-i700.localnet (unknown [90.169.233.126])
	(Authenticated sender: test@spatialys.com)
	by relay2-d.mail.gandi.net (Postfix) with ESMTPSA id 8832C40002;
	Mon, 23 Apr 2018 18:17:19 +0200 (CEST)
From: Even Rouault <even.rouault@spatialys.com>
To: tiff@lists.maptools.org
Date: Mon, 23 Apr 2018 18:17:18 +0200
Message-ID: <1864351.rjRi7P38io@even-i700>
User-Agent: KMail/5.1.3 (Linux/4.4.0-104-generic; KDE/5.18.0; x86_64; ; )
In-Reply-To: <CAKSvmhZ6-6N32PxHr8ODzY698Mp+f3GocB+N1+J2JZmxUP2Mfg@mail.gmail.com>
References: <CAKSvmhZ6-6N32PxHr8ODzY698Mp+f3GocB+N1+J2JZmxUP2Mfg@mail.gmail.com>
MIME-Version: 1.0
Cc: SM <skypemesm@gmail.com>
Subject: Re: [Tiff] libTiff Bug
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============0601080191=="
Mime-version: 1.0
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org
X-Spam-Level: *

This is a multi-part message in MIME format.

--===============0601080191==
Content-Type: multipart/alternative; boundary="nextPart3879563.KoZ70xdsPu"
Content-Transfer-Encoding: 7Bit

This is a multi-part message in MIME format.

--nextPart3879563.KoZ70xdsPu
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"

>     uint32 npixels=width*height;

If it is large enough, it might be possible that the above 
multiplication overflows uint32, and thus the below memory 
allocation is not large enough

>     uint32* raster=(uint32 *) _TIFFmalloc(npixels *sizeof(uint32));


-- 
Spatialys - Geospatial professional services
http://www.spatialys.com

--nextPart3879563.KoZ70xdsPu
Content-Transfer-Encoding: 7Bit
Content-Type: text/html; charset="us-ascii"

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd">
<html><head><meta name="qrichtext" content="1" /><style type="text/css">
p, li { white-space: pre-wrap; }
</style></head><body style=" font-family:'Sans Serif'; font-size:9pt; font-weight:400; font-style:normal;">
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">&gt;     uint32 npixels=width*height;</p>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; ">&nbsp;</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">If it is large enough, it might be possible that the above multiplication overflows uint32, and thus the below memory allocation is not large enough</p>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; ">&nbsp;</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">&gt;     uint32* raster=(uint32 *) _TIFFmalloc(npixels *sizeof(uint32));</p>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; ">&nbsp;</p>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; ">&nbsp;</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">-- </p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">Spatialys - Geospatial professional services</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">http://www.spatialys.com</p></body></html>
--nextPart3879563.KoZ70xdsPu--


--===============0601080191==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
--===============0601080191==--


