Return-Path: <skypemesm@gmail.com>
Delivered-To: even.rouault@free.fr
Received: from relay2-d.mail.gandi.net (mx24-g26.priv.proxad.net [172.20.243.94])
	by toaster12-g26.priv.proxad.net (Postfix) with ESMTP id 2B2D5CA07C4
	for <even.rouault@free.fr>; Mon, 23 Apr 2018 18:41:27 +0200 (CEST)
Received: from relay2-d.mail.gandi.net ([217.70.183.194])
	by mx1-g20.free.fr (MXproxy) with ESMTPS for even.rouault@free.fr
	(version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256);
	Mon, 23 Apr 2018 18:41:27 +0200 (CEST)
X-ProXaD-SC: state=HAM score=0
X-ProXaD-Cause: (null)
Received: from spool.mail.gandi.net (spool3.mail.gandi.net [217.70.178.212])
	by relay2-d.mail.gandi.net (Postfix) with ESMTP id 0177940003
	for <even.rouault@free.fr>; Mon, 23 Apr 2018 18:41:26 +0200 (CEST)
Received: from mail-oi0-f41.google.com (mail-oi0-f41.google.com [209.85.218.41])
	by spool.mail.gandi.net (Postfix) with ESMTPS id 0BF31AC05CC
	for <even.rouault@spatialys.com>; Mon, 23 Apr 2018 18:41:27 +0200 (CEST)
Received: by mail-oi0-f41.google.com with SMTP id v2-v6so1120046oif.3
        for <even.rouault@spatialys.com>; Mon, 23 Apr 2018 09:41:26 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20161025;
        h=mime-version:in-reply-to:references:from:date:message-id:subject:to
         :cc;
        bh=iGpHDo1quym/93+a3MeLsvelGZVkCMqQBM8YRpaB7pk=;
        b=jK2DqRyP+SZAmbHP74NPYSC2o2ow8DcP/gnRW6JKcdPwm6zYHIy7Yi4T4swIbgpN19
         fL5mnDdJXtzN9eHTo/sgOv++Sfx1MfK5x+w+3TSVJHoNKwBDpGKud8315hJgacy/5fhZ
         Dm9S6nyja9pg1+WQPsHLWkSQ0JqrQJdSGOH4Dh8vyh/1V3KRBxhsENWzdTCJyD0anFqH
         Vxlx2k5K+A/I96cuE7Dw8VGqEZhu9eauxtjZ4tthBNDhZyewD/5dVkFcVHi7zUiz6Z/b
         1U9AJ4x8coLU6q4mIWD4ur1aXwplNe/swJBSIJ3KlPRzDoB2Zo5nv/CR4I1LXI2uyalR
         cb+A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
        h=x-gm-message-state:mime-version:in-reply-to:references:from:date
         :message-id:subject:to:cc;
        bh=iGpHDo1quym/93+a3MeLsvelGZVkCMqQBM8YRpaB7pk=;
        b=G7BwMI452QL+zU9wDIfzT2nwFE6jClgCwEL/fIBg8czrD7T9ew/nClgN+r4ZpifOAw
         YchRtfukl2nq2UmIdBSJ+aAjBuUGjFQBoHxO/azs1YLVlMmsEI7BsN9+Q8tpxr7rGLC8
         jN8B0fyumQv2Jyf4y2uEu3ifByxF0gEutXvs6bxMkx6o+bFsbpArMvWuwT+x7ofCYRmT
         y2LPih/cgD2ZzYbnhnl4EOB1ra8Fob/bjfD3mqoupNyI9riClZ3kvsc2s9z3ve1WfKh+
         LHnUgAtbULEbMCMLCZyNzD/dpB3Mu4DVePmETTS3bBhD+6q565psGrNSHZjOUBB71ZP9
         UbQg==
X-Gm-Message-State: ALQs6tDs3IpZOQQOgTnNi4yQS83GU0JiNWksdnd0bRww584OJentpmAV
	x05EKh7OhLcKutYbNvEE2dSETcLND/1Q2PpheA4A
X-Google-Smtp-Source: AIpwx49lzjFsZF3efQEyi/nRMLg1IKlrAcT9fb5bCUndZT1XjLiAOiwhIgD1gxTCN3gskGsxXMVOSRyE2IfqaXLHW8M=
X-Received: by 2002:aca:a4d:: with SMTP id 74-v6mr12828184oik.317.1524501684959;
 Mon, 23 Apr 2018 09:41:24 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.74.183.131 with HTTP; Mon, 23 Apr 2018 09:41:24 -0700 (PDT)
In-Reply-To: <1864351.rjRi7P38io@even-i700>
References: <CAKSvmhZ6-6N32PxHr8ODzY698Mp+f3GocB+N1+J2JZmxUP2Mfg@mail.gmail.com>
 <1864351.rjRi7P38io@even-i700>
From: SM <skypemesm@gmail.com>
Date: Mon, 23 Apr 2018 12:41:24 -0400
Message-ID: <CAKSvmhY6xVoeX0YumKC_1JJHv6nzSa4AG25XkL96s38OCEx-kA@mail.gmail.com>
Subject: Re: [Tiff] libTiff Bug
To: Even Rouault <even.rouault@spatialys.com>
Cc: tiff@lists.maptools.org
Content-Type: multipart/alternative; boundary="000000000000644bed056a86b52f"
X-Spam-Level: 

--000000000000644bed056a86b52f
Content-Type: text/plain; charset="UTF-8"

Hi! You may be right. I will check this and let you know.

On Mon, Apr 23, 2018 at 12:17 PM, Even Rouault <even.rouault@spatialys.com>
wrote:

> > uint32 npixels=width*height;
>
>
>
> If it is large enough, it might be possible that the above multiplication
> overflows uint32, and thus the below memory allocation is not large enough
>
>
>
> > uint32* raster=(uint32 *) _TIFFmalloc(npixels *sizeof(uint32));
>
>
>
>
>
> --
>
> Spatialys - Geospatial professional services
>
> http://www.spatialys.com
>

--000000000000644bed056a86b52f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi! You may be right. I will check this and let you know.<=
/div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Mon, Apr =
23, 2018 at 12:17 PM, Even Rouault <span dir=3D"ltr">&lt;<a href=3D"mailto:=
even.rouault@spatialys.com" target=3D"_blank">even.rouault@spatialys.com</a=
>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 =
0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><u></u>
<div style=3D"font-family:&#39;Sans Serif&#39;;font-size:9pt;font-weight:40=
0;font-style:normal">
<p style=3D"margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0=
px;text-indent:0px">&gt;     uint32 npixels=3Dwidth*height;</p>
<p style=3D"margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0=
px;text-indent:0px">=C2=A0</p>
<p style=3D"margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0=
px;text-indent:0px">If it is large enough, it might be possible that the ab=
ove multiplication overflows uint32, and thus the below memory allocation i=
s not large enough</p><span class=3D"">
<p style=3D"margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0=
px;text-indent:0px">=C2=A0</p>
<p style=3D"margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0=
px;text-indent:0px">&gt;     uint32* raster=3D(uint32 *) _TIFFmalloc(npixel=
s *sizeof(uint32));</p>
<p style=3D"margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0=
px;text-indent:0px">=C2=A0</p>
<p style=3D"margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0=
px;text-indent:0px">=C2=A0</p>
</span><p style=3D"margin-top:0px;margin-bottom:0px;margin-left:0px;margin-=
right:0px;text-indent:0px">-- </p>
<p style=3D"margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0=
px;text-indent:0px">Spatialys - Geospatial professional services</p>
<p style=3D"margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0=
px;text-indent:0px"><a href=3D"http://www.spatialys.com" target=3D"_blank">=
http://www.spatialys.com</a></p></div></blockquote></div><br></div>

--000000000000644bed056a86b52f--

