Return-Path: <tiff-bounces@lists.maptools.org>
X-Original-To: info@awaresystems.be
Delivered-To: info@awaresystems.be
Received: from mx-j.b-one.net (mx-j.one.com [91.198.169.57])
	by mail9.b-one.net (Postfix) with ESMTP id C36D1400107
	for <info@awaresystems.be>; Fri, 25 Jun 2010 14:42:05 +0200 (CEST)
Received: by mx-j.b-one.net (Postfix, from userid 106)
	id BF02E4665; Fri, 25 Jun 2010 14:42:05 +0200 (CEST)
X-Virus-Scanned: by one.com
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.4
Received: from lists.maptools.org (lists.maptools.org [65.39.174.144]) by
 mx-j.b-one.net (Postfix) with ESMTP id CFC7F4665 for <info@awaresystems.be>;
 Fri, 25 Jun 2010 14:42:04 +0200 (CEST)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by
 lists.maptools.org (Postfix) with ESMTP id 6D2ED1D184BD5; Fri, 25 Jun 2010
 07:40:57 -0500 (EST)
Received: from relay-home.eltel.net (relay-home.eltel.net [81.9.47.66]) by
 lists.maptools.org (Postfix) with ESMTPS id AC5751D184BD4 for
 <tiff@lists.maptools.org>; Fri, 25 Jun 2010 07:27:17 -0500 (EST)
Received: from [89.112.24.117] (helo=ak4719.spb.edu) by relay-home.eltel.net
 with esmtp (Exim 4.63) (envelope-from <dron@ak4719.spb.edu>) id
 1OS7zy-00031R-Al for tiff@lists.maptools.org; Fri, 25 Jun 2010 16:27:10 +0400
Received: from dron by ak4719.spb.edu with local (Exim 4.69) (envelope-from
 <dron@ak4719.spb.edu>) id 1OS7zy-0006wt-5P for tiff@lists.maptools.org; Fri,
 25 Jun 2010 16:27:10 +0400
Date: Fri, 25 Jun 2010 16:27:09 +0400
From: Andrey Kiselev <dron@ak4719.spb.edu>
To: tiff@lists.maptools.org
Message-ID: <20100625122709.GA25896@ak4719.spb.edu>
Mail-Followup-To: tiff@lists.maptools.org
References: <AANLkTin9tNcJ8ZhLxvJ3Siucvtr-mnSez74q2iukGMUX@mail.gmail.com>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <AANLkTin9tNcJ8ZhLxvJ3Siucvtr-mnSez74q2iukGMUX@mail.gmail.com>
X-GnuPG-Key: http://www.srces.spb.org/dron/export.home.key
X-Face: "t+se9s~+y~[XUH]L|pmeO3Pt/Q@DNv**S,d@_1-C=}/,c%<3Qp]eu!ok<"2lYJm$!9q
 Vcg F?7o*L;|$`6|Q|>Rt-cU%2_y@6tQ|`!Li}TsvZvEKx;>fuY=fc(=sX^`7Wmw8%SsR`Av
 M$a;0U/eN\
 P?B\FTyqD,0np$U2!*'z_4D,VPlFf?bN0&zYf"zF0s!7Tl7?$we)xD0@lL>[h|8bhys0
 i.g|zLnu@C
 Ti@d]i=[!:j1CB\5/TF[m]`lfHfaqSN[0qn@T3zeosV/[LAss{@p_?],x*j8P_9t[}uH
 D^X-;j~\M! gyTly;fj`}&Y~i{<#bN.#QmkE}#T`dxP.I1\.)_MEN{@#W
User-Agent: Mutt/1.5.18 (2008-05-17)
Subject: Re: [Tiff] Use of uninitialised value in tiled jpeg tiff
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.maptools.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

On Wed, Jun 23, 2010 at 01:11:39PM +0100, jcupitt@gmail.com wrote:
> I noticed a small problem in libtiff-3.9.2 with tiled jpeg images. If
> the image to be written is smaller than a tile, the jpeg compressor
> appears to read beyond the end of the available data.
> 
> For example:
> 
> $ tiffinfo tiny.tif
> TIFF Directory at offset 0x9008 (36872)
>   Image Width: 128 Image Length: 96
>   Resolution: 1.25, 1.25 pixels/cm
>   Bits/Sample: 8
>   Compression Scheme: None
>   Photometric Interpretation: RGB color
>   Orientation: row 0 top, col 0 lhs
>   Samples/Pixel: 3
>   Rows/Strip: 16
>   Planar Configuration: single image plane
> $ valgrind tiffcp -t -c jpeg tiny.tif test.tif
> ==2872== Use of uninitialised value of size 8
> ==2872==    at 0x50987B8: rgb_ycc_convert (jccolor.c:159)
> ==2872==    by 0x50977B3: pre_process_data (jcprepct.c:145)
> ==2872==    by 0x509730D: process_data_simple_main (jcmainct.c:122)
> ==2872==    by 0x5093F1B: jpeg_write_scanlines (jcapistd.c:108)
> ==2872==    by 0x4E4EE0B: ??? (in /usr/lib/libtiff.so.4.3.2)
> ==2872==    by 0x4E4EE9B: ??? (in /usr/lib/libtiff.so.4.3.2)
> ==2872==    by 0x4E66111: TIFFWriteEncodedTile (in /usr/lib/libtiff.so.4.3.2)
> ==2872==    by 0x40508B: ??? (in /usr/bin/tiffcp)
> ==2872==    by 0x4041AD: ??? (in /usr/bin/tiffcp)
> ==2872==    by 0x404420: ??? (in /usr/bin/tiffcp)
> ==2872==    by 0x40340D: ??? (in /usr/bin/tiffcp)
> ==2872==    by 0x576CC4C: (below main) (libc-start.c:226)

This happens not only for JPEG case, but for any conversion when output tile is
larger than the image size. I have checked in the code to initialize the
allocated buffers (memset to 0) in tiffcp, that should fix the issue.

-- 
Andrey V. Kiselev
_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
