Received: by cthulhu.engr.sgi.com (940816.SGI.8.6.9/911001.SGI)
	for tiff-list id MAA27760; Mon, 17 Oct 1994 12:59:20 -0700
Return-Path: <owner-tiff>
Received: from sgi.sgi.com by cthulhu.engr.sgi.com via ESMTP (940816.SGI.8.6.9/911001.SGI)
	for <tiff-relay@cthulhu.engr.sgi.com> id MAA27752; Mon, 17 Oct 1994 12:59:13 -0700
Received: from MIT.EDU by sgi.sgi.com via SMTP (940627.SGI.8.6.9/910110.SGI)
	for <tiff@sgi.com> id MAA14656; Mon, 17 Oct 1994 12:59:11 -0700
From: wchuang@MIT.EDU
Received: from TIGANA.MIT.EDU by MIT.EDU with SMTP
	id AA01035; Mon, 17 Oct 94 15:58:52 EDT
Received: by tigana.MIT.EDU (5.0/4.7) id AA04749; Mon, 17 Oct 1994 15:58:47 +0500
Date: Mon, 17 Oct 1994 15:58:47 +0500
Message-Id: <9410171958.AA04749@tigana.MIT.EDU>
To: tiff@sgi.sgi.com
Subject: Bug in tiff2ps.c
Content-Length: 1685
Sender: owner-tiff@sgi.sgi.com
Precedence: bulk


There is a bug in the tiff2ps.c in all versions up to and including
v3.3beta021, in the function PSRawDataBW().  The code in question is:

        TIFFGetField(tif, TIFFTAG_FILLORDER, &fillorder);
        TIFFGetField(tif, TIFFTAG_STRIPBYTECOUNTS, &bc);
        bufsize = bc[0];
        tf_buf = (unsigned char*) malloc(bufsize);
        if (tf_buf == NULL) {
                TIFFError(filename, "No space for strip buffer");
                return;
        }
        for (s = 0; s < TIFFNumberOfStrips(tif); s++) {
                if (bc[s] > bufsize) {
                        tf_buf = (unsigned char *) realloc(tf_buf, bc[0]);
                        if (tf_buf == NULL) {
                                TIFFError(filename,
                                    "No space for strip buffer");
                                return;
                        }
                        bufsize = bc[0];
                }
                cc = TIFFReadRawStrip(tif, s, tf_buf, bc[s]);

where the latter 11 lines should instead read (note the indexing):

        for (s = 0; s < TIFFNumberOfStrips(tif); s++) {
                if (bc[s] > bufsize) {
!                       tf_buf = (unsigned char *) realloc(tf_buf, bc[s]);
                        if (tf_buf == NULL) {
                                TIFFError(filename,
                                    "No space for strip buffer");
                                return;
                        }
!                       bufsize = bc[s];
                }
                cc = TIFFReadRawStrip(tif, s, tf_buf, bc[s]);

If the strip sizes were ascending in the TIFF file, TIFFReadRawStrip()
would start clobbering memory.

-William

