Message-ID: 38E9D02F.8043.137848E7@localhost
To: tiff@olympiakos.com
Subject: Suggested changes to tif_win32.c
From: "Arvan Pritchard" <arvan.pritchard@informatix.co.uk>
Date: Tue, 4 Apr 2000 11:21:19 +0100
Sender: owner-tiff@olympiakos.com


These changes to libtiff version 3.5.5 arise out of testing with BoundsChecker. There 
are two problems:

1) An overread of the mode in TIFFFdOpen()

155c155,157
<       BOOL fSuppressMap = (mode[1] == 'u' || mode[2] == 'u');
---
>     // Avoid reading uninitialised memory - note that this
>     // use of 'u' does not match the spec
>       BOOL fSuppressMap = (mode[1] == 'u' || (mode[1]!=0 && mode[2] == 'u'));


2) Overwriting in _TIFFrealloc() when reducing the size.

229,231c231,244
<               if ((pvTmp = GlobalAlloc(GMEM_FIXED, s)) != NULL) {
<                       CopyMemory(pvTmp, p, GlobalSize(p));
<                       GlobalFree(p);
---
>         tsize_t old=GlobalSize(p);
>         if (old>=s)
>         {
>                   if ((pvTmp = GlobalAlloc(GMEM_FIXED, s)) != NULL) {
>                           CopyMemory(pvTmp, p, s);
>                           GlobalFree(p);
>             }
>         }
>         else
>         {
>                   if ((pvTmp = GlobalAlloc(GMEM_FIXED, s)) != NULL) {
>                           CopyMemory(pvTmp, p, old);
>                           GlobalFree(p);
>             }


-- 
Arvan Pritchard
Informatix Software International Limited
Daedalus House, Station Road, Cambridge, CB1 2RE
arvan.pritchard@informatix.co.uk

