File tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.... of Package tiff

Overview Repositories Revisions Requests Users Attributes Meta

File tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch of Package tiff (Revision 36daca0e0162844ee55f795d26bd159b)

Currently displaying revision 36daca0e0162844ee55f795d26bd159b , Show latest

Index: tiff-4.0.9/tools/tiffcrop.c
===================================================================
--- tiff-4.0.9.orig/tools/tiffcrop.c
+++ tiff-4.0.9/tools/tiffcrop.c
@@ -5167,26 +5167,31 @@ computeInputPixelOffsets(struct crop_mas
 	y1 = _TIFFClampDoubleToUInt32(crop->corners[i].Y1);
 	y2 = _TIFFClampDoubleToUInt32(crop->corners[i].Y2);
 	}
-      if (x1 < 1)
-        crop->regionlist[i].x1 = 0;
-      else
-        crop->regionlist[i].x1 = (uint32) (x1 - 1);
+       /* region needs to be within image sizes 0.. width-1; 0..length-1 
+        * - be aware x,y are already casted to (uint32_t) and avoid (0 - 1)
+        */
+      if (x1 > image->width - 1)
+         crop->regionlist[i].x1 = image->width - 1;
+      else if (x1 > 0)
+         crop->regionlist[i].x1 = (uint32) (x1 - 1);
 
       if (x2 > image->width - 1)
         crop->regionlist[i].x2 = image->width - 1;
-      else
-        crop->regionlist[i].x2 = (uint32) (x2 - 1);
+      else if (x2 > 0)
+        crop->regionlist[i].x2 = (uint32_t)(x2 - 1);
+
       zwidth  = crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1; 
 
-      if (y1 < 1)
-        crop->regionlist[i].y1 = 0;
-      else
-        crop->regionlist[i].y1 = (uint32) (y1 - 1);
+      if (y1 > image->length - 1)
+        crop->regionlist[i].y1 = image->length - 1;
+      else if (y1 > 0)
+        crop->regionlist[i].y1 = (uint32_t)(y1 - 1);
 
       if (y2 > image->length - 1)
         crop->regionlist[i].y2 = image->length - 1;
-      else
-        crop->regionlist[i].y2 = (uint32) (y2 - 1);
+      else if (y2 > 0)
+        crop->regionlist[i].y2 = (uint32_t)(y2 - 1);
+
 
       zlength = crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1; 
 
@@ -5349,7 +5354,7 @@ computeInputPixelOffsets(struct crop_mas
   crop_width  = endx - startx + 1;
   crop_length = endy - starty + 1;
 
-  if (crop_width <= 0)
+  if (endx + 1 <= startx)
     {
     TIFFError("computeInputPixelOffsets", 
                "Invalid left/right margins and /or image crop width requested");
@@ -5358,7 +5363,7 @@ computeInputPixelOffsets(struct crop_mas
   if (crop_width > image->width)
     crop_width = image->width;
 
-  if (crop_length <= 0)
+  if (endy + 1 <= starty)
     {
     TIFFError("computeInputPixelOffsets", 
               "Invalid top/bottom margins and /or image crop length requested");

Places

File tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch of Package tiff (Revision 36daca0e0162844ee55f795d26bd159b)

Places