opencv/CVE-2022-0561_and_CVE-2022-0562.patch

26 lines
1.3 KiB
Diff
Raw Permalink Normal View History

2022-11-05 11:41:56 +08:00
diff -Npur opencv-4.5.2/3rdparty/libtiff/tif_dirread.c opencv-4.5.2-new/3rdparty/libtiff/tif_dirread.c
--- opencv-4.5.2/3rdparty/libtiff/tif_dirread.c 2021-04-02 19:23:54.000000000 +0800
+++ opencv-4.5.2-new/3rdparty/libtiff/tif_dirread.c 2022-05-21 14:44:25.639756094 +0800
@@ -4173,7 +4173,8 @@ TIFFReadDirectory(TIFF* tif)
goto bad;
}
- memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, old_extrasamples * sizeof(uint16));
+ if (old_extrasamples > 0)
+ memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, old_extrasamples * sizeof(uint16));
_TIFFsetShortArray(&tif->tif_dir.td_sampleinfo, new_sampleinfo, tif->tif_dir.td_extrasamples);
_TIFFfree(new_sampleinfo);
}
@@ -5765,8 +5766,9 @@ TIFFFetchStripThing(TIFF* tif, TIFFDirEn
_TIFFfree(data);
return(0);
}
- _TIFFmemcpy(resizeddata,data,(uint32)dir->tdir_count*sizeof(uint64));
- _TIFFmemset(resizeddata+(uint32)dir->tdir_count,0,(nstrips-(uint32)dir->tdir_count)*sizeof(uint64));
+ if( dir->tdir_count )
+ _TIFFmemcpy(resizeddata,data, (uint32)dir->tdir_count * sizeof(uint64));
+ _TIFFmemset(resizeddata+(uint32)dir->tdir_count, 0, (nstrips - (uint32)dir->tdir_count) * sizeof(uint64));
_TIFFfree(data);
data=resizeddata;
}