X-Git-Url: https://git.saurik.com/wxWidgets.git/blobdiff_plain/426272a35e5727f8c2ca147a6b1eb865cc5e34d6..85284ca4b226d9a1ab6bed26c5eaa480543649d5:/src/common/imagtiff.cpp

diff --git a/src/common/imagtiff.cpp b/src/common/imagtiff.cpp
index 3a5e63fb5e..2b48f30b6d 100644
--- a/src/common/imagtiff.cpp
+++ b/src/common/imagtiff.cpp
@@ -32,6 +32,7 @@
     #include "wx/intl.h"
     #include "wx/bitmap.h"
     #include "wx/module.h"
+    #include "wx/wxcrtvararg.h"
 #endif
 
 extern "C"
@@ -61,39 +62,38 @@ extern "C"
 // TIFF library error/warning handlers
 // ----------------------------------------------------------------------------
 
+static wxString
+FormatTiffMessage(const char *module, const char *fmt, va_list ap)
+{
+    char buf[512];
+    if ( wxCRT_VsnprintfA(buf, WXSIZEOF(buf), fmt, ap) <= 0 )
+    {
+        // this isn't supposed to happen, but if it does, it's better
+        // than nothing
+        strcpy(buf, "Incorrectly formatted TIFF message");
+    }
+    buf[WXSIZEOF(buf)-1] = 0; // make sure it is always NULL-terminated
+
+    wxString msg(buf);
+    if ( module )
+        msg += wxString::Format(_(" (in module \"%s\")"), module);
+
+    return msg;
+}
+
 extern "C"
 {
 
 static void
-TIFFwxWarningHandler(const char* module,
-                     const char* WXUNUSED_IN_UNICODE(fmt),
-                     va_list WXUNUSED_IN_UNICODE(ap))
+TIFFwxWarningHandler(const char* module, const char *fmt, va_list ap)
 {
-    if (module != NULL)
-        wxLogWarning(_("tiff module: %s"), wxString::FromAscii(module).c_str());
-
-    // FIXME: this is not terrible informative but better than crashing!
-#if wxUSE_UNICODE
-    wxLogWarning(_("TIFF library warning."));
-#else
-    wxVLogWarning(fmt, ap);
-#endif
+    wxLogWarning("%s", FormatTiffMessage(module, fmt, ap));
 }
 
 static void
-TIFFwxErrorHandler(const char* module,
-                   const char* WXUNUSED_IN_UNICODE(fmt),
-                   va_list WXUNUSED_IN_UNICODE(ap))
+TIFFwxErrorHandler(const char* module, const char *fmt, va_list ap)
 {
-    if (module != NULL)
-        wxLogError(_("tiff module: %s"), wxString::FromAscii(module).c_str());
-
-    // FIXME: as above
-#if wxUSE_UNICODE
-    wxLogError(_("TIFF library error."));
-#else
-    wxVLogError(fmt, ap);
-#endif
+    wxLogError("%s", FormatTiffMessage(module, fmt, ap));
 }
 
 } // extern "C"
@@ -108,6 +108,7 @@ wxTIFFHandler::wxTIFFHandler()
 {
     m_name = wxT("TIFF file");
     m_extension = wxT("tif");
+    m_altExtensions.Add(wxT("tiff"));
     m_type = wxBITMAP_TYPE_TIF;
     m_mime = wxT("image/tiff");
     TIFFSetWarningHandler((TIFFErrorHandler) TIFFwxWarningHandler);
@@ -285,7 +286,6 @@ bool wxTIFFHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbos
     }
 
     uint32 w, h;
-    uint32 npixels;
     uint32 *raster;
 
     TIFFGetField( tif, TIFFTAG_IMAGEWIDTH, &w );
@@ -299,9 +299,20 @@ bool wxTIFFHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbos
                            (samplesInfo[0] == EXTRASAMPLE_ASSOCALPHA ||
                             samplesInfo[0] == EXTRASAMPLE_UNASSALPHA));
 
-    npixels = w * h;
+    // guard against integer overflow during multiplication which could result
+    // in allocating a too small buffer and then overflowing it
+    const double bytesNeeded = (double)w * (double)h * sizeof(uint32);
+    if ( bytesNeeded >= wxUINT32_MAX )
+    {
+        if ( verbose )
+            wxLogError( _("TIFF: Image size is abnormally big.") );
+
+        TIFFClose(tif);
+
+        return false;
+    }
 
-    raster = (uint32*) _TIFFmalloc( npixels * sizeof(uint32) );
+    raster = (uint32*) _TIFFmalloc( bytesNeeded );
 
     if (!raster)
     {
@@ -412,7 +423,7 @@ bool wxTIFFHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbos
     return true;
 }
 
-int wxTIFFHandler::GetImageCount( wxInputStream& stream )
+int wxTIFFHandler::DoGetImageCount( wxInputStream& stream )
 {
     TIFF *tif = TIFFwxOpen( stream, "image", "r" );
 
@@ -425,6 +436,9 @@ int wxTIFFHandler::GetImageCount( wxInputStream& stream )
     } while (TIFFReadDirectory(tif));
 
     TIFFClose( tif );
+    
+    // NOTE: this function modifies the current stream position but it's ok
+    //       (see wxImageHandler::GetImageCount)
 
     return dircount;
 }
@@ -586,7 +600,7 @@ bool wxTIFFHandler::DoCanRead( wxInputStream& stream )
 {
     unsigned char hdr[2];
 
-    if ( !stream.Read(&hdr[0], WXSIZEOF(hdr)) )
+    if ( !stream.Read(&hdr[0], WXSIZEOF(hdr)) )     // it's ok to modify the stream position here
         return false;
 
     return (hdr[0] == 'I' && hdr[1] == 'I') ||