X-Git-Url: https://git.saurik.com/wxWidgets.git/blobdiff_plain/ba4800d3aeb254dd00277ff0a71df9321ca692dc..5eed855656b3996f4c0aa0a585a4820a2af6d628:/src/common/imagtiff.cpp

diff --git a/src/common/imagtiff.cpp b/src/common/imagtiff.cpp
index 91b70afbae..5d8476daec 100644
--- a/src/common/imagtiff.cpp
+++ b/src/common/imagtiff.cpp
@@ -25,6 +25,7 @@
 #if wxUSE_IMAGE && wxUSE_LIBTIFF
 
 #include "wx/imagtiff.h"
+#include "wx/versioninfo.h"
 
 #ifndef WX_PRECOMP
     #include "wx/log.h"
@@ -126,7 +127,7 @@ static toff_t wxFileOffsetToTIFF(wxFileOffset ofs)
 
     toff_t tofs = wx_truncate_cast(toff_t, ofs);
     wxCHECK_MSG( (wxFileOffset)tofs == ofs, (toff_t)-1,
-                    _T("TIFF library doesn't support large files") );
+                    wxT("TIFF library doesn't support large files") );
 
     return tofs;
 }
@@ -270,7 +271,9 @@ bool wxTIFFHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbos
     if (!tif)
     {
         if (verbose)
+        {
             wxLogError( _("TIFF: Error loading image.") );
+        }
 
         return false;
     }
@@ -278,7 +281,9 @@ bool wxTIFFHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbos
     if (!TIFFSetDirectory( tif, (tdir_t)index ))
     {
         if (verbose)
+        {
             wxLogError( _("Invalid TIFF image index.") );
+        }
 
         TIFFClose( tif );
 
@@ -286,7 +291,6 @@ bool wxTIFFHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbos
     }
 
     uint32 w, h;
-    uint32 npixels;
     uint32 *raster;
 
     TIFFGetField( tif, TIFFTAG_IMAGEWIDTH, &w );
@@ -300,14 +304,29 @@ bool wxTIFFHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbos
                            (samplesInfo[0] == EXTRASAMPLE_ASSOCALPHA ||
                             samplesInfo[0] == EXTRASAMPLE_UNASSALPHA));
 
-    npixels = w * h;
+    // guard against integer overflow during multiplication which could result
+    // in allocating a too small buffer and then overflowing it
+    const double bytesNeeded = (double)w * (double)h * sizeof(uint32);
+    if ( bytesNeeded >= wxUINT32_MAX )
+    {
+        if ( verbose )
+        {
+            wxLogError( _("TIFF: Image size is abnormally big.") );
+        }
 
-    raster = (uint32*) _TIFFmalloc( npixels * sizeof(uint32) );
+        TIFFClose(tif);
+
+        return false;
+    }
+
+    raster = (uint32*) _TIFFmalloc( (uint32)bytesNeeded );
 
     if (!raster)
     {
         if (verbose)
+        {
             wxLogError( _("TIFF: Couldn't allocate memory.") );
+        }
 
         TIFFClose( tif );
 
@@ -318,7 +337,9 @@ bool wxTIFFHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbos
     if (!image->Ok())
     {
         if (verbose)
+        {
             wxLogError( _("TIFF: Couldn't allocate memory.") );
+        }
 
         _TIFFfree( raster );
         TIFFClose( tif );
@@ -332,7 +353,9 @@ bool wxTIFFHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbos
     if (!TIFFReadRGBAImage( tif, w, h, raster, 0 ))
     {
         if (verbose)
+        {
             wxLogError( _("TIFF: Error reading image.") );
+        }
 
         _TIFFfree( raster );
         image->Destroy();
@@ -413,7 +436,7 @@ bool wxTIFFHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbos
     return true;
 }
 
-int wxTIFFHandler::GetImageCount( wxInputStream& stream )
+int wxTIFFHandler::DoGetImageCount( wxInputStream& stream )
 {
     TIFF *tif = TIFFwxOpen( stream, "image", "r" );
 
@@ -427,6 +450,9 @@ int wxTIFFHandler::GetImageCount( wxInputStream& stream )
 
     TIFFClose( tif );
 
+    // NOTE: this function modifies the current stream position but it's ok
+    //       (see wxImageHandler::GetImageCount)
+
     return dircount;
 }
 
@@ -437,7 +463,9 @@ bool wxTIFFHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbo
     if (!tif)
     {
         if (verbose)
+        {
             wxLogError( _("TIFF: Error saving image.") );
+        }
 
         return false;
     }
@@ -455,7 +483,7 @@ bool wxTIFFHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbo
     switch ( res )
     {
         default:
-            wxFAIL_MSG( _T("unknown image resolution units") );
+            wxFAIL_MSG( wxT("unknown image resolution units") );
             // fall through
 
         case wxIMAGE_RESOLUTION_NONE:
@@ -517,7 +545,9 @@ bool wxTIFFHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbo
         if (!buf)
         {
             if (verbose)
+            {
                 wxLogError( _("TIFF: Couldn't allocate memory.") );
+            }
 
             TIFFClose( tif );
 
@@ -563,7 +593,9 @@ bool wxTIFFHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbo
         if ( TIFFWriteScanline(tif, buf ? buf : ptr, (uint32)row, 0) < 0 )
         {
             if (verbose)
+            {
                 wxLogError( _("TIFF: Error writing image.") );
+            }
 
             TIFFClose( tif );
             if (buf)
@@ -587,7 +619,7 @@ bool wxTIFFHandler::DoCanRead( wxInputStream& stream )
 {
     unsigned char hdr[2];
 
-    if ( !stream.Read(&hdr[0], WXSIZEOF(hdr)) )
+    if ( !stream.Read(&hdr[0], WXSIZEOF(hdr)) )     // it's ok to modify the stream position here
         return false;
 
     return (hdr[0] == 'I' && hdr[1] == 'I') ||
@@ -596,4 +628,27 @@ bool wxTIFFHandler::DoCanRead( wxInputStream& stream )
 
 #endif  // wxUSE_STREAMS
 
+/*static*/ wxVersionInfo wxTIFFHandler::GetLibraryVersionInfo()
+{
+    int major,
+        minor,
+        micro;
+
+    const wxString ver(::TIFFGetVersion());
+    if ( wxSscanf(ver, "LIBTIFF, Version %d.%d.%d", &major, &minor, &micro) != 3 )
+    {
+        wxLogDebug("Unrecognized libtiff version string \"%s\"", ver);
+
+        major =
+        minor =
+        micro = 0;
+    }
+
+    wxString copyright;
+    const wxString desc = ver.BeforeFirst('\n', &copyright);
+    copyright.Replace("\n", "");
+
+    return wxVersionInfo("libtiff", major, minor, micro, desc, copyright);
+}
+
 #endif  // wxUSE_LIBTIFF