security fix (patch 1089659)

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@31140 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775

diff --git a/src/tiff/VERSION b/src/tiff/VERSION
index de4dc85aca96a228d642ce2dbf7fc4cc79d22731..0ed63eab341f53f85c91cbf94899cc5977e1582a 100644 (file)
--- a/src/tiff/VERSION
+++ b/src/tiff/VERSION
@@ -1 +1 @@
-3.6.1-2
+3.6.1-3

diff --git a/src/tiff/tif_dirread.c b/src/tiff/tif_dirread.c
index 4c4991a62a6f09c8a76652f00a8d0d269dac2f09..96ecfe59ed0d3078b7b2a8684c7d954c92f2d6c1 100644 (file)
--- a/src/tiff/tif_dirread.c
+++ b/src/tiff/tif_dirread.c
@@ -67,7 +67,7 @@ CheckMalloc(TIFF* tif, size_t nmemb, size_t elem_size, const char* what)
        char    *cp = NULL;
        tsize_t bytes = nmemb * elem_size;
 
        char    *cp = NULL;
        tsize_t bytes = nmemb * elem_size;
 

-       if (elem_size && bytes / elem_size == nmemb)
+       if (nmemb && elem_size && bytes / elem_size == nmemb)

                cp = (char*)_TIFFmalloc(bytes);
 
        if (cp == NULL)
                cp = (char*)_TIFFmalloc(bytes);
 
        if (cp == NULL)

diff --git a/src/tiff/tif_fax3.c b/src/tiff/tif_fax3.c
index e816107fc01979233aef31aa8e5875f8b69aa6aa..4318bf3a3203967e180d2841921a8c883bdb319b 100644 (file)
--- a/src/tiff/tif_fax3.c
+++ b/src/tiff/tif_fax3.c
@@ -443,7 +443,7 @@ CheckMalloc(TIFF* tif, size_t nmemb, size_t elem_size, const char* what)
        char    *cp = NULL;
        tsize_t bytes = nmemb * elem_size;
 
        char    *cp = NULL;
        tsize_t bytes = nmemb * elem_size;
 

-       if (elem_size && bytes / elem_size == nmemb)
+       if (nmemb && elem_size && bytes / elem_size == nmemb)

                cp = (char*) _TIFFmalloc(bytes);
 
        if (cp == NULL)
                cp = (char*) _TIFFmalloc(bytes);
 
        if (cp == NULL)