tiff comparison warnings

python-pillow · Jul 2, 2020 · 21533e4 · 21533e4
1 parent eb9464e
commit 21533e4
Showing 1 changed file with 14 additions and 7 deletions.
diff --git a/src/libImaging/TiffDecode.c b/src/libImaging/TiffDecode.c
@@ -344,13 +344,20 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
     }
 
     if (TIFFIsTiled(tiff)) {
-        UINT32 x, y, tile_y, row_byte_size;
-        UINT32 tile_width, tile_length, current_tile_width;
+        INT32 x, y, tile_y;
+        UINT32 tile_width, tile_length, current_tile_width, row_byte_size;
         UINT8 *new_data;
 
         TIFFGetField(tiff, TIFFTAG_TILEWIDTH, &tile_width);
         TIFFGetField(tiff, TIFFTAG_TILELENGTH, &tile_length);
 
+        /* overflow check for row_byte_size calculation */
+        if ((UINT32) INT_MAX / state->bits < tile_width) {
+            state->errcode = IMAGING_CODEC_MEMORY;
+            TIFFClose(tiff);
+            return -1;
+        }
+
         // We could use TIFFTileSize, but for YCbCr data it returns subsampled data size
         row_byte_size = (tile_width * state->bits + 7) / 8;
 
@@ -394,10 +401,10 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
 
                 TRACE(("Read tile at %dx%d; \n\n", x, y));
 
-                current_tile_width = min(tile_width, state->xsize - x);
+                current_tile_width = min((INT32) tile_width, state->xsize - x);
 
                 // iterate over each line in the tile and stuff data into image
-                for (tile_y = 0; tile_y < min(tile_length, state->ysize - y); tile_y++) {
+                for (tile_y = 0; tile_y < min((INT32) tile_length, state->ysize - y); tile_y++) {
                     TRACE(("Writing tile data at %dx%d using tile_width: %d; \n", tile_y + y, x, current_tile_width));
 
                     // UINT8 * bbb = state->buffer + tile_y * row_byte_size;
@@ -411,9 +418,9 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
             }
         }
     } else {
-        UINT32 strip_row, row_byte_size;
+        INT32 strip_row;
         UINT8 *new_data;
-        UINT32 rows_per_strip;
+        UINT32 rows_per_strip, row_byte_size;
         int ret;
 
         ret = TIFFGetField(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_strip);
@@ -468,7 +475,7 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
             TRACE(("Decoded strip for row %d \n", state->y));
 
             // iterate over each row in the strip and stuff data into image
-            for (strip_row = 0; strip_row < min(rows_per_strip, state->ysize - state->y); strip_row++) {
+            for (strip_row = 0; strip_row < min((INT32) rows_per_strip, state->ysize - state->y); strip_row++) {
                 TRACE(("Writing data into line %d ; \n", state->y + strip_row));
 
                 // UINT8 * bbb = state->buffer + strip_row * (state->bytes / rows_per_strip);