1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
$NetBSD: patch-ap,v 1.1 2004/10/18 14:37:24 tron Exp $
--- libtiff/tif_dirwrite.c.orig 2003-12-22 09:22:15.000000000 +0100
+++ libtiff/tif_dirwrite.c 2004-10-18 16:25:32.000000000 +0200
@@ -692,8 +692,14 @@
uint16* w = buf;
int i, status, samples = tif->tif_dir.td_samplesperpixel;
- if (samples > NITEMS(buf))
+ if (samples > NITEMS(buf)) {
w = (uint16*) _TIFFmalloc(samples * sizeof (uint16));
+ if (w == NULL) {
+ TIFFError(tif->tif_name,
+ "No space to write per-sample shorts");
+ return (0);
+ }
+ }
TIFFGetField(tif, tag, &v);
for (i = 0; i < samples; i++)
w[i] = v;
@@ -717,8 +723,14 @@
int i, status;
int samples = (int) tif->tif_dir.td_samplesperpixel;
- if (samples > NITEMS(buf))
+ if (samples > NITEMS(buf)) {
w = (double*) _TIFFmalloc(samples * sizeof (double));
+ if (w == NULL) {
+ TIFFError(tif->tif_name,
+ "No space to write per-sample values");
+ return (0);
+ }
+ }
TIFFGetField(tif, tag, &v);
for (i = 0; i < samples; i++)
w[i] = v;
@@ -840,6 +852,11 @@
dir->tdir_type = (short) type;
dir->tdir_count = n;
t = (uint32*) _TIFFmalloc(2*n * sizeof (uint32));
+ if (t == NULL) {
+ TIFFError(tif->tif_name,
+ "No space to write RATIONAL array");
+ return (0);
+ }
for (i = 0; i < n; i++) {
float fv = v[i];
int sign = 1;
@@ -910,8 +927,14 @@
char* w = buf;
int i, status = 0;
- if (n * TIFFDataWidth(type) > sizeof buf)
+ if (n * TIFFDataWidth(type) > sizeof buf) {
w = (char*) _TIFFmalloc(n * TIFFDataWidth(type));
+ if (w == NULL) {
+ TIFFError(tif->tif_name,
+ "No space to write array");
+ return (0);
+ }
+ }
switch (type) {
case TIFF_BYTE:
{ uint8* bp = (uint8*) w;
|
