File tiff-CVE-2024-13978.patch of Package tiff

Index: tiff-4.7.0/tools/tiff2pdf.c
===================================================================
--- tiff-4.7.0.orig/tools/tiff2pdf.c
+++ tiff-4.7.0/tools/tiff2pdf.c
@@ -1371,8 +1371,24 @@ void t2p_read_tiff_init(T2P *t2p, TIFF *
             t2p->pdf_xrefcount += (t2p->tiff_tiles[i].tiles_tilecount - 1) * 2;
             TIFFGetField(input, TIFFTAG_TILEWIDTH,
                          &(t2p->tiff_tiles[i].tiles_tilewidth));
+			if (t2p->tiff_tiles[i].tiles_tilewidth < 1)
+            {
+                TIFFError(TIFF2PDF_MODULE, "Invalid tile width (%d), %s",
+                          t2p->tiff_tiles[i].tiles_tilewidth,
+                          TIFFFileName(input));
+                t2p->t2p_error = T2P_ERR_ERROR;
+                return;
+            }
             TIFFGetField(input, TIFFTAG_TILELENGTH,
                          &(t2p->tiff_tiles[i].tiles_tilelength));
+			if (t2p->tiff_tiles[i].tiles_tilelength < 1)
+            {
+                TIFFError(TIFF2PDF_MODULE, "Invalid tile length (%d), %s",
+                          t2p->tiff_tiles[i].tiles_tilelength,
+                          TIFFFileName(input));
+                t2p->t2p_error = T2P_ERR_ERROR;
+                return;
+            }
             t2p->tiff_tiles[i].tiles_tiles = (T2P_TILE *)_TIFFmalloc(
                 TIFFSafeMultiply(tmsize_t, t2p->tiff_tiles[i].tiles_tilecount,
                                  sizeof(T2P_TILE)));
openSUSE Build Service is sponsored by