1*4882a593SmuzhiyunFrom fb89eab3ed46bbb0276bdee05b570455f6a27d2f Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Su_Laus <sulau@freenet.de> 3*4882a593SmuzhiyunDate: Sun, 6 Feb 2022 19:52:17 +0100 4*4882a593SmuzhiyunSubject: [PATCH] Move the crop_width and crop_length computation after the 5*4882a593Smuzhiyun sanity check to avoid warnings when built with 6*4882a593Smuzhiyun -fsanitize=unsigned-integer-overflow. 7*4882a593Smuzhiyun 8*4882a593SmuzhiyunUpstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/b258ed69a485a9cfb299d9f060eb2a46c54e5903?merge_request_iid=294] 9*4882a593Smuzhiyun 10*4882a593SmuzhiyunSigned-off-by: Teoh Jay Shen <jay.shen.teoh@intel.com> 11*4882a593Smuzhiyun 12*4882a593SmuzhiyunCVE: CVE-2022-2868 13*4882a593Smuzhiyun 14*4882a593Smuzhiyun--- 15*4882a593Smuzhiyun tools/tiffcrop.c | 5 ++--- 16*4882a593Smuzhiyun 1 file changed, 2 insertions(+), 3 deletions(-) 17*4882a593Smuzhiyun 18*4882a593Smuzhiyundiff --git a/tools/tiffcrop.c b/tools/tiffcrop.c 19*4882a593Smuzhiyunindex 0ef5bb2..99e4208 100644 20*4882a593Smuzhiyun--- a/tools/tiffcrop.c 21*4882a593Smuzhiyun+++ b/tools/tiffcrop.c 22*4882a593Smuzhiyun@@ -5389,15 +5389,13 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image, 23*4882a593Smuzhiyun off->endx = endx; 24*4882a593Smuzhiyun off->endy = endy; 25*4882a593Smuzhiyun 26*4882a593Smuzhiyun- crop_width = endx - startx + 1; 27*4882a593Smuzhiyun- crop_length = endy - starty + 1; 28*4882a593Smuzhiyun- 29*4882a593Smuzhiyun if (endx + 1 <= startx) 30*4882a593Smuzhiyun { 31*4882a593Smuzhiyun TIFFError("computeInputPixelOffsets", 32*4882a593Smuzhiyun "Invalid left/right margins and /or image crop width requested"); 33*4882a593Smuzhiyun return (-1); 34*4882a593Smuzhiyun } 35*4882a593Smuzhiyun+ crop_width = endx - startx + 1; 36*4882a593Smuzhiyun if (crop_width > image->width) 37*4882a593Smuzhiyun crop_width = image->width; 38*4882a593Smuzhiyun 39*4882a593Smuzhiyun@@ -5407,6 +5405,7 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image, 40*4882a593Smuzhiyun "Invalid top/bottom margins and /or image crop length requested"); 41*4882a593Smuzhiyun return (-1); 42*4882a593Smuzhiyun } 43*4882a593Smuzhiyun+ crop_length = endy - starty + 1; 44*4882a593Smuzhiyun if (crop_length > image->length) 45*4882a593Smuzhiyun crop_length = image->length; 46*4882a593Smuzhiyun 47