Skip to content

Commit 26fc9a3

Browse files
authored
Merge pull request OSGeo#11872 from rouault/fix_ossfuzz_397740496
third_party/libertiff: tileCoordinateToIdx(): avoid potential harmless unsigned-int-overflow (ossfuzz#397740496)
2 parents b51894d + dd00fc4 commit 26fc9a3

File tree

1 file changed

+12
-4
lines changed

1 file changed

+12
-4
lines changed

third_party/libertiff/libertiff.hpp

+12-4
Original file line numberDiff line numberDiff line change
@@ -1084,18 +1084,26 @@ class Image
10841084
{
10851085
if (m_isTiled && m_tileWidth > 0 && m_tileHeight > 0)
10861086
{
1087-
const auto lTilesPerRow = tilesPerRow();
1088-
const auto lTilesPerCol = tilesPerCol();
1087+
const uint32_t lTilesPerRow = tilesPerRow();
1088+
const uint32_t lTilesPerCol = tilesPerCol();
10891089
if (xtile >= lTilesPerRow || ytile >= lTilesPerCol)
10901090
{
10911091
ok = false;
10921092
return 0;
10931093
}
1094-
auto idx = uint64_t(ytile) * lTilesPerRow + xtile;
1094+
uint64_t idx = uint64_t(ytile) * lTilesPerRow + xtile;
10951095
if (bandIdx &&
10961096
m_planarConfiguration == PlanarConfiguration::Separate)
10971097
{
1098-
idx += uint64_t(bandIdx) * lTilesPerCol * lTilesPerRow;
1098+
const uint64_t lTotalTiles =
1099+
uint64_t(lTilesPerCol) * lTilesPerRow;
1100+
if (lTotalTiles >
1101+
std::numeric_limits<uint64_t>::max() / bandIdx)
1102+
{
1103+
ok = false;
1104+
return 0;
1105+
}
1106+
idx += bandIdx * lTotalTiles;
10991107
}
11001108
return idx;
11011109
}

0 commit comments

Comments
 (0)