From 4e2e1028695415a2bdcccb1b9e39958f1c41f2f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fridrich=20=C5=A0trba?= <fridrich.strba@bluewin.ch>
Date: Wed, 7 Dec 2016 15:10:21 +0100
Subject: [PATCH] fix some CVEs for bmp2tiff

---
 archive/tools/bmp2tiff.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/archive/tools/bmp2tiff.c b/archive/tools/bmp2tiff.c
index d541e203..80d4e8bc 100644
--- a/archive/tools/bmp2tiff.c
+++ b/archive/tools/bmp2tiff.c
@@ -770,6 +770,14 @@ main(int argc, char* argv[])

            _TIFFfree(comprbuf);

+           /* Check whether we are not going to read past the uncompressed data */
+           if ( length > j || width > j || length * width > j) {
+               TIFFError(infilename,
+                                          "Premature end of file");
+               _TIFFfree(uncomprbuf);
+               goto bad3;
+           }
+
            for (row = 0; row < length; row++) {
                if (TIFFWriteScanline(out,
                                                       uncomprbuf + (length - row - 1) * width,
--
2.15.1