[libtiff] Fixup unitialized access issue
This CL initializes the raw tif data to guard against unitialized memory access.
BUG=chromium:677377
Change-Id: If272fafacd996c2e93a41fb6e477661dc0c5492c
Reviewed-on: https://pdfium-review.googlesource.com/2150
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
diff --git a/third_party/libtiff/0012-initialize-tif-rawdata.patch b/third_party/libtiff/0012-initialize-tif-rawdata.patch
new file mode 100644
index 0000000..2543b89
--- /dev/null
+++ b/third_party/libtiff/0012-initialize-tif-rawdata.patch
@@ -0,0 +1,14 @@
+diff --git a/third_party/libtiff/tif_read.c b/third_party/libtiff/tif_read.c
+index 5cb419bd4..548b1f5ea 100644
+--- a/third_party/libtiff/tif_read.c
++++ b/third_party/libtiff/tif_read.c
+@@ -936,6 +936,9 @@ TIFFReadBufferSetup(TIFF* tif, void* bp, tmsize_t size)
+ return (0);
+ }
+ tif->tif_rawdata = (uint8*) _TIFFmalloc(tif->tif_rawdatasize);
++ if (tif->tif_rawdata)
++ memset(tif->tif_rawdata, 0, tif->tif_rawdatasize);
++
+ tif->tif_flags |= TIFF_MYBUFFER;
+ }
+ if (tif->tif_rawdata == NULL) {
diff --git a/third_party/libtiff/README.pdfium b/third_party/libtiff/README.pdfium
index fde3060..c55fc63 100644
--- a/third_party/libtiff/README.pdfium
+++ b/third_party/libtiff/README.pdfium
@@ -21,3 +21,4 @@
0009-HeapBufferOverflow-PixarLogDecode.patch: Fix a heap buffer overflow
0010-fix-leak-imagebegin: Fix a leak when TIFFRGBAImageBegin fails
0011-fix-leak-imagebegin2: Apply upstream fix related to our previous patch
+0012-initialize-tif-rawdata.patch: Initialize tif_rawdata to guard against unitialized access
diff --git a/third_party/libtiff/tif_read.c b/third_party/libtiff/tif_read.c
index 5cb419b..548b1f5 100644
--- a/third_party/libtiff/tif_read.c
+++ b/third_party/libtiff/tif_read.c
@@ -936,6 +936,9 @@
return (0);
}
tif->tif_rawdata = (uint8*) _TIFFmalloc(tif->tif_rawdatasize);
+ if (tif->tif_rawdata)
+ memset(tif->tif_rawdata, 0, tif->tif_rawdatasize);
+
tif->tif_flags |= TIFF_MYBUFFER;
}
if (tif->tif_rawdata == NULL) {