From 4d28af5fe61b1760f10981f5072ff1e6fd44f210 Mon Sep 17 00:00:00 2001 From: Lee Howard Date: Fri, 5 Sep 2025 21:44:49 +0000 Subject: [PATCH] tiffcrop: avoid nullptr dereference Fixes #734 CVE: CVE-2025-61143 Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/4d28af5fe61b1760f10981f5072ff1e6fd44f210] Signed-off-by: Peter Marko --- tools/tiffcrop.c | 2 +- tools/tiffdither.c | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c index ae414efc..1cbb49b6 100644 --- a/tools/tiffcrop.c +++ b/tools/tiffcrop.c @@ -2561,7 +2561,7 @@ main(int argc, char* argv[]) if (dump.outfile != NULL) { - dump_info (dump.outfile, dump.format, "", "Completed run for %s", TIFFFileName(out)); + dump_info (dump.outfile, dump.format, "", "Completed run for %s", out ? TIFFFileName(out) : "(not opened)"); fclose (dump.outfile); } } diff --git a/tools/tiffdither.c b/tools/tiffdither.c index 3c64fdc0..405527c7 100644 --- a/tools/tiffdither.c +++ b/tools/tiffdither.c @@ -84,6 +84,11 @@ fsdither(TIFF* in, TIFF* out) fprintf(stderr, "Out of memory.\n"); goto skip_on_error; } + if (imagewidth > TIFFScanlineSize(in)) + { + fprintf(stderr, "Image width exceeds scanline size.\n"); + goto skip_on_error; + } /* * Get first line