From a95b799f65064e4ba2e2dfc206808f86faf93e85 Mon Sep 17 00:00:00 2001 From: Even Rouault Date: Thu, 17 Feb 2022 15:28:43 +0100 Subject: [PATCH] TIFFFetchNormalTag(): avoid calling memcpy() with a null source pointer and size of zero (fixes #383) CVE: CVE-2022-0908 Upstream-Status: Backport [https://sources.debian.org/src/tiff/4.1.0+git191117-2%7Edeb10u4/debian/patches/CVE-2022-0908.patch/] Signed-off-by: Ranjitsinh Rathod Comment: No change in any hunk --- libtiff/tif_dirread.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c index 50ebf8ac..2ec44a4f 100644 --- a/libtiff/tif_dirread.c +++ b/libtiff/tif_dirread.c @@ -5021,7 +5021,10 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover) _TIFFfree(data); return(0); } - _TIFFmemcpy(o,data,(uint32)dp->tdir_count); + if (dp->tdir_count > 0 ) + { + _TIFFmemcpy(o,data,(uint32)dp->tdir_count); + } o[(uint32)dp->tdir_count]=0; if (data!=0) _TIFFfree(data); -- GitLab