[ros-diffs] [reactos] 01/01: [WINDOWSCODECS] Avoid buffer underflow in TiffFrameDecode_ReadTile. CORE-16796

[Thomas Faber]

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=f4a8d3d70483c7d781e1e…

commit f4a8d3d70483c7d781e1e674a633a449e52197e8
Author:     Thomas Faber <thomas.faber(a)reactos.org>
AuthorDate: Mon Apr 13 17:55:00 2020 +0200
Commit:     Thomas Faber <thomas.faber(a)reactos.org>
CommitDate: Mon Apr 13 18:18:35 2020 +0200

    [WINDOWSCODECS] Avoid buffer underflow in TiffFrameDecode_ReadTile. CORE-16796
---
 dll/win32/windowscodecs/tiffformat.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/dll/win32/windowscodecs/tiffformat.c b/dll/win32/windowscodecs/tiffformat.c
index 6f4f6d06b74..e7141fc3e23 100644
--- a/dll/win32/windowscodecs/tiffformat.c
+++ b/dll/win32/windowscodecs/tiffformat.c
@@ -1164,6 +1164,21 @@ static HRESULT TiffFrameDecode_ReadTile(TiffFrameDecode *This, UINT
tile_x, UINT
         {
             BYTE b = *src--;
 
+#ifdef __REACTOS__
+            dst -= 4;
+            dst[2] = (b & 0x08) ? 0xff : 0; /* R */
+            dst[1] = (b & 0x04) ? 0xff : 0; /* G */
+            dst[0] = (b & 0x02) ? 0xff : 0; /* B */
+            dst[3] = (b & 0x01) ? 0xff : 0; /* A */
+            if (count || This->decode_info.tile_width % 2 == 0)
+            {
+                dst -= 4;
+                dst[2] = (b & 0x80) ? 0xff : 0; /* R */
+                dst[1] = (b & 0x40) ? 0xff : 0; /* G */
+                dst[0] = (b & 0x20) ? 0xff : 0; /* B */
+                dst[3] = (b & 0x10) ? 0xff : 0; /* A */
+            }
+#else
             dst -= 8;
             dst[2] = (b & 0x80) ? 0xff : 0; /* R */
             dst[1] = (b & 0x40) ? 0xff : 0; /* G */
@@ -1173,6 +1188,7 @@ static HRESULT TiffFrameDecode_ReadTile(TiffFrameDecode *This, UINT
tile_x, UINT
             dst[5] = (b & 0x04) ? 0xff : 0; /* G */
             dst[4] = (b & 0x02) ? 0xff : 0; /* B */
             dst[7] = (b & 0x01) ? 0xff : 0; /* A */
+#endif
         }
     }
     /* 16bpp RGBA */