aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2013-08-07 12:21:11 +0000
committerNatanael Copa <ncopa@alpinelinux.org>2013-08-07 12:24:10 +0000
commit844b74d92a894847d6c48a9ffd34f26e6f552051 (patch)
tree1e9a3ebbf028394f374117f30d228d252c7fe95b
parentf0b476449f4f3d020cd0217348604352264c9d6c (diff)
downloadalpine_aports-844b74d92a894847d6c48a9ffd34f26e6f552051.tar.bz2
alpine_aports-844b74d92a894847d6c48a9ffd34f26e6f552051.tar.xz
alpine_aports-844b74d92a894847d6c48a9ffd34f26e6f552051.zip
main/tiff: sec fixes (CVE-2012-4447,CVE-2012-4564,CVE-2013-1960,CVE-2013-1961)
ref #2203 fixes #2205
Diffstat
-rw-r--r--main/tiff/APKBUILD22
-rw-r--r--main/tiff/libtiff-CVE-2012-4447.patch40
-rw-r--r--main/tiff/libtiff-CVE-2012-4564.patch86
-rw-r--r--main/tiff/libtiff-CVE-2013-1960.patch145
-rw-r--r--main/tiff/libtiff-CVE-2013-1961.patch759
5 files changed, 1050 insertions, 2 deletions
diff --git a/main/tiff/APKBUILD b/main/tiff/APKBUILD
index 2bfdb997a8..bf8afcc82a 100644
--- a/main/tiff/APKBUILD
+++ b/main/tiff/APKBUILD
@@ -2,7 +2,7 @@
2# Maintainer: Michael Mason <ms13sp@gmail.com> 2# Maintainer: Michael Mason <ms13sp@gmail.com>
3pkgname=tiff 3pkgname=tiff
4pkgver=4.0.3 4pkgver=4.0.3
5pkgrel=0 5pkgrel=1
6pkgdesc="Provides support for the Tag Image File Format or TIFF" 6pkgdesc="Provides support for the Tag Image File Format or TIFF"
7url="http://www.libtiff.org/" 7url="http://www.libtiff.org/"
8arch="all" 8arch="all"
@@ -12,6 +12,10 @@ depends_dev="zlib-dev libjpeg-turbo-dev"
12makedepends="libtool autoconf automake $depends_dev" 12makedepends="libtool autoconf automake $depends_dev"
13subpackages="$pkgname-doc $pkgname-dev $pkgname-tools" 13subpackages="$pkgname-doc $pkgname-dev $pkgname-tools"
14source="ftp://ftp.remotesensing.org/pub/libtiff/$pkgname-$pkgver.tar.gz 14source="ftp://ftp.remotesensing.org/pub/libtiff/$pkgname-$pkgver.tar.gz
15 libtiff-CVE-2012-4447.patch
16 libtiff-CVE-2012-4564.patch
17 libtiff-CVE-2013-1960.patch
18 libtiff-CVE-2013-1961.patch
15 " 19 "
16 20
17_builddir="$srcdir"/$pkgname-$pkgver 21_builddir="$srcdir"/$pkgname-$pkgver
@@ -50,4 +54,18 @@ tools() {
50 mv "$pkgdir"/usr/bin "$subpkgdir"/usr/ 54 mv "$pkgdir"/usr/bin "$subpkgdir"/usr/
51} 55}
52 56
53md5sums="051c1068e6a0627f461948c365290410 tiff-4.0.3.tar.gz" 57md5sums="051c1068e6a0627f461948c365290410 tiff-4.0.3.tar.gz
5871bbe3b51f8a4e3a26cbf0af63588e4a libtiff-CVE-2012-4447.patch
59a4b9f293f706b5668df62833cf0b56d2 libtiff-CVE-2012-4564.patch
60e9de577a81571ab8ffac84aac8c64381 libtiff-CVE-2013-1960.patch
61e484981da6d2366a30a89dc0217c115a libtiff-CVE-2013-1961.patch"
62sha256sums="ea1aebe282319537fb2d4d7805f478dd4e0e05c33d0928baba76a7c963684872 tiff-4.0.3.tar.gz
63917187494cd3f80929e4919951637683aaccd98ffa23a6f1f97e49f6db85baa9 libtiff-CVE-2012-4447.patch
640ef1f4055930c8b38246a4f6ed66e393bb2f2a3d5238f5c5f5d57d1f4b230d3e libtiff-CVE-2012-4564.patch
65688e577d3266b1cd7df5321b5e63fed82d088407a447a022eea2188d643b5a5b libtiff-CVE-2013-1960.patch
662f0a1cf4826416d248ff5288db7702b80245d02c624c415836053a762c1e3fd4 libtiff-CVE-2013-1961.patch"
67sha512sums="d80e18b00e9e696a30b954c0d92e5f2f773fd9a7a0a944cf6cabb69c1798e671506580daa1cd2ebf493ae922000170c2491dfc6d4c0a9cd0b865684070595a73 tiff-4.0.3.tar.gz
681377b675cfbeffbe810518053fb2e683f889cf1274d0b1adc6060beb9ef70dcd504038b02d569d08bf497511b99ea9c237e581b4a66676d0a69370b78c98736b libtiff-CVE-2012-4447.patch
69d8e9ffaefd9ce9f38c117faa6368fd858422b870d1afa3e9ce7b05218f35c29a84e23a1da00879aedade4c1d1d578c06be08aa51ed4e2e7d2a3ca819614be8e8 libtiff-CVE-2012-4564.patch
70db160c93453db8f4b611028bca48622eebfa54b320b780b7491bdc9c3385d227928a7e9016073a64cdd85388284aa2bb0f0af04daa235d45cdb28e4e6fcf82fa libtiff-CVE-2013-1960.patch
71c9870c7b85d2a3c666e2c9f932c815a1b4c9fb0bf2485c7cfff3ab3435222214fa7900adc0ded0f49866f28db2124121012bac7186b675955613fa983dbf45d7 libtiff-CVE-2013-1961.patch"
diff --git a/main/tiff/libtiff-CVE-2012-4447.patch b/main/tiff/libtiff-CVE-2012-4447.patch
new file mode 100644
index 0000000000..ebf9a00e1b
--- /dev/null
+++ b/main/tiff/libtiff-CVE-2012-4447.patch
@@ -0,0 +1,40 @@
1Upstream patch for CVE-2012-4447.
2
3
4diff -Naur tiff-4.0.3.orig/libtiff/tif_pixarlog.c tiff-4.0.3/libtiff/tif_pixarlog.c
5--- tiff-4.0.3.orig/libtiff/tif_pixarlog.c 2012-07-04 15:26:31.000000000 -0400
6+++ tiff-4.0.3/libtiff/tif_pixarlog.c 2012-12-12 16:43:18.931315699 -0500
7@@ -644,6 +644,20 @@
8 return bytes;
9 }
10
11+static tmsize_t
12+add_ms(tmsize_t m1, tmsize_t m2)
13+{
14+ tmsize_t bytes = m1 + m2;
15+
16+ /* if either input is zero, assume overflow already occurred */
17+ if (m1 == 0 || m2 == 0)
18+ bytes = 0;
19+ else if (bytes <= m1 || bytes <= m2)
20+ bytes = 0;
21+
22+ return bytes;
23+}
24+
25 static int
26 PixarLogFixupTags(TIFF* tif)
27 {
28@@ -671,9 +685,11 @@
29 td->td_samplesperpixel : 1);
30 tbuf_size = multiply_ms(multiply_ms(multiply_ms(sp->stride, td->td_imagewidth),
31 td->td_rowsperstrip), sizeof(uint16));
32+ /* add one more stride in case input ends mid-stride */
33+ tbuf_size = add_ms(tbuf_size, sizeof(uint16) * sp->stride);
34 if (tbuf_size == 0)
35 return (0); /* TODO: this is an error return without error report through TIFFErrorExt */
36- sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size+sizeof(uint16)*sp->stride);
37+ sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size);
38 if (sp->tbuf == NULL)
39 return (0);
40 if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN)
diff --git a/main/tiff/libtiff-CVE-2012-4564.patch b/main/tiff/libtiff-CVE-2012-4564.patch
new file mode 100644
index 0000000000..3d7946c7ec
--- /dev/null
+++ b/main/tiff/libtiff-CVE-2012-4564.patch
@@ -0,0 +1,86 @@
1Upstream patch for CVE-2012-4564.
2
3
4diff -Naur tiff-4.0.3.orig/tools/ppm2tiff.c tiff-4.0.3/tools/ppm2tiff.c
5--- tiff-4.0.3.orig/tools/ppm2tiff.c 2010-04-10 15:22:34.000000000 -0400
6+++ tiff-4.0.3/tools/ppm2tiff.c 2012-12-12 16:43:18.932315708 -0500
7@@ -72,6 +72,17 @@
8 exit(-2);
9 }
10
11+static tmsize_t
12+multiply_ms(tmsize_t m1, tmsize_t m2)
13+{
14+ tmsize_t bytes = m1 * m2;
15+
16+ if (m1 && bytes / m1 != m2)
17+ bytes = 0;
18+
19+ return bytes;
20+}
21+
22 int
23 main(int argc, char* argv[])
24 {
25@@ -79,7 +90,7 @@
26 uint32 rowsperstrip = (uint32) -1;
27 double resolution = -1;
28 unsigned char *buf = NULL;
29- tsize_t linebytes = 0;
30+ tmsize_t linebytes = 0;
31 uint16 spp = 1;
32 uint16 bpp = 8;
33 TIFF *out;
34@@ -89,6 +100,7 @@
35 int c;
36 extern int optind;
37 extern char* optarg;
38+ tmsize_t scanline_size;
39
40 if (argc < 2) {
41 fprintf(stderr, "%s: Too few arguments\n", argv[0]);
42@@ -221,7 +233,8 @@
43 }
44 switch (bpp) {
45 case 1:
46- linebytes = (spp * w + (8 - 1)) / 8;
47+ /* if round-up overflows, result will be zero, OK */
48+ linebytes = (multiply_ms(spp, w) + (8 - 1)) / 8;
49 if (rowsperstrip == (uint32) -1) {
50 TIFFSetField(out, TIFFTAG_ROWSPERSTRIP, h);
51 } else {
52@@ -230,15 +243,31 @@
53 }
54 break;
55 case 8:
56- linebytes = spp * w;
57+ linebytes = multiply_ms(spp, w);
58 TIFFSetField(out, TIFFTAG_ROWSPERSTRIP,
59 TIFFDefaultStripSize(out, rowsperstrip));
60 break;
61 }
62- if (TIFFScanlineSize(out) > linebytes)
63+ if (linebytes == 0) {
64+ fprintf(stderr, "%s: scanline size overflow\n", infile);
65+ (void) TIFFClose(out);
66+ exit(-2);
67+ }
68+ scanline_size = TIFFScanlineSize(out);
69+ if (scanline_size == 0) {
70+ /* overflow - TIFFScanlineSize already printed a message */
71+ (void) TIFFClose(out);
72+ exit(-2);
73+ }
74+ if (scanline_size < linebytes)
75 buf = (unsigned char *)_TIFFmalloc(linebytes);
76 else
77- buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
78+ buf = (unsigned char *)_TIFFmalloc(scanline_size);
79+ if (buf == NULL) {
80+ fprintf(stderr, "%s: Not enough memory\n", infile);
81+ (void) TIFFClose(out);
82+ exit(-2);
83+ }
84 if (resolution > 0) {
85 TIFFSetField(out, TIFFTAG_XRESOLUTION, resolution);
86 TIFFSetField(out, TIFFTAG_YRESOLUTION, resolution);
diff --git a/main/tiff/libtiff-CVE-2013-1960.patch b/main/tiff/libtiff-CVE-2013-1960.patch
new file mode 100644
index 0000000000..1c8dfb7bc6
--- /dev/null
+++ b/main/tiff/libtiff-CVE-2013-1960.patch
@@ -0,0 +1,145 @@
1diff -Naur tiff-4.0.3.orig/tools/tiff2pdf.c tiff-4.0.3/tools/tiff2pdf.c
2--- tiff-4.0.3.orig/tools/tiff2pdf.c 2012-07-25 22:56:43.000000000 -0400
3+++ tiff-4.0.3/tools/tiff2pdf.c 2013-05-02 12:04:49.057090227 -0400
4@@ -3341,33 +3341,56 @@
5 uint32 height){
6
7 tsize_t i=0;
8- uint16 ri =0;
9- uint16 v_samp=1;
10- uint16 h_samp=1;
11- int j=0;
12-
13- i++;
14-
15- while(i<(*striplength)){
16+
17+ while (i < *striplength) {
18+ tsize_t datalen;
19+ uint16 ri;
20+ uint16 v_samp;
21+ uint16 h_samp;
22+ int j;
23+ int ncomp;
24+
25+ /* marker header: one or more FFs */
26+ if (strip[i] != 0xff)
27+ return(0);
28+ i++;
29+ while (i < *striplength && strip[i] == 0xff)
30+ i++;
31+ if (i >= *striplength)
32+ return(0);
33+ /* SOI is the only pre-SOS marker without a length word */
34+ if (strip[i] == 0xd8)
35+ datalen = 0;
36+ else {
37+ if ((*striplength - i) <= 2)
38+ return(0);
39+ datalen = (strip[i+1] << 8) | strip[i+2];
40+ if (datalen < 2 || datalen >= (*striplength - i))
41+ return(0);
42+ }
43 switch( strip[i] ){
44- case 0xd8:
45- /* SOI - start of image */
46+ case 0xd8: /* SOI - start of image */
47 _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), 2);
48 *bufferoffset+=2;
49- i+=2;
50 break;
51- case 0xc0:
52- case 0xc1:
53- case 0xc3:
54- case 0xc9:
55- case 0xca:
56+ case 0xc0: /* SOF0 */
57+ case 0xc1: /* SOF1 */
58+ case 0xc3: /* SOF3 */
59+ case 0xc9: /* SOF9 */
60+ case 0xca: /* SOF10 */
61 if(no==0){
62- _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
63- for(j=0;j<buffer[*bufferoffset+9];j++){
64- if( (buffer[*bufferoffset+11+(2*j)]>>4) > h_samp)
65- h_samp = (buffer[*bufferoffset+11+(2*j)]>>4);
66- if( (buffer[*bufferoffset+11+(2*j)] & 0x0f) > v_samp)
67- v_samp = (buffer[*bufferoffset+11+(2*j)] & 0x0f);
68+ _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
69+ ncomp = buffer[*bufferoffset+9];
70+ if (ncomp < 1 || ncomp > 4)
71+ return(0);
72+ v_samp=1;
73+ h_samp=1;
74+ for(j=0;j<ncomp;j++){
75+ uint16 samp = buffer[*bufferoffset+11+(3*j)];
76+ if( (samp>>4) > h_samp)
77+ h_samp = (samp>>4);
78+ if( (samp & 0x0f) > v_samp)
79+ v_samp = (samp & 0x0f);
80 }
81 v_samp*=8;
82 h_samp*=8;
83@@ -3381,45 +3404,43 @@
84 (unsigned char) ((height>>8) & 0xff);
85 buffer[*bufferoffset+6]=
86 (unsigned char) (height & 0xff);
87- *bufferoffset+=strip[i+2]+2;
88- i+=strip[i+2]+2;
89-
90+ *bufferoffset+=datalen+2;
91+ /* insert a DRI marker */
92 buffer[(*bufferoffset)++]=0xff;
93 buffer[(*bufferoffset)++]=0xdd;
94 buffer[(*bufferoffset)++]=0x00;
95 buffer[(*bufferoffset)++]=0x04;
96 buffer[(*bufferoffset)++]=(ri >> 8) & 0xff;
97 buffer[(*bufferoffset)++]= ri & 0xff;
98- } else {
99- i+=strip[i+2]+2;
100 }
101 break;
102- case 0xc4:
103- case 0xdb:
104- _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
105- *bufferoffset+=strip[i+2]+2;
106- i+=strip[i+2]+2;
107+ case 0xc4: /* DHT */
108+ case 0xdb: /* DQT */
109+ _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
110+ *bufferoffset+=datalen+2;
111 break;
112- case 0xda:
113+ case 0xda: /* SOS */
114 if(no==0){
115- _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
116- *bufferoffset+=strip[i+2]+2;
117- i+=strip[i+2]+2;
118+ _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
119+ *bufferoffset+=datalen+2;
120 } else {
121 buffer[(*bufferoffset)++]=0xff;
122 buffer[(*bufferoffset)++]=
123 (unsigned char)(0xd0 | ((no-1)%8));
124- i+=strip[i+2]+2;
125 }
126- _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), (*striplength)-i-1);
127- *bufferoffset+=(*striplength)-i-1;
128+ i += datalen + 1;
129+ /* copy remainder of strip */
130+ _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i]), *striplength - i);
131+ *bufferoffset+= *striplength - i;
132 return(1);
133 default:
134- i+=strip[i+2]+2;
135+ /* ignore any other marker */
136+ break;
137 }
138+ i += datalen + 1;
139 }
140-
141
142+ /* failed to find SOS marker */
143 return(0);
144 }
145 #endif
diff --git a/main/tiff/libtiff-CVE-2013-1961.patch b/main/tiff/libtiff-CVE-2013-1961.patch
new file mode 100644
index 0000000000..0ea9b52e3f
--- /dev/null
+++ b/main/tiff/libtiff-CVE-2013-1961.patch
@@ -0,0 +1,759 @@
1diff -Naur tiff-4.0.3.orig/contrib/dbs/xtiff/xtiff.c tiff-4.0.3/contrib/dbs/xtiff/xtiff.c
2--- tiff-4.0.3.orig/contrib/dbs/xtiff/xtiff.c 2010-06-08 14:55:15.000000000 -0400
3+++ tiff-4.0.3/contrib/dbs/xtiff/xtiff.c 2013-05-02 12:02:42.782287939 -0400
4@@ -512,9 +512,9 @@
5 Arg args[1];
6
7 if (tfMultiPage)
8- sprintf(buffer, "%s - page %d", fileName, tfDirectory);
9+ snprintf(buffer, sizeof(buffer), "%s - page %d", fileName, tfDirectory);
10 else
11- strcpy(buffer, fileName);
12+ snprintf(buffer, sizeof(buffer), "%s", fileName);
13 XtSetArg(args[0], XtNlabel, buffer);
14 XtSetValues(labelWidget, args, 1);
15 }
16diff -Naur tiff-4.0.3.orig/libtiff/tif_codec.c tiff-4.0.3/libtiff/tif_codec.c
17--- tiff-4.0.3.orig/libtiff/tif_codec.c 2010-12-14 09:18:28.000000000 -0500
18+++ tiff-4.0.3/libtiff/tif_codec.c 2013-05-02 12:02:42.783287946 -0400
19@@ -108,7 +108,8 @@
20 const TIFFCodec* c = TIFFFindCODEC(tif->tif_dir.td_compression);
21 char compression_code[20];
22
23- sprintf( compression_code, "%d", tif->tif_dir.td_compression );
24+ snprintf(compression_code, sizeof(compression_code), "%d",
25+ tif->tif_dir.td_compression );
26 TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
27 "%s compression support is not configured",
28 c ? c->name : compression_code );
29diff -Naur tiff-4.0.3.orig/libtiff/tif_dirinfo.c tiff-4.0.3/libtiff/tif_dirinfo.c
30--- tiff-4.0.3.orig/libtiff/tif_dirinfo.c 2012-08-19 12:56:34.000000000 -0400
31+++ tiff-4.0.3/libtiff/tif_dirinfo.c 2013-05-02 12:02:42.784287953 -0400
32@@ -711,7 +711,7 @@
33 * note that this name is a special sign to TIFFClose() and
34 * _TIFFSetupFields() to free the field
35 */
36- sprintf(fld->field_name, "Tag %d", (int) tag);
37+ snprintf(fld->field_name, 32, "Tag %d", (int) tag);
38
39 return fld;
40 }
41diff -Naur tiff-4.0.3.orig/tools/rgb2ycbcr.c tiff-4.0.3/tools/rgb2ycbcr.c
42--- tiff-4.0.3.orig/tools/rgb2ycbcr.c 2011-05-31 13:03:16.000000000 -0400
43+++ tiff-4.0.3/tools/rgb2ycbcr.c 2013-05-02 12:02:42.785287961 -0400
44@@ -332,7 +332,8 @@
45 TIFFSetField(out, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG);
46 { char buf[2048];
47 char *cp = strrchr(TIFFFileName(in), '/');
48- sprintf(buf, "YCbCr conversion of %s", cp ? cp+1 : TIFFFileName(in));
49+ snprintf(buf, sizeof(buf), "YCbCr conversion of %s",
50+ cp ? cp+1 : TIFFFileName(in));
51 TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, buf);
52 }
53 TIFFSetField(out, TIFFTAG_SOFTWARE, TIFFGetVersion());
54diff -Naur tiff-4.0.3.orig/tools/tiff2bw.c tiff-4.0.3/tools/tiff2bw.c
55--- tiff-4.0.3.orig/tools/tiff2bw.c 2010-07-08 12:10:24.000000000 -0400
56+++ tiff-4.0.3/tools/tiff2bw.c 2013-05-02 12:02:42.785287961 -0400
57@@ -205,7 +205,7 @@
58 }
59 }
60 TIFFSetField(out, TIFFTAG_PHOTOMETRIC, PHOTOMETRIC_MINISBLACK);
61- sprintf(thing, "B&W version of %s", argv[optind]);
62+ snprintf(thing, sizeof(thing), "B&W version of %s", argv[optind]);
63 TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, thing);
64 TIFFSetField(out, TIFFTAG_SOFTWARE, "tiff2bw");
65 outbuf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
66diff -Naur tiff-4.0.3.orig/tools/tiff2pdf.c tiff-4.0.3/tools/tiff2pdf.c
67--- tiff-4.0.3.orig/tools/tiff2pdf.c 2012-07-25 22:56:43.000000000 -0400
68+++ tiff-4.0.3/tools/tiff2pdf.c 2013-05-02 12:02:42.788287983 -0400
69@@ -3609,7 +3609,9 @@
70 char buffer[16];
71 int buflen=0;
72
73- buflen=sprintf(buffer, "%%PDF-%u.%u ", t2p->pdf_majorversion&0xff, t2p->pdf_minorversion&0xff);
74+ buflen = snprintf(buffer, sizeof(buffer), "%%PDF-%u.%u ",
75+ t2p->pdf_majorversion&0xff,
76+ t2p->pdf_minorversion&0xff);
77 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
78 written += t2pWriteFile(output, (tdata_t)"\n%\342\343\317\323\n", 7);
79
80@@ -3623,10 +3625,10 @@
81 tsize_t t2p_write_pdf_obj_start(uint32 number, TIFF* output){
82
83 tsize_t written=0;
84- char buffer[16];
85+ char buffer[32];
86 int buflen=0;
87
88- buflen=sprintf(buffer, "%lu", (unsigned long)number);
89+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)number);
90 written += t2pWriteFile(output, (tdata_t) buffer, buflen );
91 written += t2pWriteFile(output, (tdata_t) " 0 obj\n", 7);
92
93@@ -3665,13 +3667,13 @@
94 written += t2pWriteFile(output, (tdata_t) "/", 1);
95 for (i=0;i<namelen;i++){
96 if ( ((unsigned char)name[i]) < 0x21){
97- sprintf(buffer, "#%.2X", name[i]);
98+ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
99 buffer[sizeof(buffer) - 1] = '\0';
100 written += t2pWriteFile(output, (tdata_t) buffer, 3);
101 nextchar=1;
102 }
103 if ( ((unsigned char)name[i]) > 0x7E){
104- sprintf(buffer, "#%.2X", name[i]);
105+ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
106 buffer[sizeof(buffer) - 1] = '\0';
107 written += t2pWriteFile(output, (tdata_t) buffer, 3);
108 nextchar=1;
109@@ -3679,57 +3681,57 @@
110 if (nextchar==0){
111 switch (name[i]){
112 case 0x23:
113- sprintf(buffer, "#%.2X", name[i]);
114+ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
115 buffer[sizeof(buffer) - 1] = '\0';
116 written += t2pWriteFile(output, (tdata_t) buffer, 3);
117 break;
118 case 0x25:
119- sprintf(buffer, "#%.2X", name[i]);
120+ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
121 buffer[sizeof(buffer) - 1] = '\0';
122 written += t2pWriteFile(output, (tdata_t) buffer, 3);
123 break;
124 case 0x28:
125- sprintf(buffer, "#%.2X", name[i]);
126+ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
127 buffer[sizeof(buffer) - 1] = '\0';
128 written += t2pWriteFile(output, (tdata_t) buffer, 3);
129 break;
130 case 0x29:
131- sprintf(buffer, "#%.2X", name[i]);
132+ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
133 buffer[sizeof(buffer) - 1] = '\0';
134 written += t2pWriteFile(output, (tdata_t) buffer, 3);
135 break;
136 case 0x2F:
137- sprintf(buffer, "#%.2X", name[i]);
138+ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
139 buffer[sizeof(buffer) - 1] = '\0';
140 written += t2pWriteFile(output, (tdata_t) buffer, 3);
141 break;
142 case 0x3C:
143- sprintf(buffer, "#%.2X", name[i]);
144+ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
145 buffer[sizeof(buffer) - 1] = '\0';
146 written += t2pWriteFile(output, (tdata_t) buffer, 3);
147 break;
148 case 0x3E:
149- sprintf(buffer, "#%.2X", name[i]);
150+ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
151 buffer[sizeof(buffer) - 1] = '\0';
152 written += t2pWriteFile(output, (tdata_t) buffer, 3);
153 break;
154 case 0x5B:
155- sprintf(buffer, "#%.2X", name[i]);
156+ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
157 buffer[sizeof(buffer) - 1] = '\0';
158 written += t2pWriteFile(output, (tdata_t) buffer, 3);
159 break;
160 case 0x5D:
161- sprintf(buffer, "#%.2X", name[i]);
162+ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
163 buffer[sizeof(buffer) - 1] = '\0';
164 written += t2pWriteFile(output, (tdata_t) buffer, 3);
165 break;
166 case 0x7B:
167- sprintf(buffer, "#%.2X", name[i]);
168+ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
169 buffer[sizeof(buffer) - 1] = '\0';
170 written += t2pWriteFile(output, (tdata_t) buffer, 3);
171 break;
172 case 0x7D:
173- sprintf(buffer, "#%.2X", name[i]);
174+ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
175 buffer[sizeof(buffer) - 1] = '\0';
176 written += t2pWriteFile(output, (tdata_t) buffer, 3);
177 break;
178@@ -3844,14 +3846,14 @@
179 tsize_t t2p_write_pdf_stream_dict(tsize_t len, uint32 number, TIFF* output){
180
181 tsize_t written=0;
182- char buffer[16];
183+ char buffer[32];
184 int buflen=0;
185
186 written += t2pWriteFile(output, (tdata_t) "/Length ", 8);
187 if(len!=0){
188 written += t2p_write_pdf_stream_length(len, output);
189 } else {
190- buflen=sprintf(buffer, "%lu", (unsigned long)number);
191+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)number);
192 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
193 written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6);
194 }
195@@ -3892,10 +3894,10 @@
196 tsize_t t2p_write_pdf_stream_length(tsize_t len, TIFF* output){
197
198 tsize_t written=0;
199- char buffer[16];
200+ char buffer[32];
201 int buflen=0;
202
203- buflen=sprintf(buffer, "%lu", (unsigned long)len);
204+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)len);
205 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
206 written += t2pWriteFile(output, (tdata_t) "\n", 1);
207
208@@ -3909,7 +3911,7 @@
209 tsize_t t2p_write_pdf_catalog(T2P* t2p, TIFF* output)
210 {
211 tsize_t written = 0;
212- char buffer[16];
213+ char buffer[32];
214 int buflen = 0;
215
216 written += t2pWriteFile(output,
217@@ -3948,7 +3950,6 @@
218 written += t2p_write_pdf_string(t2p->pdf_datetime, output);
219 }
220 written += t2pWriteFile(output, (tdata_t) "\n/Producer ", 11);
221- _TIFFmemset((tdata_t)buffer, 0x00, sizeof(buffer));
222 snprintf(buffer, sizeof(buffer), "libtiff / tiff2pdf - %d", TIFFLIB_VERSION);
223 written += t2p_write_pdf_string(buffer, output);
224 written += t2pWriteFile(output, (tdata_t) "\n", 1);
225@@ -4089,7 +4090,7 @@
226 {
227 tsize_t written=0;
228 tdir_t i=0;
229- char buffer[16];
230+ char buffer[32];
231 int buflen=0;
232
233 int page=0;
234@@ -4097,7 +4098,7 @@
235 (tdata_t) "<< \n/Type /Pages \n/Kids [ ", 26);
236 page = t2p->pdf_pages+1;
237 for (i=0;i<t2p->tiff_pagecount;i++){
238- buflen=sprintf(buffer, "%d", page);
239+ buflen=snprintf(buffer, sizeof(buffer), "%d", page);
240 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
241 written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
242 if ( ((i+1)%8)==0 ) {
243@@ -4112,8 +4113,7 @@
244 }
245 }
246 written += t2pWriteFile(output, (tdata_t) "] \n/Count ", 10);
247- _TIFFmemset(buffer, 0x00, 16);
248- buflen=sprintf(buffer, "%d", t2p->tiff_pagecount);
249+ buflen=snprintf(buffer, sizeof(buffer), "%d", t2p->tiff_pagecount);
250 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
251 written += t2pWriteFile(output, (tdata_t) " \n>> \n", 6);
252
253@@ -4128,28 +4128,28 @@
254
255 unsigned int i=0;
256 tsize_t written=0;
257- char buffer[16];
258+ char buffer[256];
259 int buflen=0;
260
261 written += t2pWriteFile(output, (tdata_t) "<<\n/Type /Page \n/Parent ", 24);
262- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_pages);
263+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_pages);
264 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
265 written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6);
266 written += t2pWriteFile(output, (tdata_t) "/MediaBox [", 11);
267- buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.x1);
268+ buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.x1);
269 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
270 written += t2pWriteFile(output, (tdata_t) " ", 1);
271- buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.y1);
272+ buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.y1);
273 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
274 written += t2pWriteFile(output, (tdata_t) " ", 1);
275- buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.x2);
276+ buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.x2);
277 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
278 written += t2pWriteFile(output, (tdata_t) " ", 1);
279- buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.y2);
280+ buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.y2);
281 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
282 written += t2pWriteFile(output, (tdata_t) "] \n", 3);
283 written += t2pWriteFile(output, (tdata_t) "/Contents ", 10);
284- buflen=sprintf(buffer, "%lu", (unsigned long)(object + 1));
285+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(object + 1));
286 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
287 written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6);
288 written += t2pWriteFile(output, (tdata_t) "/Resources << \n", 15);
289@@ -4157,15 +4157,13 @@
290 written += t2pWriteFile(output, (tdata_t) "/XObject <<\n", 12);
291 for(i=0;i<t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount;i++){
292 written += t2pWriteFile(output, (tdata_t) "/Im", 3);
293- buflen = sprintf(buffer, "%u", t2p->pdf_page+1);
294+ buflen = snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1);
295 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
296 written += t2pWriteFile(output, (tdata_t) "_", 1);
297- buflen = sprintf(buffer, "%u", i+1);
298+ buflen = snprintf(buffer, sizeof(buffer), "%u", i+1);
299 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
300 written += t2pWriteFile(output, (tdata_t) " ", 1);
301- buflen = sprintf(
302- buffer,
303- "%lu",
304+ buflen = snprintf(buffer, sizeof(buffer), "%lu",
305 (unsigned long)(object+3+(2*i)+t2p->tiff_pages[t2p->pdf_page].page_extra));
306 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
307 written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
308@@ -4177,12 +4175,10 @@
309 } else {
310 written += t2pWriteFile(output, (tdata_t) "/XObject <<\n", 12);
311 written += t2pWriteFile(output, (tdata_t) "/Im", 3);
312- buflen = sprintf(buffer, "%u", t2p->pdf_page+1);
313+ buflen = snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1);
314 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
315 written += t2pWriteFile(output, (tdata_t) " ", 1);
316- buflen = sprintf(
317- buffer,
318- "%lu",
319+ buflen = snprintf(buffer, sizeof(buffer), "%lu",
320 (unsigned long)(object+3+(2*i)+t2p->tiff_pages[t2p->pdf_page].page_extra));
321 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
322 written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
323@@ -4191,9 +4187,7 @@
324 if(t2p->tiff_transferfunctioncount != 0) {
325 written += t2pWriteFile(output, (tdata_t) "/ExtGState <<", 13);
326 t2pWriteFile(output, (tdata_t) "/GS1 ", 5);
327- buflen = sprintf(
328- buffer,
329- "%lu",
330+ buflen = snprintf(buffer, sizeof(buffer), "%lu",
331 (unsigned long)(object + 3));
332 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
333 written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
334@@ -4566,7 +4560,7 @@
335 if(t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount>0){
336 for(i=0;i<t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount; i++){
337 box=t2p->tiff_tiles[t2p->pdf_page].tiles_tiles[i].tile_box;
338- buflen=sprintf(buffer,
339+ buflen=snprintf(buffer, sizeof(buffer),
340 "q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d_%ld Do Q\n",
341 t2p->tiff_transferfunctioncount?"/GS1 gs ":"",
342 box.mat[0],
343@@ -4581,7 +4575,7 @@
344 }
345 } else {
346 box=t2p->pdf_imagebox;
347- buflen=sprintf(buffer,
348+ buflen=snprintf(buffer, sizeof(buffer),
349 "q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d Do Q\n",
350 t2p->tiff_transferfunctioncount?"/GS1 gs ":"",
351 box.mat[0],
352@@ -4606,59 +4600,48 @@
353 TIFF* output){
354
355 tsize_t written=0;
356- char buffer[16];
357+ char buffer[32];
358 int buflen=0;
359
360 written += t2p_write_pdf_stream_dict(0, t2p->pdf_xrefcount+1, output);
361 written += t2pWriteFile(output,
362 (tdata_t) "/Type /XObject \n/Subtype /Image \n/Name /Im",
363 42);
364- buflen=sprintf(buffer, "%u", t2p->pdf_page+1);
365+ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1);
366 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
367 if(tile != 0){
368 written += t2pWriteFile(output, (tdata_t) "_", 1);
369- buflen=sprintf(buffer, "%lu", (unsigned long)tile);
370+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)tile);
371 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
372 }
373 written += t2pWriteFile(output, (tdata_t) "\n/Width ", 8);
374- _TIFFmemset((tdata_t)buffer, 0x00, 16);
375 if(tile==0){
376- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->tiff_width);
377+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->tiff_width);
378 } else {
379 if(t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)!=0){
380- buflen=sprintf(
381- buffer,
382- "%lu",
383+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
384 (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilewidth);
385 } else {
386- buflen=sprintf(
387- buffer,
388- "%lu",
389+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
390 (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilewidth);
391 }
392 }
393 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
394 written += t2pWriteFile(output, (tdata_t) "\n/Height ", 9);
395- _TIFFmemset((tdata_t)buffer, 0x00, 16);
396 if(tile==0){
397- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->tiff_length);
398+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->tiff_length);
399 } else {
400 if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)!=0){
401- buflen=sprintf(
402- buffer,
403- "%lu",
404+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
405 (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilelength);
406 } else {
407- buflen=sprintf(
408- buffer,
409- "%lu",
410+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
411 (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilelength);
412 }
413 }
414 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
415 written += t2pWriteFile(output, (tdata_t) "\n/BitsPerComponent ", 19);
416- _TIFFmemset((tdata_t)buffer, 0x00, 16);
417- buflen=sprintf(buffer, "%u", t2p->tiff_bitspersample);
418+ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_bitspersample);
419 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
420 written += t2pWriteFile(output, (tdata_t) "\n/ColorSpace ", 13);
421 written += t2p_write_pdf_xobject_cs(t2p, output);
422@@ -4702,11 +4685,10 @@
423 t2p->pdf_colorspace ^= T2P_CS_PALETTE;
424 written += t2p_write_pdf_xobject_cs(t2p, output);
425 t2p->pdf_colorspace |= T2P_CS_PALETTE;
426- buflen=sprintf(buffer, "%u", (0x0001 << t2p->tiff_bitspersample)-1 );
427+ buflen=snprintf(buffer, sizeof(buffer), "%u", (0x0001 << t2p->tiff_bitspersample)-1 );
428 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
429 written += t2pWriteFile(output, (tdata_t) " ", 1);
430- _TIFFmemset(buffer, 0x00, 16);
431- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_palettecs );
432+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_palettecs );
433 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
434 written += t2pWriteFile(output, (tdata_t) " 0 R ]\n", 7);
435 return(written);
436@@ -4740,10 +4722,10 @@
437 X_W /= Y_W;
438 Z_W /= Y_W;
439 Y_W = 1.0F;
440- buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
441+ buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
442 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
443 written += t2pWriteFile(output, (tdata_t) "/Range ", 7);
444- buflen=sprintf(buffer, "[%d %d %d %d] \n",
445+ buflen=snprintf(buffer, sizeof(buffer), "[%d %d %d %d] \n",
446 t2p->pdf_labrange[0],
447 t2p->pdf_labrange[1],
448 t2p->pdf_labrange[2],
449@@ -4759,26 +4741,26 @@
450 tsize_t t2p_write_pdf_transfer(T2P* t2p, TIFF* output){
451
452 tsize_t written=0;
453- char buffer[16];
454+ char buffer[32];
455 int buflen=0;
456
457 written += t2pWriteFile(output, (tdata_t) "<< /Type /ExtGState \n/TR ", 25);
458 if(t2p->tiff_transferfunctioncount == 1){
459- buflen=sprintf(buffer, "%lu",
460+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
461 (unsigned long)(t2p->pdf_xrefcount + 1));
462 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
463 written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
464 } else {
465 written += t2pWriteFile(output, (tdata_t) "[ ", 2);
466- buflen=sprintf(buffer, "%lu",
467+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
468 (unsigned long)(t2p->pdf_xrefcount + 1));
469 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
470 written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
471- buflen=sprintf(buffer, "%lu",
472+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
473 (unsigned long)(t2p->pdf_xrefcount + 2));
474 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
475 written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
476- buflen=sprintf(buffer, "%lu",
477+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
478 (unsigned long)(t2p->pdf_xrefcount + 3));
479 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
480 written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
481@@ -4800,7 +4782,7 @@
482 written += t2pWriteFile(output, (tdata_t) "/FunctionType 0 \n", 17);
483 written += t2pWriteFile(output, (tdata_t) "/Domain [0.0 1.0] \n", 19);
484 written += t2pWriteFile(output, (tdata_t) "/Range [0.0 1.0] \n", 18);
485- buflen=sprintf(buffer, "/Size [%u] \n", (1<<t2p->tiff_bitspersample));
486+ buflen=snprintf(buffer, sizeof(buffer), "/Size [%u] \n", (1<<t2p->tiff_bitspersample));
487 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
488 written += t2pWriteFile(output, (tdata_t) "/BitsPerSample 16 \n", 19);
489 written += t2p_write_pdf_stream_dict(((tsize_t)1)<<(t2p->tiff_bitspersample+1), 0, output);
490@@ -4827,7 +4809,7 @@
491 tsize_t t2p_write_pdf_xobject_calcs(T2P* t2p, TIFF* output){
492
493 tsize_t written=0;
494- char buffer[128];
495+ char buffer[256];
496 int buflen=0;
497
498 float X_W=0.0;
499@@ -4895,16 +4877,16 @@
500 written += t2pWriteFile(output, (tdata_t) "<< \n", 4);
501 if(t2p->pdf_colorspace & T2P_CS_CALGRAY){
502 written += t2pWriteFile(output, (tdata_t) "/WhitePoint ", 12);
503- buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
504+ buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
505 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
506 written += t2pWriteFile(output, (tdata_t) "/Gamma 2.2 \n", 12);
507 }
508 if(t2p->pdf_colorspace & T2P_CS_CALRGB){
509 written += t2pWriteFile(output, (tdata_t) "/WhitePoint ", 12);
510- buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
511+ buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
512 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
513 written += t2pWriteFile(output, (tdata_t) "/Matrix ", 8);
514- buflen=sprintf(buffer, "[%.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f] \n",
515+ buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f] \n",
516 X_R, Y_R, Z_R,
517 X_G, Y_G, Z_G,
518 X_B, Y_B, Z_B);
519@@ -4923,11 +4905,11 @@
520 tsize_t t2p_write_pdf_xobject_icccs(T2P* t2p, TIFF* output){
521
522 tsize_t written=0;
523- char buffer[16];
524+ char buffer[32];
525 int buflen=0;
526
527 written += t2pWriteFile(output, (tdata_t) "[/ICCBased ", 11);
528- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_icccs);
529+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_icccs);
530 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
531 written += t2pWriteFile(output, (tdata_t) " 0 R] \n", 7);
532
533@@ -4937,11 +4919,11 @@
534 tsize_t t2p_write_pdf_xobject_icccs_dict(T2P* t2p, TIFF* output){
535
536 tsize_t written=0;
537- char buffer[16];
538+ char buffer[32];
539 int buflen=0;
540
541 written += t2pWriteFile(output, (tdata_t) "/N ", 3);
542- buflen=sprintf(buffer, "%u \n", t2p->tiff_samplesperpixel);
543+ buflen=snprintf(buffer, sizeof(buffer), "%u \n", t2p->tiff_samplesperpixel);
544 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
545 written += t2pWriteFile(output, (tdata_t) "/Alternate ", 11);
546 t2p->pdf_colorspace ^= T2P_CS_ICCBASED;
547@@ -5006,7 +4988,7 @@
548 tsize_t t2p_write_pdf_xobject_stream_filter(ttile_t tile, T2P* t2p, TIFF* output){
549
550 tsize_t written=0;
551- char buffer[16];
552+ char buffer[32];
553 int buflen=0;
554
555 if(t2p->pdf_compression==T2P_COMPRESS_NONE){
556@@ -5021,41 +5003,33 @@
557 written += t2pWriteFile(output, (tdata_t) "<< /K -1 ", 9);
558 if(tile==0){
559 written += t2pWriteFile(output, (tdata_t) "/Columns ", 9);
560- buflen=sprintf(buffer, "%lu",
561+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
562 (unsigned long)t2p->tiff_width);
563 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
564 written += t2pWriteFile(output, (tdata_t) " /Rows ", 7);
565- buflen=sprintf(buffer, "%lu",
566+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
567 (unsigned long)t2p->tiff_length);
568 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
569 } else {
570 if(t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)==0){
571 written += t2pWriteFile(output, (tdata_t) "/Columns ", 9);
572- buflen=sprintf(
573- buffer,
574- "%lu",
575+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
576 (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilewidth);
577 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
578 } else {
579 written += t2pWriteFile(output, (tdata_t) "/Columns ", 9);
580- buflen=sprintf(
581- buffer,
582- "%lu",
583+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
584 (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilewidth);
585 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
586 }
587 if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)==0){
588 written += t2pWriteFile(output, (tdata_t) " /Rows ", 7);
589- buflen=sprintf(
590- buffer,
591- "%lu",
592+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
593 (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilelength);
594 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
595 } else {
596 written += t2pWriteFile(output, (tdata_t) " /Rows ", 7);
597- buflen=sprintf(
598- buffer,
599- "%lu",
600+ buflen=snprintf(buffer, sizeof(buffer), "%lu",
601 (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilelength);
602 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
603 }
604@@ -5082,21 +5056,17 @@
605 if(t2p->pdf_compressionquality%100){
606 written += t2pWriteFile(output, (tdata_t) "/DecodeParms ", 13);
607 written += t2pWriteFile(output, (tdata_t) "<< /Predictor ", 14);
608- _TIFFmemset(buffer, 0x00, 16);
609- buflen=sprintf(buffer, "%u", t2p->pdf_compressionquality%100);
610+ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_compressionquality%100);
611 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
612 written += t2pWriteFile(output, (tdata_t) " /Columns ", 10);
613- _TIFFmemset(buffer, 0x00, 16);
614- buflen = sprintf(buffer, "%lu",
615+ buflen = snprintf(buffer, sizeof(buffer), "%lu",
616 (unsigned long)t2p->tiff_width);
617 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
618 written += t2pWriteFile(output, (tdata_t) " /Colors ", 9);
619- _TIFFmemset(buffer, 0x00, 16);
620- buflen=sprintf(buffer, "%u", t2p->tiff_samplesperpixel);
621+ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_samplesperpixel);
622 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
623 written += t2pWriteFile(output, (tdata_t) " /BitsPerComponent ", 19);
624- _TIFFmemset(buffer, 0x00, 16);
625- buflen=sprintf(buffer, "%u", t2p->tiff_bitspersample);
626+ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_bitspersample);
627 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
628 written += t2pWriteFile(output, (tdata_t) ">>\n", 3);
629 }
630@@ -5116,16 +5086,16 @@
631 tsize_t t2p_write_pdf_xreftable(T2P* t2p, TIFF* output){
632
633 tsize_t written=0;
634- char buffer[21];
635+ char buffer[64];
636 int buflen=0;
637 uint32 i=0;
638
639 written += t2pWriteFile(output, (tdata_t) "xref\n0 ", 7);
640- buflen=sprintf(buffer, "%lu", (unsigned long)(t2p->pdf_xrefcount + 1));
641+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(t2p->pdf_xrefcount + 1));
642 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
643 written += t2pWriteFile(output, (tdata_t) " \n0000000000 65535 f \n", 22);
644 for (i=0;i<t2p->pdf_xrefcount;i++){
645- sprintf(buffer, "%.10lu 00000 n \n",
646+ snprintf(buffer, sizeof(buffer), "%.10lu 00000 n \n",
647 (unsigned long)t2p->pdf_xrefoffsets[i]);
648 written += t2pWriteFile(output, (tdata_t) buffer, 20);
649 }
650@@ -5149,17 +5119,14 @@
651 snprintf(t2p->pdf_fileid + i, 9, "%.8X", rand());
652
653 written += t2pWriteFile(output, (tdata_t) "trailer\n<<\n/Size ", 17);
654- buflen = sprintf(buffer, "%lu", (unsigned long)(t2p->pdf_xrefcount+1));
655+ buflen = snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(t2p->pdf_xrefcount+1));
656 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
657- _TIFFmemset(buffer, 0x00, 32);
658 written += t2pWriteFile(output, (tdata_t) "\n/Root ", 7);
659- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_catalog);
660+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_catalog);
661 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
662- _TIFFmemset(buffer, 0x00, 32);
663 written += t2pWriteFile(output, (tdata_t) " 0 R \n/Info ", 12);
664- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_info);
665+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_info);
666 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
667- _TIFFmemset(buffer, 0x00, 32);
668 written += t2pWriteFile(output, (tdata_t) " 0 R \n/ID[<", 11);
669 written += t2pWriteFile(output, (tdata_t) t2p->pdf_fileid,
670 sizeof(t2p->pdf_fileid) - 1);
671@@ -5167,9 +5134,8 @@
672 written += t2pWriteFile(output, (tdata_t) t2p->pdf_fileid,
673 sizeof(t2p->pdf_fileid) - 1);
674 written += t2pWriteFile(output, (tdata_t) ">]\n>>\nstartxref\n", 16);
675- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_startxref);
676+ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_startxref);
677 written += t2pWriteFile(output, (tdata_t) buffer, buflen);
678- _TIFFmemset(buffer, 0x00, 32);
679 written += t2pWriteFile(output, (tdata_t) "\n%%EOF\n", 7);
680
681 return(written);
682diff -Naur tiff-4.0.3.orig/tools/tiff2ps.c tiff-4.0.3/tools/tiff2ps.c
683--- tiff-4.0.3.orig/tools/tiff2ps.c 2011-05-31 13:10:18.000000000 -0400
684+++ tiff-4.0.3/tools/tiff2ps.c 2013-05-02 12:02:42.789287990 -0400
685@@ -1781,8 +1781,8 @@
686 imageOp = "imagemask";
687
688 (void)strcpy(im_x, "0");
689- (void)sprintf(im_y, "%lu", (long) h);
690- (void)sprintf(im_h, "%lu", (long) h);
691+ (void)snprintf(im_y, sizeof(im_y), "%lu", (long) h);
692+ (void)snprintf(im_h, sizeof(im_h), "%lu", (long) h);
693 tile_width = w;
694 tile_height = h;
695 if (TIFFIsTiled(tif)) {
696@@ -1803,7 +1803,7 @@
697 }
698 if (tile_height < h) {
699 fputs("/im_y 0 def\n", fd);
700- (void)sprintf(im_y, "%lu im_y sub", (unsigned long) h);
701+ (void)snprintf(im_y, sizeof(im_y), "%lu im_y sub", (unsigned long) h);
702 }
703 } else {
704 repeat_count = tf_numberstrips;
705@@ -1815,7 +1815,7 @@
706 fprintf(fd, "/im_h %lu def\n",
707 (unsigned long) tile_height);
708 (void)strcpy(im_h, "im_h");
709- (void)sprintf(im_y, "%lu im_y sub", (unsigned long) h);
710+ (void)snprintf(im_y, sizeof(im_y), "%lu im_y sub", (unsigned long) h);
711 }
712 }
713
714diff -Naur tiff-4.0.3.orig/tools/tiffcrop.c tiff-4.0.3/tools/tiffcrop.c
715--- tiff-4.0.3.orig/tools/tiffcrop.c 2010-12-14 09:18:28.000000000 -0500
716+++ tiff-4.0.3/tools/tiffcrop.c 2013-05-02 12:02:42.791288005 -0400
717@@ -2077,7 +2077,7 @@
718 return 1;
719 }
720
721- sprintf (filenum, "-%03d%s", findex, export_ext);
722+ snprintf(filenum, sizeof(filenum), "-%03d%s", findex, export_ext);
723 filenum[14] = '\0';
724 strncat (exportname, filenum, 15);
725 }
726@@ -2230,8 +2230,8 @@
727
728 /* dump.infilename is guaranteed to be NUL termimated and have 20 bytes
729 fewer than PATH_MAX */
730- memset (temp_filename, '\0', PATH_MAX + 1);
731- sprintf (temp_filename, "%s-read-%03d.%s", dump.infilename, dump_images,
732+ snprintf(temp_filename, sizeof(temp_filename), "%s-read-%03d.%s",
733+ dump.infilename, dump_images,
734 (dump.format == DUMP_TEXT) ? "txt" : "raw");
735 if ((dump.infile = fopen(temp_filename, dump.mode)) == NULL)
736 {
737@@ -2249,8 +2249,8 @@
738
739 /* dump.outfilename is guaranteed to be NUL termimated and have 20 bytes
740 fewer than PATH_MAX */
741- memset (temp_filename, '\0', PATH_MAX + 1);
742- sprintf (temp_filename, "%s-write-%03d.%s", dump.outfilename, dump_images,
743+ snprintf(temp_filename, sizeof(temp_filename), "%s-write-%03d.%s",
744+ dump.outfilename, dump_images,
745 (dump.format == DUMP_TEXT) ? "txt" : "raw");
746 if ((dump.outfile = fopen(temp_filename, dump.mode)) == NULL)
747 {
748diff -Naur tiff-4.0.3.orig/tools/tiffdither.c tiff-4.0.3/tools/tiffdither.c
749--- tiff-4.0.3.orig/tools/tiffdither.c 2010-03-10 13:56:50.000000000 -0500
750+++ tiff-4.0.3/tools/tiffdither.c 2013-05-02 12:02:42.792288013 -0400
751@@ -260,7 +260,7 @@
752 TIFFSetField(out, TIFFTAG_FILLORDER, fillorder);
753 else
754 CopyField(TIFFTAG_FILLORDER, shortv);
755- sprintf(thing, "Dithered B&W version of %s", argv[optind]);
756+ snprintf(thing, sizeof(thing), "Dithered B&W version of %s", argv[optind]);
757 TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, thing);
758 CopyField(TIFFTAG_PHOTOMETRIC, shortv);
759 CopyField(TIFFTAG_ORIENTATION, shortv);
© 2015 Mike Crute