From 0343619094bfc7b8e23814f672411b008db2aa66 Mon Sep 17 00:00:00 2001 From: Even Rouault Date: Thu, 17 Feb 2022 15:28:43 +0100 Subject: [PATCH] TIFFFetchNormalTag(): avoid calling memcpy() with a null CVE: CVE-2022-0908 Upstream-Status: Backport Signed-off-by: Ross Burton source pointer and size of zero (fixes #383) --- libtiff/tif_dirread.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c index d654a1c..a31109a 100644 --- a/libtiff/tif_dirread.c +++ b/libtiff/tif_dirread.c @@ -5080,7 +5080,10 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover) _TIFFfree(data); return(0); } - _TIFFmemcpy(o,data,(uint32_t)dp->tdir_count); + if (dp->tdir_count > 0 ) + { + _TIFFmemcpy(o,data,(uint32_t)dp->tdir_count); + } o[(uint32_t)dp->tdir_count]=0; if (data!=0) _TIFFfree(data);