From a48a4aa7d3720798ecd9457cb102d76acf7331c4 Mon Sep 17 00:00:00 2001 From: Robert Osfield Date: Mon, 30 Oct 2006 12:05:56 +0000 Subject: [PATCH] From Michael Henheffer, "Bug: The reader would crash when trying to load a .tif image that contained an 8-bit color map. The crash occured at line 545: remap_row(currPtr, inbuf, w, red, green, blue); Cause: The code was trying to write past the end of the buffer while doing this remapping. The size of the buffer is determined based on the value of 'format', which was 1 in this case since bitspersample is 8(indicating a 8-bit color map). The buffer should have been created 3 times as large since that 8-bit value is indexing a 24-bit color. Fix: I've put in an if statement to set format to 3 if 'photometric' indicates the tif contains a palette as the output data will always be 24-bit color data in this case." --- src/osgPlugins/tiff/ReaderWriterTIFF.cpp | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/osgPlugins/tiff/ReaderWriterTIFF.cpp b/src/osgPlugins/tiff/ReaderWriterTIFF.cpp index dc5786a6c..8656996d2 100644 --- a/src/osgPlugins/tiff/ReaderWriterTIFF.cpp +++ b/src/osgPlugins/tiff/ReaderWriterTIFF.cpp @@ -472,7 +472,14 @@ int *numComponents_ret) else format = 3; */ - format = samplesperpixel * bitspersample / 8; + // if it has a palette, data returned is 3 byte rgb + // so set format to 3. + if (photometric == PHOTOMETRIC_PALETTE) + format = 3; + else + format = samplesperpixel * bitspersample / 8; + + buffer = new unsigned char [w*h*format]; for(unsigned char* ptr=buffer;ptr