tif_dir: unset transferfunction field if necessary
The number of entries in the transfer table is determined as following: (td->td_samplesperpixel - td->td_extrasamples) > 1 ? 3 : 1 This means that whenever td->td_samplesperpixel or td->td_extrasamples are modified we also need to make sure that the number of required entries in the transfer table didn't change. If it changed and the number of entries is higher than before we should invalidate the transfer table field and free previously allocated values. In the other case there's nothing to do, additional tf entries won't harm and properly written code will just ignore them since spp - es < 1. For instance this situation might happen when reading an OJPEG compressed image with missing SamplesPerPixel tag. In this case the SamplesPerPixel field might be updated after setting the transfer table. see http://bugzilla.maptools.org/show_bug.cgi?id=2500 This commit addresses CVE-2018-19210.
Showing with 22 additions and 0 deletions