Skip to content

ChopUpSingleUncompressedStrip: avoid memory exhaustion (CVE-2017-11613)

In ChopUpSingleUncompressedStrip(), if the computed number of strips is big enough and we are in read only mode, validate that the file size is consistent with that number of strips to avoid useless attempts at allocating a lot of memory for the td_stripbytecount and td_stripoffset arrays.

Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2724

Merge request reports