ReadKey(): only allow reading a key with TIFFTagLocation=0 that has a…

… count of 1 to avoid reading an illegal address (and crashing) when using GTIFKeyGet() or PrintKey() (fixes #66)
OSGeo · Feb 23, 2022 · aa98b78 · aa98b78
1 parent f5f080f
commit aa98b78
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/libgeotiff/geo_new.c b/libgeotiff/geo_new.c
@@ -267,6 +267,19 @@ static int ReadKey(GTIF* gt, TempKeyData* tempData,
     {
         case GTIFF_LOCAL:
             /* store value into data value */
+            if (count != 1 )
+            {
+                if( gt->gt_error_callback )
+                {
+                    gt->gt_error_callback(
+                        gt,
+                        LIBGEOTIFF_ERROR,
+                        "Key %s of TIFFTagLocation=0 has count=%d, "
+                        "whereas only 1 is legal.",
+                        GTIFKeyName(keyptr->gk_key), count);
+                }
+                return 0;
+            }
             memcpy(&keyptr->gk_data, &(entptr->ent_val_offset), sizeof(pinfo_t));
             break;
         case GTIFF_GEOKEYDIRECTORY: