From d63de61b1ec3385f6383ef9a1f453e4b8b11d536 Mon Sep 17 00:00:00 2001 From: Su_Laus Date: Fri, 3 Feb 2023 17:38:55 +0100 Subject: [PATCH] TIFFClose() avoid NULL pointer dereferencing. fix#515 Closes #515 Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/d63de61b1ec3385f6383ef9a1f453e4b8b11d536] CVE: CVE-2023-3316 Signed-off-by: Hitendra Prajapati --- libtiff/tif_close.c | 11 +++++++---- tools/tiffcrop.c | 5 ++++- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/libtiff/tif_close.c b/libtiff/tif_close.c index 674518a..0fe7af4 100644 --- a/libtiff/tif_close.c +++ b/libtiff/tif_close.c @@ -118,13 +118,16 @@ TIFFCleanup(TIFF* tif) */ void -TIFFClose(TIFF* tif) +TIFFClose(TIFF *tif) { - TIFFCloseProc closeproc = tif->tif_closeproc; - thandle_t fd = tif->tif_clientdata; + if (tif != NULL) + { + TIFFCloseProc closeproc = tif->tif_closeproc; + thandle_t fd = tif->tif_clientdata; TIFFCleanup(tif); - (void) (*closeproc)(fd); + (void)(*closeproc)(fd); + } } /* vim: set ts=8 sts=8 sw=8 noet: */ diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c index ce77c74..cd49660 100644 --- a/tools/tiffcrop.c +++ b/tools/tiffcrop.c @@ -2548,7 +2548,10 @@ main(int argc, char* argv[]) } } - TIFFClose(out); + if (out != NULL) + { + TIFFClose(out); + } return (0); } /* end main */ -- 2.25.1