CVE-2012-1173

An attacker crafts a TIFF file with a malicious tile size (or strip size) that, when multiplied by 3 or 4 inside `gtTileSeparate` or `gtStripSeparate`, causes an integer overflow. The overflowed value is passed to `_TIFFmalloc`, allocating an undersized heap buffer, and subsequent writes overflow that buffer, leading to arbitrary code execution. The attack is delivered over the network by tricking a user or service into processing the malformed TIFF file. [ref_id=1]

The patch replaces the direct multiplication `(alpha?4:3)*tilesize` (and the analogous `stripsize` expression) with a call to `TIFFSafeMultiply`, which checks for overflow before performing the multiplication. If overflow is detected, `bufsize` is set to 0, the allocation is skipped, and an error is returned instead of proceeding with a corrupted size. The same safe-multiply result is also used for the subsequent `_TIFFmemset` call, ensuring the memset operates on the correctly computed buffer size. [ref_id=1]