Re: [boost] GIL: Buffer overflow when reading tiffs

From: Sebastian Redl (sebastian.redl_at_[hidden])
Date: 2006-12-14 16:36:11

Tilo Nitzsche wrote:
> A quick fix for that would be to do a
> row.reserve(TIFFScanlineSize(_tp));
>   
Most definitely not. The correct fix is to pass TIFFScanlineSize(_tp) to
the vector's constructor. Writing more bytes than the vector's size,
even if they have been reserved, is undefined behaviour and just might
mess up the container's internal structure.
OK, so I can't think of any implementation where it would ever do so,
but it's the principle that matters: you do not write beyond a vector's
size, even if the space has been allocated.

Sebastian Redl