summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorYi Zhao <yi.zhao@windriver.com>2016-08-10 15:11:20 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2016-09-23 23:22:03 +0100
commit9f1dc20619dd4e96368d67190009d548d8b8ffab (patch)
tree125a49370973a08bb43a0b5cd2d655d4356fe33e
parentc95d42a7d1fbd11fab8d4d4a5735eae49c1a2a44 (diff)
downloadpoky-9f1dc20619dd4e96368d67190009d548d8b8ffab.tar.gz
tiff: Security fix CVE-2016-5323
CVE-2016-5323 libtiff: a maliciously crafted TIFF file could cause the application to crash when using tiffcrop command External References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5323 http://bugzilla.maptools.org/show_bug.cgi?id=2559 Patch from: https://github.com/vadz/libtiff/commit/2f79856097f423eb33796a15fcf700d2ea41bf31 (From OE-Core rev: 4e2f4484d6e1418c34f65de954809d06df41cc38) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 4ad1220e0a7f9ca9096860f4f9ae7017b36e29e4) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2016-5323.patch103
-rw-r--r--meta/recipes-multimedia/libtiff/tiff_4.0.4.bb1
2 files changed, 104 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2016-5323.patch b/meta/recipes-multimedia/libtiff/files/CVE-2016-5323.patch
new file mode 100644
index 0000000000..aaad423029
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2016-5323.patch
@@ -0,0 +1,103 @@
1From 2f79856097f423eb33796a15fcf700d2ea41bf31 Mon Sep 17 00:00:00 2001
2From: erouault <erouault>
3Date: Mon, 11 Jul 2016 21:38:31 +0000
4Subject: [PATCH 2/2] (CVE-2016-5321 / CVE-2016-5323 , bugzilla #2558 / #2559)
5
6CVE: CVE-2016-5323
7Upstream-Status: Backport
8https://github.com/vadz/libtiff/commit/2f79856097f423eb33796a15fcf700d2ea41bf31
9
10Signed-off-by: Yi Zhao <yi.zhao@windirver.com>
11---
12 tools/tiffcrop.c | 16 ++++++++--------
13 2 files changed, 9 insertions(+), 9 deletions(-)
14
15Index: tiff-4.0.4/tools/tiffcrop.c
16===================================================================
17--- tiff-4.0.4.orig/tools/tiffcrop.c
18+++ tiff-4.0.4/tools/tiffcrop.c
19@@ -3738,7 +3738,7 @@ combineSeparateSamples8bits (uint8 *in[]
20
21 matchbits = maskbits << (8 - src_bit - bps);
22 /* load up next sample from each plane */
23- for (s = 0; s < spp; s++)
24+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
25 {
26 src = in[s] + src_offset + src_byte;
27 buff1 = ((*src) & matchbits) << (src_bit);
28@@ -3837,7 +3837,7 @@ combineSeparateSamples16bits (uint8 *in[
29 src_bit = bit_offset % 8;
30
31 matchbits = maskbits << (16 - src_bit - bps);
32- for (s = 0; s < spp; s++)
33+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
34 {
35 src = in[s] + src_offset + src_byte;
36 if (little_endian)
37@@ -3947,7 +3947,7 @@ combineSeparateSamples24bits (uint8 *in[
38 src_bit = bit_offset % 8;
39
40 matchbits = maskbits << (32 - src_bit - bps);
41- for (s = 0; s < spp; s++)
42+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
43 {
44 src = in[s] + src_offset + src_byte;
45 if (little_endian)
46@@ -4073,7 +4073,7 @@ combineSeparateSamples32bits (uint8 *in[
47 src_bit = bit_offset % 8;
48
49 matchbits = maskbits << (64 - src_bit - bps);
50- for (s = 0; s < spp; s++)
51+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
52 {
53 src = in[s] + src_offset + src_byte;
54 if (little_endian)
55@@ -4263,7 +4263,7 @@ combineSeparateTileSamples8bits (uint8 *
56
57 matchbits = maskbits << (8 - src_bit - bps);
58 /* load up next sample from each plane */
59- for (s = 0; s < spp; s++)
60+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
61 {
62 src = in[s] + src_offset + src_byte;
63 buff1 = ((*src) & matchbits) << (src_bit);
64@@ -4362,7 +4362,7 @@ combineSeparateTileSamples16bits (uint8
65 src_bit = bit_offset % 8;
66
67 matchbits = maskbits << (16 - src_bit - bps);
68- for (s = 0; s < spp; s++)
69+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
70 {
71 src = in[s] + src_offset + src_byte;
72 if (little_endian)
73@@ -4471,7 +4471,7 @@ combineSeparateTileSamples24bits (uint8
74 src_bit = bit_offset % 8;
75
76 matchbits = maskbits << (32 - src_bit - bps);
77- for (s = 0; s < spp; s++)
78+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
79 {
80 src = in[s] + src_offset + src_byte;
81 if (little_endian)
82@@ -4597,7 +4597,7 @@ combineSeparateTileSamples32bits (uint8
83 src_bit = bit_offset % 8;
84
85 matchbits = maskbits << (64 - src_bit - bps);
86- for (s = 0; s < spp; s++)
87+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
88 {
89 src = in[s] + src_offset + src_byte;
90 if (little_endian)
91Index: tiff-4.0.4/ChangeLog
92===================================================================
93--- tiff-4.0.4.orig/ChangeLog
94+++ tiff-4.0.4/ChangeLog
95@@ -3,7 +3,7 @@
96 * tools/tiffcrop.c: Avoid access outside of stack allocated array
97 on a tiled separate TIFF with more than 8 samples per pixel.
98 Reported by Kaixiang Zhang of the Cloud Security Team, Qihoo 360
99- (CVE-2016-5321, bugzilla #2558)
100+ (CVE-2016-5321 / CVE-2016-5323 , bugzilla #2558 / #2559)
101
102 2015-12-26 Even Rouault <even.rouault at spatialys.com>
103
diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.4.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.4.bb
index 2e97653d95..1f0585a25c 100644
--- a/meta/recipes-multimedia/libtiff/tiff_4.0.4.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.0.4.bb
@@ -10,6 +10,7 @@ SRC_URI = "ftp://ftp.remotesensing.org/pub/libtiff/tiff-${PV}.tar.gz \
10 file://CVE-2015-8665_8683.patch \ 10 file://CVE-2015-8665_8683.patch \
11 file://CVE-2016-3186.patch \ 11 file://CVE-2016-3186.patch \
12 file://CVE-2016-5321.patch \ 12 file://CVE-2016-5321.patch \
13 file://CVE-2016-5323.patch \
13 " 14 "
14 15
15SRC_URI[md5sum] = "9aee7107408a128c0c7b24286c0db900" 16SRC_URI[md5sum] = "9aee7107408a128c0c7b24286c0db900"