summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMingli Yu <Mingli.Yu@windriver.com>2016-12-07 08:01:12 (GMT)
committerSona Sarmadi <sona.sarmadi@enea.com>2017-02-10 11:21:39 (GMT)
commitdfde5b94e82264ea16a189252d615d67366e3d98 (patch)
tree8dc9b8609df8269a9d0ea7f1d64f07c490edfcda
parenta7301f1b499a971f6b208865f1241aaffa4b1dde (diff)
downloadpoky-dfde5b94e82264ea16a189252d615d67366e3d98.tar.gz
tiff: Security fix CVE-2016-9538
* tools/tiffcrop.c: fix read of undefined buffer in readContigStripsIntoBuffer() due to uint16 overflow. External References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9538 Patch from: https://github.com/vadz/libtiff/commit/43c0b81a818640429317c80fea1e66771e85024b#diff-c8b4b355f9b5c06d585b23138e1c185f (From OE-Core rev: 9af5d5ea882c853e4cb15006f990d3814eeea9ae) (From OE-Core rev: 33cad1173f6d1b803b794a2ec57fe8a9ef19fb44) Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2016-9538.patch67
-rw-r--r--meta/recipes-multimedia/libtiff/tiff_4.0.6.bb1
2 files changed, 68 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2016-9538.patch b/meta/recipes-multimedia/libtiff/files/CVE-2016-9538.patch
new file mode 100644
index 0000000..e1141df
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2016-9538.patch
@@ -0,0 +1,67 @@
1From 43c0b81a818640429317c80fea1e66771e85024b Mon Sep 17 00:00:00 2001
2From: erouault <erouault>
3Date: Sat, 8 Oct 2016 15:04:31 +0000
4Subject: [PATCH] Fix CVE-2016-9538
5* tools/tiffcp.c: fix read of undefined variable in case of
6 missing required tags. Found on test case of MSVR 35100. * tools/tiffcrop.c:
7 fix read of undefined buffer in readContigStripsIntoBuffer() due to uint16
8 overflow. Probably not a security issue but I can be wrong. Reported as MSVR
9 35100 by Axel Souchet from the MSRC Vulnerabilities & Mitigations team.
10
11CVE: CVE-2016-9538
12Upstream-Status: Backport
13https://github.com/vadz/libtiff/commit/43c0b81a818640429317c80fea1e66771e85024b#diff-c8b4b355f9b5c06d585b23138e1c185f
14
15Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
16
17---
18 tools/tiffcp.c | 4 ++--
19 tools/tiffcrop.c | 9 ++++++---
20 2 files changed, 17 insertions(+), 5 deletions(-)
21
22diff --git a/tools/tiffcp.c b/tools/tiffcp.c
23index ba2b715..4ad74d3 100644
24--- a/tools/tiffcp.c
25+++ b/tools/tiffcp.c
26@@ -592,8 +592,8 @@ static copyFunc pickCopyFunc(TIFF*, TIFF*, uint16, uint16);
27 static int
28 tiffcp(TIFF* in, TIFF* out)
29 {
30- uint16 bitspersample, samplesperpixel;
31- uint16 input_compression, input_photometric;
32+ uint16 bitspersample, samplesperpixel = 1;
33+ uint16 input_compression, input_photometric = PHOTOMETRIC_MINISBLACK;
34 copyFunc cf;
35 uint32 width, length;
36 struct cpTag* p;
37diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
38index 7685566..eb6de77 100644
39--- a/tools/tiffcrop.c
40+++ b/tools/tiffcrop.c
41@@ -3628,7 +3628,7 @@ static int readContigStripsIntoBuffer (TIFF* in, uint8* buf)
42 {
43 uint8* bufp = buf;
44 int32 bytes_read = 0;
45- uint16 strip, nstrips = TIFFNumberOfStrips(in);
46+ uint32 strip, nstrips = TIFFNumberOfStrips(in);
47 uint32 stripsize = TIFFStripSize(in);
48 uint32 rows = 0;
49 uint32 rps = TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rps);
50@@ -4711,9 +4711,12 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
51 uint32 width, uint16 spp,
52 struct dump_opts *dump)
53 {
54- int i, j, bytes_per_sample, bytes_per_pixel, shift_width, result = 1;
55+ int i, bytes_per_sample, bytes_per_pixel, shift_width, result = 1;
56+ uint32 j;
57 int32 bytes_read = 0;
58- uint16 bps, nstrips, planar, strips_per_sample;
59+ uint16 bps, planar;
60+ uint32 nstrips;
61+ uint32 strips_per_sample;
62 uint32 src_rowsize, dst_rowsize, rows_processed, rps;
63 uint32 rows_this_strip = 0;
64 tsample_t s;
65--
662.9.3
67
diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
index 7b5dd9c..8521fd7 100644
--- a/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
@@ -21,6 +21,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
21 file://CVE-2016-9539.patch \ 21 file://CVE-2016-9539.patch \
22 file://CVE-2016-9535-1.patch \ 22 file://CVE-2016-9535-1.patch \
23 file://CVE-2016-9535-2.patch \ 23 file://CVE-2016-9535-2.patch \
24 file://CVE-2016-9538.patch \
24 " 25 "
25 26
26SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72" 27SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72"