summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/libtiff/files/CVE-2017-11335.patch
diff options
context:
space:
mode:
authorHuang Qiyu <huangqy.fnst@cn.fujitsu.com>2018-01-18 10:29:37 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2018-01-19 12:37:14 +0000
commit975591a8d6cbea068d52417df0dfdd20aa586175 (patch)
treea356cfaae66b4eff6569d6054acd8604964c9011 /meta/recipes-multimedia/libtiff/files/CVE-2017-11335.patch
parent6d22e5395408a98d1908a73297f0d07cde7591c7 (diff)
downloadpoky-975591a8d6cbea068d52417df0dfdd20aa586175.tar.gz
tiff: 4.0.8 -> 4.0.9
1.Upgrade tiff from 4.0.8 to 4.0.9. 2.Delete CVE-2017-10688.patch, CVE-2017-11335.patch, CVE-2017-13726.patch, CVE-2017-13727.patch, CVE-2017-9147.patch, CVE-2017-9936.patch, since it is integrated upstream. (From OE-Core rev: df894b523d74f8fd723d1c8fb03f55e46c6af0f5) Signed-off-by: Huang Qiyu <huangqy.fnst@cn.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-multimedia/libtiff/files/CVE-2017-11335.patch')
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2017-11335.patch54
1 files changed, 0 insertions, 54 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2017-11335.patch b/meta/recipes-multimedia/libtiff/files/CVE-2017-11335.patch
deleted file mode 100644
index d08e7612b7..0000000000
--- a/meta/recipes-multimedia/libtiff/files/CVE-2017-11335.patch
+++ /dev/null
@@ -1,54 +0,0 @@
1From e8b15ccf8c9c593000f8202cf34cc6c4b936d01e Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Sat, 15 Jul 2017 11:13:46 +0000
4Subject: [PATCH] * tools/tiff2pdf.c: prevent heap buffer overflow write in
5 "Raw" mode on PlanarConfig=Contig input images. Fixes
6 http://bugzilla.maptools.org/show_bug.cgi?id=2715 Reported by team OWL337
7
8Upstream-Status: Backport
9[https://github.com/vadz/libtiff/commit/69bfeec247899776b1b396651adb47436e5f1556]
10
11CVE: CVE-2017-11355
12
13Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
14---
15 ChangeLog | 7 +++++++
16 tools/tiff2pdf.c | 7 ++++++-
17 2 files changed, 13 insertions(+), 1 deletion(-)
18
19diff --git a/ChangeLog b/ChangeLog
20index 42eaeb7..6980da8 100644
21--- a/ChangeLog
22+++ b/ChangeLog
23@@ -1,3 +1,10 @@
24+2017-07-15 Even Rouault <even.rouault at spatialys.com>
25+
26+ * tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
27+ mode on PlanarConfig=Contig input images.
28+ Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2715
29+ Reported by team OWL337
30+
31 2017-06-30 Even Rouault <even.rouault at spatialys.com>
32
33 * libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
34diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
35index db196e0..cd1e235 100644
36--- a/tools/tiff2pdf.c
37+++ b/tools/tiff2pdf.c
38@@ -1737,7 +1737,12 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){
39 return;
40
41 t2p->pdf_transcode = T2P_TRANSCODE_ENCODE;
42- if(t2p->pdf_nopassthrough==0){
43+ /* It seems that T2P_TRANSCODE_RAW mode doesn't support separate->contig */
44+ /* conversion. At least t2p_read_tiff_size and t2p_read_tiff_size_tile */
45+ /* do not take into account the number of samples, and thus */
46+ /* that can cause heap buffer overflows such as in */
47+ /* http://bugzilla.maptools.org/show_bug.cgi?id=2715 */
48+ if(t2p->pdf_nopassthrough==0 && t2p->tiff_planar!=PLANARCONFIG_SEPARATE){
49 #ifdef CCITT_SUPPORT
50 if(t2p->tiff_compression==COMPRESSION_CCITTFAX4
51 ){
52--
532.7.4
54