tiff: fix CVE-2020-35523 CVE-2020-35524

(From OE-Core rev: 84239e11227bc0b0e2e6d3b2faa7a9ee63025dd1)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

1 files changed, 42 insertions, 0 deletions

diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2020-35524-1.patch b/meta/recipes-multimedia/libtiff/files/CVE-2020-35524-1.patch
new file mode 100644
index 0000000000..5232eacb50
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2020-35524-1.patch
@@ -0,0 +1,42 @@
+From c6a12721b46f1a72974f91177890301730d7b330 Mon Sep 17 00:00:00 2001
+From: Thomas Bernard <miniupnp@free.fr>
+Date: Tue, 10 Nov 2020 01:01:59 +0100
+Subject: [PATCH] tiff2pdf.c: properly calculate datasize when saving to JPEG
+ YCbCr
+
+fixes #220
+Upstream-Status: Backport
+https://gitlab.com/libtiff/libtiff/-/commit/c6a12721b46f1a72974f91177890301730d7b330
+https://gitlab.com/libtiff/libtiff/-/merge_requests/159/commits
+CVE: CVE-2021-35524
+Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
+
+---
+ tools/tiff2pdf.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
+index 719811ea..dc69d2f9 100644
+--- a/tools/tiff2pdf.c
++++ b/tools/tiff2pdf.c
+@@ -2087,9 +2087,14 @@ void t2p_read_tiff_size(T2P* t2p, TIFF* input){
+ #endif
+                (void) 0;
+        }
+-       k = checkMultiply64(TIFFScanlineSize(input), t2p->tiff_length, t2p);
+-       if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){
+-               k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
++       if(t2p->pdf_compression == T2P_COMPRESS_JPEG
++          && t2p->tiff_photometric == PHOTOMETRIC_YCBCR) {
++               k = checkMultiply64(TIFFNumberOfStrips(input), TIFFStripSize(input), t2p);
++       } else {
++               k = checkMultiply64(TIFFScanlineSize(input), t2p->tiff_length, t2p);
++               if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){
++                       k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
++               }
+        }
+        if (k == 0) {
+                /* Assume we had overflow inside TIFFScanlineSize */
+-- 
+GitLab
+