summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/libtiff/files/CVE-2023-40745.patch
diff options
context:
space:
mode:
authorAlexander Kanavin <alex.kanavin@gmail.com>2023-09-22 09:24:27 +0200
committerRichard Purdie <richard.purdie@linuxfoundation.org>2023-09-26 10:35:27 +0100
commit8c5dd21254be4775a3b4aa9e60d852e941dfa255 (patch)
tree7f1507fbc5c87a22e0842f94ae18de9f21b312bb /meta/recipes-multimedia/libtiff/files/CVE-2023-40745.patch
parent08471afec7523500df0837c0624e8bd7737b564d (diff)
downloadpoky-8c5dd21254be4775a3b4aa9e60d852e941dfa255.tar.gz
tiff: upgrade 4.5.1 -> 4.6.0
(From OE-Core rev: 9e80f93ada4eae638350d86b8aa514203f757d43) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-multimedia/libtiff/files/CVE-2023-40745.patch')
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-40745.patch35
1 files changed, 0 insertions, 35 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-40745.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-40745.patch
deleted file mode 100644
index 73f1f37bab..0000000000
--- a/meta/recipes-multimedia/libtiff/files/CVE-2023-40745.patch
+++ /dev/null
@@ -1,35 +0,0 @@
1From 4fc16f649fa2875d5c388cf2edc295510a247ee5 Mon Sep 17 00:00:00 2001
2From: Arie Haenel <arie.haenel@jct.ac.il>
3Date: Thu, 14 Sep 2023 04:31:35 +0000
4Subject: [PATCH] tiffcp: fix memory corruption (overflow) on hostile images
5 (fixes #591)
6
7CVE: CVE-2023-40745
8
9Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/4fc16f649fa2875d5c388cf2edc295510a247ee5]
10
11Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
12---
13 tools/tiffcp.c | 7 +++++++
14 1 file changed, 7 insertions(+)
15
16diff --git a/tools/tiffcp.c b/tools/tiffcp.c
17index 3b2d1dd..57fa6e8 100644
18--- a/tools/tiffcp.c
19+++ b/tools/tiffcp.c
20@@ -1754,6 +1754,13 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
21 "Width * Samples/Pixel)");
22 return 0;
23 }
24+
25+ if ( (imagew - tilew * spp) > INT_MAX ){
26+ TIFFError(TIFFFileName(in),
27+ "Error, image raster scan line size is too large");
28+ return 0;
29+ }
30+
31 iskew = imagew - tilew * spp;
32 tilebuf = limitMalloc(tilesize);
33 if (tilebuf == 0)
34--
352.35.5