summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2016-3991.patch147
-rw-r--r--meta/recipes-multimedia/libtiff/tiff_4.0.6.bb1
2 files changed, 148 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2016-3991.patch b/meta/recipes-multimedia/libtiff/files/CVE-2016-3991.patch
new file mode 100644
index 0000000000..27dfd37d25
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2016-3991.patch
@@ -0,0 +1,147 @@
1From e596d4e27c5afb7960dc360fdd3afd90ba0fb8ba Mon Sep 17 00:00:00 2001
2From: erouault <erouault>
3Date: Mon, 15 Aug 2016 21:05:40 +0000
4Subject: [PATCH 2/2] * tools/tiffcrop.c: Fix out-of-bounds write in
5 loadImage(). From patch libtiff-CVE-2016-3991.patch from
6 libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro (bugzilla #2543)
7
8CVE: CVE-2016-3991
9Upstream-Status: Backport
10https://github.com/vadz/libtiff/commit/e596d4e27c5afb7960dc360fdd3afd90ba0fb8ba
11
12Signed-off-by: Yi Zhao <yi.zhao@windirver.com>
13---
14 ChangeLog | 6 ++++++
15 tools/tiffcrop.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++++---
16 2 files changed, 62 insertions(+), 3 deletions(-)
17
18diff --git a/ChangeLog b/ChangeLog
19index db4ea18..5d60608 100644
20--- a/ChangeLog
21+++ b/ChangeLog
22@@ -1,5 +1,11 @@
23 2016-08-15 Even Rouault <even.rouault at spatialys.com>
24
25+ * tools/tiffcrop.c: Fix out-of-bounds write in loadImage().
26+ From patch libtiff-CVE-2016-3991.patch from
27+ libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro (bugzilla #2543)
28+
29+2016-08-15 Even Rouault <even.rouault at spatialys.com>
30+
31 * libtiff/tif_pixarlog.c: Fix write buffer overflow in PixarLogEncode
32 if more input samples are provided than expected by PixarLogSetupEncode.
33 Idea based on libtiff-CVE-2016-3990.patch from
34diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
35index 27abc0b..ddba7b9 100644
36--- a/tools/tiffcrop.c
37+++ b/tools/tiffcrop.c
38@@ -798,6 +798,11 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8* buf,
39 }
40
41 tile_buffsize = tilesize;
42+ if (tilesize == 0 || tile_rowsize == 0)
43+ {
44+ TIFFError("readContigTilesIntoBuffer", "Tile size or tile rowsize is zero");
45+ exit(-1);
46+ }
47
48 if (tilesize < (tsize_t)(tl * tile_rowsize))
49 {
50@@ -807,7 +812,12 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8* buf,
51 tilesize, tl * tile_rowsize);
52 #endif
53 tile_buffsize = tl * tile_rowsize;
54- }
55+ if (tl != (tile_buffsize / tile_rowsize))
56+ {
57+ TIFFError("readContigTilesIntoBuffer", "Integer overflow when calculating buffer size.");
58+ exit(-1);
59+ }
60+ }
61
62 tilebuf = _TIFFmalloc(tile_buffsize);
63 if (tilebuf == 0)
64@@ -1210,6 +1220,12 @@ static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
65 !TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps) )
66 return 1;
67
68+ if (tilesize == 0 || tile_rowsize == 0 || tl == 0 || tw == 0)
69+ {
70+ TIFFError("writeBufferToContigTiles", "Tile size, tile row size, tile width, or tile length is zero");
71+ exit(-1);
72+ }
73+
74 tile_buffsize = tilesize;
75 if (tilesize < (tsize_t)(tl * tile_rowsize))
76 {
77@@ -1219,6 +1235,11 @@ static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
78 tilesize, tl * tile_rowsize);
79 #endif
80 tile_buffsize = tl * tile_rowsize;
81+ if (tl != tile_buffsize / tile_rowsize)
82+ {
83+ TIFFError("writeBufferToContigTiles", "Integer overflow when calculating buffer size");
84+ exit(-1);
85+ }
86 }
87
88 tilebuf = _TIFFmalloc(tile_buffsize);
89@@ -5945,12 +5966,27 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c
90 TIFFGetField(in, TIFFTAG_TILELENGTH, &tl);
91
92 tile_rowsize = TIFFTileRowSize(in);
93+ if (ntiles == 0 || tlsize == 0 || tile_rowsize == 0)
94+ {
95+ TIFFError("loadImage", "File appears to be tiled, but the number of tiles, tile size, or tile rowsize is zero.");
96+ exit(-1);
97+ }
98 buffsize = tlsize * ntiles;
99+ if (tlsize != (buffsize / ntiles))
100+ {
101+ TIFFError("loadImage", "Integer overflow when calculating buffer size");
102+ exit(-1);
103+ }
104
105-
106 if (buffsize < (uint32)(ntiles * tl * tile_rowsize))
107 {
108 buffsize = ntiles * tl * tile_rowsize;
109+ if (ntiles != (buffsize / tl / tile_rowsize))
110+ {
111+ TIFFError("loadImage", "Integer overflow when calculating buffer size");
112+ exit(-1);
113+ }
114+
115 #ifdef DEBUG2
116 TIFFError("loadImage",
117 "Tilesize %u is too small, using ntiles * tilelength * tilerowsize %lu",
118@@ -5969,8 +6005,25 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c
119 TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
120 stsize = TIFFStripSize(in);
121 nstrips = TIFFNumberOfStrips(in);
122+ if (nstrips == 0 || stsize == 0)
123+ {
124+ TIFFError("loadImage", "File appears to be striped, but the number of stipes or stripe size is zero.");
125+ exit(-1);
126+ }
127+
128 buffsize = stsize * nstrips;
129-
130+ if (stsize != (buffsize / nstrips))
131+ {
132+ TIFFError("loadImage", "Integer overflow when calculating buffer size");
133+ exit(-1);
134+ }
135+ uint32 buffsize_check;
136+ buffsize_check = ((length * width * spp * bps) + 7);
137+ if (length != ((buffsize_check - 7) / width / spp / bps))
138+ {
139+ TIFFError("loadImage", "Integer overflow detected.");
140+ exit(-1);
141+ }
142 if (buffsize < (uint32) (((length * width * spp * bps) + 7) / 8))
143 {
144 buffsize = ((length * width * spp * bps) + 7) / 8;
145--
1462.7.4
147
diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
index dfb2996897..713cf24d5b 100644
--- a/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
@@ -12,6 +12,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
12 file://CVE-2016-5323.patch \ 12 file://CVE-2016-5323.patch \
13 file://CVE-2016-3945.patch \ 13 file://CVE-2016-3945.patch \
14 file://CVE-2016-3990.patch \ 14 file://CVE-2016-3990.patch \
15 file://CVE-2016-3991.patch \
15 " 16 "
16 17
17SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72" 18SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72"