summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2016-5323.patch107
-rw-r--r--meta/recipes-multimedia/libtiff/tiff_4.0.6.bb1
2 files changed, 108 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2016-5323.patch b/meta/recipes-multimedia/libtiff/files/CVE-2016-5323.patch
new file mode 100644
index 0000000000..41eab91ab4
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2016-5323.patch
@@ -0,0 +1,107 @@
1From 2f79856097f423eb33796a15fcf700d2ea41bf31 Mon Sep 17 00:00:00 2001
2From: erouault <erouault>
3Date: Mon, 11 Jul 2016 21:38:31 +0000
4Subject: [PATCH 2/2] (CVE-2016-5321 / CVE-2016-5323 , bugzilla #2558 / #2559)
5
6CVE: CVE-2016-5323
7Upstream-Status: Backport
8https://github.com/vadz/libtiff/commit/2f79856097f423eb33796a15fcf700d2ea41bf31
9
10Signed-off-by: Yi Zhao <yi.zhao@windirver.com>
11---
12 ChangeLog | 2 +-
13 tools/tiffcrop.c | 16 ++++++++--------
14 2 files changed, 9 insertions(+), 9 deletions(-)
15
16diff --git a/ChangeLog b/ChangeLog
17index 4e0302f..62dc1b5 100644
18--- a/ChangeLog
19+++ b/ChangeLog
20@@ -3,7 +3,7 @@
21 * tools/tiffcrop.c: Avoid access outside of stack allocated array
22 on a tiled separate TIFF with more than 8 samples per pixel.
23 Reported by Kaixiang Zhang of the Cloud Security Team, Qihoo 360
24- (CVE-2016-5321, bugzilla #2558)
25+ (CVE-2016-5321 / CVE-2016-5323 , bugzilla #2558 / #2559)
26
27 2016-07-10 Even Rouault <even.rouault at spatialys.com>
28
29diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
30index 6fc8fc1..27abc0b 100644
31--- a/tools/tiffcrop.c
32+++ b/tools/tiffcrop.c
33@@ -3738,7 +3738,7 @@ combineSeparateSamples8bits (uint8 *in[], uint8 *out, uint32 cols,
34
35 matchbits = maskbits << (8 - src_bit - bps);
36 /* load up next sample from each plane */
37- for (s = 0; s < spp; s++)
38+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
39 {
40 src = in[s] + src_offset + src_byte;
41 buff1 = ((*src) & matchbits) << (src_bit);
42@@ -3837,7 +3837,7 @@ combineSeparateSamples16bits (uint8 *in[], uint8 *out, uint32 cols,
43 src_bit = bit_offset % 8;
44
45 matchbits = maskbits << (16 - src_bit - bps);
46- for (s = 0; s < spp; s++)
47+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
48 {
49 src = in[s] + src_offset + src_byte;
50 if (little_endian)
51@@ -3947,7 +3947,7 @@ combineSeparateSamples24bits (uint8 *in[], uint8 *out, uint32 cols,
52 src_bit = bit_offset % 8;
53
54 matchbits = maskbits << (32 - src_bit - bps);
55- for (s = 0; s < spp; s++)
56+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
57 {
58 src = in[s] + src_offset + src_byte;
59 if (little_endian)
60@@ -4073,7 +4073,7 @@ combineSeparateSamples32bits (uint8 *in[], uint8 *out, uint32 cols,
61 src_bit = bit_offset % 8;
62
63 matchbits = maskbits << (64 - src_bit - bps);
64- for (s = 0; s < spp; s++)
65+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
66 {
67 src = in[s] + src_offset + src_byte;
68 if (little_endian)
69@@ -4263,7 +4263,7 @@ combineSeparateTileSamples8bits (uint8 *in[], uint8 *out, uint32 cols,
70
71 matchbits = maskbits << (8 - src_bit - bps);
72 /* load up next sample from each plane */
73- for (s = 0; s < spp; s++)
74+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
75 {
76 src = in[s] + src_offset + src_byte;
77 buff1 = ((*src) & matchbits) << (src_bit);
78@@ -4362,7 +4362,7 @@ combineSeparateTileSamples16bits (uint8 *in[], uint8 *out, uint32 cols,
79 src_bit = bit_offset % 8;
80
81 matchbits = maskbits << (16 - src_bit - bps);
82- for (s = 0; s < spp; s++)
83+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
84 {
85 src = in[s] + src_offset + src_byte;
86 if (little_endian)
87@@ -4471,7 +4471,7 @@ combineSeparateTileSamples24bits (uint8 *in[], uint8 *out, uint32 cols,
88 src_bit = bit_offset % 8;
89
90 matchbits = maskbits << (32 - src_bit - bps);
91- for (s = 0; s < spp; s++)
92+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
93 {
94 src = in[s] + src_offset + src_byte;
95 if (little_endian)
96@@ -4597,7 +4597,7 @@ combineSeparateTileSamples32bits (uint8 *in[], uint8 *out, uint32 cols,
97 src_bit = bit_offset % 8;
98
99 matchbits = maskbits << (64 - src_bit - bps);
100- for (s = 0; s < spp; s++)
101+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
102 {
103 src = in[s] + src_offset + src_byte;
104 if (little_endian)
105--
1062.7.4
107
diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
index 63df126627..83d88df1c1 100644
--- a/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
@@ -10,6 +10,7 @@ SRC_URI = "ftp://ftp.remotesensing.org/pub/libtiff/tiff-${PV}.tar.gz \
10 file://CVE-2015-8784.patch \ 10 file://CVE-2015-8784.patch \
11 file://CVE-2016-3186.patch \ 11 file://CVE-2016-3186.patch \
12 file://CVE-2016-5321.patch \ 12 file://CVE-2016-5321.patch \
13 file://CVE-2016-5323.patch \
13 " 14 "
14 15
15SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72" 16SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72"