diff options
Diffstat (limited to 'meta/recipes-multimedia/libtiff/files/CVE-2016-3990.patch')
| -rw-r--r-- | meta/recipes-multimedia/libtiff/files/CVE-2016-3990.patch | 66 |
1 files changed, 66 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2016-3990.patch b/meta/recipes-multimedia/libtiff/files/CVE-2016-3990.patch new file mode 100644 index 0000000000..7bf52ee5dc --- /dev/null +++ b/meta/recipes-multimedia/libtiff/files/CVE-2016-3990.patch | |||
| @@ -0,0 +1,66 @@ | |||
| 1 | From 6a4dbb07ccf92836bb4adac7be4575672d0ac5f1 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: erouault <erouault> | ||
| 3 | Date: Mon, 15 Aug 2016 20:49:48 +0000 | ||
| 4 | Subject: [PATCH] * libtiff/tif_pixarlog.c: Fix write buffer overflow in | ||
| 5 | PixarLogEncode if more input samples are provided than expected by | ||
| 6 | PixarLogSetupEncode. Idea based on libtiff-CVE-2016-3990.patch from | ||
| 7 | libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with different and | ||
| 8 | simpler check. (bugzilla #2544) | ||
| 9 | |||
| 10 | invalid tests that rejected valid files. (bugzilla #2545) | ||
| 11 | |||
| 12 | CVE: CVE-2016-3990 | ||
| 13 | Upstream-Status: Backport | ||
| 14 | https://github.com/vadz/libtiff/commit/6a4dbb07ccf92836bb4adac7be4575672d0ac5f1 | ||
| 15 | |||
| 16 | Signed-off-by: Yi Zhao <yi.zhao@windirver.com> | ||
| 17 | --- | ||
| 18 | ChangeLog | 10 +++++++++- | ||
| 19 | libtiff/tif_pixarlog.c | 7 +++++++ | ||
| 20 | 2 files changed, 16 insertions(+), 1 deletion(-) | ||
| 21 | |||
| 22 | diff --git a/ChangeLog b/ChangeLog | ||
| 23 | index 9c0ab29..db4ea18 100644 | ||
| 24 | --- a/ChangeLog | ||
| 25 | +++ b/ChangeLog | ||
| 26 | @@ -1,10 +1,18 @@ | ||
| 27 | 2016-08-15 Even Rouault <even.rouault at spatialys.com> | ||
| 28 | |||
| 29 | + * libtiff/tif_pixarlog.c: Fix write buffer overflow in PixarLogEncode | ||
| 30 | + if more input samples are provided than expected by PixarLogSetupEncode. | ||
| 31 | + Idea based on libtiff-CVE-2016-3990.patch from | ||
| 32 | + libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with different and | ||
| 33 | + simpler check. (bugzilla #2544) | ||
| 34 | + | ||
| 35 | +2016-08-15 Even Rouault <even.rouault at spatialys.com> | ||
| 36 | + | ||
| 37 | * tools/tiff2rgba.c: Fix integer overflow in size of allocated | ||
| 38 | buffer, when -b mode is enabled, that could result in out-of-bounds | ||
| 39 | write. Based initially on patch tiff-CVE-2016-3945.patch from | ||
| 40 | libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with correction for | ||
| 41 | - invalid tests that rejected valid files. | ||
| 42 | + invalid tests that rejected valid files. (bugzilla #2545) | ||
| 43 | |||
| 44 | 2016-07-11 Even Rouault <even.rouault at spatialys.com> | ||
| 45 | |||
| 46 | diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c | ||
| 47 | index e78f788..28329d1 100644 | ||
| 48 | --- a/libtiff/tif_pixarlog.c | ||
| 49 | +++ b/libtiff/tif_pixarlog.c | ||
| 50 | @@ -1141,6 +1141,13 @@ PixarLogEncode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s) | ||
| 51 | } | ||
| 52 | |||
| 53 | llen = sp->stride * td->td_imagewidth; | ||
| 54 | + /* Check against the number of elements (of size uint16) of sp->tbuf */ | ||
| 55 | + if( n > td->td_rowsperstrip * llen ) | ||
| 56 | + { | ||
| 57 | + TIFFErrorExt(tif->tif_clientdata, module, | ||
| 58 | + "Too many input bytes provided"); | ||
| 59 | + return 0; | ||
| 60 | + } | ||
| 61 | |||
| 62 | for (i = 0, up = sp->tbuf; i < n; i += llen, up += llen) { | ||
| 63 | switch (sp->user_datafmt) { | ||
| 64 | -- | ||
| 65 | 2.7.4 | ||
| 66 | |||