summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/libtiff/files/CVE-2017-9147.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-multimedia/libtiff/files/CVE-2017-9147.patch')
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2017-9147.patch206
1 files changed, 206 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2017-9147.patch b/meta/recipes-multimedia/libtiff/files/CVE-2017-9147.patch
new file mode 100644
index 0000000000..3392285901
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2017-9147.patch
@@ -0,0 +1,206 @@
1From 0acf01fea714af573b814e10cf105c3359a236c3 Mon Sep 17 00:00:00 2001
2From: erouault <erouault>
3Date: Thu, 1 Jun 2017 12:44:04 +0000
4Subject: [PATCH] * libtiff/tif_dirinfo.c, tif_dirread.c: add _TIFFCheckFieldIsValidForCodec(),
5and use it in TIFFReadDirectory() so as to ignore fields whose tag is a
6codec-specified tag but this codec is not enabled. This avoids TIFFGetField()
7to behave differently depending on whether the codec is enabled or not, and
8thus can avoid stack based buffer overflows in a number of TIFF utilities
9such as tiffsplit, tiffcmp, thumbnail, etc.
10Patch derived from 0063-Handle-properly-CODEC-specific-tags.patch
11(http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël Hertzog.
12Fixes:
13http://bugzilla.maptools.org/show_bug.cgi?id=2580
14http://bugzilla.maptools.org/show_bug.cgi?id=2693
15http://bugzilla.maptools.org/show_bug.cgi?id=2625 (CVE-2016-10095)
16http://bugzilla.maptools.org/show_bug.cgi?id=2564 (CVE-2015-7554)
17http://bugzilla.maptools.org/show_bug.cgi?id=2561 (CVE-2016-5318)
18http://bugzilla.maptools.org/show_bug.cgi?id=2499 (CVE-2014-8128)
19http://bugzilla.maptools.org/show_bug.cgi?id=2441
20http://bugzilla.maptools.org/show_bug.cgi?id=2433
21
22Upstream-Status: Backport
23[https://github.com/vadz/libtiff/commit/4d4fa0b68ae9ae038959ee4f69ebe288ec892f06]
24
25CVE: CVE-2017-9147
26
27Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
28---
29 ChangeLog | 20 ++++++++++
30 libtiff/tif_dir.h | 1 +
31 libtiff/tif_dirinfo.c | 103 ++++++++++++++++++++++++++++++++++++++++++++++++++
32 libtiff/tif_dirread.c | 4 ++
33 4 files changed, 128 insertions(+)
34
35diff --git a/ChangeLog b/ChangeLog
36index ee8d9d0..5739292 100644
37--- a/ChangeLog
38+++ b/ChangeLog
39@@ -1,3 +1,23 @@
40+2017-06-01 Even Rouault <even.rouault at spatialys.com>
41+
42+ * libtiff/tif_dirinfo.c, tif_dirread.c: add _TIFFCheckFieldIsValidForCodec(),
43+ and use it in TIFFReadDirectory() so as to ignore fields whose tag is a
44+ codec-specified tag but this codec is not enabled. This avoids TIFFGetField()
45+ to behave differently depending on whether the codec is enabled or not, and
46+ thus can avoid stack based buffer overflows in a number of TIFF utilities
47+ such as tiffsplit, tiffcmp, thumbnail, etc.
48+ Patch derived from 0063-Handle-properly-CODEC-specific-tags.patch
49+ (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël Hertzog.
50+ Fixes:
51+ http://bugzilla.maptools.org/show_bug.cgi?id=2580
52+ http://bugzilla.maptools.org/show_bug.cgi?id=2693
53+ http://bugzilla.maptools.org/show_bug.cgi?id=2625 (CVE-2016-10095)
54+ http://bugzilla.maptools.org/show_bug.cgi?id=2564 (CVE-2015-7554)
55+ http://bugzilla.maptools.org/show_bug.cgi?id=2561 (CVE-2016-5318)
56+ http://bugzilla.maptools.org/show_bug.cgi?id=2499 (CVE-2014-8128)
57+ http://bugzilla.maptools.org/show_bug.cgi?id=2441
58+ http://bugzilla.maptools.org/show_bug.cgi?id=2433
59+
60 2017-05-21 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
61
62 * configure.ac: libtiff 4.0.8 released.
63diff --git a/libtiff/tif_dir.h b/libtiff/tif_dir.h
64index e12b44b..5206be4 100644
65--- a/libtiff/tif_dir.h
66+++ b/libtiff/tif_dir.h
67@@ -291,6 +291,7 @@ struct _TIFFField {
68 extern int _TIFFMergeFields(TIFF*, const TIFFField[], uint32);
69 extern const TIFFField* _TIFFFindOrRegisterField(TIFF *, uint32, TIFFDataType);
70 extern TIFFField* _TIFFCreateAnonField(TIFF *, uint32, TIFFDataType);
71+extern int _TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag);
72
73 #if defined(__cplusplus)
74 }
75diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c
76index 0c8ef42..97c0df0 100644
77--- a/libtiff/tif_dirinfo.c
78+++ b/libtiff/tif_dirinfo.c
79@@ -956,6 +956,109 @@ TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
80 return 0;
81 }
82
83+int
84+_TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag)
85+{
86+ /* Filter out non-codec specific tags */
87+ switch (tag) {
88+ /* Shared tags */
89+ case TIFFTAG_PREDICTOR:
90+ /* JPEG tags */
91+ case TIFFTAG_JPEGTABLES:
92+ /* OJPEG tags */
93+ case TIFFTAG_JPEGIFOFFSET:
94+ case TIFFTAG_JPEGIFBYTECOUNT:
95+ case TIFFTAG_JPEGQTABLES:
96+ case TIFFTAG_JPEGDCTABLES:
97+ case TIFFTAG_JPEGACTABLES:
98+ case TIFFTAG_JPEGPROC:
99+ case TIFFTAG_JPEGRESTARTINTERVAL:
100+ /* CCITT* */
101+ case TIFFTAG_BADFAXLINES:
102+ case TIFFTAG_CLEANFAXDATA:
103+ case TIFFTAG_CONSECUTIVEBADFAXLINES:
104+ case TIFFTAG_GROUP3OPTIONS:
105+ case TIFFTAG_GROUP4OPTIONS:
106+ break;
107+ default:
108+ return 1;
109+ }
110+ /* Check if codec specific tags are allowed for the current
111+ * compression scheme (codec) */
112+ switch (tif->tif_dir.td_compression) {
113+ case COMPRESSION_LZW:
114+ if (tag == TIFFTAG_PREDICTOR)
115+ return 1;
116+ break;
117+ case COMPRESSION_PACKBITS:
118+ /* No codec-specific tags */
119+ break;
120+ case COMPRESSION_THUNDERSCAN:
121+ /* No codec-specific tags */
122+ break;
123+ case COMPRESSION_NEXT:
124+ /* No codec-specific tags */
125+ break;
126+ case COMPRESSION_JPEG:
127+ if (tag == TIFFTAG_JPEGTABLES)
128+ return 1;
129+ break;
130+ case COMPRESSION_OJPEG:
131+ switch (tag) {
132+ case TIFFTAG_JPEGIFOFFSET:
133+ case TIFFTAG_JPEGIFBYTECOUNT:
134+ case TIFFTAG_JPEGQTABLES:
135+ case TIFFTAG_JPEGDCTABLES:
136+ case TIFFTAG_JPEGACTABLES:
137+ case TIFFTAG_JPEGPROC:
138+ case TIFFTAG_JPEGRESTARTINTERVAL:
139+ return 1;
140+ }
141+ break;
142+ case COMPRESSION_CCITTRLE:
143+ case COMPRESSION_CCITTRLEW:
144+ case COMPRESSION_CCITTFAX3:
145+ case COMPRESSION_CCITTFAX4:
146+ switch (tag) {
147+ case TIFFTAG_BADFAXLINES:
148+ case TIFFTAG_CLEANFAXDATA:
149+ case TIFFTAG_CONSECUTIVEBADFAXLINES:
150+ return 1;
151+ case TIFFTAG_GROUP3OPTIONS:
152+ if (tif->tif_dir.td_compression == COMPRESSION_CCITTFAX3)
153+ return 1;
154+ break;
155+ case TIFFTAG_GROUP4OPTIONS:
156+ if (tif->tif_dir.td_compression == COMPRESSION_CCITTFAX4)
157+ return 1;
158+ break;
159+ }
160+ break;
161+ case COMPRESSION_JBIG:
162+ /* No codec-specific tags */
163+ break;
164+ case COMPRESSION_DEFLATE:
165+ case COMPRESSION_ADOBE_DEFLATE:
166+ if (tag == TIFFTAG_PREDICTOR)
167+ return 1;
168+ break;
169+ case COMPRESSION_PIXARLOG:
170+ if (tag == TIFFTAG_PREDICTOR)
171+ return 1;
172+ break;
173+ case COMPRESSION_SGILOG:
174+ case COMPRESSION_SGILOG24:
175+ /* No codec-specific tags */
176+ break;
177+ case COMPRESSION_LZMA:
178+ if (tag == TIFFTAG_PREDICTOR)
179+ return 1;
180+ break;
181+
182+ }
183+ return 0;
184+}
185+
186 /* vim: set ts=8 sts=8 sw=8 noet: */
187
188 /*
189diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
190index 1d4f0b9..f1dc3d7 100644
191--- a/libtiff/tif_dirread.c
192+++ b/libtiff/tif_dirread.c
193@@ -3580,6 +3580,10 @@ TIFFReadDirectory(TIFF* tif)
194 goto bad;
195 dp->tdir_tag=IGNORE;
196 break;
197+ default:
198+ if( !_TIFFCheckFieldIsValidForCodec(tif, dp->tdir_tag) )
199+ dp->tdir_tag=IGNORE;
200+ break;
201 }
202 }
203 }
204--
2052.7.4
206
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-12 01:56:56 +0000