diff options
Diffstat (limited to 'meta/recipes-multimedia/libtiff/files/CVE-2022-0891.patch')
-rw-r--r-- | meta/recipes-multimedia/libtiff/files/CVE-2022-0891.patch | 217 |
1 files changed, 217 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-0891.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-0891.patch new file mode 100644 index 0000000000..e2f1bd3056 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-0891.patch | |||
@@ -0,0 +1,217 @@ | |||
1 | From 232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c Mon Sep 17 00:00:00 2001 | ||
2 | From: Su Laus <sulau@freenet.de> | ||
3 | Date: Tue, 8 Mar 2022 17:02:44 +0000 | ||
4 | Subject: [PATCH] tiffcrop: fix issue #380 and #382 heap buffer overflow in | ||
5 | extractImageSection | ||
6 | |||
7 | CVE: CVE-2022-0891 | ||
8 | Upstream-Status: Backport [https://sources.debian.org/src/tiff/4.1.0+git191117-2%7Edeb10u4/debian/patches/CVE-2022-0891.patch/] | ||
9 | Comment: No change in any hunk | ||
10 | Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> | ||
11 | --- | ||
12 | tools/tiffcrop.c | 92 +++++++++++++++++++----------------------------- | ||
13 | 1 file changed, 36 insertions(+), 56 deletions(-) | ||
14 | |||
15 | diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c | ||
16 | index f2e5474a..e62bcc71 100644 | ||
17 | --- a/tools/tiffcrop.c | ||
18 | +++ b/tools/tiffcrop.c | ||
19 | @@ -105,8 +105,8 @@ | ||
20 | * of messages to monitor progess without enabling dump logs. | ||
21 | */ | ||
22 | |||
23 | -static char tiffcrop_version_id[] = "2.4"; | ||
24 | -static char tiffcrop_rev_date[] = "12-13-2010"; | ||
25 | +static char tiffcrop_version_id[] = "2.4.1"; | ||
26 | +static char tiffcrop_rev_date[] = "03-03-2010"; | ||
27 | |||
28 | #include "tif_config.h" | ||
29 | #include "tiffiop.h" | ||
30 | @@ -6670,10 +6670,10 @@ extractImageSection(struct image_data *image, struct pageseg *section, | ||
31 | #ifdef DEVELMODE | ||
32 | uint32 img_length; | ||
33 | #endif | ||
34 | - uint32 j, shift1, shift2, trailing_bits; | ||
35 | + uint32 j, shift1, trailing_bits; | ||
36 | uint32 row, first_row, last_row, first_col, last_col; | ||
37 | uint32 src_offset, dst_offset, row_offset, col_offset; | ||
38 | - uint32 offset1, offset2, full_bytes; | ||
39 | + uint32 offset1, full_bytes; | ||
40 | uint32 sect_width; | ||
41 | #ifdef DEVELMODE | ||
42 | uint32 sect_length; | ||
43 | @@ -6683,7 +6683,6 @@ extractImageSection(struct image_data *image, struct pageseg *section, | ||
44 | #ifdef DEVELMODE | ||
45 | int k; | ||
46 | unsigned char bitset; | ||
47 | - static char *bitarray = NULL; | ||
48 | #endif | ||
49 | |||
50 | img_width = image->width; | ||
51 | @@ -6701,17 +6700,12 @@ extractImageSection(struct image_data *image, struct pageseg *section, | ||
52 | dst_offset = 0; | ||
53 | |||
54 | #ifdef DEVELMODE | ||
55 | - if (bitarray == NULL) | ||
56 | - { | ||
57 | - if ((bitarray = (char *)malloc(img_width)) == NULL) | ||
58 | - { | ||
59 | - TIFFError ("", "DEBUG: Unable to allocate debugging bitarray"); | ||
60 | - return (-1); | ||
61 | - } | ||
62 | - } | ||
63 | + char bitarray[39]; | ||
64 | #endif | ||
65 | |||
66 | - /* rows, columns, width, length are expressed in pixels */ | ||
67 | + /* rows, columns, width, length are expressed in pixels | ||
68 | + * first_row, last_row, .. are index into image array starting at 0 to width-1, | ||
69 | + * last_col shall be also extracted. */ | ||
70 | first_row = section->y1; | ||
71 | last_row = section->y2; | ||
72 | first_col = section->x1; | ||
73 | @@ -6721,9 +6715,14 @@ extractImageSection(struct image_data *image, struct pageseg *section, | ||
74 | #ifdef DEVELMODE | ||
75 | sect_length = last_row - first_row + 1; | ||
76 | #endif | ||
77 | - img_rowsize = ((img_width * bps + 7) / 8) * spp; | ||
78 | - full_bytes = (sect_width * spp * bps) / 8; /* number of COMPLETE bytes per row in section */ | ||
79 | - trailing_bits = (sect_width * bps) % 8; | ||
80 | + /* The read function loadImage() used copy separate plane data into a buffer as interleaved | ||
81 | + * samples rather than separate planes so the same logic works to extract regions | ||
82 | + * regardless of the way the data are organized in the input file. | ||
83 | + * Furthermore, bytes and bits are arranged in buffer according to COMPRESSION=1 and FILLORDER=1 | ||
84 | + */ | ||
85 | + img_rowsize = (((img_width * spp * bps) + 7) / 8); /* row size in full bytes of source image */ | ||
86 | + full_bytes = (sect_width * spp * bps) / 8; /* number of COMPLETE bytes per row in section */ | ||
87 | + trailing_bits = (sect_width * spp * bps) % 8; /* trailing bits within the last byte of destination buffer */ | ||
88 | |||
89 | #ifdef DEVELMODE | ||
90 | TIFFError ("", "First row: %d, last row: %d, First col: %d, last col: %d\n", | ||
91 | @@ -6736,10 +6735,9 @@ extractImageSection(struct image_data *image, struct pageseg *section, | ||
92 | |||
93 | if ((bps % 8) == 0) | ||
94 | { | ||
95 | - col_offset = first_col * spp * bps / 8; | ||
96 | + col_offset = (first_col * spp * bps) / 8; | ||
97 | for (row = first_row; row <= last_row; row++) | ||
98 | { | ||
99 | - /* row_offset = row * img_width * spp * bps / 8; */ | ||
100 | row_offset = row * img_rowsize; | ||
101 | src_offset = row_offset + col_offset; | ||
102 | |||
103 | @@ -6752,14 +6750,12 @@ extractImageSection(struct image_data *image, struct pageseg *section, | ||
104 | } | ||
105 | else | ||
106 | { /* bps != 8 */ | ||
107 | - shift1 = spp * ((first_col * bps) % 8); | ||
108 | - shift2 = spp * ((last_col * bps) % 8); | ||
109 | + shift1 = ((first_col * spp * bps) % 8); /* shift1 = bits to skip in the first byte of source buffer*/ | ||
110 | for (row = first_row; row <= last_row; row++) | ||
111 | { | ||
112 | /* pull out the first byte */ | ||
113 | row_offset = row * img_rowsize; | ||
114 | - offset1 = row_offset + (first_col * bps / 8); | ||
115 | - offset2 = row_offset + (last_col * bps / 8); | ||
116 | + offset1 = row_offset + ((first_col * spp * bps) / 8); /* offset1 = offset into source of byte with first bits to be extracted */ | ||
117 | |||
118 | #ifdef DEVELMODE | ||
119 | for (j = 0, k = 7; j < 8; j++, k--) | ||
120 | @@ -6771,12 +6767,12 @@ extractImageSection(struct image_data *image, struct pageseg *section, | ||
121 | sprintf(&bitarray[9], " "); | ||
122 | for (j = 10, k = 7; j < 18; j++, k--) | ||
123 | { | ||
124 | - bitset = *(src_buff + offset2) & (((unsigned char)1 << k)) ? 1 : 0; | ||
125 | + bitset = *(src_buff + offset1 + full_bytes) & (((unsigned char)1 << k)) ? 1 : 0; | ||
126 | sprintf(&bitarray[j], (bitset) ? "1" : "0"); | ||
127 | } | ||
128 | bitarray[18] = '\0'; | ||
129 | - TIFFError ("", "Row: %3d Offset1: %d, Shift1: %d, Offset2: %d, Shift2: %d\n", | ||
130 | - row, offset1, shift1, offset2, shift2); | ||
131 | + TIFFError ("", "Row: %3d Offset1: %"PRIu32", Shift1: %"PRIu32", Offset2: %"PRIu32", Trailing_bits: %"PRIu32"\n", | ||
132 | + row, offset1, shift1, offset1+full_bytes, trailing_bits); | ||
133 | #endif | ||
134 | |||
135 | bytebuff1 = bytebuff2 = 0; | ||
136 | @@ -6800,11 +6796,12 @@ extractImageSection(struct image_data *image, struct pageseg *section, | ||
137 | |||
138 | if (trailing_bits != 0) | ||
139 | { | ||
140 | - bytebuff2 = src_buff[offset2] & ((unsigned char)255 << (7 - shift2)); | ||
141 | + /* Only copy higher bits of samples and mask lower bits of not wanted column samples to zero */ | ||
142 | + bytebuff2 = src_buff[offset1 + full_bytes] & ((unsigned char)255 << (8 - trailing_bits)); | ||
143 | sect_buff[dst_offset] = bytebuff2; | ||
144 | #ifdef DEVELMODE | ||
145 | TIFFError ("", " Trailing bits src offset: %8d, Dst offset: %8d\n", | ||
146 | - offset2, dst_offset); | ||
147 | + offset1 + full_bytes, dst_offset); | ||
148 | for (j = 30, k = 7; j < 38; j++, k--) | ||
149 | { | ||
150 | bitset = *(sect_buff + dst_offset) & (((unsigned char)1 << k)) ? 1 : 0; | ||
151 | @@ -6823,8 +6820,10 @@ extractImageSection(struct image_data *image, struct pageseg *section, | ||
152 | #endif | ||
153 | for (j = 0; j <= full_bytes; j++) | ||
154 | { | ||
155 | - bytebuff1 = src_buff[offset1 + j] & ((unsigned char)255 >> shift1); | ||
156 | - bytebuff2 = src_buff[offset1 + j + 1] & ((unsigned char)255 << (7 - shift1)); | ||
157 | + /* Skip the first shift1 bits and shift the source up by shift1 bits before save to destination.*/ | ||
158 | + /* Attention: src_buff size needs to be some bytes larger than image size, because could read behind image here. */ | ||
159 | + bytebuff1 = src_buff[offset1 + j] & ((unsigned char)255 >> shift1); | ||
160 | + bytebuff2 = src_buff[offset1 + j + 1] & ((unsigned char)255 << (8 - shift1)); | ||
161 | sect_buff[dst_offset + j] = (bytebuff1 << shift1) | (bytebuff2 >> (8 - shift1)); | ||
162 | } | ||
163 | #ifdef DEVELMODE | ||
164 | @@ -6840,36 +6839,17 @@ extractImageSection(struct image_data *image, struct pageseg *section, | ||
165 | #endif | ||
166 | dst_offset += full_bytes; | ||
167 | |||
168 | + /* Copy the trailing_bits for the last byte in the destination buffer. | ||
169 | + Could come from one ore two bytes of the source buffer. */ | ||
170 | if (trailing_bits != 0) | ||
171 | { | ||
172 | #ifdef DEVELMODE | ||
173 | - TIFFError ("", " Trailing bits src offset: %8d, Dst offset: %8d\n", offset1 + full_bytes, dst_offset); | ||
174 | -#endif | ||
175 | - if (shift2 > shift1) | ||
176 | - { | ||
177 | - bytebuff1 = src_buff[offset1 + full_bytes] & ((unsigned char)255 << (7 - shift2)); | ||
178 | - bytebuff2 = bytebuff1 & ((unsigned char)255 << shift1); | ||
179 | - sect_buff[dst_offset] = bytebuff2; | ||
180 | -#ifdef DEVELMODE | ||
181 | - TIFFError ("", " Shift2 > Shift1\n"); | ||
182 | + TIFFError("", " Trailing bits %4"PRIu32" src offset: %8"PRIu32", Dst offset: %8"PRIu32"\n", trailing_bits, offset1 + full_bytes, dst_offset); | ||
183 | #endif | ||
184 | + /* More than necessary bits are already copied into last destination buffer, | ||
185 | + * only masking of last byte in destination buffer is necessary.*/ | ||
186 | + sect_buff[dst_offset] &= ((uint8_t)0xFF << (8 - trailing_bits)); | ||
187 | } | ||
188 | - else | ||
189 | - { | ||
190 | - if (shift2 < shift1) | ||
191 | - { | ||
192 | - bytebuff2 = ((unsigned char)255 << (shift1 - shift2 - 1)); | ||
193 | - sect_buff[dst_offset] &= bytebuff2; | ||
194 | -#ifdef DEVELMODE | ||
195 | - TIFFError ("", " Shift2 < Shift1\n"); | ||
196 | -#endif | ||
197 | - } | ||
198 | -#ifdef DEVELMODE | ||
199 | - else | ||
200 | - TIFFError ("", " Shift2 == Shift1\n"); | ||
201 | -#endif | ||
202 | - } | ||
203 | - } | ||
204 | #ifdef DEVELMODE | ||
205 | sprintf(&bitarray[28], " "); | ||
206 | sprintf(&bitarray[29], " "); | ||
207 | @@ -7022,7 +7002,7 @@ writeImageSections(TIFF *in, TIFF *out, struct image_data *image, | ||
208 | width = sections[i].x2 - sections[i].x1 + 1; | ||
209 | length = sections[i].y2 - sections[i].y1 + 1; | ||
210 | sectsize = (uint32) | ||
211 | - ceil((width * image->bps + 7) / (double)8) * image->spp * length; | ||
212 | + ceil((width * image->bps * image->spp + 7) / (double)8) * length; | ||
213 | /* allocate a buffer if we don't have one already */ | ||
214 | if (createImageSection(sectsize, sect_buff_ptr)) | ||
215 | { | ||
216 | -- | ||
217 | GitLab | ||