diff options
Diffstat (limited to 'meta/recipes-multimedia/libtiff/files/CVE-2023-25433.patch')
-rw-r--r-- | meta/recipes-multimedia/libtiff/files/CVE-2023-25433.patch | 173 |
1 files changed, 173 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-25433.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-25433.patch new file mode 100644 index 0000000000..7d6d40f25a --- /dev/null +++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-25433.patch | |||
@@ -0,0 +1,173 @@ | |||
1 | From 9c22495e5eeeae9e00a1596720c969656bb8d678 Mon Sep 17 00:00:00 2001 | ||
2 | From: Su_Laus <sulau@freenet.de> | ||
3 | Date: Fri, 3 Feb 2023 15:31:31 +0100 | ||
4 | Subject: [PATCH] tiffcrop correctly update buffersize after rotateImage() | ||
5 | fix#520 rotateImage() set up a new buffer and calculates its size | ||
6 | individually. Therefore, seg_buffs[] size needs to be updated accordingly. | ||
7 | Before this fix, the seg_buffs buffer size was calculated with a different | ||
8 | formula than within rotateImage(). | ||
9 | |||
10 | Closes #520. | ||
11 | |||
12 | Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/9c22495e5eeeae9e00a1596720c969656bb8d678 && https://gitlab.com/libtiff/libtiff/-/commit/688012dca2c39033aa2dc7bcea9796787cfd1b44] | ||
13 | CVE: CVE-2023-25433 | ||
14 | Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> | ||
15 | --- | ||
16 | tools/tiffcrop.c | 69 +++++++++++++++++++++++++++++++++++++++--------- | ||
17 | 1 file changed, 56 insertions(+), 13 deletions(-) | ||
18 | |||
19 | diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c | ||
20 | index 742615a..aab0ec6 100644 | ||
21 | --- a/tools/tiffcrop.c | ||
22 | +++ b/tools/tiffcrop.c | ||
23 | @@ -531,7 +531,7 @@ static int rotateContigSamples24bits(uint16, uint16, uint16, uint32, | ||
24 | static int rotateContigSamples32bits(uint16, uint16, uint16, uint32, | ||
25 | uint32, uint32, uint8 *, uint8 *); | ||
26 | static int rotateImage(uint16, struct image_data *, uint32 *, uint32 *, | ||
27 | - unsigned char **, int); | ||
28 | + unsigned char **, size_t *); | ||
29 | static int mirrorImage(uint16, uint16, uint16, uint32, uint32, | ||
30 | unsigned char *); | ||
31 | static int invertImage(uint16, uint16, uint16, uint32, uint32, | ||
32 | @@ -6384,7 +6384,7 @@ static int correct_orientation(struct image_data *image, unsigned char **work_b | ||
33 | * but switch xres, yres there. */ | ||
34 | uint32_t width = image->width; | ||
35 | uint32_t length = image->length; | ||
36 | - if (rotateImage(rotation, image, &width, &length, work_buff_ptr, TRUE)) | ||
37 | + if (rotateImage(rotation, image, &width, &length, work_buff_ptr, NULL)) | ||
38 | { | ||
39 | TIFFError ("correct_orientation", "Unable to rotate image"); | ||
40 | return (-1); | ||
41 | @@ -7607,8 +7607,12 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, | ||
42 | |||
43 | if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */ | ||
44 | { | ||
45 | + /* rotateImage() set up a new buffer and calculates its size | ||
46 | + * individually. Therefore, seg_buffs size needs to be updated | ||
47 | + * accordingly. */ | ||
48 | + size_t rot_buf_size = 0; | ||
49 | if (rotateImage(crop->rotation, image, &crop->combined_width, | ||
50 | - &crop->combined_length, &crop_buff, FALSE)) | ||
51 | + &crop->combined_length, &crop_buff, &rot_buf_size)) | ||
52 | { | ||
53 | TIFFError("processCropSelections", | ||
54 | "Failed to rotate composite regions by %d degrees", crop->rotation); | ||
55 | @@ -7713,8 +7717,13 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, | ||
56 | |||
57 | if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */ | ||
58 | { | ||
59 | - if (rotateImage(crop->rotation, image, &crop->regionlist[i].width, | ||
60 | - &crop->regionlist[i].length, &crop_buff, FALSE)) | ||
61 | + /* Furthermore, rotateImage() set up a new buffer and calculates | ||
62 | + * its size individually. Therefore, seg_buffs size needs to be | ||
63 | + * updated accordingly. */ | ||
64 | + size_t rot_buf_size = 0; | ||
65 | + if (rotateImage( | ||
66 | + crop->rotation, image, &crop->regionlist[i].width, | ||
67 | + &crop->regionlist[i].length, &crop_buff, &rot_buf_size)) | ||
68 | { | ||
69 | TIFFError("processCropSelections", | ||
70 | "Failed to rotate crop region by %d degrees", crop->rotation); | ||
71 | @@ -7725,8 +7734,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, | ||
72 | crop->combined_width = total_width; | ||
73 | crop->combined_length = total_length; | ||
74 | seg_buffs[i].buffer = crop_buff; | ||
75 | - seg_buffs[i].size = (((crop->regionlist[i].width * image->bps + 7 ) / 8) | ||
76 | - * image->spp) * crop->regionlist[i].length; | ||
77 | + seg_buffs[i].size = rot_buf_size; | ||
78 | } | ||
79 | } | ||
80 | } | ||
81 | @@ -7735,7 +7743,6 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, | ||
82 | |||
83 | /* Copy the crop section of the data from the current image into a buffer | ||
84 | * and adjust the IFD values to reflect the new size. If no cropping is | ||
85 | - * required, use the origial read buffer as the crop buffer. | ||
86 | * | ||
87 | * There is quite a bit of redundancy between this routine and the more | ||
88 | * specialized processCropSelections, but this provides | ||
89 | @@ -7846,7 +7853,7 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop, | ||
90 | if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */ | ||
91 | { | ||
92 | if (rotateImage(crop->rotation, image, &crop->combined_width, | ||
93 | - &crop->combined_length, crop_buff_ptr, TRUE)) | ||
94 | + &crop->combined_length, crop_buff_ptr, NULL)) | ||
95 | { | ||
96 | TIFFError("createCroppedImage", | ||
97 | "Failed to rotate image or cropped selection by %d degrees", crop->rotation); | ||
98 | @@ -8515,7 +8522,8 @@ rotateImage(uint16 rotation, struct image_data *image, uint32 *img_width, | ||
99 | uint32 bytes_per_pixel, bytes_per_sample; | ||
100 | uint32 row, rowsize, src_offset, dst_offset; | ||
101 | uint32 i, col, width, length; | ||
102 | - uint32 colsize, buffsize, col_offset, pix_offset; | ||
103 | + uint32 colsize, col_offset, pix_offset; | ||
104 | + tmsize_t buffsize; | ||
105 | unsigned char *ibuff; | ||
106 | unsigned char *src; | ||
107 | unsigned char *dst; | ||
108 | @@ -8528,12 +8536,41 @@ rotateImage(uint16 rotation, struct image_data *image, uint32 *img_width, | ||
109 | spp = image->spp; | ||
110 | bps = image->bps; | ||
111 | |||
112 | + if ((spp != 0 && bps != 0 && | ||
113 | + width > (uint32_t)((UINT32_MAX - 7) / spp / bps)) || | ||
114 | + (spp != 0 && bps != 0 && | ||
115 | + length > (uint32_t)((UINT32_MAX - 7) / spp / bps))) | ||
116 | + { | ||
117 | + TIFFError("rotateImage", "Integer overflow detected."); | ||
118 | + return (-1); | ||
119 | + } | ||
120 | + | ||
121 | rowsize = ((bps * spp * width) + 7) / 8; | ||
122 | colsize = ((bps * spp * length) + 7) / 8; | ||
123 | if ((colsize * width) > (rowsize * length)) | ||
124 | - buffsize = (colsize + 1) * width; | ||
125 | +{ | ||
126 | + if (((tmsize_t)colsize + 1) != 0 && | ||
127 | + (tmsize_t)width > ((TIFF_TMSIZE_T_MAX - NUM_BUFF_OVERSIZE_BYTES) / | ||
128 | + ((tmsize_t)colsize + 1))) | ||
129 | + { | ||
130 | + TIFFError("rotateImage", | ||
131 | + "Integer overflow when calculating buffer size."); | ||
132 | + return (-1); | ||
133 | + } | ||
134 | + buffsize = ((tmsize_t)colsize + 1) * width; | ||
135 | + } | ||
136 | else | ||
137 | - buffsize = (rowsize + 1) * length; | ||
138 | + { | ||
139 | + if (((tmsize_t)rowsize + 1) != 0 && | ||
140 | + (tmsize_t)length > ((TIFF_TMSIZE_T_MAX - NUM_BUFF_OVERSIZE_BYTES) / | ||
141 | + ((tmsize_t)rowsize + 1))) | ||
142 | + { | ||
143 | + TIFFError("rotateImage", | ||
144 | + "Integer overflow when calculating buffer size."); | ||
145 | + return (-1); | ||
146 | + } | ||
147 | + buffsize = (rowsize + 1) * length; | ||
148 | + } | ||
149 | |||
150 | bytes_per_sample = (bps + 7) / 8; | ||
151 | bytes_per_pixel = ((bps * spp) + 7) / 8; | ||
152 | @@ -8556,11 +8593,17 @@ rotateImage(uint16 rotation, struct image_data *image, uint32 *img_width, | ||
153 | /* Add 3 padding bytes for extractContigSamplesShifted32bits */ | ||
154 | if (!(rbuff = (unsigned char *)_TIFFmalloc(buffsize + NUM_BUFF_OVERSIZE_BYTES))) | ||
155 | { | ||
156 | - TIFFError("rotateImage", "Unable to allocate rotation buffer of %1u bytes", buffsize + NUM_BUFF_OVERSIZE_BYTES); | ||
157 | + TIFFError("rotateImage", | ||
158 | + "Unable to allocate rotation buffer of %" TIFF_SSIZE_FORMAT | ||
159 | + " bytes ", | ||
160 | + buffsize + NUM_BUFF_OVERSIZE_BYTES); | ||
161 | return (-1); | ||
162 | } | ||
163 | _TIFFmemset(rbuff, '\0', buffsize + NUM_BUFF_OVERSIZE_BYTES); | ||
164 | |||
165 | + if (rot_buf_size != NULL) | ||
166 | + *rot_buf_size = buffsize; | ||
167 | + | ||
168 | ibuff = *ibuff_ptr; | ||
169 | switch (rotation) | ||
170 | { | ||
171 | -- | ||
172 | 2.25.1 | ||
173 | |||