summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/libtiff
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-multimedia/libtiff')
-rw-r--r--meta/recipes-multimedia/libtiff/files/0001-tiffset-fix-global-buffer-overflow-for-ASCII-tags-wh.patch52
-rw-r--r--meta/recipes-multimedia/libtiff/files/001_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch148
-rw-r--r--meta/recipes-multimedia/libtiff/files/002_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch27
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2020-35521_and_CVE-2020-35522.patch119
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2020-35523.patch55
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2020-35524-1.patch42
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2020-35524-2.patch36
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-0865.patch39
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-0891.patch217
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-0907.patch94
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-0908.patch34
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-0909.patch37
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-0924.patch58
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-2056-CVE-2022-2057-CVE-2022-2058.patch183
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-2867-CVE-2022-2868-CVE-2022-2869.patch159
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-34526.patch29
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-3570_3598.patch659
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-3597_3626_3627.patch123
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-3599.patch277
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-3970.patch45
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-40090.patch548
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2022-48281.patch26
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-0795_0796_0797_0798_0799.patch157
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-0800_0801_0802_0803_0804.patch135
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-1916.patch91
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-25433.patch173
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-25434-CVE-2023-25435.patch94
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-26965.patch90
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-26966.patch35
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-2908.patch33
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-3316.patch59
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-3576.patch35
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-3618.patch47
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-40745.patch34
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-41175.patch67
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-52356.patch53
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-6228.patch30
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-6277-1.patch191
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-6277-2.patch152
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-6277-3.patch46
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2023-6277-4.patch94
-rw-r--r--meta/recipes-multimedia/libtiff/tiff/561599c99f987dc32ae110370cfdd7df7975586b.patch28
-rw-r--r--meta/recipes-multimedia/libtiff/tiff/CVE-2022-1354.patch212
-rw-r--r--meta/recipes-multimedia/libtiff/tiff/CVE-2022-1355.patch62
-rw-r--r--meta/recipes-multimedia/libtiff/tiff/eecb0712f4c3a5b449f70c57988260a667ddbdef.patch30
-rw-r--r--meta/recipes-multimedia/libtiff/tiff_4.1.0.bb53
46 files changed, 5008 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/0001-tiffset-fix-global-buffer-overflow-for-ASCII-tags-wh.patch b/meta/recipes-multimedia/libtiff/files/0001-tiffset-fix-global-buffer-overflow-for-ASCII-tags-wh.patch
new file mode 100644
index 0000000000..31f867e000
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/0001-tiffset-fix-global-buffer-overflow-for-ASCII-tags-wh.patch
@@ -0,0 +1,52 @@
1From b12a0326e6064b6e0b051d1184a219877472f69b Mon Sep 17 00:00:00 2001
2From: 4ugustus <wangdw.augustus@qq.com>
3Date: Tue, 25 Jan 2022 16:25:28 +0000
4Subject: [PATCH] tiffset: fix global-buffer-overflow for ASCII tags where
5 count is required (fixes #355)
6
7CVE: CVE-2022-22844
8Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e0aa51bc64]
9Signed-off-by: Purushottam Choudhary <purushottam.choudhary@kpit.com>
10Signed-off-by: Purushottam Choudhary <purushottamchoudhary29@gmail.com>
11Comments: Add header stdint.h in tiffset.c explicitly for UINT16_MAX
12---
13 tools/tiffset.c | 17 ++++++++++++++---
14 1 file changed, 14 insertions(+), 3 deletions(-)
15
16diff --git a/tools/tiffset.c b/tools/tiffset.c
17index 8c9e23c5..e7a88c09 100644
18--- a/tools/tiffset.c
19+++ b/tools/tiffset.c
20@@ -33,6 +33,7 @@
21 #include <string.h>
22 #include <stdlib.h>
23
24+#include <stdint.h>
25 #include "tiffio.h"
26
27 static char* usageMsg[] = {
28@@ -146,9 +146,19 @@ main(int argc, char* argv[])
29
30 arg_index++;
31 if (TIFFFieldDataType(fip) == TIFF_ASCII) {
32- if (TIFFSetField(tiff, TIFFFieldTag(fip), argv[arg_index]) != 1)
33- fprintf( stderr, "Failed to set %s=%s\n",
34- TIFFFieldName(fip), argv[arg_index] );
35+ if(TIFFFieldPassCount( fip )) {
36+ size_t len;
37+ len = strlen(argv[arg_index]) + 1;
38+ if (len > UINT16_MAX || TIFFSetField(tiff, TIFFFieldTag(fip),
39+ (uint16_t)len, argv[arg_index]) != 1)
40+ fprintf( stderr, "Failed to set %s=%s\n",
41+ TIFFFieldName(fip), argv[arg_index] );
42+ } else {
43+ if (TIFFSetField(tiff, TIFFFieldTag(fip),
44+ argv[arg_index]) != 1)
45+ fprintf( stderr, "Failed to set %s=%s\n",
46+ TIFFFieldName(fip), argv[arg_index] );
47+ }
48 } else if (TIFFFieldWriteCount(fip) > 0
49 || TIFFFieldWriteCount(fip) == TIFF_VARIABLE) {
50 int ret = 1;
51--
52GitLab
diff --git a/meta/recipes-multimedia/libtiff/files/001_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch b/meta/recipes-multimedia/libtiff/files/001_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch
new file mode 100644
index 0000000000..9b4724a325
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/001_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch
@@ -0,0 +1,148 @@
1From 02875964eba5c4a2ea98c41562835428214adfe7 Mon Sep 17 00:00:00 2001
2From: Thomas Bernard <miniupnp@free.fr>
3Date: Sat, 7 Mar 2020 13:21:56 +0100
4Subject: [PATCH] tiff2rgba: output usage to stdout when using -h
5
6also uses std C EXIT_FAILURE / EXIT_SUCCESS
7see #17
8
9Signed-off-by: akash hadke <akash.hadke@kpit.com>
10---
11 tools/tiff2rgba.c | 39 ++++++++++++++++++++++++---------------
12 1 file changed, 24 insertions(+), 15 deletions(-)
13---
14Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/02875964eba5c4a2ea98c41562835428214adfe7.patch]
15---
16diff --git a/tools/tiff2rgba.c b/tools/tiff2rgba.c
17index 2eb6f6c4..ef643653 100644
18--- a/tools/tiff2rgba.c
19+++ b/tools/tiff2rgba.c
20@@ -39,6 +39,13 @@
21 #include "tiffiop.h"
22 #include "tiffio.h"
23
24+#ifndef EXIT_SUCCESS
25+#define EXIT_SUCCESS 0
26+#endif
27+#ifndef EXIT_FAILURE
28+#define EXIT_FAILURE 1
29+#endif
30+
31 #define streq(a,b) (strcmp(a,b) == 0)
32 #define CopyField(tag, v) \
33 if (TIFFGetField(in, tag, &v)) TIFFSetField(out, tag, v)
34@@ -68,7 +75,7 @@ main(int argc, char* argv[])
35 extern char *optarg;
36 #endif
37
38- while ((c = getopt(argc, argv, "c:r:t:bn8")) != -1)
39+ while ((c = getopt(argc, argv, "c:r:t:bn8h")) != -1)
40 switch (c) {
41 case 'b':
42 process_by_block = 1;
43@@ -86,7 +93,7 @@ main(int argc, char* argv[])
44 else if (streq(optarg, "zip"))
45 compression = COMPRESSION_DEFLATE;
46 else
47- usage(-1);
48+ usage(EXIT_FAILURE);
49 break;
50
51 case 'r':
52@@ -105,17 +112,20 @@ main(int argc, char* argv[])
53 bigtiff_output = 1;
54 break;
55
56+ case 'h':
57+ usage(EXIT_SUCCESS);
58+ /*NOTREACHED*/
59 case '?':
60- usage(0);
61+ usage(EXIT_FAILURE);
62 /*NOTREACHED*/
63 }
64
65 if (argc - optind < 2)
66- usage(-1);
67+ usage(EXIT_FAILURE);
68
69 out = TIFFOpen(argv[argc-1], bigtiff_output?"w8":"w");
70 if (out == NULL)
71- return (-2);
72+ return (EXIT_FAILURE);
73
74 for (; optind < argc-1; optind++) {
75 in = TIFFOpen(argv[optind], "r");
76@@ -132,7 +142,7 @@ main(int argc, char* argv[])
77 }
78 }
79 (void) TIFFClose(out);
80- return (0);
81+ return (EXIT_SUCCESS);
82 }
83
84 static int
85@@ -166,7 +176,7 @@ cvt_by_tile( TIFF *in, TIFF *out )
86 if (tile_width != (rastersize / tile_height) / sizeof( uint32))
87 {
88 TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");
89- exit(-1);
90+ exit(EXIT_FAILURE);
91 }
92 raster = (uint32*)_TIFFmalloc(rastersize);
93 if (raster == 0) {
94@@ -182,7 +192,7 @@ cvt_by_tile( TIFF *in, TIFF *out )
95 if (tile_width != wrk_linesize / sizeof (uint32))
96 {
97 TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");
98- exit(-1);
99+ exit(EXIT_FAILURE);
100 }
101 wrk_line = (uint32*)_TIFFmalloc(wrk_linesize);
102 if (!wrk_line) {
103@@ -279,7 +289,7 @@ cvt_by_strip( TIFF *in, TIFF *out )
104 if (width != (rastersize / rowsperstrip) / sizeof( uint32))
105 {
106 TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");
107- exit(-1);
108+ exit(EXIT_FAILURE);
109 }
110 raster = (uint32*)_TIFFmalloc(rastersize);
111 if (raster == 0) {
112@@ -295,7 +305,7 @@ cvt_by_strip( TIFF *in, TIFF *out )
113 if (width != wrk_linesize / sizeof (uint32))
114 {
115 TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");
116- exit(-1);
117+ exit(EXIT_FAILURE);
118 }
119 wrk_line = (uint32*)_TIFFmalloc(wrk_linesize);
120 if (!wrk_line) {
121@@ -528,7 +538,7 @@ tiffcvt(TIFF* in, TIFF* out)
122 return( cvt_whole_image( in, out ) );
123 }
124
125-static char* stuff[] = {
126+const static char* stuff[] = {
127 "usage: tiff2rgba [-c comp] [-r rows] [-b] [-n] [-8] input... output",
128 "where comp is one of the following compression algorithms:",
129 " jpeg\t\tJPEG encoding",
130@@ -547,13 +557,12 @@ static char* stuff[] = {
131 static void
132 usage(int code)
133 {
134- char buf[BUFSIZ];
135 int i;
136+ FILE * out = (code == EXIT_SUCCESS) ? stdout : stderr;
137
138- setbuf(stderr, buf);
139- fprintf(stderr, "%s\n\n", TIFFGetVersion());
140+ fprintf(out, "%s\n\n", TIFFGetVersion());
141 for (i = 0; stuff[i] != NULL; i++)
142- fprintf(stderr, "%s\n", stuff[i]);
143+ fprintf(out, "%s\n", stuff[i]);
144 exit(code);
145 }
146
147--
148GitLab
diff --git a/meta/recipes-multimedia/libtiff/files/002_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch b/meta/recipes-multimedia/libtiff/files/002_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch
new file mode 100644
index 0000000000..b6e1842a54
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/002_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch
@@ -0,0 +1,27 @@
1From ca70b5e702b9f503333344b2d46691de9feae84e Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Sat, 3 Oct 2020 18:16:27 +0200
4Subject: [PATCH] tiff2rgba.c: fix -Wold-style-declaration warning
5
6Signed-off-by: akash hadke <akash.hadke@kpit.com>
7---
8 tools/tiff2rgba.c | 2 +-
9 1 file changed, 1 insertion(+), 1 deletion(-)
10---
11Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/ca70b5e702b9f503333344b2d46691de9feae84e.patch]
12---
13diff --git a/tools/tiff2rgba.c b/tools/tiff2rgba.c
14index ef643653..fbc383aa 100644
15--- a/tools/tiff2rgba.c
16+++ b/tools/tiff2rgba.c
17@@ -538,7 +538,7 @@ tiffcvt(TIFF* in, TIFF* out)
18 return( cvt_whole_image( in, out ) );
19 }
20
21-const static char* stuff[] = {
22+static const char* stuff[] = {
23 "usage: tiff2rgba [-c comp] [-r rows] [-b] [-n] [-8] input... output",
24 "where comp is one of the following compression algorithms:",
25 " jpeg\t\tJPEG encoding",
26--
27GitLab
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2020-35521_and_CVE-2020-35522.patch b/meta/recipes-multimedia/libtiff/files/CVE-2020-35521_and_CVE-2020-35522.patch
new file mode 100644
index 0000000000..129721ff3e
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2020-35521_and_CVE-2020-35522.patch
@@ -0,0 +1,119 @@
1From 98a254f5b92cea22f5436555ff7fceb12afee84d Mon Sep 17 00:00:00 2001
2From: Thomas Bernard <miniupnp@free.fr>
3Date: Sun, 15 Nov 2020 17:02:51 +0100
4Subject: [PATCH 1/2] enforce (configurable) memory limit in tiff2rgba
5
6fixes #207
7fixes #209
8
9Signed-off-by: akash hadke <akash.hadke@kpit.com>
10---
11 tools/tiff2rgba.c | 25 +++++++++++++++++++++++--
12 1 file changed, 23 insertions(+), 2 deletions(-)
13---
14CVE: CVE-2020-35521
15CVE: CVE-2020-35522
16Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/b5a935d96b21cda0f434230cdf8ca958cd8b4eef.patch]
17---
18diff --git a/tools/tiff2rgba.c b/tools/tiff2rgba.c
19index fbc383aa..764395f6 100644
20--- a/tools/tiff2rgba.c
21+++ b/tools/tiff2rgba.c
22@@ -60,6 +60,10 @@ uint32 rowsperstrip = (uint32) -1;
23 int process_by_block = 0; /* default is whole image at once */
24 int no_alpha = 0;
25 int bigtiff_output = 0;
26+#define DEFAULT_MAX_MALLOC (256 * 1024 * 1024)
27+/* malloc size limit (in bytes)
28+ * disabled when set to 0 */
29+static tmsize_t maxMalloc = DEFAULT_MAX_MALLOC;
30
31
32 static int tiffcvt(TIFF* in, TIFF* out);
33@@ -75,8 +79,11 @@ main(int argc, char* argv[])
34 extern char *optarg;
35 #endif
36
37- while ((c = getopt(argc, argv, "c:r:t:bn8h")) != -1)
38+ while ((c = getopt(argc, argv, "c:r:t:bn8hM:")) != -1)
39 switch (c) {
40+ case 'M':
41+ maxMalloc = (tmsize_t)strtoul(optarg, NULL, 0) << 20;
42+ break;
43 case 'b':
44 process_by_block = 1;
45 break;
46@@ -405,6 +412,12 @@ cvt_whole_image( TIFF *in, TIFF *out )
47 (unsigned long)width, (unsigned long)height);
48 return 0;
49 }
50+ if (maxMalloc != 0 && (tmsize_t)pixel_count * (tmsize_t)sizeof(uint32) > maxMalloc) {
51+ TIFFError(TIFFFileName(in),
52+ "Raster size " TIFF_UINT64_FORMAT " over memory limit (" TIFF_UINT64_FORMAT "), try -b option.",
53+ (uint64)pixel_count * sizeof(uint32), (uint64)maxMalloc);
54+ return 0;
55+ }
56
57 rowsperstrip = TIFFDefaultStripSize(out, rowsperstrip);
58 TIFFSetField(out, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
59@@ -530,6 +543,13 @@ tiffcvt(TIFF* in, TIFF* out)
60 TIFFSetField(out, TIFFTAG_SOFTWARE, TIFFGetVersion());
61 CopyField(TIFFTAG_DOCUMENTNAME, stringv);
62
63+ if (maxMalloc != 0 && TIFFStripSize(in) > maxMalloc)
64+ {
65+ TIFFError(TIFFFileName(in),
66+ "Strip Size " TIFF_UINT64_FORMAT " over memory limit (" TIFF_UINT64_FORMAT ")",
67+ (uint64)TIFFStripSize(in), (uint64)maxMalloc);
68+ return 0;
69+ }
70 if( process_by_block && TIFFIsTiled( in ) )
71 return( cvt_by_tile( in, out ) );
72 else if( process_by_block )
73@@ -539,7 +559,7 @@ tiffcvt(TIFF* in, TIFF* out)
74 }
75
76 static const char* stuff[] = {
77- "usage: tiff2rgba [-c comp] [-r rows] [-b] [-n] [-8] input... output",
78+ "usage: tiff2rgba [-c comp] [-r rows] [-b] [-n] [-8] [-M size] input... output",
79 "where comp is one of the following compression algorithms:",
80 " jpeg\t\tJPEG encoding",
81 " zip\t\tZip/Deflate encoding",
82@@ -551,6 +571,7 @@ static const char* stuff[] = {
83 " -b (progress by block rather than as a whole image)",
84 " -n don't emit alpha component.",
85 " -8 write BigTIFF file instead of ClassicTIFF",
86+ " -M set the memory allocation limit in MiB. 0 to disable limit",
87 NULL
88 };
89
90--
91GitLab
92
93
94From e9e504193ef1f87e9cb5e986586b0cbe3254e421 Mon Sep 17 00:00:00 2001
95From: Thomas Bernard <miniupnp@free.fr>
96Date: Sun, 15 Nov 2020 17:08:42 +0100
97Subject: [PATCH 2/2] tiff2rgba.1: -M option
98
99---
100 man/tiff2rgba.1 | 4 ++++
101 1 file changed, 4 insertions(+)
102
103diff --git a/man/tiff2rgba.1 b/man/tiff2rgba.1
104index d9c9baae..fe9ebb2c 100644
105--- a/man/tiff2rgba.1
106+++ b/man/tiff2rgba.1
107@@ -87,6 +87,10 @@ Drop the alpha component from the output file, producing a pure RGB file.
108 Currently this does not work if the
109 .B \-b
110 flag is also in effect.
111+.TP
112+.BI \-M " size"
113+Set maximum memory allocation size (in MiB). The default is 256MiB.
114+Set to 0 to disable the limit.
115 .SH "SEE ALSO"
116 .BR tiff2bw (1),
117 .BR TIFFReadRGBAImage (3t),
118--
119GitLab
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2020-35523.patch b/meta/recipes-multimedia/libtiff/files/CVE-2020-35523.patch
new file mode 100644
index 0000000000..1f30b32799
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2020-35523.patch
@@ -0,0 +1,55 @@
1From c8d613ef497058fe653c467fc84c70a62a4a71b2 Mon Sep 17 00:00:00 2001
2From: Thomas Bernard <miniupnp@free.fr>
3Date: Tue, 10 Nov 2020 01:54:30 +0100
4Subject: [PATCH] gtTileContig(): check Tile width for overflow
5
6fixes #211
7
8Upstream-Status: Backport [ https://gitlab.com/libtiff/libtiff/-/commit/c8d613ef497058fe653c467fc84c70a62a4a71b2 ]
9CVE: CVE-2020-35523
10Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
11---
12 libtiff/tif_getimage.c | 17 +++++++++++++----
13 1 file changed, 13 insertions(+), 4 deletions(-)
14
15diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
16index 4da785d3..96ab1460 100644
17--- a/libtiff/tif_getimage.c
18+++ b/libtiff/tif_getimage.c
19@@ -29,6 +29,7 @@
20 */
21 #include "tiffiop.h"
22 #include <stdio.h>
23+#include <limits.h>
24
25 static int gtTileContig(TIFFRGBAImage*, uint32*, uint32, uint32);
26 static int gtTileSeparate(TIFFRGBAImage*, uint32*, uint32, uint32);
27@@ -645,12 +646,20 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
28
29 flip = setorientation(img);
30 if (flip & FLIP_VERTICALLY) {
31- y = h - 1;
32- toskew = -(int32)(tw + w);
33+ if ((tw + w) > INT_MAX) {
34+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)");
35+ return (0);
36+ }
37+ y = h - 1;
38+ toskew = -(int32)(tw + w);
39 }
40 else {
41- y = 0;
42- toskew = -(int32)(tw - w);
43+ if (tw > (INT_MAX + w)) {
44+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)");
45+ return (0);
46+ }
47+ y = 0;
48+ toskew = -(int32)(tw - w);
49 }
50
51 /*
52--
53GitLab
54
55
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2020-35524-1.patch b/meta/recipes-multimedia/libtiff/files/CVE-2020-35524-1.patch
new file mode 100644
index 0000000000..5232eacb50
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2020-35524-1.patch
@@ -0,0 +1,42 @@
1From c6a12721b46f1a72974f91177890301730d7b330 Mon Sep 17 00:00:00 2001
2From: Thomas Bernard <miniupnp@free.fr>
3Date: Tue, 10 Nov 2020 01:01:59 +0100
4Subject: [PATCH] tiff2pdf.c: properly calculate datasize when saving to JPEG
5 YCbCr
6
7fixes #220
8Upstream-Status: Backport
9https://gitlab.com/libtiff/libtiff/-/commit/c6a12721b46f1a72974f91177890301730d7b330
10https://gitlab.com/libtiff/libtiff/-/merge_requests/159/commits
11CVE: CVE-2021-35524
12Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
13
14---
15 tools/tiff2pdf.c | 11 ++++++++---
16 1 file changed, 8 insertions(+), 3 deletions(-)
17
18diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
19index 719811ea..dc69d2f9 100644
20--- a/tools/tiff2pdf.c
21+++ b/tools/tiff2pdf.c
22@@ -2087,9 +2087,14 @@ void t2p_read_tiff_size(T2P* t2p, TIFF* input){
23 #endif
24 (void) 0;
25 }
26- k = checkMultiply64(TIFFScanlineSize(input), t2p->tiff_length, t2p);
27- if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){
28- k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
29+ if(t2p->pdf_compression == T2P_COMPRESS_JPEG
30+ && t2p->tiff_photometric == PHOTOMETRIC_YCBCR) {
31+ k = checkMultiply64(TIFFNumberOfStrips(input), TIFFStripSize(input), t2p);
32+ } else {
33+ k = checkMultiply64(TIFFScanlineSize(input), t2p->tiff_length, t2p);
34+ if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){
35+ k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
36+ }
37 }
38 if (k == 0) {
39 /* Assume we had overflow inside TIFFScanlineSize */
40--
41GitLab
42
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2020-35524-2.patch b/meta/recipes-multimedia/libtiff/files/CVE-2020-35524-2.patch
new file mode 100644
index 0000000000..406d467766
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2020-35524-2.patch
@@ -0,0 +1,36 @@
1From d74f56e3b7ea55c8a18a03bc247cd5fd0ca288b2 Mon Sep 17 00:00:00 2001
2From: Thomas Bernard <miniupnp@free.fr>
3Date: Tue, 10 Nov 2020 02:05:05 +0100
4Subject: [PATCH] Fix for building without JPEG support
5
6Upstream-Status: Backport
7https://gitlab.com/libtiff/libtiff/-/commit/d74f56e3b7ea55c8a18a03bc247cd5fd0ca288b2
8https://gitlab.com/libtiff/libtiff/-/merge_requests/159/commits
9CVE: CVE-2021-35524
10Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
11---
12 tools/tiff2pdf.c | 5 ++++-
13 1 file changed, 4 insertions(+), 1 deletion(-)
14
15diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
16index dc69d2f9..d0b0ede7 100644
17--- a/tools/tiff2pdf.c
18+++ b/tools/tiff2pdf.c
19@@ -2087,10 +2087,13 @@ void t2p_read_tiff_size(T2P* t2p, TIFF* input){
20 #endif
21 (void) 0;
22 }
23+#ifdef JPEG_SUPPORT
24 if(t2p->pdf_compression == T2P_COMPRESS_JPEG
25 && t2p->tiff_photometric == PHOTOMETRIC_YCBCR) {
26 k = checkMultiply64(TIFFNumberOfStrips(input), TIFFStripSize(input), t2p);
27- } else {
28+ } else
29+#endif
30+ {
31 k = checkMultiply64(TIFFScanlineSize(input), t2p->tiff_length, t2p);
32 if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){
33 k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
34--
35GitLab
36
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-0865.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-0865.patch
new file mode 100644
index 0000000000..e2d136f587
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-0865.patch
@@ -0,0 +1,39 @@
1From a1c933dabd0e1c54a412f3f84ae0aa58115c6067 Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Thu, 24 Feb 2022 22:26:02 +0100
4Subject: [PATCH] tif_jbig.c: fix crash when reading a file with multiple IFD
5 in memory-mapped mode and when bit reversal is needed (fixes #385)
6
7CVE: CVE-2022-0865
8Upstream-Status: Backport [https://sources.debian.org/src/tiff/4.1.0+git191117-2%7Edeb10u4/debian/patches/CVE-2022-0865.patch/]
9Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
10Comment: No change in any hunk
11
12---
13 libtiff/tif_jbig.c | 10 ++++++++++
14 1 file changed, 10 insertions(+)
15
16diff --git a/libtiff/tif_jbig.c b/libtiff/tif_jbig.c
17index 74086338..8bfa4cef 100644
18--- a/libtiff/tif_jbig.c
19+++ b/libtiff/tif_jbig.c
20@@ -208,6 +208,16 @@ int TIFFInitJBIG(TIFF* tif, int scheme)
21 */
22 tif->tif_flags |= TIFF_NOBITREV;
23 tif->tif_flags &= ~TIFF_MAPPED;
24+ /* We may have read from a previous IFD and thus set TIFF_BUFFERMMAP and
25+ * cleared TIFF_MYBUFFER. It is necessary to restore them to their initial
26+ * value to be consistent with the state of a non-memory mapped file.
27+ */
28+ if (tif->tif_flags&TIFF_BUFFERMMAP) {
29+ tif->tif_rawdata = NULL;
30+ tif->tif_rawdatasize = 0;
31+ tif->tif_flags &= ~TIFF_BUFFERMMAP;
32+ tif->tif_flags |= TIFF_MYBUFFER;
33+ }
34
35 /* Setup the function pointers for encode, decode, and cleanup. */
36 tif->tif_setupdecode = JBIGSetupDecode;
37--
38GitLab
39
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-0891.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-0891.patch
new file mode 100644
index 0000000000..e2f1bd3056
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-0891.patch
@@ -0,0 +1,217 @@
1From 232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c Mon Sep 17 00:00:00 2001
2From: Su Laus <sulau@freenet.de>
3Date: Tue, 8 Mar 2022 17:02:44 +0000
4Subject: [PATCH] tiffcrop: fix issue #380 and #382 heap buffer overflow in
5 extractImageSection
6
7CVE: CVE-2022-0891
8Upstream-Status: Backport [https://sources.debian.org/src/tiff/4.1.0+git191117-2%7Edeb10u4/debian/patches/CVE-2022-0891.patch/]
9Comment: No change in any hunk
10Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com>
11---
12 tools/tiffcrop.c | 92 +++++++++++++++++++-----------------------------
13 1 file changed, 36 insertions(+), 56 deletions(-)
14
15diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
16index f2e5474a..e62bcc71 100644
17--- a/tools/tiffcrop.c
18+++ b/tools/tiffcrop.c
19@@ -105,8 +105,8 @@
20 * of messages to monitor progess without enabling dump logs.
21 */
22
23-static char tiffcrop_version_id[] = "2.4";
24-static char tiffcrop_rev_date[] = "12-13-2010";
25+static char tiffcrop_version_id[] = "2.4.1";
26+static char tiffcrop_rev_date[] = "03-03-2010";
27
28 #include "tif_config.h"
29 #include "tiffiop.h"
30@@ -6670,10 +6670,10 @@ extractImageSection(struct image_data *image, struct pageseg *section,
31 #ifdef DEVELMODE
32 uint32 img_length;
33 #endif
34- uint32 j, shift1, shift2, trailing_bits;
35+ uint32 j, shift1, trailing_bits;
36 uint32 row, first_row, last_row, first_col, last_col;
37 uint32 src_offset, dst_offset, row_offset, col_offset;
38- uint32 offset1, offset2, full_bytes;
39+ uint32 offset1, full_bytes;
40 uint32 sect_width;
41 #ifdef DEVELMODE
42 uint32 sect_length;
43@@ -6683,7 +6683,6 @@ extractImageSection(struct image_data *image, struct pageseg *section,
44 #ifdef DEVELMODE
45 int k;
46 unsigned char bitset;
47- static char *bitarray = NULL;
48 #endif
49
50 img_width = image->width;
51@@ -6701,17 +6700,12 @@ extractImageSection(struct image_data *image, struct pageseg *section,
52 dst_offset = 0;
53
54 #ifdef DEVELMODE
55- if (bitarray == NULL)
56- {
57- if ((bitarray = (char *)malloc(img_width)) == NULL)
58- {
59- TIFFError ("", "DEBUG: Unable to allocate debugging bitarray");
60- return (-1);
61- }
62- }
63+ char bitarray[39];
64 #endif
65
66- /* rows, columns, width, length are expressed in pixels */
67+ /* rows, columns, width, length are expressed in pixels
68+ * first_row, last_row, .. are index into image array starting at 0 to width-1,
69+ * last_col shall be also extracted. */
70 first_row = section->y1;
71 last_row = section->y2;
72 first_col = section->x1;
73@@ -6721,9 +6715,14 @@ extractImageSection(struct image_data *image, struct pageseg *section,
74 #ifdef DEVELMODE
75 sect_length = last_row - first_row + 1;
76 #endif
77- img_rowsize = ((img_width * bps + 7) / 8) * spp;
78- full_bytes = (sect_width * spp * bps) / 8; /* number of COMPLETE bytes per row in section */
79- trailing_bits = (sect_width * bps) % 8;
80+ /* The read function loadImage() used copy separate plane data into a buffer as interleaved
81+ * samples rather than separate planes so the same logic works to extract regions
82+ * regardless of the way the data are organized in the input file.
83+ * Furthermore, bytes and bits are arranged in buffer according to COMPRESSION=1 and FILLORDER=1
84+ */
85+ img_rowsize = (((img_width * spp * bps) + 7) / 8); /* row size in full bytes of source image */
86+ full_bytes = (sect_width * spp * bps) / 8; /* number of COMPLETE bytes per row in section */
87+ trailing_bits = (sect_width * spp * bps) % 8; /* trailing bits within the last byte of destination buffer */
88
89 #ifdef DEVELMODE
90 TIFFError ("", "First row: %d, last row: %d, First col: %d, last col: %d\n",
91@@ -6736,10 +6735,9 @@ extractImageSection(struct image_data *image, struct pageseg *section,
92
93 if ((bps % 8) == 0)
94 {
95- col_offset = first_col * spp * bps / 8;
96+ col_offset = (first_col * spp * bps) / 8;
97 for (row = first_row; row <= last_row; row++)
98 {
99- /* row_offset = row * img_width * spp * bps / 8; */
100 row_offset = row * img_rowsize;
101 src_offset = row_offset + col_offset;
102
103@@ -6752,14 +6750,12 @@ extractImageSection(struct image_data *image, struct pageseg *section,
104 }
105 else
106 { /* bps != 8 */
107- shift1 = spp * ((first_col * bps) % 8);
108- shift2 = spp * ((last_col * bps) % 8);
109+ shift1 = ((first_col * spp * bps) % 8); /* shift1 = bits to skip in the first byte of source buffer*/
110 for (row = first_row; row <= last_row; row++)
111 {
112 /* pull out the first byte */
113 row_offset = row * img_rowsize;
114- offset1 = row_offset + (first_col * bps / 8);
115- offset2 = row_offset + (last_col * bps / 8);
116+ offset1 = row_offset + ((first_col * spp * bps) / 8); /* offset1 = offset into source of byte with first bits to be extracted */
117
118 #ifdef DEVELMODE
119 for (j = 0, k = 7; j < 8; j++, k--)
120@@ -6771,12 +6767,12 @@ extractImageSection(struct image_data *image, struct pageseg *section,
121 sprintf(&bitarray[9], " ");
122 for (j = 10, k = 7; j < 18; j++, k--)
123 {
124- bitset = *(src_buff + offset2) & (((unsigned char)1 << k)) ? 1 : 0;
125+ bitset = *(src_buff + offset1 + full_bytes) & (((unsigned char)1 << k)) ? 1 : 0;
126 sprintf(&bitarray[j], (bitset) ? "1" : "0");
127 }
128 bitarray[18] = '\0';
129- TIFFError ("", "Row: %3d Offset1: %d, Shift1: %d, Offset2: %d, Shift2: %d\n",
130- row, offset1, shift1, offset2, shift2);
131+ TIFFError ("", "Row: %3d Offset1: %"PRIu32", Shift1: %"PRIu32", Offset2: %"PRIu32", Trailing_bits: %"PRIu32"\n",
132+ row, offset1, shift1, offset1+full_bytes, trailing_bits);
133 #endif
134
135 bytebuff1 = bytebuff2 = 0;
136@@ -6800,11 +6796,12 @@ extractImageSection(struct image_data *image, struct pageseg *section,
137
138 if (trailing_bits != 0)
139 {
140- bytebuff2 = src_buff[offset2] & ((unsigned char)255 << (7 - shift2));
141+ /* Only copy higher bits of samples and mask lower bits of not wanted column samples to zero */
142+ bytebuff2 = src_buff[offset1 + full_bytes] & ((unsigned char)255 << (8 - trailing_bits));
143 sect_buff[dst_offset] = bytebuff2;
144 #ifdef DEVELMODE
145 TIFFError ("", " Trailing bits src offset: %8d, Dst offset: %8d\n",
146- offset2, dst_offset);
147+ offset1 + full_bytes, dst_offset);
148 for (j = 30, k = 7; j < 38; j++, k--)
149 {
150 bitset = *(sect_buff + dst_offset) & (((unsigned char)1 << k)) ? 1 : 0;
151@@ -6823,8 +6820,10 @@ extractImageSection(struct image_data *image, struct pageseg *section,
152 #endif
153 for (j = 0; j <= full_bytes; j++)
154 {
155- bytebuff1 = src_buff[offset1 + j] & ((unsigned char)255 >> shift1);
156- bytebuff2 = src_buff[offset1 + j + 1] & ((unsigned char)255 << (7 - shift1));
157+ /* Skip the first shift1 bits and shift the source up by shift1 bits before save to destination.*/
158+ /* Attention: src_buff size needs to be some bytes larger than image size, because could read behind image here. */
159+ bytebuff1 = src_buff[offset1 + j] & ((unsigned char)255 >> shift1);
160+ bytebuff2 = src_buff[offset1 + j + 1] & ((unsigned char)255 << (8 - shift1));
161 sect_buff[dst_offset + j] = (bytebuff1 << shift1) | (bytebuff2 >> (8 - shift1));
162 }
163 #ifdef DEVELMODE
164@@ -6840,36 +6839,17 @@ extractImageSection(struct image_data *image, struct pageseg *section,
165 #endif
166 dst_offset += full_bytes;
167
168+ /* Copy the trailing_bits for the last byte in the destination buffer.
169+ Could come from one ore two bytes of the source buffer. */
170 if (trailing_bits != 0)
171 {
172 #ifdef DEVELMODE
173- TIFFError ("", " Trailing bits src offset: %8d, Dst offset: %8d\n", offset1 + full_bytes, dst_offset);
174-#endif
175- if (shift2 > shift1)
176- {
177- bytebuff1 = src_buff[offset1 + full_bytes] & ((unsigned char)255 << (7 - shift2));
178- bytebuff2 = bytebuff1 & ((unsigned char)255 << shift1);
179- sect_buff[dst_offset] = bytebuff2;
180-#ifdef DEVELMODE
181- TIFFError ("", " Shift2 > Shift1\n");
182+ TIFFError("", " Trailing bits %4"PRIu32" src offset: %8"PRIu32", Dst offset: %8"PRIu32"\n", trailing_bits, offset1 + full_bytes, dst_offset);
183 #endif
184+ /* More than necessary bits are already copied into last destination buffer,
185+ * only masking of last byte in destination buffer is necessary.*/
186+ sect_buff[dst_offset] &= ((uint8_t)0xFF << (8 - trailing_bits));
187 }
188- else
189- {
190- if (shift2 < shift1)
191- {
192- bytebuff2 = ((unsigned char)255 << (shift1 - shift2 - 1));
193- sect_buff[dst_offset] &= bytebuff2;
194-#ifdef DEVELMODE
195- TIFFError ("", " Shift2 < Shift1\n");
196-#endif
197- }
198-#ifdef DEVELMODE
199- else
200- TIFFError ("", " Shift2 == Shift1\n");
201-#endif
202- }
203- }
204 #ifdef DEVELMODE
205 sprintf(&bitarray[28], " ");
206 sprintf(&bitarray[29], " ");
207@@ -7022,7 +7002,7 @@ writeImageSections(TIFF *in, TIFF *out, struct image_data *image,
208 width = sections[i].x2 - sections[i].x1 + 1;
209 length = sections[i].y2 - sections[i].y1 + 1;
210 sectsize = (uint32)
211- ceil((width * image->bps + 7) / (double)8) * image->spp * length;
212+ ceil((width * image->bps * image->spp + 7) / (double)8) * length;
213 /* allocate a buffer if we don't have one already */
214 if (createImageSection(sectsize, sect_buff_ptr))
215 {
216--
217GitLab
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-0907.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-0907.patch
new file mode 100644
index 0000000000..da3ead5481
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-0907.patch
@@ -0,0 +1,94 @@
1From 40b00cfb32256d377608b4d4cd30fac338d0a0bc Mon Sep 17 00:00:00 2001
2From: Augustus <wangdw.augustus@qq.com>
3Date: Mon, 7 Mar 2022 18:21:49 +0800
4Subject: [PATCH] add checks for return value of limitMalloc (#392)
5
6CVE: CVE-2022-0907
7Upstream-Status: Backport [https://sources.debian.org/src/tiff/4.1.0+git191117-2%7Edeb10u4/debian/patches/CVE-2022-0907.patch/]
8Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
9Comment: No change in any hunk
10
11---
12 tools/tiffcrop.c | 33 +++++++++++++++++++++------------
13 1 file changed, 21 insertions(+), 12 deletions(-)
14
15diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
16index f2e5474a..9b8acc7e 100644
17--- a/tools/tiffcrop.c
18+++ b/tools/tiffcrop.c
19@@ -7337,7 +7337,11 @@ createImageSection(uint32_t sectsize, unsigned char **sect_buff_ptr)
20 if (!sect_buff)
21 {
22 sect_buff = (unsigned char *)_TIFFmalloc(sectsize);
23- *sect_buff_ptr = sect_buff;
24+ if (!sect_buff)
25+ {
26+ TIFFError("createImageSection", "Unable to allocate/reallocate section buffer");
27+ return (-1);
28+ }
29 _TIFFmemset(sect_buff, 0, sectsize);
30 }
31 else
32@@ -7353,15 +7357,15 @@ createImageSection(uint32_t sectsize, unsigned char **sect_buff_ptr)
33 else
34 sect_buff = new_buff;
35
36+ if (!sect_buff)
37+ {
38+ TIFFError("createImageSection", "Unable to allocate/reallocate section buffer");
39+ return (-1);
40+ }
41 _TIFFmemset(sect_buff, 0, sectsize);
42 }
43 }
44
45- if (!sect_buff)
46- {
47- TIFFError("createImageSection", "Unable to allocate/reallocate section buffer");
48- return (-1);
49- }
50 prev_sectsize = sectsize;
51 *sect_buff_ptr = sect_buff;
52
53@@ -7628,7 +7632,11 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop,
54 if (!crop_buff)
55 {
56 crop_buff = (unsigned char *)_TIFFmalloc(cropsize);
57- *crop_buff_ptr = crop_buff;
58+ if (!crop_buff)
59+ {
60+ TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer");
61+ return (-1);
62+ }
63 _TIFFmemset(crop_buff, 0, cropsize);
64 prev_cropsize = cropsize;
65 }
66@@ -7644,15 +7652,15 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop,
67 }
68 else
69 crop_buff = new_buff;
70+ if (!crop_buff)
71+ {
72+ TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer");
73+ return (-1);
74+ }
75 _TIFFmemset(crop_buff, 0, cropsize);
76 }
77 }
78
79- if (!crop_buff)
80- {
81- TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer");
82- return (-1);
83- }
84 *crop_buff_ptr = crop_buff;
85
86 if (crop->crop_mode & CROP_INVERT)
87@@ -9211,3 +9219,4 @@ invertImage(uint16_t photometric, uint16_t spp, uint16_t bps, uint32_t width, ui
88 * fill-column: 78
89 * End:
90 */
91+
92--
93GitLab
94
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-0908.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-0908.patch
new file mode 100644
index 0000000000..e65af6c600
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-0908.patch
@@ -0,0 +1,34 @@
1From a95b799f65064e4ba2e2dfc206808f86faf93e85 Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Thu, 17 Feb 2022 15:28:43 +0100
4Subject: [PATCH] TIFFFetchNormalTag(): avoid calling memcpy() with a null
5 source pointer and size of zero (fixes #383)
6
7CVE: CVE-2022-0908
8Upstream-Status: Backport [https://sources.debian.org/src/tiff/4.1.0+git191117-2%7Edeb10u4/debian/patches/CVE-2022-0908.patch/]
9Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
10Comment: No change in any hunk
11
12---
13 libtiff/tif_dirread.c | 5 ++++-
14 1 file changed, 4 insertions(+), 1 deletion(-)
15
16diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
17index 50ebf8ac..2ec44a4f 100644
18--- a/libtiff/tif_dirread.c
19+++ b/libtiff/tif_dirread.c
20@@ -5021,7 +5021,10 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
21 _TIFFfree(data);
22 return(0);
23 }
24- _TIFFmemcpy(o,data,(uint32)dp->tdir_count);
25+ if (dp->tdir_count > 0 )
26+ {
27+ _TIFFmemcpy(o,data,(uint32)dp->tdir_count);
28+ }
29 o[(uint32)dp->tdir_count]=0;
30 if (data!=0)
31 _TIFFfree(data);
32--
33GitLab
34
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-0909.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-0909.patch
new file mode 100644
index 0000000000..d487f1bd95
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-0909.patch
@@ -0,0 +1,37 @@
1From 32ea0722ee68f503b7a3f9b2d557acb293fc8cde Mon Sep 17 00:00:00 2001
2From: 4ugustus <wangdw.augustus@qq.com>
3Date: Tue, 8 Mar 2022 16:22:04 +0000
4Subject: [PATCH] fix the FPE in tiffcrop (#393)
5
6CVE: CVE-2022-0909
7Upstream-Status: Backport [https://sources.debian.org/src/tiff/4.1.0+git191117-2%7Edeb10u4/debian/patches/CVE-2022-0909.patch/]
8Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
9Comment: No change in any hunk
10
11---
12 libtiff/tif_dir.c | 4 ++--
13 1 file changed, 2 insertions(+), 2 deletions(-)
14
15diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
16index 57055ca9..59b346ca 100644
17--- a/libtiff/tif_dir.c
18+++ b/libtiff/tif_dir.c
19@@ -334,13 +334,13 @@ _TIFFVSetField(TIFF* tif, uint32_t tag, va_list ap)
20 break;
21 case TIFFTAG_XRESOLUTION:
22 dblval = va_arg(ap, double);
23- if( dblval < 0 )
24+ if( dblval != dblval || dblval < 0 )
25 goto badvaluedouble;
26 td->td_xresolution = _TIFFClampDoubleToFloat( dblval );
27 break;
28 case TIFFTAG_YRESOLUTION:
29 dblval = va_arg(ap, double);
30- if( dblval < 0 )
31+ if( dblval != dblval || dblval < 0 )
32 goto badvaluedouble;
33 td->td_yresolution = _TIFFClampDoubleToFloat( dblval );
34 break;
35--
36GitLab
37
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-0924.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-0924.patch
new file mode 100644
index 0000000000..ddb035c972
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-0924.patch
@@ -0,0 +1,58 @@
1From 88d79a45a31c74cba98c697892fed5f7db8b963a Mon Sep 17 00:00:00 2001
2From: 4ugustus <wangdw.augustus@qq.com>
3Date: Thu, 10 Mar 2022 08:48:00 +0000
4Subject: [PATCH] fix heap buffer overflow in tiffcp (#278)
5
6CVE: CVE-2022-0924
7Upstream-Status: Backport [https://sources.debian.org/src/tiff/4.1.0+git191117-2%7Edeb10u4/debian/patches/CVE-2022-0924.patch/]
8Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
9Comment: No change in any hunk
10
11---
12 tools/tiffcp.c | 17 ++++++++++++++++-
13 1 file changed, 16 insertions(+), 1 deletion(-)
14
15diff --git a/tools/tiffcp.c b/tools/tiffcp.c
16index 224583e0..aa32b118 100644
17--- a/tools/tiffcp.c
18+++ b/tools/tiffcp.c
19@@ -1524,12 +1524,27 @@ DECLAREwriteFunc(writeBufferToSeparateSt
20 tdata_t obuf;
21 tstrip_t strip = 0;
22 tsample_t s;
23+ uint16 bps = 0, bytes_per_sample;
24
25 obuf = _TIFFmalloc(stripsize);
26 if (obuf == NULL)
27 return (0);
28 _TIFFmemset(obuf, 0, stripsize);
29 (void) TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
30+ (void) TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps);
31+ if( bps == 0 )
32+ {
33+ TIFFError(TIFFFileName(out), "Error, cannot read BitsPerSample");
34+ _TIFFfree(obuf);
35+ return 0;
36+ }
37+ if( (bps % 8) != 0 )
38+ {
39+ TIFFError(TIFFFileName(out), "Error, cannot handle BitsPerSample that is not a multiple of 8");
40+ _TIFFfree(obuf);
41+ return 0;
42+ }
43+ bytes_per_sample = bps/8;
44 for (s = 0; s < spp; s++) {
45 uint32 row;
46 for (row = 0; row < imagelength; row += rowsperstrip) {
47@@ -1539,7 +1539,7 @@ DECLAREwriteFunc(writeBufferToSeparateSt
48
49 cpContigBufToSeparateBuf(
50 obuf, (uint8*) buf + row*rowsize + s,
51- nrows, imagewidth, 0, 0, spp, 1);
52+ nrows, imagewidth, 0, 0, spp, bytes_per_sample);
53 if (TIFFWriteEncodedStrip(out, strip++, obuf, stripsize) < 0) {
54 TIFFError(TIFFFileName(out),
55 "Error, can't write strip %u",
56--
57GitLab
58
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-2056-CVE-2022-2057-CVE-2022-2058.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-2056-CVE-2022-2057-CVE-2022-2058.patch
new file mode 100644
index 0000000000..01e81349a2
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-2056-CVE-2022-2057-CVE-2022-2058.patch
@@ -0,0 +1,183 @@
1From 8261237113a53cd21029c4a8cbb62c47b4c19523 Mon Sep 17 00:00:00 2001
2From: Hitendra Prajapati <hprajapati@mvista.com>
3Date: Wed, 27 Jul 2022 11:30:18 +0530
4Subject: [PATCH] CVE-2022-2056 CVE-2022-2057 CVE-2022-2058
5
6Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/dd1bcc7abb26094e93636e85520f0d8f81ab0fab]
7CVE: CVE-2022-2056 CVE-2022-2057 CVE-2022-2058
8Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
9---
10 libtiff/tif_aux.c | 9 +++++++
11 libtiff/tiffiop.h | 1 +
12 tools/tiffcrop.c | 62 ++++++++++++++++++++++++++---------------------
13 3 files changed, 44 insertions(+), 28 deletions(-)
14
15diff --git a/libtiff/tif_aux.c b/libtiff/tif_aux.c
16index 8188db5..3dac542 100644
17--- a/libtiff/tif_aux.c
18+++ b/libtiff/tif_aux.c
19@@ -402,6 +402,15 @@ float _TIFFClampDoubleToFloat( double val )
20 return (float)val;
21 }
22
23+uint32 _TIFFClampDoubleToUInt32(double val)
24+{
25+ if( val < 0 )
26+ return 0;
27+ if( val > 0xFFFFFFFFU || val != val )
28+ return 0xFFFFFFFFU;
29+ return (uint32)val;
30+}
31+
32 int _TIFFSeekOK(TIFF* tif, toff_t off)
33 {
34 /* Huge offsets, especially -1 / UINT64_MAX, can cause issues */
35diff --git a/libtiff/tiffiop.h b/libtiff/tiffiop.h
36index 45a7932..c6f6f93 100644
37--- a/libtiff/tiffiop.h
38+++ b/libtiff/tiffiop.h
39@@ -393,6 +393,7 @@ extern double _TIFFUInt64ToDouble(uint64);
40 extern float _TIFFUInt64ToFloat(uint64);
41
42 extern float _TIFFClampDoubleToFloat(double);
43+extern uint32 _TIFFClampDoubleToUInt32(double);
44
45 extern tmsize_t
46 _TIFFReadEncodedStripAndAllocBuffer(TIFF* tif, uint32 strip,
47diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
48index c2c2052..79dd0a0 100644
49--- a/tools/tiffcrop.c
50+++ b/tools/tiffcrop.c
51@@ -5141,17 +5141,17 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image,
52 {
53 if ((crop->res_unit == RESUNIT_INCH) || (crop->res_unit == RESUNIT_CENTIMETER))
54 {
55- x1 = (uint32) (crop->corners[i].X1 * scale * xres);
56- x2 = (uint32) (crop->corners[i].X2 * scale * xres);
57- y1 = (uint32) (crop->corners[i].Y1 * scale * yres);
58- y2 = (uint32) (crop->corners[i].Y2 * scale * yres);
59+ x1 = _TIFFClampDoubleToUInt32(crop->corners[i].X1 * scale * xres);
60+ x2 = _TIFFClampDoubleToUInt32(crop->corners[i].X2 * scale * xres);
61+ y1 = _TIFFClampDoubleToUInt32(crop->corners[i].Y1 * scale * yres);
62+ y2 = _TIFFClampDoubleToUInt32(crop->corners[i].Y2 * scale * yres);
63 }
64 else
65 {
66- x1 = (uint32) (crop->corners[i].X1);
67- x2 = (uint32) (crop->corners[i].X2);
68- y1 = (uint32) (crop->corners[i].Y1);
69- y2 = (uint32) (crop->corners[i].Y2);
70+ x1 = _TIFFClampDoubleToUInt32(crop->corners[i].X1);
71+ x2 = _TIFFClampDoubleToUInt32(crop->corners[i].X2);
72+ y1 = _TIFFClampDoubleToUInt32(crop->corners[i].Y1);
73+ y2 = _TIFFClampDoubleToUInt32(crop->corners[i].Y2);
74 }
75 if (x1 < 1)
76 crop->regionlist[i].x1 = 0;
77@@ -5214,17 +5214,17 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image,
78 {
79 if (crop->res_unit != RESUNIT_INCH && crop->res_unit != RESUNIT_CENTIMETER)
80 { /* User has specified pixels as reference unit */
81- tmargin = (uint32)(crop->margins[0]);
82- lmargin = (uint32)(crop->margins[1]);
83- bmargin = (uint32)(crop->margins[2]);
84- rmargin = (uint32)(crop->margins[3]);
85+ tmargin = _TIFFClampDoubleToUInt32(crop->margins[0]);
86+ lmargin = _TIFFClampDoubleToUInt32(crop->margins[1]);
87+ bmargin = _TIFFClampDoubleToUInt32(crop->margins[2]);
88+ rmargin = _TIFFClampDoubleToUInt32(crop->margins[3]);
89 }
90 else
91 { /* inches or centimeters specified */
92- tmargin = (uint32)(crop->margins[0] * scale * yres);
93- lmargin = (uint32)(crop->margins[1] * scale * xres);
94- bmargin = (uint32)(crop->margins[2] * scale * yres);
95- rmargin = (uint32)(crop->margins[3] * scale * xres);
96+ tmargin = _TIFFClampDoubleToUInt32(crop->margins[0] * scale * yres);
97+ lmargin = _TIFFClampDoubleToUInt32(crop->margins[1] * scale * xres);
98+ bmargin = _TIFFClampDoubleToUInt32(crop->margins[2] * scale * yres);
99+ rmargin = _TIFFClampDoubleToUInt32(crop->margins[3] * scale * xres);
100 }
101
102 if ((lmargin + rmargin) > image->width)
103@@ -5254,24 +5254,24 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image,
104 if (crop->res_unit != RESUNIT_INCH && crop->res_unit != RESUNIT_CENTIMETER)
105 {
106 if (crop->crop_mode & CROP_WIDTH)
107- width = (uint32)crop->width;
108+ width = _TIFFClampDoubleToUInt32(crop->width);
109 else
110 width = image->width - lmargin - rmargin;
111
112 if (crop->crop_mode & CROP_LENGTH)
113- length = (uint32)crop->length;
114+ length = _TIFFClampDoubleToUInt32(crop->length);
115 else
116 length = image->length - tmargin - bmargin;
117 }
118 else
119 {
120 if (crop->crop_mode & CROP_WIDTH)
121- width = (uint32)(crop->width * scale * image->xres);
122+ width = _TIFFClampDoubleToUInt32(crop->width * scale * image->xres);
123 else
124 width = image->width - lmargin - rmargin;
125
126 if (crop->crop_mode & CROP_LENGTH)
127- length = (uint32)(crop->length * scale * image->yres);
128+ length = _TIFFClampDoubleToUInt32(crop->length * scale * image->yres);
129 else
130 length = image->length - tmargin - bmargin;
131 }
132@@ -5670,13 +5670,13 @@ computeOutputPixelOffsets (struct crop_mask *crop, struct image_data *image,
133 {
134 if (page->res_unit == RESUNIT_INCH || page->res_unit == RESUNIT_CENTIMETER)
135 { /* inches or centimeters specified */
136- hmargin = (uint32)(page->hmargin * scale * page->hres * ((image->bps + 7)/ 8));
137- vmargin = (uint32)(page->vmargin * scale * page->vres * ((image->bps + 7)/ 8));
138+ hmargin = _TIFFClampDoubleToUInt32(page->hmargin * scale * page->hres * ((image->bps + 7) / 8));
139+ vmargin = _TIFFClampDoubleToUInt32(page->vmargin * scale * page->vres * ((image->bps + 7) / 8));
140 }
141 else
142 { /* Otherwise user has specified pixels as reference unit */
143- hmargin = (uint32)(page->hmargin * scale * ((image->bps + 7)/ 8));
144- vmargin = (uint32)(page->vmargin * scale * ((image->bps + 7)/ 8));
145+ hmargin = _TIFFClampDoubleToUInt32(page->hmargin * scale * ((image->bps + 7) / 8));
146+ vmargin = _TIFFClampDoubleToUInt32(page->vmargin * scale * ((image->bps + 7) / 8));
147 }
148
149 if ((hmargin * 2.0) > (pwidth * page->hres))
150@@ -5714,13 +5714,13 @@ computeOutputPixelOffsets (struct crop_mask *crop, struct image_data *image,
151 {
152 if (page->mode & PAGE_MODE_PAPERSIZE )
153 {
154- owidth = (uint32)((pwidth * page->hres) - (hmargin * 2));
155- olength = (uint32)((plength * page->vres) - (vmargin * 2));
156+ owidth = _TIFFClampDoubleToUInt32((pwidth * page->hres) - (hmargin * 2));
157+ olength = _TIFFClampDoubleToUInt32((plength * page->vres) - (vmargin * 2));
158 }
159 else
160 {
161- owidth = (uint32)(iwidth - (hmargin * 2 * page->hres));
162- olength = (uint32)(ilength - (vmargin * 2 * page->vres));
163+ owidth = _TIFFClampDoubleToUInt32(iwidth - (hmargin * 2 * page->hres));
164+ olength = _TIFFClampDoubleToUInt32(ilength - (vmargin * 2 * page->vres));
165 }
166 }
167
168@@ -5729,6 +5729,12 @@ computeOutputPixelOffsets (struct crop_mask *crop, struct image_data *image,
169 if (olength > ilength)
170 olength = ilength;
171
172+ if (owidth == 0 || olength == 0)
173+ {
174+ TIFFError("computeOutputPixelOffsets", "Integer overflow when calculating the number of pages");
175+ exit(EXIT_FAILURE);
176+ }
177+
178 /* Compute the number of pages required for Portrait or Landscape */
179 switch (page->orient)
180 {
181--
1822.25.1
183
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-2867-CVE-2022-2868-CVE-2022-2869.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-2867-CVE-2022-2868-CVE-2022-2869.patch
new file mode 100644
index 0000000000..131ff94119
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-2867-CVE-2022-2868-CVE-2022-2869.patch
@@ -0,0 +1,159 @@
1From 07d79fcac2ead271b60e32aeb80f7b4f3be9ac8c Mon Sep 17 00:00:00 2001
2From: Su Laus <sulau@freenet.de>
3Date: Wed, 9 Feb 2022 21:31:29 +0000
4Subject: [PATCH] tiffcrop.c: Fix issue #352 heap-buffer-overflow by correcting
5 uint32_t underflow.
6
7CVE: CVE-2022-2867 CVE-2022-2868 CVE-2022-2869
8Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/07d79fcac2ead271b60e32aeb80f7b4f3be9ac8c]
9Signed-off-by: Virendra Thakur <virendrak@kpit.com>
10---
11Index: tiff-4.1.0/tools/tiffcrop.c
12===================================================================
13--- tiff-4.1.0.orig/tools/tiffcrop.c
14+++ tiff-4.1.0/tools/tiffcrop.c
15@@ -5153,29 +5153,45 @@ computeInputPixelOffsets(struct crop_mas
16 y1 = _TIFFClampDoubleToUInt32(crop->corners[i].Y1);
17 y2 = _TIFFClampDoubleToUInt32(crop->corners[i].Y2);
18 }
19- if (x1 < 1)
20- crop->regionlist[i].x1 = 0;
21- else
22- crop->regionlist[i].x1 = (uint32) (x1 - 1);
23+ /* a) Region needs to be within image sizes 0.. width-1; 0..length-1
24+ * b) Corners are expected to be submitted as top-left to bottom-right.
25+ * Therefore, check that and reorder input.
26+ * (be aware x,y are already casted to (uint32_t) and avoid (0 - 1) )
27+ */
28+ uint32_t aux;
29+ if (x1 > x2) {
30+ aux = x1;
31+ x1 = x2;
32+ x2 = aux;
33+ }
34+ if (y1 > y2) {
35+ aux = y1;
36+ y1 = y2;
37+ y2 = aux;
38+ }
39+ if (x1 > image->width - 1)
40+ crop->regionlist[i].x1 = image->width - 1;
41+ else if (x1 > 0)
42+ crop->regionlist[i].x1 = (uint32_t)(x1 - 1);
43
44 if (x2 > image->width - 1)
45 crop->regionlist[i].x2 = image->width - 1;
46- else
47- crop->regionlist[i].x2 = (uint32) (x2 - 1);
48- zwidth = crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1;
49-
50- if (y1 < 1)
51- crop->regionlist[i].y1 = 0;
52- else
53- crop->regionlist[i].y1 = (uint32) (y1 - 1);
54+ else if (x2 > 0)
55+ crop->regionlist[i].x2 = (uint32_t)(x2 - 1);
56+
57+ zwidth = crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1;
58+
59+ if (y1 > image->length - 1)
60+ crop->regionlist[i].y1 = image->length - 1;
61+ else if (y1 > 0)
62+ crop->regionlist[i].y1 = (uint32_t)(y1 - 1);
63
64 if (y2 > image->length - 1)
65 crop->regionlist[i].y2 = image->length - 1;
66- else
67- crop->regionlist[i].y2 = (uint32) (y2 - 1);
68-
69- zlength = crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1;
70+ else if (y2 > 0)
71+ crop->regionlist[i].y2 = (uint32_t)(y2 - 1);
72
73+ zlength = crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1;
74 if (zwidth > max_width)
75 max_width = zwidth;
76 if (zlength > max_length)
77@@ -5205,7 +5221,7 @@ computeInputPixelOffsets(struct crop_mas
78 }
79 }
80 return (0);
81- }
82+ } /* crop_mode == CROP_REGIONS */
83
84 /* Convert crop margins into offsets into image
85 * Margins are expressed as pixel rows and columns, not bytes
86@@ -5241,7 +5257,7 @@ computeInputPixelOffsets(struct crop_mas
87 bmargin = (uint32) 0;
88 return (-1);
89 }
90- }
91+ } /* crop_mode == CROP_MARGINS */
92 else
93 { /* no margins requested */
94 tmargin = (uint32) 0;
95@@ -5332,24 +5348,23 @@ computeInputPixelOffsets(struct crop_mas
96 off->endx = endx;
97 off->endy = endy;
98
99- crop_width = endx - startx + 1;
100- crop_length = endy - starty + 1;
101-
102- if (crop_width <= 0)
103+ if (endx + 1 <= startx)
104 {
105 TIFFError("computeInputPixelOffsets",
106 "Invalid left/right margins and /or image crop width requested");
107 return (-1);
108 }
109+ crop_width = endx - startx + 1;
110 if (crop_width > image->width)
111 crop_width = image->width;
112
113- if (crop_length <= 0)
114+ if (endy + 1 <= starty)
115 {
116 TIFFError("computeInputPixelOffsets",
117 "Invalid top/bottom margins and /or image crop length requested");
118 return (-1);
119 }
120+ crop_length = endy - starty + 1;
121 if (crop_length > image->length)
122 crop_length = image->length;
123
124@@ -5449,10 +5464,17 @@ getCropOffsets(struct image_data *image,
125 else
126 crop->selections = crop->zones;
127
128- for (i = 0; i < crop->zones; i++)
129+ /* Initialize regions iterator i */
130+ i = 0;
131+ for (int j = 0; j < crop->zones; j++)
132 {
133- seg = crop->zonelist[i].position;
134- total = crop->zonelist[i].total;
135+ seg = crop->zonelist[j].position;
136+ total = crop->zonelist[j].total;
137+
138+ /* check for not allowed zone cases like 0:0; 4:3; etc. and skip that input */
139+ if (seg == 0 || total == 0 || seg > total) {
140+ continue;
141+ }
142
143 switch (crop->edge_ref)
144 {
145@@ -5581,8 +5603,11 @@ getCropOffsets(struct image_data *image,
146 i + 1, (uint32)zwidth, (uint32)zlength,
147 crop->regionlist[i].x1, crop->regionlist[i].x2,
148 crop->regionlist[i].y1, crop->regionlist[i].y2);
149+ /* increment regions iterator */
150+ i++;
151 }
152-
153+ /* set number of generated regions out of given zones */
154+ crop->selections = i;
155 return (0);
156 } /* end getCropOffsets */
157
158--
159GitLab
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-34526.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-34526.patch
new file mode 100644
index 0000000000..cf440ce55f
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-34526.patch
@@ -0,0 +1,29 @@
1From 06386cc9dff5dc162006abe11fd4d1a6fad616cc Mon Sep 17 00:00:00 2001
2From: Hitendra Prajapati <hprajapati@mvista.com>
3Date: Thu, 18 Aug 2022 09:40:50 +0530
4Subject: [PATCH] CVE-2022-34526
5
6Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990]
7CVE: CVE-2022-34526
8Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
9---
10 libtiff/tif_dirinfo.c | 3 +++
11 1 file changed, 3 insertions(+)
12
13diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c
14index 52d53d4..4a1ca00 100644
15--- a/libtiff/tif_dirinfo.c
16+++ b/libtiff/tif_dirinfo.c
17@@ -983,6 +983,9 @@ _TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag)
18 default:
19 return 1;
20 }
21+ if( !TIFFIsCODECConfigured(tif->tif_dir.td_compression) ) {
22+ return 0;
23+ }
24 /* Check if codec specific tags are allowed for the current
25 * compression scheme (codec) */
26 switch (tif->tif_dir.td_compression) {
27--
282.25.1
29
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-3570_3598.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-3570_3598.patch
new file mode 100644
index 0000000000..760e20dd2b
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-3570_3598.patch
@@ -0,0 +1,659 @@
1From 226e336cdceec933da2e9f72b6578c7a1bea450b Mon Sep 17 00:00:00 2001
2From: Su Laus <sulau@freenet.de>
3Date: Thu, 13 Oct 2022 14:33:27 +0000
4Subject: [PATCH] tiffcrop subroutines require a larger buffer (fixes #271,
5
6Upstream-Status: Backport [import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u7.debian.tar.xz ]
7CVE: CVE-2022-3570 CVE-2022-3598
8Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
9
10Origin: https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff
11Origin: https://gitlab.com/libtiff/libtiff/-/commit/24d3b2425af24432e0e4e2fd58b33f3b04c4bfa4
12Reviewed-by: Sylvain Beucler <beuc@debian.org>
13Last-Update: 2023-01-17
14
15 #381, #386, #388, #389, #435)
16
17---
18 tools/tiffcrop.c | 209 ++++++++++++++++++++++++++---------------------
19 1 file changed, 117 insertions(+), 92 deletions(-)
20
21diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
22index c7877aa..c923920 100644
23--- a/tools/tiffcrop.c
24+++ b/tools/tiffcrop.c
25@@ -126,6 +126,7 @@ static char tiffcrop_rev_date[] = "03-03-2010";
26
27 #ifdef HAVE_STDINT_H
28 # include <stdint.h>
29+# include <inttypes.h>
30 #endif
31
32 #ifndef HAVE_GETOPT
33@@ -212,6 +213,10 @@ extern int getopt(int argc, char * const argv[], const char *optstring);
34
35 #define TIFF_DIR_MAX 65534
36
37+/* Some conversion subroutines require image buffers, which are at least 3 bytes
38+ * larger than the necessary size for the image itself. */
39+#define NUM_BUFF_OVERSIZE_BYTES 3
40+
41 /* Offsets into buffer for margins and fixed width and length segments */
42 struct offset {
43 uint32 tmargin;
44@@ -233,7 +238,7 @@ struct offset {
45 */
46
47 struct buffinfo {
48- uint32 size; /* size of this buffer */
49+ size_t size; /* size of this buffer */
50 unsigned char *buffer; /* address of the allocated buffer */
51 };
52
53@@ -771,8 +776,8 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8* buf,
54 uint32 dst_rowsize, shift_width;
55 uint32 bytes_per_sample, bytes_per_pixel;
56 uint32 trailing_bits, prev_trailing_bits;
57- uint32 tile_rowsize = TIFFTileRowSize(in);
58- uint32 src_offset, dst_offset;
59+ tmsize_t tile_rowsize = TIFFTileRowSize(in);
60+ tmsize_t src_offset, dst_offset;
61 uint32 row_offset, col_offset;
62 uint8 *bufp = (uint8*) buf;
63 unsigned char *src = NULL;
64@@ -822,7 +827,7 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8* buf,
65 TIFFError("readContigTilesIntoBuffer", "Integer overflow when calculating buffer size.");
66 exit(-1);
67 }
68- tilebuf = _TIFFmalloc(tile_buffsize + 3);
69+ tilebuf = _TIFFmalloc(tile_buffsize + NUM_BUFF_OVERSIZE_BYTES);
70 if (tilebuf == 0)
71 return 0;
72 tilebuf[tile_buffsize] = 0;
73@@ -986,7 +991,7 @@ static int readSeparateTilesIntoBuffer (TIFF* in, uint8 *obuf,
74 for (sample = 0; (sample < spp) && (sample < MAX_SAMPLES); sample++)
75 {
76 srcbuffs[sample] = NULL;
77- tbuff = (unsigned char *)_TIFFmalloc(tilesize + 8);
78+ tbuff = (unsigned char *)_TIFFmalloc(tilesize + NUM_BUFF_OVERSIZE_BYTES);
79 if (!tbuff)
80 {
81 TIFFError ("readSeparateTilesIntoBuffer",
82@@ -1181,7 +1186,8 @@ writeBufferToSeparateStrips (TIFF* out, uint8* buf,
83 }
84 rowstripsize = rowsperstrip * bytes_per_sample * (width + 1);
85
86- obuf = _TIFFmalloc (rowstripsize);
87+ /* Add 3 padding bytes for extractContigSamples32bits */
88+ obuf = _TIFFmalloc (rowstripsize + NUM_BUFF_OVERSIZE_BYTES);
89 if (obuf == NULL)
90 return 1;
91
92@@ -1194,7 +1200,7 @@ writeBufferToSeparateStrips (TIFF* out, uint8* buf,
93 stripsize = TIFFVStripSize(out, nrows);
94 src = buf + (row * rowsize);
95 total_bytes += stripsize;
96- memset (obuf, '\0', rowstripsize);
97+ memset (obuf, '\0',rowstripsize + NUM_BUFF_OVERSIZE_BYTES);
98 if (extractContigSamplesToBuffer(obuf, src, nrows, width, s, spp, bps, dump))
99 {
100 _TIFFfree(obuf);
101@@ -1202,10 +1208,15 @@ writeBufferToSeparateStrips (TIFF* out, uint8* buf,
102 }
103 if ((dump->outfile != NULL) && (dump->level == 1))
104 {
105- dump_info(dump->outfile, dump->format,"",
106+ if ((uint64_t)scanlinesize > 0x0ffffffffULL) {
107+ dump_info(dump->infile, dump->format, "loadImage",
108+ "Attention: scanlinesize %"PRIu64" is larger than UINT32_MAX.\nFollowing dump might be wrong.",
109+ (uint64_t)scanlinesize);
110+ }
111+ dump_info(dump->outfile, dump->format,"",
112 "Sample %2d, Strip: %2d, bytes: %4d, Row %4d, bytes: %4d, Input offset: %6d",
113- s + 1, strip + 1, stripsize, row + 1, scanlinesize, src - buf);
114- dump_buffer(dump->outfile, dump->format, nrows, scanlinesize, row, obuf);
115+ s + 1, strip + 1, stripsize, row + 1, (uint32)scanlinesize, src - buf);
116+ dump_buffer(dump->outfile, dump->format, nrows, (uint32)scanlinesize, row, obuf);
117 }
118
119 if (TIFFWriteEncodedStrip(out, strip++, obuf, stripsize) < 0)
120@@ -1232,7 +1243,7 @@ static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
121 uint32 tl, tw;
122 uint32 row, col, nrow, ncol;
123 uint32 src_rowsize, col_offset;
124- uint32 tile_rowsize = TIFFTileRowSize(out);
125+ tmsize_t tile_rowsize = TIFFTileRowSize(out);
126 uint8* bufp = (uint8*) buf;
127 tsize_t tile_buffsize = 0;
128 tsize_t tilesize = TIFFTileSize(out);
129@@ -1275,9 +1286,11 @@ static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
130 }
131 src_rowsize = ((imagewidth * spp * bps) + 7U) / 8;
132
133- tilebuf = _TIFFmalloc(tile_buffsize);
134+ /* Add 3 padding bytes for extractContigSamples32bits */
135+ tilebuf = _TIFFmalloc(tile_buffsize + NUM_BUFF_OVERSIZE_BYTES);
136 if (tilebuf == 0)
137 return 1;
138+ memset(tilebuf, 0, tile_buffsize + NUM_BUFF_OVERSIZE_BYTES);
139 for (row = 0; row < imagelength; row += tl)
140 {
141 nrow = (row + tl > imagelength) ? imagelength - row : tl;
142@@ -1323,7 +1336,8 @@ static int writeBufferToSeparateTiles (TIFF* out, uint8* buf, uint32 imagelength
143 uint32 imagewidth, tsample_t spp,
144 struct dump_opts * dump)
145 {
146- tdata_t obuf = _TIFFmalloc(TIFFTileSize(out));
147+ /* Add 3 padding bytes for extractContigSamples32bits */
148+ tdata_t obuf = _TIFFmalloc(TIFFTileSize(out) + NUM_BUFF_OVERSIZE_BYTES);
149 uint32 tl, tw;
150 uint32 row, col, nrow, ncol;
151 uint32 src_rowsize, col_offset;
152@@ -1333,6 +1347,7 @@ static int writeBufferToSeparateTiles (TIFF* out, uint8* buf, uint32 imagelength
153
154 if (obuf == NULL)
155 return 1;
156+ memset(obuf, 0, TIFFTileSize(out) + NUM_BUFF_OVERSIZE_BYTES);
157
158 TIFFGetField(out, TIFFTAG_TILELENGTH, &tl);
159 TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw);
160@@ -1754,14 +1769,14 @@ void process_command_opts (int argc, char *argv[], char *mp, char *mode, uint32
161
162 *opt_offset = '\0';
163 /* convert option to lowercase */
164- end = strlen (opt_ptr);
165+ end = (unsigned int)strlen (opt_ptr);
166 for (i = 0; i < end; i++)
167 *(opt_ptr + i) = tolower((int) *(opt_ptr + i));
168 /* Look for dump format specification */
169 if (strncmp(opt_ptr, "for", 3) == 0)
170 {
171 /* convert value to lowercase */
172- end = strlen (opt_offset + 1);
173+ end = (unsigned int)strlen (opt_offset + 1);
174 for (i = 1; i <= end; i++)
175 *(opt_offset + i) = tolower((int) *(opt_offset + i));
176 /* check dump format value */
177@@ -2213,6 +2228,8 @@ main(int argc, char* argv[])
178 size_t length;
179 char temp_filename[PATH_MAX + 16]; /* Extra space keeps the compiler from complaining */
180
181+ assert(NUM_BUFF_OVERSIZE_BYTES >= 3);
182+
183 little_endian = *((unsigned char *)&little_endian) & '1';
184
185 initImageData(&image);
186@@ -3114,13 +3131,13 @@ extractContigSamples32bits (uint8 *in, uint8 *out, uint32 cols,
187 /* If we have a full buffer's worth, write it out */
188 if (ready_bits >= 32)
189 {
190- bytebuff1 = (buff2 >> 56);
191+ bytebuff1 = (uint8)(buff2 >> 56);
192 *dst++ = bytebuff1;
193- bytebuff2 = (buff2 >> 48);
194+ bytebuff2 = (uint8)(buff2 >> 48);
195 *dst++ = bytebuff2;
196- bytebuff3 = (buff2 >> 40);
197+ bytebuff3 = (uint8)(buff2 >> 40);
198 *dst++ = bytebuff3;
199- bytebuff4 = (buff2 >> 32);
200+ bytebuff4 = (uint8)(buff2 >> 32);
201 *dst++ = bytebuff4;
202 ready_bits -= 32;
203
204@@ -3495,13 +3512,13 @@ extractContigSamplesShifted32bits (uint8 *in, uint8 *out, uint32 cols,
205 }
206 else /* If we have a full buffer's worth, write it out */
207 {
208- bytebuff1 = (buff2 >> 56);
209+ bytebuff1 = (uint8)(buff2 >> 56);
210 *dst++ = bytebuff1;
211- bytebuff2 = (buff2 >> 48);
212+ bytebuff2 = (uint8)(buff2 >> 48);
213 *dst++ = bytebuff2;
214- bytebuff3 = (buff2 >> 40);
215+ bytebuff3 = (uint8)(buff2 >> 40);
216 *dst++ = bytebuff3;
217- bytebuff4 = (buff2 >> 32);
218+ bytebuff4 = (uint8)(buff2 >> 32);
219 *dst++ = bytebuff4;
220 ready_bits -= 32;
221
222@@ -3678,10 +3695,10 @@ extractContigSamplesToTileBuffer(uint8 *out, uint8 *in, uint32 rows, uint32 cols
223 static int readContigStripsIntoBuffer (TIFF* in, uint8* buf)
224 {
225 uint8* bufp = buf;
226- int32 bytes_read = 0;
227+ tmsize_t bytes_read = 0;
228 uint32 strip, nstrips = TIFFNumberOfStrips(in);
229- uint32 stripsize = TIFFStripSize(in);
230- uint32 rows = 0;
231+ tmsize_t stripsize = TIFFStripSize(in);
232+ tmsize_t rows = 0;
233 uint32 rps = TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rps);
234 tsize_t scanline_size = TIFFScanlineSize(in);
235
236@@ -3694,13 +3711,12 @@ static int readContigStripsIntoBuffer (TIFF* in, uint8* buf)
237 bytes_read = TIFFReadEncodedStrip (in, strip, bufp, -1);
238 rows = bytes_read / scanline_size;
239 if ((strip < (nstrips - 1)) && (bytes_read != (int32)stripsize))
240- TIFFError("", "Strip %d: read %lu bytes, strip size %lu",
241- (int)strip + 1, (unsigned long) bytes_read,
242- (unsigned long)stripsize);
243+ TIFFError("", "Strip %"PRIu32": read %"PRId64" bytes, strip size %"PRIu64,
244+ strip + 1, bytes_read, stripsize);
245
246 if (bytes_read < 0 && !ignore) {
247- TIFFError("", "Error reading strip %lu after %lu rows",
248- (unsigned long) strip, (unsigned long)rows);
249+ TIFFError("", "Error reading strip %"PRIu32" after %"PRIu64" rows",
250+ strip, rows);
251 return 0;
252 }
253 bufp += stripsize;
254@@ -4164,13 +4180,13 @@ combineSeparateSamples32bits (uint8 *in[], uint8 *out, uint32 cols,
255 /* If we have a full buffer's worth, write it out */
256 if (ready_bits >= 32)
257 {
258- bytebuff1 = (buff2 >> 56);
259+ bytebuff1 = (uint8)(buff2 >> 56);
260 *dst++ = bytebuff1;
261- bytebuff2 = (buff2 >> 48);
262+ bytebuff2 = (uint8)(buff2 >> 48);
263 *dst++ = bytebuff2;
264- bytebuff3 = (buff2 >> 40);
265+ bytebuff3 = (uint8)(buff2 >> 40);
266 *dst++ = bytebuff3;
267- bytebuff4 = (buff2 >> 32);
268+ bytebuff4 = (uint8)(buff2 >> 32);
269 *dst++ = bytebuff4;
270 ready_bits -= 32;
271
272@@ -4213,10 +4229,10 @@ combineSeparateSamples32bits (uint8 *in[], uint8 *out, uint32 cols,
273 "Row %3d, Col %3d, Src byte offset %3d bit offset %2d Dst offset %3d",
274 row + 1, col + 1, src_byte, src_bit, dst - out);
275
276- dump_long (dumpfile, format, "Match bits ", matchbits);
277+ dump_wide (dumpfile, format, "Match bits ", matchbits);
278 dump_data (dumpfile, format, "Src bits ", src, 4);
279- dump_long (dumpfile, format, "Buff1 bits ", buff1);
280- dump_long (dumpfile, format, "Buff2 bits ", buff2);
281+ dump_wide (dumpfile, format, "Buff1 bits ", buff1);
282+ dump_wide (dumpfile, format, "Buff2 bits ", buff2);
283 dump_byte (dumpfile, format, "Write bits1", bytebuff1);
284 dump_byte (dumpfile, format, "Write bits2", bytebuff2);
285 dump_info (dumpfile, format, "", "Ready bits: %2d", ready_bits);
286@@ -4689,13 +4705,13 @@ combineSeparateTileSamples32bits (uint8 *in[], uint8 *out, uint32 cols,
287 /* If we have a full buffer's worth, write it out */
288 if (ready_bits >= 32)
289 {
290- bytebuff1 = (buff2 >> 56);
291+ bytebuff1 = (uint8)(buff2 >> 56);
292 *dst++ = bytebuff1;
293- bytebuff2 = (buff2 >> 48);
294+ bytebuff2 = (uint8)(buff2 >> 48);
295 *dst++ = bytebuff2;
296- bytebuff3 = (buff2 >> 40);
297+ bytebuff3 = (uint8)(buff2 >> 40);
298 *dst++ = bytebuff3;
299- bytebuff4 = (buff2 >> 32);
300+ bytebuff4 = (uint8)(buff2 >> 32);
301 *dst++ = bytebuff4;
302 ready_bits -= 32;
303
304@@ -4738,10 +4754,10 @@ combineSeparateTileSamples32bits (uint8 *in[], uint8 *out, uint32 cols,
305 "Row %3d, Col %3d, Src byte offset %3d bit offset %2d Dst offset %3d",
306 row + 1, col + 1, src_byte, src_bit, dst - out);
307
308- dump_long (dumpfile, format, "Match bits ", matchbits);
309+ dump_wide (dumpfile, format, "Match bits ", matchbits);
310 dump_data (dumpfile, format, "Src bits ", src, 4);
311- dump_long (dumpfile, format, "Buff1 bits ", buff1);
312- dump_long (dumpfile, format, "Buff2 bits ", buff2);
313+ dump_wide (dumpfile, format, "Buff1 bits ", buff1);
314+ dump_wide (dumpfile, format, "Buff2 bits ", buff2);
315 dump_byte (dumpfile, format, "Write bits1", bytebuff1);
316 dump_byte (dumpfile, format, "Write bits2", bytebuff2);
317 dump_info (dumpfile, format, "", "Ready bits: %2d", ready_bits);
318@@ -4764,7 +4780,7 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
319 {
320 int i, bytes_per_sample, bytes_per_pixel, shift_width, result = 1;
321 uint32 j;
322- int32 bytes_read = 0;
323+ tmsize_t bytes_read = 0;
324 uint16 bps = 0, planar;
325 uint32 nstrips;
326 uint32 strips_per_sample;
327@@ -4830,7 +4846,7 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
328 for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
329 {
330 srcbuffs[s] = NULL;
331- buff = _TIFFmalloc(stripsize + 3);
332+ buff = _TIFFmalloc(stripsize + NUM_BUFF_OVERSIZE_BYTES);
333 if (!buff)
334 {
335 TIFFError ("readSeparateStripsIntoBuffer",
336@@ -4853,7 +4869,7 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
337 buff = srcbuffs[s];
338 strip = (s * strips_per_sample) + j;
339 bytes_read = TIFFReadEncodedStrip (in, strip, buff, stripsize);
340- rows_this_strip = bytes_read / src_rowsize;
341+ rows_this_strip = (uint32)(bytes_read / src_rowsize);
342 if (bytes_read < 0 && !ignore)
343 {
344 TIFFError(TIFFFileName(in),
345@@ -5860,13 +5876,14 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c
346 uint16 input_compression = 0, input_photometric = 0;
347 uint16 subsampling_horiz, subsampling_vert;
348 uint32 width = 0, length = 0;
349- uint32 stsize = 0, tlsize = 0, buffsize = 0, scanlinesize = 0;
350+ tmsize_t stsize = 0, tlsize = 0, buffsize = 0;
351+ tmsize_t scanlinesize = 0;
352 uint32 tw = 0, tl = 0; /* Tile width and length */
353- uint32 tile_rowsize = 0;
354+ tmsize_t tile_rowsize = 0;
355 unsigned char *read_buff = NULL;
356 unsigned char *new_buff = NULL;
357 int readunit = 0;
358- static uint32 prev_readsize = 0;
359+ static tmsize_t prev_readsize = 0;
360
361 TIFFGetFieldDefaulted(in, TIFFTAG_BITSPERSAMPLE, &bps);
362 TIFFGetFieldDefaulted(in, TIFFTAG_SAMPLESPERPIXEL, &spp);
363@@ -6168,7 +6185,7 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c
364 TIFFError("loadImage", "Unable to allocate/reallocate read buffer");
365 return (-1);
366 }
367- read_buff = (unsigned char *)_TIFFmalloc(buffsize+3);
368+ read_buff = (unsigned char *)_TIFFmalloc(buffsize + NUM_BUFF_OVERSIZE_BYTES);
369 }
370 else
371 {
372@@ -6179,11 +6196,11 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c
373 TIFFError("loadImage", "Unable to allocate/reallocate read buffer");
374 return (-1);
375 }
376- new_buff = _TIFFrealloc(read_buff, buffsize+3);
377+ new_buff = _TIFFrealloc(read_buff, buffsize + NUM_BUFF_OVERSIZE_BYTES);
378 if (!new_buff)
379 {
380 free (read_buff);
381- read_buff = (unsigned char *)_TIFFmalloc(buffsize+3);
382+ read_buff = (unsigned char *)_TIFFmalloc(buffsize + NUM_BUFF_OVERSIZE_BYTES);
383 }
384 else
385 read_buff = new_buff;
386@@ -6256,8 +6273,13 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c
387 dump_info (dump->infile, dump->format, "",
388 "Bits per sample %d, Samples per pixel %d", bps, spp);
389
390+ if ((uint64_t)scanlinesize > 0x0ffffffffULL) {
391+ dump_info(dump->infile, dump->format, "loadImage",
392+ "Attention: scanlinesize %"PRIu64" is larger than UINT32_MAX.\nFollowing dump might be wrong.",
393+ (uint64_t)scanlinesize);
394+ }
395 for (i = 0; i < length; i++)
396- dump_buffer(dump->infile, dump->format, 1, scanlinesize,
397+ dump_buffer(dump->infile, dump->format, 1, (uint32)scanlinesize,
398 i, read_buff + (i * scanlinesize));
399 }
400 return (0);
401@@ -7277,13 +7299,13 @@ writeSingleSection(TIFF *in, TIFF *out, struct image_data *image,
402 if (TIFFGetField(in, TIFFTAG_NUMBEROFINKS, &ninks)) {
403 TIFFSetField(out, TIFFTAG_NUMBEROFINKS, ninks);
404 if (TIFFGetField(in, TIFFTAG_INKNAMES, &inknames)) {
405- int inknameslen = strlen(inknames) + 1;
406+ int inknameslen = (int)strlen(inknames) + 1;
407 const char* cp = inknames;
408 while (ninks > 1) {
409 cp = strchr(cp, '\0');
410 if (cp) {
411 cp++;
412- inknameslen += (strlen(cp) + 1);
413+ inknameslen += ((int)strlen(cp) + 1);
414 }
415 ninks--;
416 }
417@@ -7346,23 +7368,23 @@ createImageSection(uint32 sectsize, unsigned char **sect_buff_ptr)
418
419 if (!sect_buff)
420 {
421- sect_buff = (unsigned char *)_TIFFmalloc(sectsize);
422+ sect_buff = (unsigned char *)_TIFFmalloc(sectsize + NUM_BUFF_OVERSIZE_BYTES);
423 if (!sect_buff)
424 {
425 TIFFError("createImageSection", "Unable to allocate/reallocate section buffer");
426 return (-1);
427 }
428- _TIFFmemset(sect_buff, 0, sectsize);
429+ _TIFFmemset(sect_buff, 0, sectsize + NUM_BUFF_OVERSIZE_BYTES);
430 }
431 else
432 {
433 if (prev_sectsize < sectsize)
434 {
435- new_buff = _TIFFrealloc(sect_buff, sectsize);
436+ new_buff = _TIFFrealloc(sect_buff, sectsize + NUM_BUFF_OVERSIZE_BYTES);
437 if (!new_buff)
438 {
439 free (sect_buff);
440- sect_buff = (unsigned char *)_TIFFmalloc(sectsize);
441+ sect_buff = (unsigned char *)_TIFFmalloc(sectsize + NUM_BUFF_OVERSIZE_BYTES);
442 }
443 else
444 sect_buff = new_buff;
445@@ -7372,7 +7394,7 @@ createImageSection(uint32 sectsize, unsigned char **sect_buff_ptr)
446 TIFFError("createImageSection", "Unable to allocate/reallocate section buffer");
447 return (-1);
448 }
449- _TIFFmemset(sect_buff, 0, sectsize);
450+ _TIFFmemset(sect_buff, 0, sectsize + NUM_BUFF_OVERSIZE_BYTES);
451 }
452 }
453
454@@ -7403,17 +7425,17 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
455 cropsize = crop->bufftotal;
456 crop_buff = seg_buffs[0].buffer;
457 if (!crop_buff)
458- crop_buff = (unsigned char *)_TIFFmalloc(cropsize);
459+ crop_buff = (unsigned char *)_TIFFmalloc(cropsize + NUM_BUFF_OVERSIZE_BYTES);
460 else
461 {
462 prev_cropsize = seg_buffs[0].size;
463 if (prev_cropsize < cropsize)
464 {
465- next_buff = _TIFFrealloc(crop_buff, cropsize);
466+ next_buff = _TIFFrealloc(crop_buff, cropsize + NUM_BUFF_OVERSIZE_BYTES);
467 if (! next_buff)
468 {
469 _TIFFfree (crop_buff);
470- crop_buff = (unsigned char *)_TIFFmalloc(cropsize);
471+ crop_buff = (unsigned char *)_TIFFmalloc(cropsize + NUM_BUFF_OVERSIZE_BYTES);
472 }
473 else
474 crop_buff = next_buff;
475@@ -7426,7 +7448,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
476 return (-1);
477 }
478
479- _TIFFmemset(crop_buff, 0, cropsize);
480+ _TIFFmemset(crop_buff, 0, cropsize + NUM_BUFF_OVERSIZE_BYTES);
481 seg_buffs[0].buffer = crop_buff;
482 seg_buffs[0].size = cropsize;
483
484@@ -7505,17 +7527,17 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
485 cropsize = crop->bufftotal;
486 crop_buff = seg_buffs[i].buffer;
487 if (!crop_buff)
488- crop_buff = (unsigned char *)_TIFFmalloc(cropsize);
489+ crop_buff = (unsigned char *)_TIFFmalloc(cropsize + NUM_BUFF_OVERSIZE_BYTES);
490 else
491 {
492 prev_cropsize = seg_buffs[0].size;
493 if (prev_cropsize < cropsize)
494 {
495- next_buff = _TIFFrealloc(crop_buff, cropsize);
496+ next_buff = _TIFFrealloc(crop_buff, cropsize + NUM_BUFF_OVERSIZE_BYTES);
497 if (! next_buff)
498 {
499 _TIFFfree (crop_buff);
500- crop_buff = (unsigned char *)_TIFFmalloc(cropsize);
501+ crop_buff = (unsigned char *)_TIFFmalloc(cropsize + NUM_BUFF_OVERSIZE_BYTES);
502 }
503 else
504 crop_buff = next_buff;
505@@ -7528,7 +7550,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
506 return (-1);
507 }
508
509- _TIFFmemset(crop_buff, 0, cropsize);
510+ _TIFFmemset(crop_buff, 0, cropsize + NUM_BUFF_OVERSIZE_BYTES);
511 seg_buffs[i].buffer = crop_buff;
512 seg_buffs[i].size = cropsize;
513
514@@ -7641,24 +7663,24 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop,
515 crop_buff = *crop_buff_ptr;
516 if (!crop_buff)
517 {
518- crop_buff = (unsigned char *)_TIFFmalloc(cropsize);
519+ crop_buff = (unsigned char *)_TIFFmalloc(cropsize + NUM_BUFF_OVERSIZE_BYTES);
520 if (!crop_buff)
521 {
522 TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer");
523 return (-1);
524 }
525- _TIFFmemset(crop_buff, 0, cropsize);
526+ _TIFFmemset(crop_buff, 0, cropsize + NUM_BUFF_OVERSIZE_BYTES);
527 prev_cropsize = cropsize;
528 }
529 else
530 {
531 if (prev_cropsize < cropsize)
532 {
533- new_buff = _TIFFrealloc(crop_buff, cropsize);
534+ new_buff = _TIFFrealloc(crop_buff, cropsize + NUM_BUFF_OVERSIZE_BYTES);
535 if (!new_buff)
536 {
537 free (crop_buff);
538- crop_buff = (unsigned char *)_TIFFmalloc(cropsize);
539+ crop_buff = (unsigned char *)_TIFFmalloc(cropsize + NUM_BUFF_OVERSIZE_BYTES);
540 }
541 else
542 crop_buff = new_buff;
543@@ -7667,7 +7689,7 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop,
544 TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer");
545 return (-1);
546 }
547- _TIFFmemset(crop_buff, 0, cropsize);
548+ _TIFFmemset(crop_buff, 0, cropsize + NUM_BUFF_OVERSIZE_BYTES);
549 }
550 }
551
552@@ -7965,13 +7987,13 @@ writeCroppedImage(TIFF *in, TIFF *out, struct image_data *image,
553 if (TIFFGetField(in, TIFFTAG_NUMBEROFINKS, &ninks)) {
554 TIFFSetField(out, TIFFTAG_NUMBEROFINKS, ninks);
555 if (TIFFGetField(in, TIFFTAG_INKNAMES, &inknames)) {
556- int inknameslen = strlen(inknames) + 1;
557+ int inknameslen = (int)strlen(inknames) + 1;
558 const char* cp = inknames;
559 while (ninks > 1) {
560 cp = strchr(cp, '\0');
561 if (cp) {
562 cp++;
563- inknameslen += (strlen(cp) + 1);
564+ inknameslen += ((int)strlen(cp) + 1);
565 }
566 ninks--;
567 }
568@@ -8356,13 +8378,13 @@ rotateContigSamples32bits(uint16 rotation, uint16 spp, uint16 bps, uint32 width,
569 }
570 else /* If we have a full buffer's worth, write it out */
571 {
572- bytebuff1 = (buff2 >> 56);
573+ bytebuff1 = (uint8)(buff2 >> 56);
574 *dst++ = bytebuff1;
575- bytebuff2 = (buff2 >> 48);
576+ bytebuff2 = (uint8)(buff2 >> 48);
577 *dst++ = bytebuff2;
578- bytebuff3 = (buff2 >> 40);
579+ bytebuff3 = (uint8)(buff2 >> 40);
580 *dst++ = bytebuff3;
581- bytebuff4 = (buff2 >> 32);
582+ bytebuff4 = (uint8)(buff2 >> 32);
583 *dst++ = bytebuff4;
584 ready_bits -= 32;
585
586@@ -8431,12 +8453,13 @@ rotateImage(uint16 rotation, struct image_data *image, uint32 *img_width,
587 return (-1);
588 }
589
590- if (!(rbuff = (unsigned char *)_TIFFmalloc(buffsize)))
591+ /* Add 3 padding bytes for extractContigSamplesShifted32bits */
592+ if (!(rbuff = (unsigned char *)_TIFFmalloc(buffsize + NUM_BUFF_OVERSIZE_BYTES)))
593 {
594- TIFFError("rotateImage", "Unable to allocate rotation buffer of %1u bytes", buffsize);
595+ TIFFError("rotateImage", "Unable to allocate rotation buffer of %1u bytes", buffsize + NUM_BUFF_OVERSIZE_BYTES);
596 return (-1);
597 }
598- _TIFFmemset(rbuff, '\0', buffsize);
599+ _TIFFmemset(rbuff, '\0', buffsize + NUM_BUFF_OVERSIZE_BYTES);
600
601 ibuff = *ibuff_ptr;
602 switch (rotation)
603@@ -8964,13 +8987,13 @@ reverseSamples32bits (uint16 spp, uint16 bps, uint32 width,
604 }
605 else /* If we have a full buffer's worth, write it out */
606 {
607- bytebuff1 = (buff2 >> 56);
608+ bytebuff1 = (uint8)(buff2 >> 56);
609 *dst++ = bytebuff1;
610- bytebuff2 = (buff2 >> 48);
611+ bytebuff2 = (uint8)(buff2 >> 48);
612 *dst++ = bytebuff2;
613- bytebuff3 = (buff2 >> 40);
614+ bytebuff3 = (uint8)(buff2 >> 40);
615 *dst++ = bytebuff3;
616- bytebuff4 = (buff2 >> 32);
617+ bytebuff4 = (uint8)(buff2 >> 32);
618 *dst++ = bytebuff4;
619 ready_bits -= 32;
620
621@@ -9061,12 +9084,13 @@ mirrorImage(uint16 spp, uint16 bps, uint16 mirror, uint32 width, uint32 length,
622 {
623 case MIRROR_BOTH:
624 case MIRROR_VERT:
625- line_buff = (unsigned char *)_TIFFmalloc(rowsize);
626+ line_buff = (unsigned char *)_TIFFmalloc(rowsize + NUM_BUFF_OVERSIZE_BYTES);
627 if (line_buff == NULL)
628 {
629- TIFFError ("mirrorImage", "Unable to allocate mirror line buffer of %1u bytes", rowsize);
630+ TIFFError ("mirrorImage", "Unable to allocate mirror line buffer of %1u bytes", rowsize + NUM_BUFF_OVERSIZE_BYTES);
631 return (-1);
632 }
633+ _TIFFmemset(line_buff, '\0', rowsize + NUM_BUFF_OVERSIZE_BYTES);
634
635 dst = ibuff + (rowsize * (length - 1));
636 for (row = 0; row < length / 2; row++)
637@@ -9098,11 +9122,12 @@ mirrorImage(uint16 spp, uint16 bps, uint16 mirror, uint32 width, uint32 length,
638 }
639 else
640 { /* non 8 bit per sample data */
641- if (!(line_buff = (unsigned char *)_TIFFmalloc(rowsize + 1)))
642+ if (!(line_buff = (unsigned char *)_TIFFmalloc(rowsize + NUM_BUFF_OVERSIZE_BYTES)))
643 {
644 TIFFError("mirrorImage", "Unable to allocate mirror line buffer");
645 return (-1);
646 }
647+ _TIFFmemset(line_buff, '\0', rowsize + NUM_BUFF_OVERSIZE_BYTES);
648 bytes_per_sample = (bps + 7) / 8;
649 bytes_per_pixel = ((bps * spp) + 7) / 8;
650 if (bytes_per_pixel < (bytes_per_sample + 1))
651@@ -9114,7 +9139,7 @@ mirrorImage(uint16 spp, uint16 bps, uint16 mirror, uint32 width, uint32 length,
652 {
653 row_offset = row * rowsize;
654 src = ibuff + row_offset;
655- _TIFFmemset (line_buff, '\0', rowsize);
656+ _TIFFmemset (line_buff, '\0', rowsize + NUM_BUFF_OVERSIZE_BYTES);
657 switch (shift_width)
658 {
659 case 1: if (reverseSamples16bits(spp, bps, width, src, line_buff))
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-3597_3626_3627.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-3597_3626_3627.patch
new file mode 100644
index 0000000000..18a4b4e0ff
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-3597_3626_3627.patch
@@ -0,0 +1,123 @@
1From f7c06c395daf1b2c52ab431e00db2d9fc2ac993e Mon Sep 17 00:00:00 2001
2From: Su Laus <sulau@freenet.de>
3Date: Tue, 10 May 2022 20:03:17 +0000
4Subject: [PATCH] tiffcrop: Fix issue #330 and some more from 320 to 349
5
6Upstream-Status: Backport [import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u7.debian.tar.xz ]
7CVE: CVE-2022-3597 CVE-2022-3626 CVE-2022-3627
8Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
9
10Origin: https://gitlab.com/libtiff/libtiff/-/commit/e319508023580e2f70e6e626f745b5b2a1707313
11Origin: https://gitlab.com/libtiff/libtiff/-/commit/8fe3735942ea1d90d8cef843b55b3efe8ab6feaf
12Origin: https://gitlab.com/libtiff/libtiff/-/commit/bad48e90b410df32172006c7876da449ba62cdba
13Origin: https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047
14Reviewed-by: Sylvain Beucler <beuc@debian.org>
15Last-Update: 2023-01-17
16
17---
18 tools/tiffcrop.c | 50 ++++++++++++++++++++++++++++++++++++++++--------
19 1 file changed, 42 insertions(+), 8 deletions(-)
20
21diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
22index c923920..a0789a3 100644
23--- a/tools/tiffcrop.c
24+++ b/tools/tiffcrop.c
25@@ -103,7 +103,12 @@
26 * selects which functions dump data, with higher numbers selecting
27 * lower level, scanline level routines. Debug reports a limited set
28 * of messages to monitor progess without enabling dump logs.
29- */
30+ *
31+ * Note 1: The (-X|-Y), -Z, -z and -S options are mutually exclusive.
32+ * In no case should the options be applied to a given selection successively.
33+ * Note 2: Any of the -X, -Y, -Z and -z options together with other PAGE_MODE_x options
34+ * such as -H, -V, -P, -J or -K are not supported and may cause buffer overflows.
35+ */
36
37 static char tiffcrop_version_id[] = "2.4.1";
38 static char tiffcrop_rev_date[] = "03-03-2010";
39@@ -176,12 +181,12 @@ extern int getopt(int argc, char * const argv[], const char *optstring);
40 #define ROTATECW_270 32
41 #define ROTATE_ANY (ROTATECW_90 | ROTATECW_180 | ROTATECW_270)
42
43-#define CROP_NONE 0
44-#define CROP_MARGINS 1
45-#define CROP_WIDTH 2
46-#define CROP_LENGTH 4
47-#define CROP_ZONES 8
48-#define CROP_REGIONS 16
49+#define CROP_NONE 0 /* "-S" -> Page_MODE_ROWSCOLS and page->rows/->cols != 0 */
50+#define CROP_MARGINS 1 /* "-m" */
51+#define CROP_WIDTH 2 /* "-X" */
52+#define CROP_LENGTH 4 /* "-Y" */
53+#define CROP_ZONES 8 /* "-Z" */
54+#define CROP_REGIONS 16 /* "-z" */
55 #define CROP_ROTATE 32
56 #define CROP_MIRROR 64
57 #define CROP_INVERT 128
58@@ -323,7 +328,7 @@ struct crop_mask {
59 #define PAGE_MODE_RESOLUTION 1
60 #define PAGE_MODE_PAPERSIZE 2
61 #define PAGE_MODE_MARGINS 4
62-#define PAGE_MODE_ROWSCOLS 8
63+#define PAGE_MODE_ROWSCOLS 8 /* for -S option */
64
65 #define INVERT_DATA_ONLY 10
66 #define INVERT_DATA_AND_TAG 11
67@@ -754,6 +759,12 @@ static char* usage_info[] = {
68 " The four debug/dump options are independent, though it makes little sense to",
69 " specify a dump file without specifying a detail level.",
70 " ",
71+"Note 1: The (-X|-Y), -Z, -z and -S options are mutually exclusive.",
72+" In no case should the options be applied to a given selection successively.",
73+" ",
74+"Note 2: Any of the -X, -Y, -Z and -z options together with other PAGE_MODE_x options",
75+" such as - H, -V, -P, -J or -K are not supported and may cause buffer overflows.",
76+" ",
77 NULL
78 };
79
80@@ -2112,6 +2123,27 @@ void process_command_opts (int argc, char *argv[], char *mp, char *mode, uint32
81 /*NOTREACHED*/
82 }
83 }
84+ /*-- Check for not allowed combinations (e.g. -X, -Y and -Z, -z and -S are mutually exclusive) --*/
85+ char XY, Z, R, S;
86+ XY = ((crop_data->crop_mode & CROP_WIDTH) || (crop_data->crop_mode & CROP_LENGTH)) ? 1 : 0;
87+ Z = (crop_data->crop_mode & CROP_ZONES) ? 1 : 0;
88+ R = (crop_data->crop_mode & CROP_REGIONS) ? 1 : 0;
89+ S = (page->mode & PAGE_MODE_ROWSCOLS) ? 1 : 0;
90+ if (XY + Z + R + S > 1) {
91+ TIFFError("tiffcrop input error", "The crop options(-X|-Y), -Z, -z and -S are mutually exclusive.->exit");
92+ exit(EXIT_FAILURE);
93+ }
94+
95+ /* Check for not allowed combination:
96+ * Any of the -X, -Y, -Z and -z options together with other PAGE_MODE_x options
97+ * such as -H, -V, -P, -J or -K are not supported and may cause buffer overflows.
98+. */
99+ if ((XY + Z + R > 0) && page->mode != PAGE_MODE_NONE) {
100+ TIFFError("tiffcrop input error",
101+ "Any of the crop options -X, -Y, -Z and -z together with other PAGE_MODE_x options such as - H, -V, -P, -J or -K is not supported and may cause buffer overflows..->exit");
102+ exit(EXIT_FAILURE);
103+ }
104+
105 } /* end process_command_opts */
106
107 /* Start a new output file if one has not been previously opened or
108@@ -2384,6 +2416,7 @@ main(int argc, char* argv[])
109 exit (-1);
110 }
111
112+ /* Crop input image and copy zones and regions from input image into seg_buffs or crop_buff. */
113 if (crop.selections > 0)
114 {
115 if (processCropSelections(&image, &crop, &read_buff, seg_buffs))
116@@ -2400,6 +2433,7 @@ main(int argc, char* argv[])
117 exit (-1);
118 }
119 }
120+ /* Format and write selected image parts to output file(s). */
121 if (page.mode == PAGE_MODE_NONE)
122 { /* Whole image or sections not based on output page size */
123 if (crop.selections > 0)
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-3599.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-3599.patch
new file mode 100644
index 0000000000..b3232d9002
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-3599.patch
@@ -0,0 +1,277 @@
1From 01bca7e6f608da7696949fca6acda78b9935ba19 Mon Sep 17 00:00:00 2001
2From: Su_Laus <sulau@freenet.de>
3Date: Tue, 30 Aug 2022 16:56:48 +0200
4Subject: [PATCH] Revised handling of TIFFTAG_INKNAMES and related
5
6Upstream-Status: Backport [import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u7.debian.tar.xz ]
7CVE: CVE-2022-3599 CVE-2022-4645 CVE-2023-30774
8Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
9
10Origin: https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246
11Reviewed-by: Sylvain Beucler <beuc@debian.org>
12Last-Update: 2023-01-17
13
14 TIFFTAG_NUMBEROFINKS value
15
16In order to solve the buffer overflow issues related to TIFFTAG_INKNAMES and related TIFFTAG_NUMBEROFINKS value, a revised handling of those tags within LibTiff is proposed:
17
18Behaviour for writing:
19 `NumberOfInks` MUST fit to the number of inks in the `InkNames` string.
20 `NumberOfInks` is automatically set when `InkNames` is set.
21 If `NumberOfInks` is different to the number of inks within `InkNames` string, that will be corrected and a warning is issued.
22 If `NumberOfInks` is not equal to samplesperpixel only a warning will be issued.
23
24Behaviour for reading:
25 When reading `InkNames` from a TIFF file, the `NumberOfInks` will be set automatically to the number of inks in `InkNames` string.
26 If `NumberOfInks` is different to the number of inks within `InkNames` string, that will be corrected and a warning is issued.
27 If `NumberOfInks` is not equal to samplesperpixel only a warning will be issued.
28
29This allows the safe use of the NumberOfInks value to read out the InkNames without buffer overflow
30
31This MR will close the following issues: #149, #150, #152, #168 (to be checked), #250, #269, #398 and #456.
32
33It also fixes the old bug at http://bugzilla.maptools.org/show_bug.cgi?id=2599, for which the limitation of `NumberOfInks = SPP` was introduced, which is in my opinion not necessary and does not solve the general issue.
34
35---
36 libtiff/tif_dir.c | 120 ++++++++++++++++++++++++-----------------
37 libtiff/tif_dir.h | 2 +
38 libtiff/tif_dirinfo.c | 2 +-
39 libtiff/tif_dirwrite.c | 5 ++
40 libtiff/tif_print.c | 4 ++
41 5 files changed, 83 insertions(+), 50 deletions(-)
42
43diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
44index 39aeeb4..9d8267a 100644
45--- a/libtiff/tif_dir.c
46+++ b/libtiff/tif_dir.c
47@@ -29,6 +29,7 @@
48 * (and also some miscellaneous stuff)
49 */
50 #include "tiffiop.h"
51+# include <inttypes.h>
52
53 /*
54 * These are used in the backwards compatibility code...
55@@ -137,32 +138,30 @@ setExtraSamples(TIFF* tif, va_list ap, uint32* v)
56 }
57
58 /*
59- * Confirm we have "samplesperpixel" ink names separated by \0. Returns
60+ * Count ink names separated by \0. Returns
61 * zero if the ink names are not as expected.
62 */
63-static uint32
64-checkInkNamesString(TIFF* tif, uint32 slen, const char* s)
65+static uint16
66+countInkNamesString(TIFF *tif, uint32 slen, const char *s)
67 {
68- TIFFDirectory* td = &tif->tif_dir;
69- uint16 i = td->td_samplesperpixel;
70+ uint16 i = 0;
71+ const char *ep = s + slen;
72+ const char *cp = s;
73
74 if (slen > 0) {
75- const char* ep = s+slen;
76- const char* cp = s;
77- for (; i > 0; i--) {
78+ do {
79 for (; cp < ep && *cp != '\0'; cp++) {}
80 if (cp >= ep)
81 goto bad;
82 cp++; /* skip \0 */
83- }
84- return ((uint32)(cp-s));
85+ i++;
86+ } while (cp < ep);
87+ return (i);
88 }
89 bad:
90 TIFFErrorExt(tif->tif_clientdata, "TIFFSetField",
91- "%s: Invalid InkNames value; expecting %d names, found %d",
92- tif->tif_name,
93- td->td_samplesperpixel,
94- td->td_samplesperpixel-i);
95+ "%s: Invalid InkNames value; no NUL at given buffer end location %"PRIu32", after %"PRIu16" ink",
96+ tif->tif_name, slen, i);
97 return (0);
98 }
99
100@@ -476,13 +475,61 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
101 _TIFFsetFloatArray(&td->td_refblackwhite, va_arg(ap, float*), 6);
102 break;
103 case TIFFTAG_INKNAMES:
104- v = (uint16) va_arg(ap, uint16_vap);
105- s = va_arg(ap, char*);
106- v = checkInkNamesString(tif, v, s);
107- status = v > 0;
108- if( v > 0 ) {
109- _TIFFsetNString(&td->td_inknames, s, v);
110- td->td_inknameslen = v;
111+ {
112+ v = (uint16) va_arg(ap, uint16_vap);
113+ s = va_arg(ap, char*);
114+ uint16 ninksinstring;
115+ ninksinstring = countInkNamesString(tif, v, s);
116+ status = ninksinstring > 0;
117+ if(ninksinstring > 0 ) {
118+ _TIFFsetNString(&td->td_inknames, s, v);
119+ td->td_inknameslen = v;
120+ /* Set NumberOfInks to the value ninksinstring */
121+ if (TIFFFieldSet(tif, FIELD_NUMBEROFINKS))
122+ {
123+ if (td->td_numberofinks != ninksinstring) {
124+ TIFFErrorExt(tif->tif_clientdata, module,
125+ "Warning %s; Tag %s:\n Value %"PRIu16" of NumberOfInks is different from the number of inks %"PRIu16".\n -> NumberOfInks value adapted to %"PRIu16"",
126+ tif->tif_name, fip->field_name, td->td_numberofinks, ninksinstring, ninksinstring);
127+ td->td_numberofinks = ninksinstring;
128+ }
129+ } else {
130+ td->td_numberofinks = ninksinstring;
131+ TIFFSetFieldBit(tif, FIELD_NUMBEROFINKS);
132+ }
133+ if (TIFFFieldSet(tif, FIELD_SAMPLESPERPIXEL))
134+ {
135+ if (td->td_numberofinks != td->td_samplesperpixel) {
136+ TIFFErrorExt(tif->tif_clientdata, module,
137+ "Warning %s; Tag %s:\n Value %"PRIu16" of NumberOfInks is different from the SamplesPerPixel value %"PRIu16"",
138+ tif->tif_name, fip->field_name, td->td_numberofinks, td->td_samplesperpixel);
139+ }
140+ }
141+ }
142+ }
143+ break;
144+ case TIFFTAG_NUMBEROFINKS:
145+ v = (uint16)va_arg(ap, uint16_vap);
146+ /* If InkNames already set also NumberOfInks is set accordingly and should be equal */
147+ if (TIFFFieldSet(tif, FIELD_INKNAMES))
148+ {
149+ if (v != td->td_numberofinks) {
150+ TIFFErrorExt(tif->tif_clientdata, module,
151+ "Error %s; Tag %s:\n It is not possible to set the value %"PRIu32" for NumberOfInks\n which is different from the number of inks in the InkNames tag (%"PRIu16")",
152+ tif->tif_name, fip->field_name, v, td->td_numberofinks);
153+ /* Do not set / overwrite number of inks already set by InkNames case accordingly. */
154+ status = 0;
155+ }
156+ } else {
157+ td->td_numberofinks = (uint16)v;
158+ if (TIFFFieldSet(tif, FIELD_SAMPLESPERPIXEL))
159+ {
160+ if (td->td_numberofinks != td->td_samplesperpixel) {
161+ TIFFErrorExt(tif->tif_clientdata, module,
162+ "Warning %s; Tag %s:\n Value %"PRIu32" of NumberOfInks is different from the SamplesPerPixel value %"PRIu16"",
163+ tif->tif_name, fip->field_name, v, td->td_samplesperpixel);
164+ }
165+ }
166 }
167 break;
168 case TIFFTAG_PERSAMPLE:
169@@ -887,34 +934,6 @@ _TIFFVGetField(TIFF* tif, uint32 tag, va_list ap)
170 if (fip->field_bit == FIELD_CUSTOM) {
171 standard_tag = 0;
172 }
173-
174- if( standard_tag == TIFFTAG_NUMBEROFINKS )
175- {
176- int i;
177- for (i = 0; i < td->td_customValueCount; i++) {
178- uint16 val;
179- TIFFTagValue *tv = td->td_customValues + i;
180- if (tv->info->field_tag != standard_tag)
181- continue;
182- if( tv->value == NULL )
183- return 0;
184- val = *(uint16 *)tv->value;
185- /* Truncate to SamplesPerPixel, since the */
186- /* setting code for INKNAMES assume that there are SamplesPerPixel */
187- /* inknames. */
188- /* Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2599 */
189- if( val > td->td_samplesperpixel )
190- {
191- TIFFWarningExt(tif->tif_clientdata,"_TIFFVGetField",
192- "Truncating NumberOfInks from %u to %u",
193- val, td->td_samplesperpixel);
194- val = td->td_samplesperpixel;
195- }
196- *va_arg(ap, uint16*) = val;
197- return 1;
198- }
199- return 0;
200- }
201
202 switch (standard_tag) {
203 case TIFFTAG_SUBFILETYPE:
204@@ -1092,6 +1111,9 @@ _TIFFVGetField(TIFF* tif, uint32 tag, va_list ap)
205 case TIFFTAG_INKNAMES:
206 *va_arg(ap, char**) = td->td_inknames;
207 break;
208+ case TIFFTAG_NUMBEROFINKS:
209+ *va_arg(ap, uint16 *) = td->td_numberofinks;
210+ break;
211 default:
212 {
213 int i;
214diff --git a/libtiff/tif_dir.h b/libtiff/tif_dir.h
215index e7f0667..7cad679 100644
216--- a/libtiff/tif_dir.h
217+++ b/libtiff/tif_dir.h
218@@ -117,6 +117,7 @@ typedef struct {
219 /* CMYK parameters */
220 int td_inknameslen;
221 char* td_inknames;
222+ uint16 td_numberofinks; /* number of inks in InkNames string */
223
224 int td_customValueCount;
225 TIFFTagValue *td_customValues;
226@@ -174,6 +175,7 @@ typedef struct {
227 #define FIELD_TRANSFERFUNCTION 44
228 #define FIELD_INKNAMES 46
229 #define FIELD_SUBIFD 49
230+#define FIELD_NUMBEROFINKS 50
231 /* FIELD_CUSTOM (see tiffio.h) 65 */
232 /* end of support for well-known tags; codec-private tags follow */
233 #define FIELD_CODEC 66 /* base of codec-private tags */
234diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c
235index fbfaaf0..bf7de70 100644
236--- a/libtiff/tif_dirinfo.c
237+++ b/libtiff/tif_dirinfo.c
238@@ -104,7 +104,7 @@ tiffFields[] = {
239 { TIFFTAG_SUBIFD, -1, -1, TIFF_IFD8, 0, TIFF_SETGET_C16_IFD8, TIFF_SETGET_UNDEFINED, FIELD_SUBIFD, 1, 1, "SubIFD", (TIFFFieldArray*) &tiffFieldArray },
240 { TIFFTAG_INKSET, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 0, 0, "InkSet", NULL },
241 { TIFFTAG_INKNAMES, -1, -1, TIFF_ASCII, 0, TIFF_SETGET_C16_ASCII, TIFF_SETGET_UNDEFINED, FIELD_INKNAMES, 1, 1, "InkNames", NULL },
242- { TIFFTAG_NUMBEROFINKS, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 1, 0, "NumberOfInks", NULL },
243+ { TIFFTAG_NUMBEROFINKS, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16, TIFF_SETGET_UNDEFINED, FIELD_NUMBEROFINKS, 1, 0, "NumberOfInks", NULL },
244 { TIFFTAG_DOTRANGE, 2, 2, TIFF_SHORT, 0, TIFF_SETGET_UINT16_PAIR, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 0, 0, "DotRange", NULL },
245 { TIFFTAG_TARGETPRINTER, -1, -1, TIFF_ASCII, 0, TIFF_SETGET_ASCII, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 1, 0, "TargetPrinter", NULL },
246 { TIFFTAG_EXTRASAMPLES, -1, -1, TIFF_SHORT, 0, TIFF_SETGET_C16_UINT16, TIFF_SETGET_UNDEFINED, FIELD_EXTRASAMPLES, 0, 1, "ExtraSamples", NULL },
247diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c
248index 9e4d306..a2dbc3b 100644
249--- a/libtiff/tif_dirwrite.c
250+++ b/libtiff/tif_dirwrite.c
251@@ -677,6 +677,11 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
252 if (!TIFFWriteDirectoryTagAscii(tif,&ndir,dir,TIFFTAG_INKNAMES,tif->tif_dir.td_inknameslen,tif->tif_dir.td_inknames))
253 goto bad;
254 }
255+ if (TIFFFieldSet(tif, FIELD_NUMBEROFINKS))
256+ {
257+ if (!TIFFWriteDirectoryTagShort(tif, &ndir, dir, TIFFTAG_NUMBEROFINKS, tif->tif_dir.td_numberofinks))
258+ goto bad;
259+ }
260 if (TIFFFieldSet(tif,FIELD_SUBIFD))
261 {
262 if (!TIFFWriteDirectoryTagSubifd(tif,&ndir,dir))
263diff --git a/libtiff/tif_print.c b/libtiff/tif_print.c
264index a073794..a9f05a7 100644
265--- a/libtiff/tif_print.c
266+++ b/libtiff/tif_print.c
267@@ -402,6 +402,10 @@ TIFFPrintDirectory(TIFF* tif, FILE* fd, long flags)
268 }
269 fputs("\n", fd);
270 }
271+ if (TIFFFieldSet(tif, FIELD_NUMBEROFINKS)) {
272+ fprintf(fd, " NumberOfInks: %d\n",
273+ td->td_numberofinks);
274+ }
275 if (TIFFFieldSet(tif,FIELD_THRESHHOLDING)) {
276 fprintf(fd, " Thresholding: ");
277 switch (td->td_threshholding) {
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-3970.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-3970.patch
new file mode 100644
index 0000000000..ea70827cbe
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-3970.patch
@@ -0,0 +1,45 @@
1From 7e87352217d1f0c77eee7033ac59e3aab08532bb Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Tue, 8 Nov 2022 15:16:58 +0100
4Subject: [PATCH] TIFFReadRGBATileExt(): fix (unsigned) integer overflow on
5
6Upstream-Status: Backport [import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u7.debian.tar.xz ]
7CVE: CVE-2022-3970
8Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
9
10Origin: https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be
11Reviewed-by: Sylvain Beucler <beuc@debian.org>
12Last-Update: 2023-01-17
13
14 strips/tiles > 2 GB
15
16Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53137
17
18---
19 libtiff/tif_getimage.c | 8 ++++----
20 1 file changed, 4 insertions(+), 4 deletions(-)
21
22diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
23index 96ab146..0b90dcc 100644
24--- a/libtiff/tif_getimage.c
25+++ b/libtiff/tif_getimage.c
26@@ -3042,15 +3042,15 @@ TIFFReadRGBATileExt(TIFF* tif, uint32 col, uint32 row, uint32 * raster, int stop
27 return( ok );
28
29 for( i_row = 0; i_row < read_ysize; i_row++ ) {
30- memmove( raster + (tile_ysize - i_row - 1) * tile_xsize,
31- raster + (read_ysize - i_row - 1) * read_xsize,
32+ memmove( raster + (size_t)(tile_ysize - i_row - 1) * tile_xsize,
33+ raster + (size_t)(read_ysize - i_row - 1) * read_xsize,
34 read_xsize * sizeof(uint32) );
35- _TIFFmemset( raster + (tile_ysize - i_row - 1) * tile_xsize+read_xsize,
36+ _TIFFmemset( raster + (size_t)(tile_ysize - i_row - 1) * tile_xsize+read_xsize,
37 0, sizeof(uint32) * (tile_xsize - read_xsize) );
38 }
39
40 for( i_row = read_ysize; i_row < tile_ysize; i_row++ ) {
41- _TIFFmemset( raster + (tile_ysize - i_row - 1) * tile_xsize,
42+ _TIFFmemset( raster + (size_t)(tile_ysize - i_row - 1) * tile_xsize,
43 0, sizeof(uint32) * tile_xsize );
44 }
45
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-40090.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-40090.patch
new file mode 100644
index 0000000000..0a88f59553
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-40090.patch
@@ -0,0 +1,548 @@
1From d385738335deb0c4bb70449f12e411f2203c0d01 Mon Sep 17 00:00:00 2001
2From: Su_Laus <sulau@freenet.de>
3Date: Fri, 2 Sep 2022 21:20:28 +0200
4Subject: [PATCH 1/4] Improved IFD-Loop Handling (fixes #455)
5
6Basic approach:
7- The order in the entire chain must be checked, and not only whether an offset has already been read once.
8- To do this, pairs of directory number and offset are stored and checked.
9- The offset of a directory number can change.
10- TIFFAdvanceDirectory() must also perform an IFD loop check.
11- TIFFCheckDirOffset() is replaced by _TIFFCheckDirNumberAndOffset().
12
13Rules for the check:
14- If an offset is already in the list, it must have the same IFD number. Otherwise it is an IDF loop.
15- If the offset is not in the list and the IFD number is greater than there are list entries, a new list entry is added.
16- Otherwise, the offset of the IFD number is updated.
17
18Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/tiff/tree/debian/patches/CVE-2022-40090.patch?h=ubuntu/focal-security
19Upstream commit
20https://gitlab.com/libtiff/libtiff/-/commit/c7caec9a4d8f24c17e667480d2c7d0d51c9fae41]
21CVE: CVE-2022-40090
22Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
23---
24 libtiff/tif_close.c | 6 ++-
25 libtiff/tif_dir.c | 91 +++++++++++++++++++++++++----------------
26 libtiff/tif_dir.h | 1 +
27 libtiff/tif_dirread.c | 94 ++++++++++++++++++++++++++++++-------------
28 libtiff/tif_open.c | 3 +-
29 libtiff/tiffiop.h | 3 +-
30 6 files changed, 131 insertions(+), 67 deletions(-)
31
32--- tiff-4.1.0+git191117.orig/libtiff/tif_close.c
33+++ tiff-4.1.0+git191117/libtiff/tif_close.c
34@@ -52,8 +52,10 @@ TIFFCleanup(TIFF* tif)
35 (*tif->tif_cleanup)(tif);
36 TIFFFreeDirectory(tif);
37
38- if (tif->tif_dirlist)
39- _TIFFfree(tif->tif_dirlist);
40+ if (tif->tif_dirlistoff)
41+ _TIFFfree(tif->tif_dirlistoff);
42+ if (tif->tif_dirlistdirn)
43+ _TIFFfree(tif->tif_dirlistdirn);
44
45 /*
46 * Clean up client info links.
47--- tiff-4.1.0+git191117.orig/libtiff/tif_dir.c
48+++ tiff-4.1.0+git191117/libtiff/tif_dir.c
49@@ -1463,12 +1463,22 @@ TIFFDefaultDirectory(TIFF* tif)
50 }
51
52 static int
53-TIFFAdvanceDirectory(TIFF* tif, uint64* nextdir, uint64* off)
54+TIFFAdvanceDirectory(TIFF* tif, uint64* nextdiroff, uint64* off, uint16* nextdirnum)
55 {
56 static const char module[] = "TIFFAdvanceDirectory";
57+
58+ /* Add this directory to the directory list, if not already in. */
59+ if (!_TIFFCheckDirNumberAndOffset(tif, *nextdirnum, *nextdiroff)) {
60+ TIFFErrorExt(tif->tif_clientdata, module, "Starting directory %hu at offset 0x%lx (%lu) might cause an IFD loop",
61+ *nextdirnum, *nextdiroff, *nextdiroff);
62+ *nextdiroff = 0;
63+ *nextdirnum = 0;
64+ return(0);
65+ }
66+
67 if (isMapped(tif))
68 {
69- uint64 poff=*nextdir;
70+ uint64 poff=*nextdiroff;
71 if (!(tif->tif_flags&TIFF_BIGTIFF))
72 {
73 tmsize_t poffa,poffb,poffc,poffd;
74@@ -1479,7 +1489,7 @@ TIFFAdvanceDirectory(TIFF* tif, uint64*
75 if (((uint64)poffa!=poff)||(poffb<poffa)||(poffb<(tmsize_t)sizeof(uint16))||(poffb>tif->tif_size))
76 {
77 TIFFErrorExt(tif->tif_clientdata,module,"Error fetching directory count");
78- *nextdir=0;
79+ *nextdiroff=0;
80 return(0);
81 }
82 _TIFFmemcpy(&dircount,tif->tif_base+poffa,sizeof(uint16));
83@@ -1497,7 +1507,7 @@ TIFFAdvanceDirectory(TIFF* tif, uint64*
84 _TIFFmemcpy(&nextdir32,tif->tif_base+poffc,sizeof(uint32));
85 if (tif->tif_flags&TIFF_SWAB)
86 TIFFSwabLong(&nextdir32);
87- *nextdir=nextdir32;
88+ *nextdiroff=nextdir32;
89 }
90 else
91 {
92@@ -1529,11 +1539,10 @@ TIFFAdvanceDirectory(TIFF* tif, uint64*
93 }
94 if (off!=NULL)
95 *off=(uint64)poffc;
96- _TIFFmemcpy(nextdir,tif->tif_base+poffc,sizeof(uint64));
97+ _TIFFmemcpy(nextdiroff,tif->tif_base+poffc,sizeof(uint64));
98 if (tif->tif_flags&TIFF_SWAB)
99- TIFFSwabLong8(nextdir);
100+ TIFFSwabLong8(nextdiroff);
101 }
102- return(1);
103 }
104 else
105 {
106@@ -1541,7 +1550,7 @@ TIFFAdvanceDirectory(TIFF* tif, uint64*
107 {
108 uint16 dircount;
109 uint32 nextdir32;
110- if (!SeekOK(tif, *nextdir) ||
111+ if (!SeekOK(tif, *nextdiroff) ||
112 !ReadOK(tif, &dircount, sizeof (uint16))) {
113 TIFFErrorExt(tif->tif_clientdata, module, "%s: Error fetching directory count",
114 tif->tif_name);
115@@ -1562,13 +1571,13 @@ TIFFAdvanceDirectory(TIFF* tif, uint64*
116 }
117 if (tif->tif_flags & TIFF_SWAB)
118 TIFFSwabLong(&nextdir32);
119- *nextdir=nextdir32;
120+ *nextdiroff=nextdir32;
121 }
122 else
123 {
124 uint64 dircount64;
125 uint16 dircount16;
126- if (!SeekOK(tif, *nextdir) ||
127+ if (!SeekOK(tif, *nextdiroff) ||
128 !ReadOK(tif, &dircount64, sizeof (uint64))) {
129 TIFFErrorExt(tif->tif_clientdata, module, "%s: Error fetching directory count",
130 tif->tif_name);
131@@ -1588,17 +1597,27 @@ TIFFAdvanceDirectory(TIFF* tif, uint64*
132 else
133 (void) TIFFSeekFile(tif,
134 dircount16*20, SEEK_CUR);
135- if (!ReadOK(tif, nextdir, sizeof (uint64))) {
136+ if (!ReadOK(tif, nextdiroff, sizeof (uint64))) {
137 TIFFErrorExt(tif->tif_clientdata, module,
138 "%s: Error fetching directory link",
139 tif->tif_name);
140 return (0);
141 }
142 if (tif->tif_flags & TIFF_SWAB)
143- TIFFSwabLong8(nextdir);
144+ TIFFSwabLong8(nextdiroff);
145 }
146- return (1);
147 }
148+ if (*nextdiroff != 0) {
149+ (*nextdirnum)++;
150+ /* Check next directory for IFD looping and if so, set it as last directory. */
151+ if (!_TIFFCheckDirNumberAndOffset(tif, *nextdirnum, *nextdiroff)) {
152+ TIFFWarningExt(tif->tif_clientdata, module, "the next directory %hu at offset 0x%lx (%lu) might be an IFD loop. Treating directory %hu as last directory",
153+ *nextdirnum, *nextdiroff, *nextdiroff, *nextdirnum-1);
154+ *nextdiroff = 0;
155+ (*nextdirnum)--;
156+ }
157+ }
158+ return (1);
159 }
160
161 /*
162@@ -1608,14 +1627,16 @@ uint16
163 TIFFNumberOfDirectories(TIFF* tif)
164 {
165 static const char module[] = "TIFFNumberOfDirectories";
166- uint64 nextdir;
167+ uint64 nextdiroff;
168+ uint16 nextdirnum;
169 uint16 n;
170 if (!(tif->tif_flags&TIFF_BIGTIFF))
171- nextdir = tif->tif_header.classic.tiff_diroff;
172+ nextdiroff = tif->tif_header.classic.tiff_diroff;
173 else
174- nextdir = tif->tif_header.big.tiff_diroff;
175+ nextdiroff = tif->tif_header.big.tiff_diroff;
176+ nextdirnum = 0;
177 n = 0;
178- while (nextdir != 0 && TIFFAdvanceDirectory(tif, &nextdir, NULL))
179+ while (nextdiroff != 0 && TIFFAdvanceDirectory(tif, &nextdiroff, NULL, &nextdirnum))
180 {
181 if (n != 65535) {
182 ++n;
183@@ -1638,28 +1659,30 @@ TIFFNumberOfDirectories(TIFF* tif)
184 int
185 TIFFSetDirectory(TIFF* tif, uint16 dirn)
186 {
187- uint64 nextdir;
188+ uint64 nextdiroff;
189+ uint16 nextdirnum;
190 uint16 n;
191
192 if (!(tif->tif_flags&TIFF_BIGTIFF))
193- nextdir = tif->tif_header.classic.tiff_diroff;
194+ nextdiroff = tif->tif_header.classic.tiff_diroff;
195 else
196- nextdir = tif->tif_header.big.tiff_diroff;
197- for (n = dirn; n > 0 && nextdir != 0; n--)
198- if (!TIFFAdvanceDirectory(tif, &nextdir, NULL))
199+ nextdiroff = tif->tif_header.big.tiff_diroff;
200+ nextdirnum = 0;
201+ for (n = dirn; n > 0 && nextdiroff != 0; n--)
202+ if (!TIFFAdvanceDirectory(tif, &nextdiroff, NULL, &nextdirnum))
203 return (0);
204- tif->tif_nextdiroff = nextdir;
205+ /* If the n-th directory could not be reached (does not exist),
206+ * return here without touching anything further. */
207+ if (nextdiroff == 0 || n > 0)
208+ return (0);
209+
210+ tif->tif_nextdiroff = nextdiroff;
211 /*
212 * Set curdir to the actual directory index. The
213 * -1 is because TIFFReadDirectory will increment
214 * tif_curdir after successfully reading the directory.
215 */
216 tif->tif_curdir = (dirn - n) - 1;
217- /*
218- * Reset tif_dirnumber counter and start new list of seen directories.
219- * We need this to prevent IFD loops.
220- */
221- tif->tif_dirnumber = 0;
222 return (TIFFReadDirectory(tif));
223 }
224
225@@ -1672,13 +1695,42 @@ TIFFSetDirectory(TIFF* tif, uint16 dirn)
226 int
227 TIFFSetSubDirectory(TIFF* tif, uint64 diroff)
228 {
229- tif->tif_nextdiroff = diroff;
230- /*
231- * Reset tif_dirnumber counter and start new list of seen directories.
232- * We need this to prevent IFD loops.
233+ /* Match nextdiroff and curdir for consistent IFD-loop checking.
234+ * Only with TIFFSetSubDirectory() the IFD list can be corrupted with invalid offsets
235+ * within the main IFD tree.
236+ * In the case of several subIFDs of a main image,
237+ * there are two possibilities that are not even mutually exclusive.
238+ * a.) The subIFD tag contains an array with all offsets of the subIFDs.
239+ * b.) The SubIFDs are concatenated with their NextIFD parameters.
240+ * (refer to https://www.awaresystems.be/imaging/tiff/specification/TIFFPM6.pdf.)
241 */
242- tif->tif_dirnumber = 0;
243- return (TIFFReadDirectory(tif));
244+ int retval;
245+ uint16 curdir = 0;
246+ int8 probablySubIFD = 0;
247+ if (diroff == 0) {
248+ /* Special case to invalidate the tif_lastdiroff member. */
249+ tif->tif_curdir = 65535;
250+ } else {
251+ if (!_TIFFGetDirNumberFromOffset(tif, diroff, &curdir)) {
252+ /* Non-existing offsets might point to a SubIFD or invalid IFD.*/
253+ probablySubIFD = 1;
254+ }
255+ /* -1 because TIFFReadDirectory() will increment tif_curdir. */
256+ tif->tif_curdir = curdir - 1;
257+ }
258+
259+ tif->tif_nextdiroff = diroff;
260+ retval = TIFFReadDirectory(tif);
261+ /* If failed, curdir was not incremented in TIFFReadDirectory(), so set it back. */
262+ if (!retval )tif->tif_curdir++;
263+ if (retval && probablySubIFD) {
264+ /* Reset IFD list to start new one for SubIFD chain and also start SubIFD chain with tif_curdir=0. */
265+ tif->tif_dirnumber = 0;
266+ tif->tif_curdir = 0; /* first directory of new chain */
267+ /* add this offset to new IFD list */
268+ _TIFFCheckDirNumberAndOffset(tif, tif->tif_curdir, diroff);
269+ }
270+ return (retval);
271 }
272
273 /*
274@@ -1702,12 +1754,15 @@ TIFFLastDirectory(TIFF* tif)
275
276 /*
277 * Unlink the specified directory from the directory chain.
278+ * Note: First directory starts with number dirn=1.
279+ * This is different to TIFFSetDirectory() where the first directory starts with zero.
280 */
281 int
282 TIFFUnlinkDirectory(TIFF* tif, uint16 dirn)
283 {
284 static const char module[] = "TIFFUnlinkDirectory";
285 uint64 nextdir;
286+ uint16 nextdirnum;
287 uint64 off;
288 uint16 n;
289
290@@ -1731,19 +1786,21 @@ TIFFUnlinkDirectory(TIFF* tif, uint16 di
291 nextdir = tif->tif_header.big.tiff_diroff;
292 off = 8;
293 }
294+ nextdirnum = 0; /* First directory is dirn=0 */
295+
296 for (n = dirn-1; n > 0; n--) {
297 if (nextdir == 0) {
298 TIFFErrorExt(tif->tif_clientdata, module, "Directory %d does not exist", dirn);
299 return (0);
300 }
301- if (!TIFFAdvanceDirectory(tif, &nextdir, &off))
302+ if (!TIFFAdvanceDirectory(tif, &nextdir, &off, &nextdirnum))
303 return (0);
304 }
305 /*
306 * Advance to the directory to be unlinked and fetch
307 * the offset of the directory that follows.
308 */
309- if (!TIFFAdvanceDirectory(tif, &nextdir, NULL))
310+ if (!TIFFAdvanceDirectory(tif, &nextdir, NULL, &nextdirnum))
311 return (0);
312 /*
313 * Go back and patch the link field of the preceding
314--- tiff-4.1.0+git191117.orig/libtiff/tif_dir.h
315+++ tiff-4.1.0+git191117/libtiff/tif_dir.h
316@@ -300,6 +300,8 @@ extern int _TIFFMergeFields(TIFF*, const
317 extern const TIFFField* _TIFFFindOrRegisterField(TIFF *, uint32, TIFFDataType);
318 extern TIFFField* _TIFFCreateAnonField(TIFF *, uint32, TIFFDataType);
319 extern int _TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag);
320+extern int _TIFFCheckDirNumberAndOffset(TIFF *tif, uint16 dirn, uint64 diroff);
321+extern int _TIFFGetDirNumberFromOffset(TIFF *tif, uint64 diroff, uint16 *dirn);
322
323 #if defined(__cplusplus)
324 }
325--- tiff-4.1.0+git191117.orig/libtiff/tif_dirread.c
326+++ tiff-4.1.0+git191117/libtiff/tif_dirread.c
327@@ -158,7 +158,6 @@ static void TIFFReadDirectoryFindFieldIn
328
329 static int EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount);
330 static void MissingRequired(TIFF*, const char*);
331-static int TIFFCheckDirOffset(TIFF* tif, uint64 diroff);
332 static int CheckDirCount(TIFF*, TIFFDirEntry*, uint32);
333 static uint16 TIFFFetchDirectory(TIFF* tif, uint64 diroff, TIFFDirEntry** pdir, uint64* nextdiroff);
334 static int TIFFFetchNormalTag(TIFF*, TIFFDirEntry*, int recover);
335@@ -3584,12 +3583,19 @@ TIFFReadDirectory(TIFF* tif)
336 int bitspersample_read = FALSE;
337 int color_channels;
338
339- tif->tif_diroff=tif->tif_nextdiroff;
340- if (!TIFFCheckDirOffset(tif,tif->tif_nextdiroff))
341- return 0; /* last offset or bad offset (IFD looping) */
342- (*tif->tif_cleanup)(tif); /* cleanup any previous compression state */
343- tif->tif_curdir++;
344- nextdiroff = tif->tif_nextdiroff;
345+ if (tif->tif_nextdiroff == 0) {
346+ /* In this special case, tif_diroff needs also to be set to 0. */
347+ tif->tif_diroff = tif->tif_nextdiroff;
348+ return 0; /* last offset, thus no checking necessary */
349+ }
350+
351+ nextdiroff = tif->tif_nextdiroff;
352+ /* tif_curdir++ and tif_nextdiroff should only be updated after SUCCESSFUL reading of the directory. Otherwise, invalid IFD offsets could corrupt the IFD list. */
353+ if (!_TIFFCheckDirNumberAndOffset(tif, tif->tif_curdir + 1, nextdiroff)) {
354+ TIFFWarningExt(tif->tif_clientdata, module,
355+ "Didn't read next directory due to IFD looping at offset 0x%lx (%lu) to offset 0x%lx (%lu)", tif->tif_diroff, tif->tif_diroff, nextdiroff, nextdiroff);
356+ return 0; /* bad offset (IFD looping) */
357+ }
358 dircount=TIFFFetchDirectory(tif,nextdiroff,&dir,&tif->tif_nextdiroff);
359 if (!dircount)
360 {
361@@ -3597,6 +3603,11 @@ TIFFReadDirectory(TIFF* tif)
362 "Failed to read directory at offset " TIFF_UINT64_FORMAT,nextdiroff);
363 return 0;
364 }
365+ /* Set global values after a valid directory has been fetched.
366+ * tif_diroff is already set to nextdiroff in TIFFFetchDirectory() in the beginning. */
367+ tif->tif_curdir++;
368+ (*tif->tif_cleanup)(tif); /* cleanup any previous compression state */
369+
370 TIFFReadDirectoryCheckOrder(tif,dir,dircount);
371
372 /*
373@@ -4628,13 +4639,17 @@ MissingRequired(TIFF* tif, const char* t
374 }
375
376 /*
377- * Check the directory offset against the list of already seen directory
378- * offsets. This is a trick to prevent IFD looping. The one can create TIFF
379- * file with looped directory pointers. We will maintain a list of already
380- * seen directories and check every IFD offset against that list.
381+ * Check the directory number and offset against the list of already seen
382+ * directory numbers and offsets. This is a trick to prevent IFD looping.
383+ * The one can create TIFF file with looped directory pointers. We will
384+ * maintain a list of already seen directories and check every IFD offset
385+ * and its IFD number against that list. However, the offset of an IFD number
386+ * can change - e.g. when writing updates to file.
387+ * Returns 1 if all is ok; 0 if last directory or IFD loop is encountered,
388+ * or an error has occured.
389 */
390-static int
391-TIFFCheckDirOffset(TIFF* tif, uint64 diroff)
392+int
393+_TIFFCheckDirNumberAndOffset(TIFF* tif, uint16 dirn, uint64 diroff)
394 {
395 uint16 n;
396
397@@ -4646,35 +4661,64 @@ TIFFCheckDirOffset(TIFF* tif, uint64 dir
398 return 0;
399 }
400
401- for (n = 0; n < tif->tif_dirnumber && tif->tif_dirlist; n++) {
402- if (tif->tif_dirlist[n] == diroff)
403- return 0;
404+ /* Check if offset is already in the list:
405+ * - yes: check, if offset is at the same IFD number - if not, it is an IFD loop
406+ * - no: add to list or update offset at that IFD number
407+ */
408+ for (n = 0; n < tif->tif_dirnumber && tif->tif_dirlistdirn && tif->tif_dirlistoff; n++) {
409+ if (tif->tif_dirlistoff[n] == diroff) {
410+ if (tif->tif_dirlistdirn[n] == dirn) {
411+ return 1;
412+ } else {
413+ TIFFWarningExt(tif->tif_clientdata, "_TIFFCheckDirNumberAndOffset",
414+ "TIFF directory %hu has IFD looping to directory %hu at offset 0x%lx (%lu)",
415+ dirn-1, tif->tif_dirlistdirn[n], diroff, diroff);
416+ return 0;
417+ }
418+ }
419+ }
420+ /* Check if offset of an IFD has been changed and update offset of that IFD number. */
421+ if (dirn < tif->tif_dirnumber && tif->tif_dirlistdirn && tif->tif_dirlistoff) {
422+ /* tif_dirlistdirn can have IFD numbers dirn in random order */
423+ for (n = 0; n < tif->tif_dirnumber; n++) {
424+ if (tif->tif_dirlistdirn[n] == dirn) {
425+ tif->tif_dirlistoff[n] = diroff;
426+ return 1;
427+ }
428+ }
429 }
430
431+ /* Add IFD offset and dirn to IFD directory list */
432 tif->tif_dirnumber++;
433
434- if (tif->tif_dirlist == NULL || tif->tif_dirnumber > tif->tif_dirlistsize) {
435- uint64* new_dirlist;
436-
437+ if (tif->tif_dirlistoff == NULL || tif->tif_dirlistdirn == NULL || tif->tif_dirnumber > tif->tif_dirlistsize) {
438+ uint64 *new_dirlist;
439 /*
440 * XXX: Reduce memory allocation granularity of the dirlist
441 * array.
442 */
443- new_dirlist = (uint64*)_TIFFCheckRealloc(tif, tif->tif_dirlist,
444- tif->tif_dirnumber, 2 * sizeof(uint64), "for IFD list");
445+ if (tif->tif_dirnumber >= 32768)
446+ tif->tif_dirlistsize = 65535;
447+ else
448+ tif->tif_dirlistsize = 2 * tif->tif_dirnumber;
449+
450+ new_dirlist = (uint64 *)_TIFFCheckRealloc(tif, tif->tif_dirlistoff,
451+ tif->tif_dirlistsize, sizeof(uint64), "for IFD offset list");
452 if (!new_dirlist)
453 return 0;
454- if( tif->tif_dirnumber >= 32768 )
455- tif->tif_dirlistsize = 65535;
456- else
457- tif->tif_dirlistsize = 2 * tif->tif_dirnumber;
458- tif->tif_dirlist = new_dirlist;
459+ tif->tif_dirlistoff = new_dirlist;
460+ new_dirlist = (uint64 *)_TIFFCheckRealloc(tif, tif->tif_dirlistdirn,
461+ tif->tif_dirlistsize, sizeof(uint16), "for IFD dirnumber list");
462+ if (!new_dirlist)
463+ return 0;
464+ tif->tif_dirlistdirn = (uint16 *)new_dirlist;
465 }
466
467- tif->tif_dirlist[tif->tif_dirnumber - 1] = diroff;
468+ tif->tif_dirlistoff[tif->tif_dirnumber - 1] = diroff;
469+ tif->tif_dirlistdirn[tif->tif_dirnumber - 1] = dirn;
470
471 return 1;
472-}
473+} /* --- _TIFFCheckDirNumberAndOffset() ---*/
474
475 /*
476 * Check the count field of a directory entry against a known value. The
477@@ -4703,6 +4747,47 @@ CheckDirCount(TIFF* tif, TIFFDirEntry* d
478 }
479
480 /*
481+ * Retrieve the matching IFD directory number of a given IFD offset
482+ * from the list of directories already seen.
483+ * Returns 1 if the offset was in the list and the directory number
484+ * can be returned.
485+ * Otherwise returns 0 or if an error occured.
486+ */
487+int
488+_TIFFGetDirNumberFromOffset(TIFF *tif, uint64 diroff, uint16* dirn)
489+{
490+ uint16 n;
491+
492+ if (diroff == 0) /* no more directories */
493+ return 0;
494+ if (tif->tif_dirnumber == 65535) {
495+ TIFFErrorExt(tif->tif_clientdata, "_TIFFGetDirNumberFromOffset",
496+ "Cannot handle more than 65535 TIFF directories");
497+ return 0;
498+ }
499+
500+ /* Check if offset is already in the list and return matching directory number.
501+ * Otherwise update IFD list using TIFFNumberOfDirectories()
502+ * and search again in IFD list.
503+ */
504+ for (n = 0; n < tif->tif_dirnumber && tif->tif_dirlistoff && tif->tif_dirlistdirn; n++) {
505+ if (tif->tif_dirlistoff[n] == diroff) {
506+ *dirn = tif->tif_dirlistdirn[n];
507+ return 1;
508+ }
509+ }
510+ TIFFNumberOfDirectories(tif);
511+ for (n = 0; n < tif->tif_dirnumber && tif->tif_dirlistoff && tif->tif_dirlistdirn; n++) {
512+ if (tif->tif_dirlistoff[n] == diroff) {
513+ *dirn = tif->tif_dirlistdirn[n];
514+ return 1;
515+ }
516+ }
517+ return 0;
518+} /*--- _TIFFGetDirNumberFromOffset() ---*/
519+
520+
521+/*
522 * Read IFD structure from the specified offset. If the pointer to
523 * nextdiroff variable has been specified, read it too. Function returns a
524 * number of fields in the directory or 0 if failed.
525--- tiff-4.1.0+git191117.orig/libtiff/tif_open.c
526+++ tiff-4.1.0+git191117/libtiff/tif_open.c
527@@ -353,7 +353,8 @@ TIFFClientOpen(
528 if (!TIFFDefaultDirectory(tif))
529 goto bad;
530 tif->tif_diroff = 0;
531- tif->tif_dirlist = NULL;
532+ tif->tif_dirlistoff = NULL;
533+ tif->tif_dirlistdirn = NULL;
534 tif->tif_dirlistsize = 0;
535 tif->tif_dirnumber = 0;
536 return (tif);
537--- tiff-4.1.0+git191117.orig/libtiff/tiffiop.h
538+++ tiff-4.1.0+git191117/libtiff/tiffiop.h
539@@ -145,7 +145,8 @@ struct tiff {
540 #define TIFF_CHOPPEDUPARRAYS 0x4000000U /* set when allocChoppedUpStripArrays() has modified strip array */
541 uint64 tif_diroff; /* file offset of current directory */
542 uint64 tif_nextdiroff; /* file offset of following directory */
543- uint64* tif_dirlist; /* list of offsets to already seen directories to prevent IFD looping */
544+ uint64* tif_dirlistoff; /* list of offsets to already seen directories to prevent IFD looping */
545+ uint16* tif_dirlistdirn; /* list of directory numbers to already seen directories to prevent IFD looping */
546 uint16 tif_dirlistsize; /* number of entries in offset list */
547 uint16 tif_dirnumber; /* number of already seen directories */
548 TIFFDirectory tif_dir; /* internal rep of current directory */
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2022-48281.patch b/meta/recipes-multimedia/libtiff/files/CVE-2022-48281.patch
new file mode 100644
index 0000000000..5747202bd9
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2022-48281.patch
@@ -0,0 +1,26 @@
1From 424c82b5b33256e7f03faace51dc8010f3ded9ff Mon Sep 17 00:00:00 2001
2From: Su Laus <sulau@freenet.de>
3Date: Sat, 21 Jan 2023 15:58:10 +0000
4Subject: [PATCH] tiffcrop: Correct simple copy paste error. Fix #488.
5
6Upstream-Status: Backport [import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u7.debian.tar.xz]
7CVE: CVE-2022-48281
8Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
9
10---
11 tools/tiffcrop.c | 2 +-
12 1 file changed, 1 insertion(+), 1 deletion(-)
13
14diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
15index a0789a3..8aed9cd 100644
16--- a/tools/tiffcrop.c
17+++ b/tools/tiffcrop.c
18@@ -7564,7 +7564,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
19 crop_buff = (unsigned char *)_TIFFmalloc(cropsize + NUM_BUFF_OVERSIZE_BYTES);
20 else
21 {
22- prev_cropsize = seg_buffs[0].size;
23+ prev_cropsize = seg_buffs[i].size;
24 if (prev_cropsize < cropsize)
25 {
26 next_buff = _TIFFrealloc(crop_buff, cropsize + NUM_BUFF_OVERSIZE_BYTES);
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-0795_0796_0797_0798_0799.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-0795_0796_0797_0798_0799.patch
new file mode 100644
index 0000000000..253018525a
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-0795_0796_0797_0798_0799.patch
@@ -0,0 +1,157 @@
1From 7808740e100ba30ffb791044f3b14dec3e85ed6f Mon Sep 17 00:00:00 2001
2From: Markus Koschany <apo@debian.org>
3Date: Tue, 21 Feb 2023 14:26:43 +0100
4Subject: [PATCH] CVE-2023-0795
5
6This is also the fix for CVE-2023-0796, CVE-2023-0797, CVE-2023-0798,
7CVE-2023-0799.
8
9Bug-Debian: https://bugs.debian.org/1031632
10Origin: https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68
11
12Upstream-Status: Backport [import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u7.debian.tar.xz ]
13CVE: CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799
14Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
15---
16 tools/tiffcrop.c | 51 ++++++++++++++++++++++++++++--------------------
17 1 file changed, 30 insertions(+), 21 deletions(-)
18
19diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
20index 8aed9cd..f21a7d7 100644
21--- a/tools/tiffcrop.c
22+++ b/tools/tiffcrop.c
23@@ -277,7 +277,6 @@ struct region {
24 uint32 width; /* width in pixels */
25 uint32 length; /* length in pixels */
26 uint32 buffsize; /* size of buffer needed to hold the cropped region */
27- unsigned char *buffptr; /* address of start of the region */
28 };
29
30 /* Cropping parameters from command line and image data
31@@ -532,7 +531,7 @@ static int rotateContigSamples24bits(uint16, uint16, uint16, uint32,
32 static int rotateContigSamples32bits(uint16, uint16, uint16, uint32,
33 uint32, uint32, uint8 *, uint8 *);
34 static int rotateImage(uint16, struct image_data *, uint32 *, uint32 *,
35- unsigned char **);
36+ unsigned char **, int);
37 static int mirrorImage(uint16, uint16, uint16, uint32, uint32,
38 unsigned char *);
39 static int invertImage(uint16, uint16, uint16, uint32, uint32,
40@@ -5112,7 +5111,6 @@ initCropMasks (struct crop_mask *cps)
41 cps->regionlist[i].width = 0;
42 cps->regionlist[i].length = 0;
43 cps->regionlist[i].buffsize = 0;
44- cps->regionlist[i].buffptr = NULL;
45 cps->zonelist[i].position = 0;
46 cps->zonelist[i].total = 0;
47 }
48@@ -6358,8 +6356,13 @@ static int correct_orientation(struct image_data *image, unsigned char **work_b
49 image->adjustments & ROTATE_ANY);
50 return (-1);
51 }
52-
53- if (rotateImage(rotation, image, &image->width, &image->length, work_buff_ptr))
54+
55+ /* Dummy variable in order not to switch two times the
56+ * image->width,->length within rotateImage(),
57+ * but switch xres, yres there. */
58+ uint32_t width = image->width;
59+ uint32_t length = image->length;
60+ if (rotateImage(rotation, image, &width, &length, work_buff_ptr, TRUE))
61 {
62 TIFFError ("correct_orientation", "Unable to rotate image");
63 return (-1);
64@@ -6427,7 +6430,6 @@ extractCompositeRegions(struct image_data *image, struct crop_mask *crop,
65 /* These should not be needed for composite images */
66 crop->regionlist[i].width = crop_width;
67 crop->regionlist[i].length = crop_length;
68- crop->regionlist[i].buffptr = crop_buff;
69
70 src_rowsize = ((img_width * bps * spp) + 7) / 8;
71 dst_rowsize = (((crop_width * bps * count) + 7) / 8);
72@@ -6664,7 +6666,6 @@ extractSeparateRegion(struct image_data *image, struct crop_mask *crop,
73
74 crop->regionlist[region].width = crop_width;
75 crop->regionlist[region].length = crop_length;
76- crop->regionlist[region].buffptr = crop_buff;
77
78 src = read_buff;
79 dst = crop_buff;
80@@ -7542,7 +7543,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
81 if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
82 {
83 if (rotateImage(crop->rotation, image, &crop->combined_width,
84- &crop->combined_length, &crop_buff))
85+ &crop->combined_length, &crop_buff, FALSE))
86 {
87 TIFFError("processCropSelections",
88 "Failed to rotate composite regions by %d degrees", crop->rotation);
89@@ -7648,7 +7649,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
90 if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
91 {
92 if (rotateImage(crop->rotation, image, &crop->regionlist[i].width,
93- &crop->regionlist[i].length, &crop_buff))
94+ &crop->regionlist[i].length, &crop_buff, FALSE))
95 {
96 TIFFError("processCropSelections",
97 "Failed to rotate crop region by %d degrees", crop->rotation);
98@@ -7780,7 +7781,7 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop,
99 if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
100 {
101 if (rotateImage(crop->rotation, image, &crop->combined_width,
102- &crop->combined_length, crop_buff_ptr))
103+ &crop->combined_length, crop_buff_ptr, TRUE))
104 {
105 TIFFError("createCroppedImage",
106 "Failed to rotate image or cropped selection by %d degrees", crop->rotation);
107@@ -8443,7 +8444,7 @@ rotateContigSamples32bits(uint16 rotation, uint16 spp, uint16 bps, uint32 width,
108 /* Rotate an image by a multiple of 90 degrees clockwise */
109 static int
110 rotateImage(uint16 rotation, struct image_data *image, uint32 *img_width,
111- uint32 *img_length, unsigned char **ibuff_ptr)
112+ uint32 *img_length, unsigned char **ibuff_ptr, int rot_image_params)
113 {
114 int shift_width;
115 uint32 bytes_per_pixel, bytes_per_sample;
116@@ -8634,11 +8635,15 @@ rotateImage(uint16 rotation, struct image_data *image, uint32 *img_width,
117
118 *img_width = length;
119 *img_length = width;
120- image->width = length;
121- image->length = width;
122- res_temp = image->xres;
123- image->xres = image->yres;
124- image->yres = res_temp;
125+ /* Only toggle image parameters if whole input image is rotated. */
126+ if (rot_image_params)
127+ {
128+ image->width = length;
129+ image->length = width;
130+ res_temp = image->xres;
131+ image->xres = image->yres;
132+ image->yres = res_temp;
133+ }
134 break;
135
136 case 270: if ((bps % 8) == 0) /* byte aligned data */
137@@ -8711,11 +8716,15 @@ rotateImage(uint16 rotation, struct image_data *image, uint32 *img_width,
138
139 *img_width = length;
140 *img_length = width;
141- image->width = length;
142- image->length = width;
143- res_temp = image->xres;
144- image->xres = image->yres;
145- image->yres = res_temp;
146+ /* Only toggle image parameters if whole input image is rotated. */
147+ if (rot_image_params)
148+ {
149+ image->width = length;
150+ image->length = width;
151+ res_temp = image->xres;
152+ image->xres = image->yres;
153+ image->yres = res_temp;
154+ }
155 break;
156 default:
157 break;
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-0800_0801_0802_0803_0804.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-0800_0801_0802_0803_0804.patch
new file mode 100644
index 0000000000..bf1a439b4d
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-0800_0801_0802_0803_0804.patch
@@ -0,0 +1,135 @@
1From e18be834497e0ebf68d443abb9e18187f36cd3bf Mon Sep 17 00:00:00 2001
2From: Markus Koschany <apo@debian.org>
3Date: Tue, 21 Feb 2023 14:39:52 +0100
4Subject: [PATCH] CVE-2023-0800
5
6This is also the fix for CVE-2023-0801, CVE-2023-0802, CVE-2023-0803,
7CVE-2023-0804.
8
9Bug-Debian: https://bugs.debian.org/1031632
10Origin: https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00
11
12Upstream-Status: Backport [import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u7.debian.tar.xz ]
13CVE: CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
14Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
15---
16 tools/tiffcrop.c | 73 +++++++++++++++++++++++++++++++++++++++++++++---
17 1 file changed, 69 insertions(+), 4 deletions(-)
18
19diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
20index f21a7d7..742615a 100644
21--- a/tools/tiffcrop.c
22+++ b/tools/tiffcrop.c
23@@ -5250,18 +5250,40 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image,
24
25 crop->regionlist[i].buffsize = buffsize;
26 crop->bufftotal += buffsize;
27+
28+ /* For composite images with more than one region, the
29+ * combined_length or combined_width always needs to be equal,
30+ * respectively.
31+ * Otherwise, even the first section/region copy
32+ * action might cause buffer overrun. */
33 if (crop->img_mode == COMPOSITE_IMAGES)
34 {
35 switch (crop->edge_ref)
36 {
37 case EDGE_LEFT:
38 case EDGE_RIGHT:
39+ if (i > 0 && zlength != crop->combined_length)
40+ {
41+ TIFFError(
42+ "computeInputPixelOffsets",
43+ "Only equal length regions can be combined for "
44+ "-E left or right");
45+ return (-1);
46+ }
47 crop->combined_length = zlength;
48 crop->combined_width += zwidth;
49 break;
50 case EDGE_BOTTOM:
51 case EDGE_TOP: /* width from left, length from top */
52 default:
53+ if (i > 0 && zwidth != crop->combined_width)
54+ {
55+ TIFFError("computeInputPixelOffsets",
56+ "Only equal width regions can be "
57+ "combined for -E "
58+ "top or bottom");
59+ return (-1);
60+ }
61 crop->combined_width = zwidth;
62 crop->combined_length += zlength;
63 break;
64@@ -6416,6 +6438,47 @@ extractCompositeRegions(struct image_data *image, struct crop_mask *crop,
65 crop->combined_width = 0;
66 crop->combined_length = 0;
67
68+ /* If there is more than one region, check beforehand whether all the width
69+ * and length values of the regions are the same, respectively. */
70+ switch (crop->edge_ref)
71+ {
72+ default:
73+ case EDGE_TOP:
74+ case EDGE_BOTTOM:
75+ for (i = 1; i < crop->selections; i++)
76+ {
77+ uint32_t crop_width0 =
78+ crop->regionlist[i - 1].x2 - crop->regionlist[i - 1].x1 + 1;
79+ uint32_t crop_width1 =
80+ crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1;
81+ if (crop_width0 != crop_width1)
82+ {
83+ TIFFError("extractCompositeRegions",
84+ "Only equal width regions can be combined for -E "
85+ "top or bottom");
86+ return (1);
87+ }
88+ }
89+ break;
90+ case EDGE_LEFT:
91+ case EDGE_RIGHT:
92+ for (i = 1; i < crop->selections; i++)
93+ {
94+ uint32_t crop_length0 =
95+ crop->regionlist[i - 1].y2 - crop->regionlist[i - 1].y1 + 1;
96+ uint32_t crop_length1 =
97+ crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1;
98+ if (crop_length0 != crop_length1)
99+ {
100+ TIFFError("extractCompositeRegions",
101+ "Only equal length regions can be combined for "
102+ "-E left or right");
103+ return (1);
104+ }
105+ }
106+ }
107+
108+
109 for (i = 0; i < crop->selections; i++)
110 {
111 /* rows, columns, width, length are expressed in pixels */
112@@ -6439,8 +6502,9 @@ extractCompositeRegions(struct image_data *image, struct crop_mask *crop,
113 default:
114 case EDGE_TOP:
115 case EDGE_BOTTOM:
116- if ((i > 0) && (crop_width != crop->regionlist[i - 1].width))
117- {
118+ if ((crop->selections > i + 1) &&
119+ (crop_width != crop->regionlist[i + 1].width))
120+ {
121 TIFFError ("extractCompositeRegions",
122 "Only equal width regions can be combined for -E top or bottom");
123 return (1);
124@@ -6520,8 +6584,9 @@ extractCompositeRegions(struct image_data *image, struct crop_mask *crop,
125 break;
126 case EDGE_LEFT: /* splice the pieces of each row together, side by side */
127 case EDGE_RIGHT:
128- if ((i > 0) && (crop_length != crop->regionlist[i - 1].length))
129- {
130+ if ((crop->selections > i + 1) &&
131+ (crop_length != crop->regionlist[i + 1].length))
132+ {
133 TIFFError ("extractCompositeRegions",
134 "Only equal length regions can be combined for -E left or right");
135 return (1);
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-1916.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-1916.patch
new file mode 100644
index 0000000000..9915b77645
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-1916.patch
@@ -0,0 +1,91 @@
1From 848434a81c443f59ec90d41218eba6e48a450a11 Mon Sep 17 00:00:00 2001
2From: zhailiangliang <zhailiangliang@loongson.cn>
3Date: Thu, 16 Mar 2023 16:16:54 +0800
4Subject: [PATCH] Fix heap-buffer-overflow in function extractImageSection
5
6CVE: CVE-2023-1916
7Upstream-Status: Submitted [https://gitlab.com/libtiff/libtiff/-/commit/848434a81c443f59ec90d41218eba6e48a450a11 https://gitlab.com/libtiff/libtiff/-/merge_requests/535]
8Signed-off-by: Marek Vasut <marex@denx.de>
9---
10 archive/tools/tiffcrop.c | 62 +++++++++++++++++++++++++++++-----------
11 1 file changed, 45 insertions(+), 17 deletions(-)
12
13--- tiff-4.1.0+git191117.orig/tools/tiffcrop.c
14+++ tiff-4.1.0+git191117/tools/tiffcrop.c
15@@ -5549,6 +5549,15 @@ getCropOffsets(struct image_data *image,
16 crop->combined_width += (uint32)zwidth;
17 else
18 crop->combined_width = (uint32)zwidth;
19+
20+ /* When the degrees clockwise rotation is 90 or 270, check the boundary */
21+ if (((crop->rotation == 90) || (crop->rotation == 270))
22+ && ((crop->combined_length > image->width) || (crop->combined_width > image->length)))
23+ {
24+ TIFFError("getCropOffsets", "The crop size exceeds the image boundary size");
25+ return -1;
26+ }
27+
28 break;
29 case EDGE_BOTTOM: /* width from left, zones from bottom to top */
30 zwidth = offsets.crop_width;
31@@ -5579,6 +5588,15 @@ getCropOffsets(struct image_data *image,
32 else
33 crop->combined_length = (uint32)zlength;
34 crop->combined_width = (uint32)zwidth;
35+
36+ /* When the degrees clockwise rotation is 90 or 270, check the boundary */
37+ if (((crop->rotation == 90) || (crop->rotation == 270))
38+ && ((crop->combined_length > image->width) || (crop->combined_width > image->length)))
39+ {
40+ TIFFError("getCropOffsets", "The crop size exceeds the image boundary size");
41+ return -1;
42+ }
43+
44 break;
45 case EDGE_RIGHT: /* zones from right to left, length from top */
46 zlength = offsets.crop_length;
47@@ -5606,6 +5624,15 @@ getCropOffsets(struct image_data *image,
48 crop->combined_width += (uint32)zwidth;
49 else
50 crop->combined_width = (uint32)zwidth;
51+
52+ /* When the degrees clockwise rotation is 90 or 270, check the boundary */
53+ if (((crop->rotation == 90) || (crop->rotation == 270))
54+ && ((crop->combined_length > image->width) || (crop->combined_width > image->length)))
55+ {
56+ TIFFError("getCropOffsets", "The crop size exceeds the image boundary size");
57+ return -1;
58+ }
59+
60 break;
61 case EDGE_TOP: /* width from left, zones from top to bottom */
62 default:
63@@ -5632,6 +5659,15 @@ getCropOffsets(struct image_data *image,
64 else
65 crop->combined_length = (uint32)zlength;
66 crop->combined_width = (uint32)zwidth;
67+
68+ /* When the degrees clockwise rotation is 90 or 270, check the boundary */
69+ if (((crop->rotation == 90) || (crop->rotation == 270))
70+ && ((crop->combined_length > image->width) || (crop->combined_width > image->length)))
71+ {
72+ TIFFError("getCropOffsets", "The crop size exceeds the image boundary size");
73+ return -1;
74+ }
75+
76 break;
77 } /* end switch statement */
78
79@@ -6827,9 +6863,9 @@ extractImageSection(struct image_data *i
80 * regardless of the way the data are organized in the input file.
81 * Furthermore, bytes and bits are arranged in buffer according to COMPRESSION=1 and FILLORDER=1
82 */
83- img_rowsize = (((img_width * spp * bps) + 7) / 8); /* row size in full bytes of source image */
84- full_bytes = (sect_width * spp * bps) / 8; /* number of COMPLETE bytes per row in section */
85- trailing_bits = (sect_width * spp * bps) % 8; /* trailing bits within the last byte of destination buffer */
86+ img_rowsize = (((img_width * spp * bps) + 7) / 8); /* row size in full bytes of source image */
87+ full_bytes = (sect_width * spp * bps) / 8; /* number of COMPLETE bytes per row in section */
88+ trailing_bits = (sect_width * spp * bps) % 8; /* trailing bits within the last byte of destination buffer */
89
90 #ifdef DEVELMODE
91 TIFFError ("", "First row: %d, last row: %d, First col: %d, last col: %d\n",
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-25433.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-25433.patch
new file mode 100644
index 0000000000..7d6d40f25a
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-25433.patch
@@ -0,0 +1,173 @@
1From 9c22495e5eeeae9e00a1596720c969656bb8d678 Mon Sep 17 00:00:00 2001
2From: Su_Laus <sulau@freenet.de>
3Date: Fri, 3 Feb 2023 15:31:31 +0100
4Subject: [PATCH] tiffcrop correctly update buffersize after rotateImage()
5 fix#520 rotateImage() set up a new buffer and calculates its size
6 individually. Therefore, seg_buffs[] size needs to be updated accordingly.
7 Before this fix, the seg_buffs buffer size was calculated with a different
8 formula than within rotateImage().
9
10Closes #520.
11
12Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/9c22495e5eeeae9e00a1596720c969656bb8d678 && https://gitlab.com/libtiff/libtiff/-/commit/688012dca2c39033aa2dc7bcea9796787cfd1b44]
13CVE: CVE-2023-25433
14Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
15---
16 tools/tiffcrop.c | 69 +++++++++++++++++++++++++++++++++++++++---------
17 1 file changed, 56 insertions(+), 13 deletions(-)
18
19diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
20index 742615a..aab0ec6 100644
21--- a/tools/tiffcrop.c
22+++ b/tools/tiffcrop.c
23@@ -531,7 +531,7 @@ static int rotateContigSamples24bits(uint16, uint16, uint16, uint32,
24 static int rotateContigSamples32bits(uint16, uint16, uint16, uint32,
25 uint32, uint32, uint8 *, uint8 *);
26 static int rotateImage(uint16, struct image_data *, uint32 *, uint32 *,
27- unsigned char **, int);
28+ unsigned char **, size_t *);
29 static int mirrorImage(uint16, uint16, uint16, uint32, uint32,
30 unsigned char *);
31 static int invertImage(uint16, uint16, uint16, uint32, uint32,
32@@ -6384,7 +6384,7 @@ static int correct_orientation(struct image_data *image, unsigned char **work_b
33 * but switch xres, yres there. */
34 uint32_t width = image->width;
35 uint32_t length = image->length;
36- if (rotateImage(rotation, image, &width, &length, work_buff_ptr, TRUE))
37+ if (rotateImage(rotation, image, &width, &length, work_buff_ptr, NULL))
38 {
39 TIFFError ("correct_orientation", "Unable to rotate image");
40 return (-1);
41@@ -7607,8 +7607,12 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
42
43 if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
44 {
45+ /* rotateImage() set up a new buffer and calculates its size
46+ * individually. Therefore, seg_buffs size needs to be updated
47+ * accordingly. */
48+ size_t rot_buf_size = 0;
49 if (rotateImage(crop->rotation, image, &crop->combined_width,
50- &crop->combined_length, &crop_buff, FALSE))
51+ &crop->combined_length, &crop_buff, &rot_buf_size))
52 {
53 TIFFError("processCropSelections",
54 "Failed to rotate composite regions by %d degrees", crop->rotation);
55@@ -7713,8 +7717,13 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
56
57 if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
58 {
59- if (rotateImage(crop->rotation, image, &crop->regionlist[i].width,
60- &crop->regionlist[i].length, &crop_buff, FALSE))
61+ /* Furthermore, rotateImage() set up a new buffer and calculates
62+ * its size individually. Therefore, seg_buffs size needs to be
63+ * updated accordingly. */
64+ size_t rot_buf_size = 0;
65+ if (rotateImage(
66+ crop->rotation, image, &crop->regionlist[i].width,
67+ &crop->regionlist[i].length, &crop_buff, &rot_buf_size))
68 {
69 TIFFError("processCropSelections",
70 "Failed to rotate crop region by %d degrees", crop->rotation);
71@@ -7725,8 +7734,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
72 crop->combined_width = total_width;
73 crop->combined_length = total_length;
74 seg_buffs[i].buffer = crop_buff;
75- seg_buffs[i].size = (((crop->regionlist[i].width * image->bps + 7 ) / 8)
76- * image->spp) * crop->regionlist[i].length;
77+ seg_buffs[i].size = rot_buf_size;
78 }
79 }
80 }
81@@ -7735,7 +7743,6 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
82
83 /* Copy the crop section of the data from the current image into a buffer
84 * and adjust the IFD values to reflect the new size. If no cropping is
85- * required, use the origial read buffer as the crop buffer.
86 *
87 * There is quite a bit of redundancy between this routine and the more
88 * specialized processCropSelections, but this provides
89@@ -7846,7 +7853,7 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop,
90 if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
91 {
92 if (rotateImage(crop->rotation, image, &crop->combined_width,
93- &crop->combined_length, crop_buff_ptr, TRUE))
94+ &crop->combined_length, crop_buff_ptr, NULL))
95 {
96 TIFFError("createCroppedImage",
97 "Failed to rotate image or cropped selection by %d degrees", crop->rotation);
98@@ -8515,7 +8522,8 @@ rotateImage(uint16 rotation, struct image_data *image, uint32 *img_width,
99 uint32 bytes_per_pixel, bytes_per_sample;
100 uint32 row, rowsize, src_offset, dst_offset;
101 uint32 i, col, width, length;
102- uint32 colsize, buffsize, col_offset, pix_offset;
103+ uint32 colsize, col_offset, pix_offset;
104+ tmsize_t buffsize;
105 unsigned char *ibuff;
106 unsigned char *src;
107 unsigned char *dst;
108@@ -8528,12 +8536,41 @@ rotateImage(uint16 rotation, struct image_data *image, uint32 *img_width,
109 spp = image->spp;
110 bps = image->bps;
111
112+ if ((spp != 0 && bps != 0 &&
113+ width > (uint32_t)((UINT32_MAX - 7) / spp / bps)) ||
114+ (spp != 0 && bps != 0 &&
115+ length > (uint32_t)((UINT32_MAX - 7) / spp / bps)))
116+ {
117+ TIFFError("rotateImage", "Integer overflow detected.");
118+ return (-1);
119+ }
120+
121 rowsize = ((bps * spp * width) + 7) / 8;
122 colsize = ((bps * spp * length) + 7) / 8;
123 if ((colsize * width) > (rowsize * length))
124- buffsize = (colsize + 1) * width;
125+{
126+ if (((tmsize_t)colsize + 1) != 0 &&
127+ (tmsize_t)width > ((TIFF_TMSIZE_T_MAX - NUM_BUFF_OVERSIZE_BYTES) /
128+ ((tmsize_t)colsize + 1)))
129+ {
130+ TIFFError("rotateImage",
131+ "Integer overflow when calculating buffer size.");
132+ return (-1);
133+ }
134+ buffsize = ((tmsize_t)colsize + 1) * width;
135+ }
136 else
137- buffsize = (rowsize + 1) * length;
138+ {
139+ if (((tmsize_t)rowsize + 1) != 0 &&
140+ (tmsize_t)length > ((TIFF_TMSIZE_T_MAX - NUM_BUFF_OVERSIZE_BYTES) /
141+ ((tmsize_t)rowsize + 1)))
142+ {
143+ TIFFError("rotateImage",
144+ "Integer overflow when calculating buffer size.");
145+ return (-1);
146+ }
147+ buffsize = (rowsize + 1) * length;
148+ }
149
150 bytes_per_sample = (bps + 7) / 8;
151 bytes_per_pixel = ((bps * spp) + 7) / 8;
152@@ -8556,11 +8593,17 @@ rotateImage(uint16 rotation, struct image_data *image, uint32 *img_width,
153 /* Add 3 padding bytes for extractContigSamplesShifted32bits */
154 if (!(rbuff = (unsigned char *)_TIFFmalloc(buffsize + NUM_BUFF_OVERSIZE_BYTES)))
155 {
156- TIFFError("rotateImage", "Unable to allocate rotation buffer of %1u bytes", buffsize + NUM_BUFF_OVERSIZE_BYTES);
157+ TIFFError("rotateImage",
158+ "Unable to allocate rotation buffer of %" TIFF_SSIZE_FORMAT
159+ " bytes ",
160+ buffsize + NUM_BUFF_OVERSIZE_BYTES);
161 return (-1);
162 }
163 _TIFFmemset(rbuff, '\0', buffsize + NUM_BUFF_OVERSIZE_BYTES);
164
165+ if (rot_buf_size != NULL)
166+ *rot_buf_size = buffsize;
167+
168 ibuff = *ibuff_ptr;
169 switch (rotation)
170 {
171--
1722.25.1
173
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-25434-CVE-2023-25435.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-25434-CVE-2023-25435.patch
new file mode 100644
index 0000000000..6a6596f092
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-25434-CVE-2023-25435.patch
@@ -0,0 +1,94 @@
1From 69818e2f2d246e6631ac2a2da692c3706b849c38 Mon Sep 17 00:00:00 2001
2From: Su_Laus <sulau@freenet.de>
3Date: Sun, 29 Jan 2023 11:09:26 +0100
4Subject: [PATCH] tiffcrop: Amend rotateImage() not to toggle the input (main)
5 image width and length parameters when only cropped image sections are
6 rotated. Remove buffptr from region structure because never used.
7
8Closes #492 #493 #494 #495 #499 #518 #519
9
10Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/69818e2f2d246e6631ac2a2da692c3706b849c38]
11CVE: CVE-2023-25434 & CVE-2023-25435
12Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
13---
14 tools/tiffcrop.c | 29 +++++++++++++++++------------
15 1 file changed, 17 insertions(+), 12 deletions(-)
16
17diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
18index aab0ec6..ce84414 100644
19--- a/tools/tiffcrop.c
20+++ b/tools/tiffcrop.c
21@@ -531,7 +531,7 @@ static int rotateContigSamples24bits(uint16, uint16, uint16, uint32,
22 static int rotateContigSamples32bits(uint16, uint16, uint16, uint32,
23 uint32, uint32, uint8 *, uint8 *);
24 static int rotateImage(uint16, struct image_data *, uint32 *, uint32 *,
25- unsigned char **, size_t *);
26+ unsigned char **, size_t *, int);
27 static int mirrorImage(uint16, uint16, uint16, uint32, uint32,
28 unsigned char *);
29 static int invertImage(uint16, uint16, uint16, uint32, uint32,
30@@ -6382,10 +6382,11 @@ static int correct_orientation(struct image_data *image, unsigned char **work_b
31 /* Dummy variable in order not to switch two times the
32 * image->width,->length within rotateImage(),
33 * but switch xres, yres there. */
34- uint32_t width = image->width;
35- uint32_t length = image->length;
36- if (rotateImage(rotation, image, &width, &length, work_buff_ptr, NULL))
37- {
38+ uint32_t width = image->width;
39+ uint32_t length = image->length;
40+ if (rotateImage(rotation, image, &width, &length, work_buff_ptr, NULL,
41+ TRUE))
42+ {
43 TIFFError ("correct_orientation", "Unable to rotate image");
44 return (-1);
45 }
46@@ -7612,7 +7613,8 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
47 * accordingly. */
48 size_t rot_buf_size = 0;
49 if (rotateImage(crop->rotation, image, &crop->combined_width,
50- &crop->combined_length, &crop_buff, &rot_buf_size))
51+ &crop->combined_length, &crop_buff, &rot_buf_size,
52+ FALSE))
53 {
54 TIFFError("processCropSelections",
55 "Failed to rotate composite regions by %d degrees", crop->rotation);
56@@ -7721,9 +7723,10 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
57 * its size individually. Therefore, seg_buffs size needs to be
58 * updated accordingly. */
59 size_t rot_buf_size = 0;
60- if (rotateImage(
61- crop->rotation, image, &crop->regionlist[i].width,
62- &crop->regionlist[i].length, &crop_buff, &rot_buf_size))
63+ if (rotateImage(crop->rotation, image,
64+ &crop->regionlist[i].width,
65+ &crop->regionlist[i].length, &crop_buff,
66+ &rot_buf_size, FALSE))
67 {
68 TIFFError("processCropSelections",
69 "Failed to rotate crop region by %d degrees", crop->rotation);
70@@ -7853,7 +7856,7 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop,
71 if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
72 {
73 if (rotateImage(crop->rotation, image, &crop->combined_width,
74- &crop->combined_length, crop_buff_ptr, NULL))
75+ &crop->combined_length, crop_buff_ptr, NULL, TRUE))
76 {
77 TIFFError("createCroppedImage",
78 "Failed to rotate image or cropped selection by %d degrees", crop->rotation);
79@@ -8515,8 +8518,10 @@ rotateContigSamples32bits(uint16 rotation, uint16 spp, uint16 bps, uint32 width,
80
81 /* Rotate an image by a multiple of 90 degrees clockwise */
82 static int
83-rotateImage(uint16 rotation, struct image_data *image, uint32 *img_width,
84- uint32 *img_length, unsigned char **ibuff_ptr, int rot_image_params)
85+rotateImage(uint16 rotation, struct image_data *image,
86+ uint32 *img_width, uint32 *img_length,
87+ unsigned char **ibuff_ptr, size_t *rot_buf_size,
88+ int rot_image_params)
89 {
90 int shift_width;
91 uint32 bytes_per_pixel, bytes_per_sample;
92--
932.25.1
94
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-26965.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-26965.patch
new file mode 100644
index 0000000000..b7a7e93764
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-26965.patch
@@ -0,0 +1,90 @@
1From ec8ef90c1f573c9eb1f17d6a056aa0015f184acf Mon Sep 17 00:00:00 2001
2From: Su_Laus <sulau@freenet.de>
3Date: Tue, 14 Feb 2023 20:43:43 +0100
4Subject: [PATCH] tiffcrop: Do not reuse input buffer for subsequent images.
5 Fix issue 527
6
7Reuse of read_buff within loadImage() from previous image is quite unsafe, because other functions (like rotateImage() etc.) reallocate that buffer with different size without updating the local prev_readsize value.
8
9Closes #527
10
11Upstream-Status: Backport [import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u8.debian.tar.xz]
12CVE: CVE-2023-26965
13Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
14---
15 tools/tiffcrop.c | 40 ++++++++++------------------------------
16 1 file changed, 10 insertions(+), 30 deletions(-)
17
18diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
19index ce84414..a533089 100644
20--- a/tools/tiffcrop.c
21+++ b/tools/tiffcrop.c
22@@ -5935,9 +5935,7 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c
23 uint32 tw = 0, tl = 0; /* Tile width and length */
24 tmsize_t tile_rowsize = 0;
25 unsigned char *read_buff = NULL;
26- unsigned char *new_buff = NULL;
27 int readunit = 0;
28- static tmsize_t prev_readsize = 0;
29
30 TIFFGetFieldDefaulted(in, TIFFTAG_BITSPERSAMPLE, &bps);
31 TIFFGetFieldDefaulted(in, TIFFTAG_SAMPLESPERPIXEL, &spp);
32@@ -6232,37 +6230,20 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c
33 read_buff = *read_ptr;
34 /* +3 : add a few guard bytes since reverseSamples16bits() can read a bit */
35 /* outside buffer */
36- if (!read_buff)
37+ if (read_buff)
38 {
39- if( buffsize > 0xFFFFFFFFU - 3 )
40- {
41- TIFFError("loadImage", "Unable to allocate/reallocate read buffer");
42- return (-1);
43- }
44- read_buff = (unsigned char *)_TIFFmalloc(buffsize + NUM_BUFF_OVERSIZE_BYTES);
45+ _TIFFfree(read_buff);
46 }
47- else
48- {
49- if (prev_readsize < buffsize)
50- {
51- if( buffsize > 0xFFFFFFFFU - 3 )
52- {
53- TIFFError("loadImage", "Unable to allocate/reallocate read buffer");
54- return (-1);
55- }
56- new_buff = _TIFFrealloc(read_buff, buffsize + NUM_BUFF_OVERSIZE_BYTES);
57- if (!new_buff)
58- {
59- free (read_buff);
60- read_buff = (unsigned char *)_TIFFmalloc(buffsize + NUM_BUFF_OVERSIZE_BYTES);
61- }
62- else
63- read_buff = new_buff;
64- }
65- }
66+ if (buffsize > 0xFFFFFFFFU - 3)
67+ {
68+ TIFFError("loadImage", "Required read buffer size too large");
69+ return (-1);
70+ }
71+ read_buff =
72+ (unsigned char *)_TIFFmalloc(buffsize + NUM_BUFF_OVERSIZE_BYTES);
73 if (!read_buff)
74 {
75- TIFFError("loadImage", "Unable to allocate/reallocate read buffer");
76+ TIFFError("loadImage", "Unable to allocate read buffer");
77 return (-1);
78 }
79
80@@ -6270,7 +6251,6 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c
81 read_buff[buffsize+1] = 0;
82 read_buff[buffsize+2] = 0;
83
84- prev_readsize = buffsize;
85 *read_ptr = read_buff;
86
87 /* N.B. The read functions used copy separate plane data into a buffer as interleaved
88--
892.25.1
90
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-26966.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-26966.patch
new file mode 100644
index 0000000000..48657e6aa4
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-26966.patch
@@ -0,0 +1,35 @@
1From b0e1c25dd1d065200c8d8f59ad0afe014861a1b9 Mon Sep 17 00:00:00 2001
2From: Su_Laus <sulau@freenet.de>
3Date: Thu, 16 Feb 2023 12:03:16 +0100
4Subject: [PATCH] tif_luv: Check and correct for NaN data in uv_encode().
5
6Closes #530
7
8Upstream-Status: Backport [import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u8.debian.tar.xz]
9CVE: CVE-2023-26966
10Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
11---
12 libtiff/tif_luv.c | 7 +++++++
13 1 file changed, 7 insertions(+)
14
15diff --git a/libtiff/tif_luv.c b/libtiff/tif_luv.c
16index 6fe4858..8b2c5f1 100644
17--- a/libtiff/tif_luv.c
18+++ b/libtiff/tif_luv.c
19@@ -923,6 +923,13 @@ uv_encode(double u, double v, int em) /* encode (u',v') coordinates */
20 {
21 register int vi, ui;
22
23+ /* check for NaN */
24+ if (u != u || v != v)
25+ {
26+ u = U_NEU;
27+ v = V_NEU;
28+ }
29+
30 if (v < UV_VSTART)
31 return oog_encode(u, v);
32 vi = itrunc((v - UV_VSTART)*(1./UV_SQSIZ), em);
33--
342.25.1
35
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-2908.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-2908.patch
new file mode 100644
index 0000000000..62a5e1831c
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-2908.patch
@@ -0,0 +1,33 @@
1From 8c0859a80444c90b8dfb862a9f16de74e16f0a9e Mon Sep 17 00:00:00 2001
2From: xiaoxiaoafeifei <lliangliang2007@163.com>
3Date: Fri, 21 Apr 2023 13:01:34 +0000
4Subject: [PATCH] countInkNamesString(): fix `UndefinedBehaviorSanitizer`:
5 applying zero offset to null pointer
6
7Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f]
8CVE: CVE-2023-2908
9Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
10---
11 libtiff/tif_dir.c | 4 ++--
12 1 file changed, 2 insertions(+), 2 deletions(-)
13
14diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
15index 9d8267a..6389b40 100644
16--- a/libtiff/tif_dir.c
17+++ b/libtiff/tif_dir.c
18@@ -145,10 +145,10 @@ static uint16
19 countInkNamesString(TIFF *tif, uint32 slen, const char *s)
20 {
21 uint16 i = 0;
22- const char *ep = s + slen;
23- const char *cp = s;
24
25 if (slen > 0) {
26+ const char *ep = s + slen;
27+ const char *cp = s;
28 do {
29 for (; cp < ep && *cp != '\0'; cp++) {}
30 if (cp >= ep)
31--
322.25.1
33
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-3316.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-3316.patch
new file mode 100644
index 0000000000..8db24fc714
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-3316.patch
@@ -0,0 +1,59 @@
1From d63de61b1ec3385f6383ef9a1f453e4b8b11d536 Mon Sep 17 00:00:00 2001
2From: Su_Laus <sulau@freenet.de>
3Date: Fri, 3 Feb 2023 17:38:55 +0100
4Subject: [PATCH] TIFFClose() avoid NULL pointer dereferencing. fix#515
5
6Closes #515
7
8Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/d63de61b1ec3385f6383ef9a1f453e4b8b11d536]
9CVE: CVE-2023-3316
10Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
11---
12 libtiff/tif_close.c | 11 +++++++----
13 tools/tiffcrop.c | 5 ++++-
14 2 files changed, 11 insertions(+), 5 deletions(-)
15
16diff --git a/libtiff/tif_close.c b/libtiff/tif_close.c
17index e4228df..335e80f 100644
18--- a/libtiff/tif_close.c
19+++ b/libtiff/tif_close.c
20@@ -118,13 +118,16 @@ TIFFCleanup(TIFF* tif)
21 */
22
23 void
24-TIFFClose(TIFF* tif)
25+TIFFClose(TIFF *tif)
26 {
27- TIFFCloseProc closeproc = tif->tif_closeproc;
28- thandle_t fd = tif->tif_clientdata;
29+ if (tif != NULL)
30+ {
31+ TIFFCloseProc closeproc = tif->tif_closeproc;
32+ thandle_t fd = tif->tif_clientdata;
33
34 TIFFCleanup(tif);
35- (void) (*closeproc)(fd);
36+ (void)(*closeproc)(fd);
37+ }
38 }
39
40 /* vim: set ts=8 sts=8 sw=8 noet: */
41diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
42index a533089..f14bb0c 100644
43--- a/tools/tiffcrop.c
44+++ b/tools/tiffcrop.c
45@@ -2526,7 +2526,10 @@ main(int argc, char* argv[])
46 }
47 }
48
49- TIFFClose(out);
50+ if (out != NULL)
51+ {
52+ TIFFClose(out);
53+ }
54
55 return (0);
56 } /* end main */
57--
582.25.1
59
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-3576.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-3576.patch
new file mode 100644
index 0000000000..67837fe142
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-3576.patch
@@ -0,0 +1,35 @@
1From 881a070194783561fd209b7c789a4e75566f7f37 Mon Sep 17 00:00:00 2001
2From: zhailiangliang <zhailiangliang@loongson.cn>
3Date: Tue, 7 Mar 2023 15:02:08 +0800
4Subject: [PATCH] Fix memory leak in tiffcrop.c
5
6Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/881a070194783561fd209b7c789a4e75566f7f37]
7CVE: CVE-2023-3576
8Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
9Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
10---
11 tools/tiffcrop.c | 7 ++++++-
12 1 file changed, 6 insertions(+), 1 deletion(-)
13
14diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
15index f14bb0c..7121c7c 100644
16--- a/tools/tiffcrop.c
17+++ b/tools/tiffcrop.c
18@@ -7746,8 +7746,13 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop,
19
20 read_buff = *read_buff_ptr;
21
22+ /* Memory is freed before crop_buff_ptr is overwritten */
23+ if (*crop_buff_ptr != NULL)
24+ {
25+ _TIFFfree(*crop_buff_ptr);
26+ }
27+
28 /* process full image, no crop buffer needed */
29- crop_buff = read_buff;
30 *crop_buff_ptr = read_buff;
31 crop->combined_width = image->width;
32 crop->combined_length = image->length;
33--
342.25.1
35
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-3618.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-3618.patch
new file mode 100644
index 0000000000..fd67305c0b
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-3618.patch
@@ -0,0 +1,47 @@
1From b5c7d4c4e03333ac16b5cfb11acaaeaa493334f8 Mon Sep 17 00:00:00 2001
2From: Su_Laus <sulau@freenet.de>
3Date: Fri, 5 May 2023 19:43:46 +0200
4Subject: [PATCH] Consider error return of writeSelections(). Fixes #553
5
6Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/b5c7d4c4e03333ac16b5cfb11acaaeaa493334f8]
7CVE: CVE-2023-3618
8Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
9---
10 tools/tiffcrop.c | 14 ++++++++++----
11 1 file changed, 10 insertions(+), 4 deletions(-)
12
13diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
14index 7121c7c..93b7f96 100644
15--- a/tools/tiffcrop.c
16+++ b/tools/tiffcrop.c
17@@ -2437,9 +2437,15 @@ main(int argc, char* argv[])
18 { /* Whole image or sections not based on output page size */
19 if (crop.selections > 0)
20 {
21- writeSelections(in, &out, &crop, &image, &dump, seg_buffs,
22- mp, argv[argc - 1], &next_page, total_pages);
23- }
24+ if (writeSelections(in, &out, &crop, &image, &dump,
25+ seg_buffs, mp, argv[argc - 1],
26+ &next_page, total_pages))
27+ {
28+ TIFFError("main",
29+ "Unable to write new image selections");
30+ exit(EXIT_FAILURE);
31+ }
32+ }
33 else /* One file all images and sections */
34 {
35 if (update_output_file (&out, mp, crop.exp_mode, argv[argc - 1],
36@@ -7749,7 +7755,7 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop,
37 /* Memory is freed before crop_buff_ptr is overwritten */
38 if (*crop_buff_ptr != NULL)
39 {
40- _TIFFfree(*crop_buff_ptr);
41+ _TIFFfree(*crop_buff_ptr);
42 }
43
44 /* process full image, no crop buffer needed */
45--
462.25.1
47
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-40745.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-40745.patch
new file mode 100644
index 0000000000..6eb286039f
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-40745.patch
@@ -0,0 +1,34 @@
1From 4fc16f649fa2875d5c388cf2edc295510a247ee5 Mon Sep 17 00:00:00 2001
2From: Arie Haenel <arie.haenel@jct.ac.il>
3Date: Wed, 19 Jul 2023 19:34:25 +0000
4Subject: [PATCH] tiffcp: fix memory corruption (overflow) on hostile images
5 (fixes #591)
6
7Upstream-Status: Backport from [https://gitlab.com/libtiff/libtiff/-/commit/4fc16f649fa2875d5c388cf2edc295510a247ee5]
8CVE: CVE-2023-40745
9Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
10---
11 tools/tiffcp.c | 7 +++++++
12 1 file changed, 7 insertions(+)
13
14diff --git a/tools/tiffcp.c b/tools/tiffcp.c
15index 83b3910..007bd05 100644
16--- a/tools/tiffcp.c
17+++ b/tools/tiffcp.c
18@@ -1437,6 +1437,13 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
19 TIFFError(TIFFFileName(in), "Error, cannot handle that much samples per tile row (Tile Width * Samples/Pixel)");
20 return 0;
21 }
22+
23+ if ( (imagew - tilew * spp) > INT_MAX ){
24+ TIFFError(TIFFFileName(in),
25+ "Error, image raster scan line size is too large");
26+ return 0;
27+ }
28+
29 iskew = imagew - tilew*spp;
30 tilebuf = _TIFFmalloc(tilesize);
31 if (tilebuf == 0)
32--
332.25.1
34
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-41175.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-41175.patch
new file mode 100644
index 0000000000..3f44a42012
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-41175.patch
@@ -0,0 +1,67 @@
1From 4cc97e3dfa6559f4d17af0d0687bcae07ca4b73d Mon Sep 17 00:00:00 2001
2From: Arie Haenel <arie.haenel@jct.ac.il>
3Date: Wed, 19 Jul 2023 19:40:01 +0000
4Subject: raw2tiff: fix integer overflow and bypass of the check (fixes #592)
5
6Upstream-Status: Backport [import from debian security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u8.debian.tar.xz
7Upstream commit https://gitlab.com/libtiff/libtiff/-/commit/6e2dac5f904496d127c92ddc4e56eccfca25c2ee]
8CVE: CVE-2023-41175
9Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
10---
11 tools/raw2tiff.c | 26 ++++++++++++++++++++++++++
12 1 file changed, 26 insertions(+)
13
14diff --git a/tools/raw2tiff.c b/tools/raw2tiff.c
15index ab36ff4e..a905da52 100644
16--- a/tools/raw2tiff.c
17+++ b/tools/raw2tiff.c
18@@ -35,6 +35,7 @@
19 #include <sys/types.h>
20 #include <math.h>
21 #include <ctype.h>
22+#include <limits.h>
23
24 #ifdef HAVE_UNISTD_H
25 # include <unistd.h>
26@@ -101,6 +102,7 @@ main(int argc, char* argv[])
27 int fd;
28 char *outfilename = NULL;
29 TIFF *out;
30+ uint32 temp_limit_check = 0;
31
32 uint32 row, col, band;
33 int c;
34@@ -212,6 +214,30 @@ main(int argc, char* argv[])
35 if (guessSize(fd, dtype, hdr_size, nbands, swab, &width, &length) < 0)
36 return 1;
37
38+ if ((width == 0) || (length == 0) ){
39+ fprintf(stderr, "Too large nbands value specified.\n");
40+ return (EXIT_FAILURE);
41+ }
42+
43+ temp_limit_check = nbands * depth;
44+
45+ if ( !temp_limit_check || length > ( UINT_MAX / temp_limit_check ) ) {
46+ fprintf(stderr, "Too large length size specified.\n");
47+ return (EXIT_FAILURE);
48+ }
49+ temp_limit_check = temp_limit_check * length;
50+
51+ if ( !temp_limit_check || width > ( UINT_MAX / temp_limit_check ) ) {
52+ fprintf(stderr, "Too large width size specified.\n");
53+ return (EXIT_FAILURE);
54+ }
55+ temp_limit_check = temp_limit_check * width;
56+
57+ if ( !temp_limit_check || hdr_size > ( UINT_MAX - temp_limit_check ) ) {
58+ fprintf(stderr, "Too large header size specified.\n");
59+ return (EXIT_FAILURE);
60+ }
61+
62 if (outfilename == NULL)
63 outfilename = argv[optind+1];
64 out = TIFFOpen(outfilename, "w");
65--
662.30.2
67
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-52356.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-52356.patch
new file mode 100644
index 0000000000..1b651e6529
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-52356.patch
@@ -0,0 +1,53 @@
1[Ubuntu note: Backport of the following patch from upstream, with a few changes
2to match the current version of the file in the present Ubuntu release:
3 . using TIFFErrorExt instead of TIFFErrorExtR (the latter did not exist yet);
4-- Rodrigo Figueiredo Zaiden]
5
6Backport of:
7
8From 51558511bdbbcffdce534db21dbaf5d54b31638a Mon Sep 17 00:00:00 2001
9From: Even Rouault <even.rouault@spatialys.com>
10Date: Tue, 31 Oct 2023 15:58:41 +0100
11Subject: [PATCH] TIFFReadRGBAStrip/TIFFReadRGBATile: add more validation of
12 col/row (fixes #622)
13
14Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/tiff/tree/debian/patches/CVE-2023-52356.patch?h=ubuntu/focal-security
15Upstream commit https://gitlab.com/libtiff/libtiff/-/commit/51558511bdbbcffdce534db21dbaf5d54b31638a]
16CVE: CVE-2023-52356
17Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
18---
19 libtiff/tif_getimage.c | 15 +++++++++++++++
20 1 file changed, 15 insertions(+)
21
22
23--- tiff-4.1.0+git191117.orig/libtiff/tif_getimage.c
24+++ tiff-4.1.0+git191117/libtiff/tif_getimage.c
25@@ -2926,6 +2926,13 @@ TIFFReadRGBAStripExt(TIFF* tif, uint32 r
26 }
27
28 if (TIFFRGBAImageOK(tif, emsg) && TIFFRGBAImageBegin(&img, tif, stop_on_error, emsg)) {
29+ if (row >= img.height)
30+ {
31+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif),
32+ "Invalid row passed to TIFFReadRGBAStrip().");
33+ TIFFRGBAImageEnd(&img);
34+ return (0);
35+ }
36
37 img.row_offset = row;
38 img.col_offset = 0;
39@@ -3002,6 +3009,14 @@ TIFFReadRGBATileExt(TIFF* tif, uint32 co
40 return( 0 );
41 }
42
43+ if (col >= img.width || row >= img.height)
44+ {
45+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif),
46+ "Invalid row/col passed to TIFFReadRGBATile().");
47+ TIFFRGBAImageEnd(&img);
48+ return (0);
49+ }
50+
51 /*
52 * The TIFFRGBAImageGet() function doesn't allow us to get off the
53 * edge of the image, even to fill an otherwise valid tile. So we
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-6228.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-6228.patch
new file mode 100644
index 0000000000..a777dea9b0
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-6228.patch
@@ -0,0 +1,30 @@
1From 1e7d217a323eac701b134afc4ae39b6bdfdbc96a Mon Sep 17 00:00:00 2001
2From: Su_Laus <sulau@freenet.de>
3Date: Sat, 9 Sep 2023 15:45:47 +0200
4Subject: [PATCH] Check also if codec of input image is available,
5 independently from codec check of output image and return with error if not.
6 Fixes #606.
7
8Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/1e7d217a323eac701b134afc4ae39b6bdfdbc96a]
9CVE: CVE-2023-6228
10Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
11---
12 tools/tiffcp.c | 2 ++
13 1 file changed, 2 insertions(+)
14
15diff --git a/tools/tiffcp.c b/tools/tiffcp.c
16index 007bd05..d2f7b66 100644
17--- a/tools/tiffcp.c
18+++ b/tools/tiffcp.c
19@@ -628,6 +628,8 @@ tiffcp(TIFF* in, TIFF* out)
20 else
21 CopyField(TIFFTAG_COMPRESSION, compression);
22 TIFFGetFieldDefaulted(in, TIFFTAG_COMPRESSION, &input_compression);
23+ if (!TIFFIsCODECConfigured(input_compression))
24+ return FALSE;
25 TIFFGetFieldDefaulted(in, TIFFTAG_PHOTOMETRIC, &input_photometric);
26 if (input_compression == COMPRESSION_JPEG) {
27 /* Force conversion to RGB */
28--
292.25.1
30
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-6277-1.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-6277-1.patch
new file mode 100644
index 0000000000..e955b3f2e4
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-6277-1.patch
@@ -0,0 +1,191 @@
1[Ubuntu note: Backport of the following patch from upstream, with a few changes
2to match the current version of the file in the present Ubuntu release:
3 . included inttypes.h header to support PRIu32 and PRIu64;
4 . using TIFFWarningExt instead of TIFFWarningExtR (the latter did not exist yet);
5 . using uint64 instead of uint64_t to preserve the current code usage;
6 . calling _TIFFfree(data) instead of _TIFFfreeExt(tif, data) (the latter did not exist yet);
7 . calls to the check size, that is the idea of the patch, were added before
8 _TIFFCheckMalloc and may note match the original patch methods;
9-- Rodrigo Figueiredo Zaiden]
10
11Backport of:
12
13From 5320c9d89c054fa805d037d84c57da874470b01a Mon Sep 17 00:00:00 2001
14From: Su Laus <sulau@freenet.de>
15Date: Tue, 31 Oct 2023 15:43:29 +0000
16Subject: [PATCH] Prevent some out-of-memory attacks
17
18Some small fuzzer files fake large amounts of data and provoke out-of-memory situations. For non-compressed data content / tags, out-of-memory can be prevented by comparing with the file size.
19
20At image reading, data size of some tags / data structures (StripByteCounts, StripOffsets, StripArray, TIFF directory) is compared with file size to prevent provoked out-of-memory attacks.
21
22See issue https://gitlab.com/libtiff/libtiff/-/issues/614#note_1602683857
23
24Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/tiff/tree/debian/patches/CVE-2023-6277-1.patch?h=ubuntu/focal-security
25Upstream commit https://gitlab.com/libtiff/libtiff/-/commit/5320c9d89c054fa805d037d84c57da874470b01a]
26CVE: CVE-2023-6277
27Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
28---
29 libtiff/tif_dirread.c | 92 ++++++++++++++++++++++++++++++++++++++++++-
30 1 file changed, 90 insertions(+), 2 deletions(-)
31
32--- tiff-4.1.0+git191117.orig/libtiff/tif_dirread.c
33+++ tiff-4.1.0+git191117/libtiff/tif_dirread.c
34@@ -37,6 +37,7 @@
35 #include "tiffiop.h"
36 #include <float.h>
37 #include <stdlib.h>
38+#include <inttypes.h>
39
40 #define FAILED_FII ((uint32) -1)
41
42@@ -863,6 +864,21 @@ static enum TIFFReadDirEntryErr TIFFRead
43 datasize=(*count)*typesize;
44 assert((tmsize_t)datasize>0);
45
46+ /* Before allocating a huge amount of memory for corrupted files, check if
47+ * size of requested memory is not greater than file size.
48+ */
49+ uint64 filesize = TIFFGetFileSize(tif);
50+ if (datasize > filesize)
51+ {
52+ TIFFWarningExt(tif->tif_clientdata, "ReadDirEntryArray",
53+ "Requested memory size for tag %d (0x%x) %" PRIu32
54+ " is greather than filesize %" PRIu64
55+ ". Memory not allocated, tag not read",
56+ direntry->tdir_tag, direntry->tdir_tag, datasize,
57+ filesize);
58+ return (TIFFReadDirEntryErrAlloc);
59+ }
60+
61 if( isMapped(tif) && datasize > (uint32)tif->tif_size )
62 return TIFFReadDirEntryErrIo;
63
64@@ -4534,6 +4550,20 @@ EstimateStripByteCounts(TIFF* tif, TIFFD
65 if( !_TIFFFillStrilesInternal( tif, 0 ) )
66 return -1;
67
68+ /* Before allocating a huge amount of memory for corrupted files, check if
69+ * size of requested memory is not greater than file size. */
70+ uint64 filesize = TIFFGetFileSize(tif);
71+ uint64 allocsize = (uint64)td->td_nstrips * sizeof(uint64);
72+ if (allocsize > filesize)
73+ {
74+ TIFFWarningExt(tif->tif_clientdata, module,
75+ "Requested memory size for StripByteCounts of %" PRIu64
76+ " is greather than filesize %" PRIu64
77+ ". Memory not allocated",
78+ allocsize, filesize);
79+ return -1;
80+ }
81+
82 if (td->td_stripbytecount_p)
83 _TIFFfree(td->td_stripbytecount_p);
84 td->td_stripbytecount_p = (uint64*)
85@@ -4544,9 +4574,7 @@ EstimateStripByteCounts(TIFF* tif, TIFFD
86
87 if (td->td_compression != COMPRESSION_NONE) {
88 uint64 space;
89- uint64 filesize;
90 uint16 n;
91- filesize = TIFFGetFileSize(tif);
92 if (!(tif->tif_flags&TIFF_BIGTIFF))
93 space=sizeof(TIFFHeaderClassic)+2+dircount*12+4;
94 else
95@@ -4854,6 +4882,20 @@ TIFFFetchDirectory(TIFF* tif, uint64 dir
96 dircount16 = (uint16)dircount64;
97 dirsize = 20;
98 }
99+ /* Before allocating a huge amount of memory for corrupted files, check
100+ * if size of requested memory is not greater than file size. */
101+ uint64 filesize = TIFFGetFileSize(tif);
102+ uint64 allocsize = (uint64)dircount16 * dirsize;
103+ if (allocsize > filesize)
104+ {
105+ TIFFWarningExt(
106+ tif->tif_clientdata, module,
107+ "Requested memory size for TIFF directory of %" PRIu64
108+ " is greather than filesize %" PRIu64
109+ ". Memory not allocated, TIFF directory not read",
110+ allocsize, filesize);
111+ return 0;
112+ }
113 origdir = _TIFFCheckMalloc(tif, dircount16,
114 dirsize, "to read TIFF directory");
115 if (origdir == NULL)
116@@ -4957,6 +4999,20 @@ TIFFFetchDirectory(TIFF* tif, uint64 dir
117 "Sanity check on directory count failed, zero tag directories not supported");
118 return 0;
119 }
120+ /* Before allocating a huge amount of memory for corrupted files, check
121+ * if size of requested memory is not greater than file size. */
122+ uint64 filesize = TIFFGetFileSize(tif);
123+ uint64 allocsize = (uint64)dircount16 * dirsize;
124+ if (allocsize > filesize)
125+ {
126+ TIFFWarningExt(
127+ tif->tif_clientdata, module,
128+ "Requested memory size for TIFF directory of %" PRIu64
129+ " is greather than filesize %" PRIu64
130+ ". Memory not allocated, TIFF directory not read",
131+ allocsize, filesize);
132+ return 0;
133+ }
134 origdir = _TIFFCheckMalloc(tif, dircount16,
135 dirsize,
136 "to read TIFF directory");
137@@ -5000,6 +5056,8 @@ TIFFFetchDirectory(TIFF* tif, uint64 dir
138 }
139 }
140 }
141+ /* No check against filesize needed here because "dir" should have same size
142+ * than "origdir" checked above. */
143 dir = (TIFFDirEntry*)_TIFFCheckMalloc(tif, dircount16,
144 sizeof(TIFFDirEntry),
145 "to read TIFF directory");
146@@ -5769,7 +5827,20 @@ TIFFFetchStripThing(TIFF* tif, TIFFDirEn
147 _TIFFfree(data);
148 return(0);
149 }
150-
151+ /* Before allocating a huge amount of memory for corrupted files, check
152+ * if size of requested memory is not greater than file size. */
153+ uint64 filesize = TIFFGetFileSize(tif);
154+ uint64 allocsize = (uint64)nstrips * sizeof(uint64);
155+ if (allocsize > filesize)
156+ {
157+ TIFFWarningExt(tif->tif_clientdata, module,
158+ "Requested memory size for StripArray of %" PRIu64
159+ " is greather than filesize %" PRIu64
160+ ". Memory not allocated",
161+ allocsize, filesize);
162+ _TIFFfree(data);
163+ return (0);
164+ }
165 resizeddata=(uint64*)_TIFFCheckMalloc(tif,nstrips,sizeof(uint64),"for strip array");
166 if (resizeddata==0) {
167 _TIFFfree(data);
168@@ -5865,6 +5936,23 @@ static void allocChoppedUpStripArrays(TI
169 }
170 bytecount = last_offset + last_bytecount - offset;
171
172+ /* Before allocating a huge amount of memory for corrupted files, check if
173+ * size of StripByteCount and StripOffset tags is not greater than
174+ * file size.
175+ */
176+ uint64 allocsize = (uint64)nstrips * sizeof(uint64) * 2;
177+ uint64 filesize = TIFFGetFileSize(tif);
178+ if (allocsize > filesize)
179+ {
180+ TIFFWarningExt(tif->tif_clientdata, "allocChoppedUpStripArrays",
181+ "Requested memory size for StripByteCount and "
182+ "StripOffsets %" PRIu64
183+ " is greather than filesize %" PRIu64
184+ ". Memory not allocated",
185+ allocsize, filesize);
186+ return;
187+ }
188+
189 newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
190 "for chopped \"StripByteCounts\" array");
191 newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-6277-2.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-6277-2.patch
new file mode 100644
index 0000000000..644b3fdb3f
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-6277-2.patch
@@ -0,0 +1,152 @@
1[Ubuntu note: Backport of the following patch from upstream, with a few changes
2to match the current version of the file in the present Ubuntu release:
3 . using TIFFWarningExt instead of TIFFWarningExtR (the latter did not exist yet);
4 . using uint64 instead of uint64_t to preserve the current code usage;
5-- Rodrigo Figueiredo Zaiden]
6
7Backport of:
8
9From 0b025324711213a75e38b52f7e7ba60235f108aa Mon Sep 17 00:00:00 2001
10From: Even Rouault <even.rouault@spatialys.com>
11Date: Tue, 31 Oct 2023 19:47:22 +0100
12Subject: [PATCH] tif_dirread.c: only issue TIFFGetFileSize() for large enough
13 RAM requests
14
15Ammends 5320c9d89c054fa805d037d84c57da874470b01a
16
17This fixes a performance regression caught by the GDAL regression test
18suite.
19
20Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/tiff/tree/debian/patches/CVE-2023-6277-2.patch?h=ubuntu/focal-security
21Upstream commit https://gitlab.com/libtiff/libtiff/-/commit/0b025324711213a75e38b52f7e7ba60235f108aa]
22CVE: CVE-2023-6277
23Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
24---
25 libtiff/tif_dirread.c | 83 +++++++++++++++++++++++++------------------
26 1 file changed, 48 insertions(+), 35 deletions(-)
27
28--- tiff-4.1.0+git191117.orig/libtiff/tif_dirread.c
29+++ tiff-4.1.0+git191117/libtiff/tif_dirread.c
30@@ -864,19 +864,22 @@ static enum TIFFReadDirEntryErr TIFFRead
31 datasize=(*count)*typesize;
32 assert((tmsize_t)datasize>0);
33
34- /* Before allocating a huge amount of memory for corrupted files, check if
35- * size of requested memory is not greater than file size.
36- */
37- uint64 filesize = TIFFGetFileSize(tif);
38- if (datasize > filesize)
39+ if (datasize > 100 * 1024 * 1024)
40 {
41- TIFFWarningExt(tif->tif_clientdata, "ReadDirEntryArray",
42- "Requested memory size for tag %d (0x%x) %" PRIu32
43- " is greather than filesize %" PRIu64
44- ". Memory not allocated, tag not read",
45- direntry->tdir_tag, direntry->tdir_tag, datasize,
46- filesize);
47- return (TIFFReadDirEntryErrAlloc);
48+ /* Before allocating a huge amount of memory for corrupted files, check
49+ * if size of requested memory is not greater than file size.
50+ */
51+ const uint64 filesize = TIFFGetFileSize(tif);
52+ if (datasize > filesize)
53+ {
54+ TIFFWarningExt(tif->tif_clientdata, "ReadDirEntryArray",
55+ "Requested memory size for tag %d (0x%x) %" PRIu32
56+ " is greater than filesize %" PRIu64
57+ ". Memory not allocated, tag not read",
58+ direntry->tdir_tag, direntry->tdir_tag, datasize,
59+ filesize);
60+ return (TIFFReadDirEntryErrAlloc);
61+ }
62 }
63
64 if( isMapped(tif) && datasize > (uint32)tif->tif_size )
65@@ -4550,18 +4553,22 @@ EstimateStripByteCounts(TIFF* tif, TIFFD
66 if( !_TIFFFillStrilesInternal( tif, 0 ) )
67 return -1;
68
69- /* Before allocating a huge amount of memory for corrupted files, check if
70- * size of requested memory is not greater than file size. */
71- uint64 filesize = TIFFGetFileSize(tif);
72- uint64 allocsize = (uint64)td->td_nstrips * sizeof(uint64);
73- if (allocsize > filesize)
74+ const uint64 allocsize = (uint64)td->td_nstrips * sizeof(uint64);
75+ uint64 filesize = 0;
76+ if (allocsize > 100 * 1024 * 1024)
77 {
78- TIFFWarningExt(tif->tif_clientdata, module,
79- "Requested memory size for StripByteCounts of %" PRIu64
80- " is greather than filesize %" PRIu64
81- ". Memory not allocated",
82- allocsize, filesize);
83- return -1;
84+ /* Before allocating a huge amount of memory for corrupted files, check
85+ * if size of requested memory is not greater than file size. */
86+ filesize = TIFFGetFileSize(tif);
87+ if (allocsize > filesize)
88+ {
89+ TIFFWarningExt(
90+ tif->tif_clientdata, module,
91+ "Requested memory size for StripByteCounts of %" PRIu64
92+ " is greater than filesize %" PRIu64 ". Memory not allocated",
93+ allocsize, filesize);
94+ return -1;
95+ }
96 }
97
98 if (td->td_stripbytecount_p)
99@@ -4608,11 +4615,13 @@ EstimateStripByteCounts(TIFF* tif, TIFFD
100 return -1;
101 space+=datasize;
102 }
103+ if (filesize == 0)
104+ filesize = TIFFGetFileSize(tif);
105 if( filesize < space )
106- /* we should perhaps return in error ? */
107- space = filesize;
108- else
109- space = filesize - space;
110+ /* we should perhaps return in error ? */
111+ space = filesize;
112+ else
113+ space = filesize - space;
114 if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
115 space /= td->td_samplesperpixel;
116 for (strip = 0; strip < td->td_nstrips; strip++)
117@@ -4882,19 +4891,23 @@ TIFFFetchDirectory(TIFF* tif, uint64 dir
118 dircount16 = (uint16)dircount64;
119 dirsize = 20;
120 }
121- /* Before allocating a huge amount of memory for corrupted files, check
122- * if size of requested memory is not greater than file size. */
123- uint64 filesize = TIFFGetFileSize(tif);
124- uint64 allocsize = (uint64)dircount16 * dirsize;
125- if (allocsize > filesize)
126+ const uint64 allocsize = (uint64)dircount16 * dirsize;
127+ if (allocsize > 100 * 1024 * 1024)
128 {
129- TIFFWarningExt(
130- tif->tif_clientdata, module,
131- "Requested memory size for TIFF directory of %" PRIu64
132- " is greather than filesize %" PRIu64
133- ". Memory not allocated, TIFF directory not read",
134- allocsize, filesize);
135- return 0;
136+ /* Before allocating a huge amount of memory for corrupted files,
137+ * check if size of requested memory is not greater than file size.
138+ */
139+ const uint64 filesize = TIFFGetFileSize(tif);
140+ if (allocsize > filesize)
141+ {
142+ TIFFWarningExt(
143+ tif->tif_clientdata, module,
144+ "Requested memory size for TIFF directory of %" PRIu64
145+ " is greater than filesize %" PRIu64
146+ ". Memory not allocated, TIFF directory not read",
147+ allocsize, filesize);
148+ return 0;
149+ }
150 }
151 origdir = _TIFFCheckMalloc(tif, dircount16,
152 dirsize, "to read TIFF directory");
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-6277-3.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-6277-3.patch
new file mode 100644
index 0000000000..ed7d7e7b96
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-6277-3.patch
@@ -0,0 +1,46 @@
1Backport of:
2
3From de7bfd7d4377c266f81849579f696fa1ad5ba6c3 Mon Sep 17 00:00:00 2001
4From: Even Rouault <even.rouault@spatialys.com>
5Date: Tue, 31 Oct 2023 20:13:45 +0100
6Subject: [PATCH] TIFFFetchDirectory(): remove useless allocsize vs filesize
7 check
8
9CoverityScan rightly points that the max value for dircount16 * dirsize
10is 4096 * 20. That's small enough not to do any check
11
12Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/tiff/tree/debian/patches/CVE-2023-6277-3.patch?h=ubuntu/focal-security
13Upstream commit https://gitlab.com/libtiff/libtiff/-/commit/de7bfd7d4377c266f81849579f696fa1ad5ba6c3]
14CVE: CVE-2023-6277
15Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
16---
17 libtiff/tif_dirread.c | 18 ------------------
18 1 file changed, 18 deletions(-)
19
20--- tiff-4.1.0+git191117.orig/libtiff/tif_dirread.c
21+++ tiff-4.1.0+git191117/libtiff/tif_dirread.c
22@@ -4891,24 +4891,6 @@ TIFFFetchDirectory(TIFF* tif, uint64 dir
23 dircount16 = (uint16)dircount64;
24 dirsize = 20;
25 }
26- const uint64 allocsize = (uint64)dircount16 * dirsize;
27- if (allocsize > 100 * 1024 * 1024)
28- {
29- /* Before allocating a huge amount of memory for corrupted files,
30- * check if size of requested memory is not greater than file size.
31- */
32- const uint64 filesize = TIFFGetFileSize(tif);
33- if (allocsize > filesize)
34- {
35- TIFFWarningExt(
36- tif->tif_clientdata, module,
37- "Requested memory size for TIFF directory of %" PRIu64
38- " is greater than filesize %" PRIu64
39- ". Memory not allocated, TIFF directory not read",
40- allocsize, filesize);
41- return 0;
42- }
43- }
44 origdir = _TIFFCheckMalloc(tif, dircount16,
45 dirsize, "to read TIFF directory");
46 if (origdir == NULL)
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-6277-4.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-6277-4.patch
new file mode 100644
index 0000000000..1a43fd3230
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-6277-4.patch
@@ -0,0 +1,94 @@
1[Ubuntu note: Backport of the following patch from upstream, with a few changes
2to match the current version of the file in the present Ubuntu release:
3 . using TIFFWarningExt instead of TIFFWarningExtR (the latter did not exist yet);
4 . using uint64 instead of uint64_t to preserve the current code usage;
5 . calling _TIFFfree(data) instead of _TIFFfreeExt(tif, data) (the latter did not exist yet);
6-- Rodrigo Figueiredo Zaiden]
7
8Backport of:
9
10From dbb825a8312f30e63a06c272010967d51af5c35a Mon Sep 17 00:00:00 2001
11From: Even Rouault <even.rouault@spatialys.com>
12Date: Tue, 31 Oct 2023 21:30:58 +0100
13Subject: [PATCH] tif_dirread.c: only issue TIFFGetFileSize() for large enough
14 RAM requests
15
16Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/tiff/tree/debian/patches/CVE-2023-6277-4.patch?h=ubuntu/focal-security
17Upstream commit https://gitlab.com/libtiff/libtiff/-/commit/dbb825a8312f30e63a06c272010967d51af5c35a]
18CVE: CVE-2023-6277
19Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
20---
21 libtiff/tif_dirread.c | 54 +++++++++++++++++++++++++------------------
22 1 file changed, 31 insertions(+), 23 deletions(-)
23
24--- tiff-4.1.0+git191117.orig/libtiff/tif_dirread.c
25+++ tiff-4.1.0+git191117/libtiff/tif_dirread.c
26@@ -5822,19 +5822,24 @@ TIFFFetchStripThing(TIFF* tif, TIFFDirEn
27 _TIFFfree(data);
28 return(0);
29 }
30- /* Before allocating a huge amount of memory for corrupted files, check
31- * if size of requested memory is not greater than file size. */
32- uint64 filesize = TIFFGetFileSize(tif);
33- uint64 allocsize = (uint64)nstrips * sizeof(uint64);
34- if (allocsize > filesize)
35+ const uint64 allocsize = (uint64)nstrips * sizeof(uint64);
36+ if (allocsize > 100 * 1024 * 1024)
37 {
38- TIFFWarningExt(tif->tif_clientdata, module,
39- "Requested memory size for StripArray of %" PRIu64
40- " is greather than filesize %" PRIu64
41- ". Memory not allocated",
42- allocsize, filesize);
43- _TIFFfree(data);
44- return (0);
45+ /* Before allocating a huge amount of memory for corrupted files,
46+ * check if size of requested memory is not greater than file size.
47+ */
48+ const uint64 filesize = TIFFGetFileSize(tif);
49+ if (allocsize > filesize)
50+ {
51+ TIFFWarningExt(
52+ tif->tif_clientdata, module,
53+ "Requested memory size for StripArray of %" PRIu64
54+ " is greater than filesize %" PRIu64
55+ ". Memory not allocated",
56+ allocsize, filesize);
57+ _TIFFfree(data);
58+ return (0);
59+ }
60 }
61 resizeddata=(uint64*)_TIFFCheckMalloc(tif,nstrips,sizeof(uint64),"for strip array");
62 if (resizeddata==0) {
63@@ -5935,17 +5940,20 @@ static void allocChoppedUpStripArrays(TI
64 * size of StripByteCount and StripOffset tags is not greater than
65 * file size.
66 */
67- uint64 allocsize = (uint64)nstrips * sizeof(uint64) * 2;
68- uint64 filesize = TIFFGetFileSize(tif);
69- if (allocsize > filesize)
70- {
71- TIFFWarningExt(tif->tif_clientdata, "allocChoppedUpStripArrays",
72- "Requested memory size for StripByteCount and "
73- "StripOffsets %" PRIu64
74- " is greather than filesize %" PRIu64
75- ". Memory not allocated",
76- allocsize, filesize);
77- return;
78+ const uint64 allocsize = (uint64)nstrips * sizeof(uint64) * 2;
79+ if (allocsize > 100 * 1024 * 1024)
80+ {
81+ const uint64 filesize = TIFFGetFileSize(tif);
82+ if (allocsize > filesize)
83+ {
84+ TIFFWarningExt(tif->tif_clientdata, "allocChoppedUpStripArrays",
85+ "Requested memory size for StripByteCount and "
86+ "StripOffsets %" PRIu64
87+ " is greater than filesize %" PRIu64
88+ ". Memory not allocated",
89+ allocsize, filesize);
90+ return;
91+ }
92 }
93
94 newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
diff --git a/meta/recipes-multimedia/libtiff/tiff/561599c99f987dc32ae110370cfdd7df7975586b.patch b/meta/recipes-multimedia/libtiff/tiff/561599c99f987dc32ae110370cfdd7df7975586b.patch
new file mode 100644
index 0000000000..01ed5dcd24
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/tiff/561599c99f987dc32ae110370cfdd7df7975586b.patch
@@ -0,0 +1,28 @@
1From 561599c99f987dc32ae110370cfdd7df7975586b Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Sat, 5 Feb 2022 20:36:41 +0100
4Subject: [PATCH] TIFFReadDirectory(): avoid calling memcpy() with a null
5 source pointer and size of zero (fixes #362)
6
7Upstream-Status: Backport
8CVE: CVE-2022-0562
9Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com>
10Comment: Refreshed patch
11---
12 libtiff/tif_dirread.c | 3 ++-
13 1 file changed, 2 insertions(+), 1 deletion(-)
14
15diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
16index 2bbc4585..23194ced 100644
17--- a/libtiff/tif_dirread.c
18+++ b/libtiff/tif_dirread.c
19@@ -4126,7 +4126,8 @@
20 goto bad;
21 }
22
23- memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, old_extrasamples * sizeof(uint16));
24+ if (old_extrasamples > 0)
25+ memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, old_extrasamples * sizeof(uint16));
26 _TIFFsetShortArray(&tif->tif_dir.td_sampleinfo, new_sampleinfo, tif->tif_dir.td_extrasamples);
27 _TIFFfree(new_sampleinfo);
28 }
diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2022-1354.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2022-1354.patch
new file mode 100644
index 0000000000..71b85cac10
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2022-1354.patch
@@ -0,0 +1,212 @@
1From 87881e093691a35c60b91cafed058ba2dd5d9807 Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Sun, 5 Dec 2021 14:37:46 +0100
4Subject: [PATCH] TIFFReadDirectory: fix OJPEG hack (fixes #319)
5
6to avoid having the size of the strip arrays inconsistent with the
7number of strips returned by TIFFNumberOfStrips(), which may cause
8out-ouf-bounds array read afterwards.
9
10One of the OJPEG hack that alters SamplesPerPixel may influence the
11number of strips. Hence compute tif_dir.td_nstrips only afterwards.
12
13CVE: CVE-2022-1354
14
15Upstream-Status: Backport
16[https://gitlab.com/libtiff/libtiff/-/commit/87f580f39011109b3bb5f6eca13fac543a542798]
17
18Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
19---
20 libtiff/tif_dirread.c | 162 ++++++++++++++++++++++--------------------
21 1 file changed, 83 insertions(+), 79 deletions(-)
22
23diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
24index 8f434ef5..14c031d1 100644
25--- a/libtiff/tif_dirread.c
26+++ b/libtiff/tif_dirread.c
27@@ -3794,50 +3794,7 @@ TIFFReadDirectory(TIFF* tif)
28 MissingRequired(tif,"ImageLength");
29 goto bad;
30 }
31- /*
32- * Setup appropriate structures (by strip or by tile)
33- */
34- if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) {
35- tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);
36- tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
37- tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;
38- tif->tif_dir.td_tiledepth = tif->tif_dir.td_imagedepth;
39- tif->tif_flags &= ~TIFF_ISTILED;
40- } else {
41- tif->tif_dir.td_nstrips = TIFFNumberOfTiles(tif);
42- tif->tif_flags |= TIFF_ISTILED;
43- }
44- if (!tif->tif_dir.td_nstrips) {
45- TIFFErrorExt(tif->tif_clientdata, module,
46- "Cannot handle zero number of %s",
47- isTiled(tif) ? "tiles" : "strips");
48- goto bad;
49- }
50- tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
51- if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
52- tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
53- if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS)) {
54-#ifdef OJPEG_SUPPORT
55- if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG) &&
56- (isTiled(tif)==0) &&
57- (tif->tif_dir.td_nstrips==1)) {
58- /*
59- * XXX: OJPEG hack.
60- * If a) compression is OJPEG, b) it's not a tiled TIFF,
61- * and c) the number of strips is 1,
62- * then we tolerate the absence of stripoffsets tag,
63- * because, presumably, all required data is in the
64- * JpegInterchangeFormat stream.
65- */
66- TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
67- } else
68-#endif
69- {
70- MissingRequired(tif,
71- isTiled(tif) ? "TileOffsets" : "StripOffsets");
72- goto bad;
73- }
74- }
75+
76 /*
77 * Second pass: extract other information.
78 */
79@@ -4042,41 +3999,6 @@ TIFFReadDirectory(TIFF* tif)
80 } /* -- if (!dp->tdir_ignore) */
81 } /* -- for-loop -- */
82
83- if( tif->tif_mode == O_RDWR &&
84- tif->tif_dir.td_stripoffset_entry.tdir_tag != 0 &&
85- tif->tif_dir.td_stripoffset_entry.tdir_count == 0 &&
86- tif->tif_dir.td_stripoffset_entry.tdir_type == 0 &&
87- tif->tif_dir.td_stripoffset_entry.tdir_offset.toff_long8 == 0 &&
88- tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0 &&
89- tif->tif_dir.td_stripbytecount_entry.tdir_count == 0 &&
90- tif->tif_dir.td_stripbytecount_entry.tdir_type == 0 &&
91- tif->tif_dir.td_stripbytecount_entry.tdir_offset.toff_long8 == 0 )
92- {
93- /* Directory typically created with TIFFDeferStrileArrayWriting() */
94- TIFFSetupStrips(tif);
95- }
96- else if( !(tif->tif_flags&TIFF_DEFERSTRILELOAD) )
97- {
98- if( tif->tif_dir.td_stripoffset_entry.tdir_tag != 0 )
99- {
100- if (!TIFFFetchStripThing(tif,&(tif->tif_dir.td_stripoffset_entry),
101- tif->tif_dir.td_nstrips,
102- &tif->tif_dir.td_stripoffset_p))
103- {
104- goto bad;
105- }
106- }
107- if( tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0 )
108- {
109- if (!TIFFFetchStripThing(tif,&(tif->tif_dir.td_stripbytecount_entry),
110- tif->tif_dir.td_nstrips,
111- &tif->tif_dir.td_stripbytecount_p))
112- {
113- goto bad;
114- }
115- }
116- }
117-
118 /*
119 * OJPEG hack:
120 * - If a) compression is OJPEG, and b) photometric tag is missing,
121@@ -4147,6 +4069,88 @@ TIFFReadDirectory(TIFF* tif)
122 }
123 }
124
125+ /*
126+ * Setup appropriate structures (by strip or by tile)
127+ * We do that only after the above OJPEG hack which alters SamplesPerPixel
128+ * and thus influences the number of strips in the separate planarconfig.
129+ */
130+ if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) {
131+ tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);
132+ tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
133+ tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;
134+ tif->tif_dir.td_tiledepth = tif->tif_dir.td_imagedepth;
135+ tif->tif_flags &= ~TIFF_ISTILED;
136+ } else {
137+ tif->tif_dir.td_nstrips = TIFFNumberOfTiles(tif);
138+ tif->tif_flags |= TIFF_ISTILED;
139+ }
140+ if (!tif->tif_dir.td_nstrips) {
141+ TIFFErrorExt(tif->tif_clientdata, module,
142+ "Cannot handle zero number of %s",
143+ isTiled(tif) ? "tiles" : "strips");
144+ goto bad;
145+ }
146+ tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
147+ if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
148+ tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
149+ if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS)) {
150+#ifdef OJPEG_SUPPORT
151+ if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG) &&
152+ (isTiled(tif)==0) &&
153+ (tif->tif_dir.td_nstrips==1)) {
154+ /*
155+ * XXX: OJPEG hack.
156+ * If a) compression is OJPEG, b) it's not a tiled TIFF,
157+ * and c) the number of strips is 1,
158+ * then we tolerate the absence of stripoffsets tag,
159+ * because, presumably, all required data is in the
160+ * JpegInterchangeFormat stream.
161+ */
162+ TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
163+ } else
164+#endif
165+ {
166+ MissingRequired(tif,
167+ isTiled(tif) ? "TileOffsets" : "StripOffsets");
168+ goto bad;
169+ }
170+ }
171+
172+ if( tif->tif_mode == O_RDWR &&
173+ tif->tif_dir.td_stripoffset_entry.tdir_tag != 0 &&
174+ tif->tif_dir.td_stripoffset_entry.tdir_count == 0 &&
175+ tif->tif_dir.td_stripoffset_entry.tdir_type == 0 &&
176+ tif->tif_dir.td_stripoffset_entry.tdir_offset.toff_long8 == 0 &&
177+ tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0 &&
178+ tif->tif_dir.td_stripbytecount_entry.tdir_count == 0 &&
179+ tif->tif_dir.td_stripbytecount_entry.tdir_type == 0 &&
180+ tif->tif_dir.td_stripbytecount_entry.tdir_offset.toff_long8 == 0 )
181+ {
182+ /* Directory typically created with TIFFDeferStrileArrayWriting() */
183+ TIFFSetupStrips(tif);
184+ }
185+ else if( !(tif->tif_flags&TIFF_DEFERSTRILELOAD) )
186+ {
187+ if( tif->tif_dir.td_stripoffset_entry.tdir_tag != 0 )
188+ {
189+ if (!TIFFFetchStripThing(tif,&(tif->tif_dir.td_stripoffset_entry),
190+ tif->tif_dir.td_nstrips,
191+ &tif->tif_dir.td_stripoffset_p))
192+ {
193+ goto bad;
194+ }
195+ }
196+ if( tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0 )
197+ {
198+ if (!TIFFFetchStripThing(tif,&(tif->tif_dir.td_stripbytecount_entry),
199+ tif->tif_dir.td_nstrips,
200+ &tif->tif_dir.td_stripbytecount_p))
201+ {
202+ goto bad;
203+ }
204+ }
205+ }
206+
207 /*
208 * Make sure all non-color channels are extrasamples.
209 * If it's not the case, define them as such.
210--
2112.25.1
212
diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2022-1355.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2022-1355.patch
new file mode 100644
index 0000000000..e59f5aad55
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2022-1355.patch
@@ -0,0 +1,62 @@
1From fb1db384959698edd6caeea84e28253d272a0f96 Mon Sep 17 00:00:00 2001
2From: Su_Laus <sulau@freenet.de>
3Date: Sat, 2 Apr 2022 22:33:31 +0200
4Subject: [PATCH] tiffcp: avoid buffer overflow in "mode" string (fixes #400)
5
6CVE: CVE-2022-1355
7
8Upstream-Status: Backport
9[https://gitlab.com/libtiff/libtiff/-/commit/c1ae29f9ebacd29b7c3e0c7db671af7db3584bc2]
10
11Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
12---
13 tools/tiffcp.c | 25 ++++++++++++++++++++-----
14 1 file changed, 20 insertions(+), 5 deletions(-)
15
16diff --git a/tools/tiffcp.c b/tools/tiffcp.c
17index fd129bb7..8d944ff6 100644
18--- a/tools/tiffcp.c
19+++ b/tools/tiffcp.c
20@@ -274,19 +274,34 @@ main(int argc, char* argv[])
21 deftilewidth = atoi(optarg);
22 break;
23 case 'B':
24- *mp++ = 'b'; *mp = '\0';
25+ if (strlen(mode) < (sizeof(mode) - 1))
26+ {
27+ *mp++ = 'b'; *mp = '\0';
28+ }
29 break;
30 case 'L':
31- *mp++ = 'l'; *mp = '\0';
32+ if (strlen(mode) < (sizeof(mode) - 1))
33+ {
34+ *mp++ = 'l'; *mp = '\0';
35+ }
36 break;
37 case 'M':
38- *mp++ = 'm'; *mp = '\0';
39+ if (strlen(mode) < (sizeof(mode) - 1))
40+ {
41+ *mp++ = 'm'; *mp = '\0';
42+ }
43 break;
44 case 'C':
45- *mp++ = 'c'; *mp = '\0';
46+ if (strlen(mode) < (sizeof(mode) - 1))
47+ {
48+ *mp++ = 'c'; *mp = '\0';
49+ }
50 break;
51 case '8':
52- *mp++ = '8'; *mp = '\0';
53+ if (strlen(mode) < (sizeof(mode)-1))
54+ {
55+ *mp++ = '8'; *mp = '\0';
56+ }
57 break;
58 case 'x':
59 pageInSeq = 1;
60--
612.25.1
62
diff --git a/meta/recipes-multimedia/libtiff/tiff/eecb0712f4c3a5b449f70c57988260a667ddbdef.patch b/meta/recipes-multimedia/libtiff/tiff/eecb0712f4c3a5b449f70c57988260a667ddbdef.patch
new file mode 100644
index 0000000000..fc5d0ab5f4
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/tiff/eecb0712f4c3a5b449f70c57988260a667ddbdef.patch
@@ -0,0 +1,30 @@
1From eecb0712f4c3a5b449f70c57988260a667ddbdef Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Sun, 6 Feb 2022 13:08:38 +0100
4Subject: [PATCH] TIFFFetchStripThing(): avoid calling memcpy() with a null
5 source pointer and size of zero (fixes #362)
6
7Upstream-Status: Backport
8CVE: CVE-2022-0561
9Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com>
10Comment: Refreshed patch
11---
12 libtiff/tif_dirread.c | 5 +++--
13 1 file changed, 3 insertions(+), 2 deletions(-)
14
15diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
16index 23194ced..50ebf8ac 100644
17--- a/libtiff/tif_dirread.c
18+++ b/libtiff/tif_dirread.c
19@@ -5683,8 +5682,9 @@
20 _TIFFfree(data);
21 return(0);
22 }
23- _TIFFmemcpy(resizeddata,data,(uint32)dir->tdir_count*sizeof(uint64));
24- _TIFFmemset(resizeddata+(uint32)dir->tdir_count,0,(nstrips-(uint32)dir->tdir_count)*sizeof(uint64));
25+ if( dir->tdir_count )
26+ _TIFFmemcpy(resizeddata,data, (uint32)dir->tdir_count * sizeof(uint64));
27+ _TIFFmemset(resizeddata+(uint32)dir->tdir_count, 0, (nstrips - (uint32)dir->tdir_count) * sizeof(uint64));
28 _TIFFfree(data);
29 data=resizeddata;
30 }
diff --git a/meta/recipes-multimedia/libtiff/tiff_4.1.0.bb b/meta/recipes-multimedia/libtiff/tiff_4.1.0.bb
index 1f92c18513..7efaba3a38 100644
--- a/meta/recipes-multimedia/libtiff/tiff_4.1.0.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.1.0.bb
@@ -1,10 +1,59 @@
1SUMMARY = "Provides support for the Tag Image File Format (TIFF)" 1SUMMARY = "Provides support for the Tag Image File Format (TIFF)"
2DESCRIPTION = "Library provides support for the Tag Image File Format \
3(TIFF), a widely used format for storing image data. This library \
4provide means to easily access and create TIFF image files."
5HOMEPAGE = "http://www.libtiff.org/"
2LICENSE = "BSD-2-Clause" 6LICENSE = "BSD-2-Clause"
3LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=34da3db46fab7501992f9615d7e158cf" 7LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=34da3db46fab7501992f9615d7e158cf"
4 8
5CVE_PRODUCT = "libtiff" 9CVE_PRODUCT = "libtiff"
6 10
7SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ 11SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
12 file://CVE-2020-35523.patch \
13 file://CVE-2020-35524-1.patch \
14 file://CVE-2020-35524-2.patch \
15 file://001_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch \
16 file://002_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch \
17 file://CVE-2020-35521_and_CVE-2020-35522.patch \
18 file://0001-tiffset-fix-global-buffer-overflow-for-ASCII-tags-wh.patch \
19 file://561599c99f987dc32ae110370cfdd7df7975586b.patch \
20 file://eecb0712f4c3a5b449f70c57988260a667ddbdef.patch \
21 file://CVE-2022-0865.patch \
22 file://CVE-2022-0908.patch \
23 file://CVE-2022-0907.patch \
24 file://CVE-2022-0909.patch \
25 file://CVE-2022-0891.patch \
26 file://CVE-2022-0924.patch \
27 file://CVE-2022-2056-CVE-2022-2057-CVE-2022-2058.patch \
28 file://CVE-2022-34526.patch \
29 file://CVE-2022-2867-CVE-2022-2868-CVE-2022-2869.patch \
30 file://CVE-2022-1354.patch \
31 file://CVE-2022-1355.patch \
32 file://CVE-2022-3570_3598.patch \
33 file://CVE-2022-3597_3626_3627.patch \
34 file://CVE-2022-3599.patch \
35 file://CVE-2022-3970.patch \
36 file://CVE-2022-48281.patch \
37 file://CVE-2023-0795_0796_0797_0798_0799.patch \
38 file://CVE-2023-0800_0801_0802_0803_0804.patch \
39 file://CVE-2023-1916.patch \
40 file://CVE-2023-25433.patch \
41 file://CVE-2023-25434-CVE-2023-25435.patch \
42 file://CVE-2023-26965.patch \
43 file://CVE-2023-26966.patch \
44 file://CVE-2023-2908.patch \
45 file://CVE-2023-3316.patch \
46 file://CVE-2023-3576.patch \
47 file://CVE-2023-3618.patch \
48 file://CVE-2023-40745.patch \
49 file://CVE-2023-41175.patch \
50 file://CVE-2022-40090.patch \
51 file://CVE-2023-6228.patch \
52 file://CVE-2023-6277-1.patch \
53 file://CVE-2023-6277-2.patch \
54 file://CVE-2023-6277-3.patch \
55 file://CVE-2023-6277-4.patch \
56 file://CVE-2023-52356.patch \
8 " 57 "
9SRC_URI[md5sum] = "2165e7aba557463acc0664e71a3ed424" 58SRC_URI[md5sum] = "2165e7aba557463acc0664e71a3ed424"
10SRC_URI[sha256sum] = "5d29f32517dadb6dbcd1255ea5bbc93a2b54b94fbf83653b4d65c7d6775b8634" 59SRC_URI[sha256sum] = "5d29f32517dadb6dbcd1255ea5bbc93a2b54b94fbf83653b4d65c7d6775b8634"
@@ -12,6 +61,10 @@ SRC_URI[sha256sum] = "5d29f32517dadb6dbcd1255ea5bbc93a2b54b94fbf83653b4d65c7d677
12# exclude betas 61# exclude betas
13UPSTREAM_CHECK_REGEX = "tiff-(?P<pver>\d+(\.\d+)+).tar" 62UPSTREAM_CHECK_REGEX = "tiff-(?P<pver>\d+(\.\d+)+).tar"
14 63
64# Tested with check from https://security-tracker.debian.org/tracker/CVE-2015-7313
65# and 4.1.0 doesn't have the issue
66CVE_CHECK_WHITELIST += "CVE-2015-7313"
67
15inherit autotools multilib_header 68inherit autotools multilib_header
16 69
17CACHED_CONFIGUREVARS = "ax_cv_check_gl_libgl=no" 70CACHED_CONFIGUREVARS = "ax_cv_check_gl_libgl=no"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-08 18:42:18 +0000