diff options
Diffstat (limited to 'meta/recipes-multimedia')
-rw-r--r-- | meta/recipes-multimedia/webp/files/CVE-2023-5129.patch | 364 | ||||
-rw-r--r-- | meta/recipes-multimedia/webp/libwebp_1.1.0.bb | 1 |
2 files changed, 365 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/webp/files/CVE-2023-5129.patch b/meta/recipes-multimedia/webp/files/CVE-2023-5129.patch new file mode 100644 index 0000000000..eb77e193c2 --- /dev/null +++ b/meta/recipes-multimedia/webp/files/CVE-2023-5129.patch | |||
@@ -0,0 +1,364 @@ | |||
1 | From 12b11893edf6c201710ebeee7c84743a8573fad6 Mon Sep 17 00:00:00 2001 | ||
2 | From: Vincent Rabaud <vrabaud@google.com> | ||
3 | Date: Thu, 7 Sep 2023 21:16:03 +0200 | ||
4 | Subject: [PATCH 1/1] Fix OOB write in BuildHuffmanTable. | ||
5 | |||
6 | First, BuildHuffmanTable is called to check if the data is valid. | ||
7 | If it is and the table is not big enough, more memory is allocated. | ||
8 | |||
9 | This will make sure that valid (but unoptimized because of unbalanced | ||
10 | codes) streams are still decodable. | ||
11 | |||
12 | Bug: chromium:1479274 | ||
13 | Change-Id: I31c36dbf3aa78d35ecf38706b50464fd3d375741 | ||
14 | |||
15 | CVE: CVE-2023-5129 | ||
16 | Upstream-Status: Backport [https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76] | ||
17 | Signed-off-by: Colin McAllister <colinmca242@gmail.com> | ||
18 | --- | ||
19 | src/dec/vp8l_dec.c | 46 ++++++++++--------- | ||
20 | src/dec/vp8li_dec.h | 2 +- | ||
21 | src/utils/huffman_utils.c | 97 +++++++++++++++++++++++++++++++-------- | ||
22 | src/utils/huffman_utils.h | 27 +++++++++-- | ||
23 | 4 files changed, 129 insertions(+), 43 deletions(-) | ||
24 | |||
25 | diff --git a/src/dec/vp8l_dec.c b/src/dec/vp8l_dec.c | ||
26 | index 93615d4e..0d38314d 100644 | ||
27 | --- a/src/dec/vp8l_dec.c | ||
28 | +++ b/src/dec/vp8l_dec.c | ||
29 | @@ -253,11 +253,11 @@ static int ReadHuffmanCodeLengths( | ||
30 | int symbol; | ||
31 | int max_symbol; | ||
32 | int prev_code_len = DEFAULT_CODE_LENGTH; | ||
33 | - HuffmanCode table[1 << LENGTHS_TABLE_BITS]; | ||
34 | + HuffmanTables tables; | ||
35 | |||
36 | - if (!VP8LBuildHuffmanTable(table, LENGTHS_TABLE_BITS, | ||
37 | - code_length_code_lengths, | ||
38 | - NUM_CODE_LENGTH_CODES)) { | ||
39 | + if (!VP8LHuffmanTablesAllocate(1 << LENGTHS_TABLE_BITS, &tables) || | ||
40 | + !VP8LBuildHuffmanTable(&tables, LENGTHS_TABLE_BITS, | ||
41 | + code_length_code_lengths, NUM_CODE_LENGTH_CODES)) { | ||
42 | goto End; | ||
43 | } | ||
44 | |||
45 | @@ -277,7 +277,7 @@ static int ReadHuffmanCodeLengths( | ||
46 | int code_len; | ||
47 | if (max_symbol-- == 0) break; | ||
48 | VP8LFillBitWindow(br); | ||
49 | - p = &table[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK]; | ||
50 | + p = &tables.curr_segment->start[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK]; | ||
51 | VP8LSetBitPos(br, br->bit_pos_ + p->bits); | ||
52 | code_len = p->value; | ||
53 | if (code_len < kCodeLengthLiterals) { | ||
54 | @@ -300,6 +300,7 @@ static int ReadHuffmanCodeLengths( | ||
55 | ok = 1; | ||
56 | |||
57 | End: | ||
58 | + VP8LHuffmanTablesDeallocate(&tables); | ||
59 | if (!ok) dec->status_ = VP8_STATUS_BITSTREAM_ERROR; | ||
60 | return ok; | ||
61 | } | ||
62 | @@ -307,7 +308,8 @@ static int ReadHuffmanCodeLengths( | ||
63 | // 'code_lengths' is pre-allocated temporary buffer, used for creating Huffman | ||
64 | // tree. | ||
65 | static int ReadHuffmanCode(int alphabet_size, VP8LDecoder* const dec, | ||
66 | - int* const code_lengths, HuffmanCode* const table) { | ||
67 | + int* const code_lengths, | ||
68 | + HuffmanTables* const table) { | ||
69 | int ok = 0; | ||
70 | int size = 0; | ||
71 | VP8LBitReader* const br = &dec->br_; | ||
72 | @@ -362,8 +364,7 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize, | ||
73 | VP8LMetadata* const hdr = &dec->hdr_; | ||
74 | uint32_t* huffman_image = NULL; | ||
75 | HTreeGroup* htree_groups = NULL; | ||
76 | - HuffmanCode* huffman_tables = NULL; | ||
77 | - HuffmanCode* huffman_table = NULL; | ||
78 | + HuffmanTables* huffman_tables = &hdr->huffman_tables_; | ||
79 | int num_htree_groups = 1; | ||
80 | int num_htree_groups_max = 1; | ||
81 | int max_alphabet_size = 0; | ||
82 | @@ -372,6 +373,10 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize, | ||
83 | int* mapping = NULL; | ||
84 | int ok = 0; | ||
85 | |||
86 | + // Check the table has been 0 initialized (through InitMetadata). | ||
87 | + assert(huffman_tables->root.start == NULL); | ||
88 | + assert(huffman_tables->curr_segment == NULL); | ||
89 | + | ||
90 | if (allow_recursion && VP8LReadBits(br, 1)) { | ||
91 | // use meta Huffman codes. | ||
92 | const int huffman_precision = VP8LReadBits(br, 3) + 2; | ||
93 | @@ -434,16 +439,15 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize, | ||
94 | |||
95 | code_lengths = (int*)WebPSafeCalloc((uint64_t)max_alphabet_size, | ||
96 | sizeof(*code_lengths)); | ||
97 | - huffman_tables = (HuffmanCode*)WebPSafeMalloc(num_htree_groups * table_size, | ||
98 | - sizeof(*huffman_tables)); | ||
99 | htree_groups = VP8LHtreeGroupsNew(num_htree_groups); | ||
100 | |||
101 | - if (htree_groups == NULL || code_lengths == NULL || huffman_tables == NULL) { | ||
102 | + if (htree_groups == NULL || code_lengths == NULL || | ||
103 | + !VP8LHuffmanTablesAllocate(num_htree_groups * table_size, | ||
104 | + huffman_tables)) { | ||
105 | dec->status_ = VP8_STATUS_OUT_OF_MEMORY; | ||
106 | goto Error; | ||
107 | } | ||
108 | |||
109 | - huffman_table = huffman_tables; | ||
110 | for (i = 0; i < num_htree_groups_max; ++i) { | ||
111 | // If the index "i" is unused in the Huffman image, just make sure the | ||
112 | // coefficients are valid but do not store them. | ||
113 | @@ -468,19 +472,20 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize, | ||
114 | int max_bits = 0; | ||
115 | for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; ++j) { | ||
116 | int alphabet_size = kAlphabetSize[j]; | ||
117 | - htrees[j] = huffman_table; | ||
118 | if (j == 0 && color_cache_bits > 0) { | ||
119 | alphabet_size += (1 << color_cache_bits); | ||
120 | } | ||
121 | - size = ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_table); | ||
122 | + size = | ||
123 | + ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_tables); | ||
124 | + htrees[j] = huffman_tables->curr_segment->curr_table; | ||
125 | if (size == 0) { | ||
126 | goto Error; | ||
127 | } | ||
128 | if (is_trivial_literal && kLiteralMap[j] == 1) { | ||
129 | - is_trivial_literal = (huffman_table->bits == 0); | ||
130 | + is_trivial_literal = (htrees[j]->bits == 0); | ||
131 | } | ||
132 | - total_size += huffman_table->bits; | ||
133 | - huffman_table += size; | ||
134 | + total_size += htrees[j]->bits; | ||
135 | + huffman_tables->curr_segment->curr_table += size; | ||
136 | if (j <= ALPHA) { | ||
137 | int local_max_bits = code_lengths[0]; | ||
138 | int k; | ||
139 | @@ -515,14 +520,13 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize, | ||
140 | hdr->huffman_image_ = huffman_image; | ||
141 | hdr->num_htree_groups_ = num_htree_groups; | ||
142 | hdr->htree_groups_ = htree_groups; | ||
143 | - hdr->huffman_tables_ = huffman_tables; | ||
144 | |||
145 | Error: | ||
146 | WebPSafeFree(code_lengths); | ||
147 | WebPSafeFree(mapping); | ||
148 | if (!ok) { | ||
149 | WebPSafeFree(huffman_image); | ||
150 | - WebPSafeFree(huffman_tables); | ||
151 | + VP8LHuffmanTablesDeallocate(huffman_tables); | ||
152 | VP8LHtreeGroupsFree(htree_groups); | ||
153 | } | ||
154 | return ok; | ||
155 | @@ -1354,7 +1358,7 @@ static void ClearMetadata(VP8LMetadata* const hdr) { | ||
156 | assert(hdr != NULL); | ||
157 | |||
158 | WebPSafeFree(hdr->huffman_image_); | ||
159 | - WebPSafeFree(hdr->huffman_tables_); | ||
160 | + VP8LHuffmanTablesDeallocate(&hdr->huffman_tables_); | ||
161 | VP8LHtreeGroupsFree(hdr->htree_groups_); | ||
162 | VP8LColorCacheClear(&hdr->color_cache_); | ||
163 | VP8LColorCacheClear(&hdr->saved_color_cache_); | ||
164 | @@ -1670,7 +1674,7 @@ int VP8LDecodeImage(VP8LDecoder* const dec) { | ||
165 | // Sanity checks. | ||
166 | if (dec == NULL) return 0; | ||
167 | |||
168 | - assert(dec->hdr_.huffman_tables_ != NULL); | ||
169 | + assert(dec->hdr_.huffman_tables_.root.start != NULL); | ||
170 | assert(dec->hdr_.htree_groups_ != NULL); | ||
171 | assert(dec->hdr_.num_htree_groups_ > 0); | ||
172 | |||
173 | diff --git a/src/dec/vp8li_dec.h b/src/dec/vp8li_dec.h | ||
174 | index 72b2e861..32540a4b 100644 | ||
175 | --- a/src/dec/vp8li_dec.h | ||
176 | +++ b/src/dec/vp8li_dec.h | ||
177 | @@ -51,7 +51,7 @@ typedef struct { | ||
178 | uint32_t* huffman_image_; | ||
179 | int num_htree_groups_; | ||
180 | HTreeGroup* htree_groups_; | ||
181 | - HuffmanCode* huffman_tables_; | ||
182 | + HuffmanTables huffman_tables_; | ||
183 | } VP8LMetadata; | ||
184 | |||
185 | typedef struct VP8LDecoder VP8LDecoder; | ||
186 | diff --git a/src/utils/huffman_utils.c b/src/utils/huffman_utils.c | ||
187 | index 0cba0fbb..9efd6283 100644 | ||
188 | --- a/src/utils/huffman_utils.c | ||
189 | +++ b/src/utils/huffman_utils.c | ||
190 | @@ -177,21 +177,24 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits, | ||
191 | if (num_open < 0) { | ||
192 | return 0; | ||
193 | } | ||
194 | - if (root_table == NULL) continue; | ||
195 | for (; count[len] > 0; --count[len]) { | ||
196 | HuffmanCode code; | ||
197 | if ((key & mask) != low) { | ||
198 | - table += table_size; | ||
199 | + if (root_table != NULL) table += table_size; | ||
200 | table_bits = NextTableBitSize(count, len, root_bits); | ||
201 | table_size = 1 << table_bits; | ||
202 | total_size += table_size; | ||
203 | low = key & mask; | ||
204 | - root_table[low].bits = (uint8_t)(table_bits + root_bits); | ||
205 | - root_table[low].value = (uint16_t)((table - root_table) - low); | ||
206 | + if (root_table != NULL) { | ||
207 | + root_table[low].bits = (uint8_t)(table_bits + root_bits); | ||
208 | + root_table[low].value = (uint16_t)((table - root_table) - low); | ||
209 | + } | ||
210 | + } | ||
211 | + if (root_table != NULL) { | ||
212 | + code.bits = (uint8_t)(len - root_bits); | ||
213 | + code.value = (uint16_t)sorted[symbol++]; | ||
214 | + ReplicateValue(&table[key >> root_bits], step, table_size, code); | ||
215 | } | ||
216 | - code.bits = (uint8_t)(len - root_bits); | ||
217 | - code.value = (uint16_t)sorted[symbol++]; | ||
218 | - ReplicateValue(&table[key >> root_bits], step, table_size, code); | ||
219 | key = GetNextKey(key, len); | ||
220 | } | ||
221 | } | ||
222 | @@ -211,25 +214,83 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits, | ||
223 | ((1 << MAX_CACHE_BITS) + NUM_LITERAL_CODES + NUM_LENGTH_CODES) | ||
224 | // Cut-off value for switching between heap and stack allocation. | ||
225 | #define SORTED_SIZE_CUTOFF 512 | ||
226 | -int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits, | ||
227 | +int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits, | ||
228 | const int code_lengths[], int code_lengths_size) { | ||
229 | - int total_size; | ||
230 | + const int total_size = | ||
231 | + BuildHuffmanTable(NULL, root_bits, code_lengths, code_lengths_size, NULL); | ||
232 | assert(code_lengths_size <= MAX_CODE_LENGTHS_SIZE); | ||
233 | - if (root_table == NULL) { | ||
234 | - total_size = BuildHuffmanTable(NULL, root_bits, | ||
235 | - code_lengths, code_lengths_size, NULL); | ||
236 | - } else if (code_lengths_size <= SORTED_SIZE_CUTOFF) { | ||
237 | + if (total_size == 0 || root_table == NULL) return total_size; | ||
238 | + | ||
239 | + if (root_table->curr_segment->curr_table + total_size >= | ||
240 | + root_table->curr_segment->start + root_table->curr_segment->size) { | ||
241 | + // If 'root_table' does not have enough memory, allocate a new segment. | ||
242 | + // The available part of root_table->curr_segment is left unused because we | ||
243 | + // need a contiguous buffer. | ||
244 | + const int segment_size = root_table->curr_segment->size; | ||
245 | + struct HuffmanTablesSegment* next = | ||
246 | + (HuffmanTablesSegment*)WebPSafeMalloc(1, sizeof(*next)); | ||
247 | + if (next == NULL) return 0; | ||
248 | + // Fill the new segment. | ||
249 | + // We need at least 'total_size' but if that value is small, it is better to | ||
250 | + // allocate a big chunk to prevent more allocations later. 'segment_size' is | ||
251 | + // therefore chosen (any other arbitrary value could be chosen). | ||
252 | + next->size = total_size > segment_size ? total_size : segment_size; | ||
253 | + next->start = | ||
254 | + (HuffmanCode*)WebPSafeMalloc(next->size, sizeof(*next->start)); | ||
255 | + if (next->start == NULL) { | ||
256 | + WebPSafeFree(next); | ||
257 | + return 0; | ||
258 | + } | ||
259 | + next->curr_table = next->start; | ||
260 | + next->next = NULL; | ||
261 | + // Point to the new segment. | ||
262 | + root_table->curr_segment->next = next; | ||
263 | + root_table->curr_segment = next; | ||
264 | + } | ||
265 | + if (code_lengths_size <= SORTED_SIZE_CUTOFF) { | ||
266 | // use local stack-allocated array. | ||
267 | uint16_t sorted[SORTED_SIZE_CUTOFF]; | ||
268 | - total_size = BuildHuffmanTable(root_table, root_bits, | ||
269 | - code_lengths, code_lengths_size, sorted); | ||
270 | - } else { // rare case. Use heap allocation. | ||
271 | + BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits, | ||
272 | + code_lengths, code_lengths_size, sorted); | ||
273 | + } else { // rare case. Use heap allocation. | ||
274 | uint16_t* const sorted = | ||
275 | (uint16_t*)WebPSafeMalloc(code_lengths_size, sizeof(*sorted)); | ||
276 | if (sorted == NULL) return 0; | ||
277 | - total_size = BuildHuffmanTable(root_table, root_bits, | ||
278 | - code_lengths, code_lengths_size, sorted); | ||
279 | + BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits, | ||
280 | + code_lengths, code_lengths_size, sorted); | ||
281 | WebPSafeFree(sorted); | ||
282 | } | ||
283 | return total_size; | ||
284 | } | ||
285 | + | ||
286 | +int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables) { | ||
287 | + // Have 'segment' point to the first segment for now, 'root'. | ||
288 | + HuffmanTablesSegment* const root = &huffman_tables->root; | ||
289 | + huffman_tables->curr_segment = root; | ||
290 | + // Allocate root. | ||
291 | + root->start = (HuffmanCode*)WebPSafeMalloc(size, sizeof(*root->start)); | ||
292 | + if (root->start == NULL) return 0; | ||
293 | + root->curr_table = root->start; | ||
294 | + root->next = NULL; | ||
295 | + root->size = size; | ||
296 | + return 1; | ||
297 | +} | ||
298 | + | ||
299 | +void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables) { | ||
300 | + HuffmanTablesSegment *current, *next; | ||
301 | + if (huffman_tables == NULL) return; | ||
302 | + // Free the root node. | ||
303 | + current = &huffman_tables->root; | ||
304 | + next = current->next; | ||
305 | + WebPSafeFree(current->start); | ||
306 | + current->start = NULL; | ||
307 | + current->next = NULL; | ||
308 | + current = next; | ||
309 | + // Free the following nodes. | ||
310 | + while (current != NULL) { | ||
311 | + next = current->next; | ||
312 | + WebPSafeFree(current->start); | ||
313 | + WebPSafeFree(current); | ||
314 | + current = next; | ||
315 | + } | ||
316 | +} | ||
317 | diff --git a/src/utils/huffman_utils.h b/src/utils/huffman_utils.h | ||
318 | index 13b7ad1a..98415c53 100644 | ||
319 | --- a/src/utils/huffman_utils.h | ||
320 | +++ b/src/utils/huffman_utils.h | ||
321 | @@ -43,6 +43,29 @@ typedef struct { | ||
322 | // or non-literal symbol otherwise | ||
323 | } HuffmanCode32; | ||
324 | |||
325 | +// Contiguous memory segment of HuffmanCodes. | ||
326 | +typedef struct HuffmanTablesSegment { | ||
327 | + HuffmanCode* start; | ||
328 | + // Pointer to where we are writing into the segment. Starts at 'start' and | ||
329 | + // cannot go beyond 'start' + 'size'. | ||
330 | + HuffmanCode* curr_table; | ||
331 | + // Pointer to the next segment in the chain. | ||
332 | + struct HuffmanTablesSegment* next; | ||
333 | + int size; | ||
334 | +} HuffmanTablesSegment; | ||
335 | + | ||
336 | +// Chained memory segments of HuffmanCodes. | ||
337 | +typedef struct HuffmanTables { | ||
338 | + HuffmanTablesSegment root; | ||
339 | + // Currently processed segment. At first, this is 'root'. | ||
340 | + HuffmanTablesSegment* curr_segment; | ||
341 | +} HuffmanTables; | ||
342 | + | ||
343 | +// Allocates a HuffmanTables with 'size' contiguous HuffmanCodes. Returns 0 on | ||
344 | +// memory allocation error, 1 otherwise. | ||
345 | +int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables); | ||
346 | +void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables); | ||
347 | + | ||
348 | #define HUFFMAN_PACKED_BITS 6 | ||
349 | #define HUFFMAN_PACKED_TABLE_SIZE (1u << HUFFMAN_PACKED_BITS) | ||
350 | |||
351 | @@ -78,9 +101,7 @@ void VP8LHtreeGroupsFree(HTreeGroup* const htree_groups); | ||
352 | // the huffman table. | ||
353 | // Returns built table size or 0 in case of error (invalid tree or | ||
354 | // memory error). | ||
355 | -// If root_table is NULL, it returns 0 if a lookup cannot be built, something | ||
356 | -// > 0 otherwise (but not the table size). | ||
357 | -int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits, | ||
358 | +int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits, | ||
359 | const int code_lengths[], int code_lengths_size); | ||
360 | |||
361 | #ifdef __cplusplus | ||
362 | -- | ||
363 | 2.34.1 | ||
364 | |||
diff --git a/meta/recipes-multimedia/webp/libwebp_1.1.0.bb b/meta/recipes-multimedia/webp/libwebp_1.1.0.bb index f449ae750b..27c5d92c92 100644 --- a/meta/recipes-multimedia/webp/libwebp_1.1.0.bb +++ b/meta/recipes-multimedia/webp/libwebp_1.1.0.bb | |||
@@ -21,6 +21,7 @@ UPSTREAM_CHECK_URI = "http://downloads.webmproject.org/releases/webp/index.html" | |||
21 | 21 | ||
22 | SRC_URI += " \ | 22 | SRC_URI += " \ |
23 | file://CVE-2023-1999.patch \ | 23 | file://CVE-2023-1999.patch \ |
24 | file://CVE-2023-5129.patch \ | ||
24 | " | 25 | " |
25 | 26 | ||
26 | EXTRA_OECONF = " \ | 27 | EXTRA_OECONF = " \ |