From dfde5b94e82264ea16a189252d615d67366e3d98 Mon Sep 17 00:00:00 2001 From: Mingli Yu Date: Wed, 7 Dec 2016 16:01:12 +0800 Subject: tiff: Security fix CVE-2016-9538 * tools/tiffcrop.c: fix read of undefined buffer in readContigStripsIntoBuffer() due to uint16 overflow. External References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9538 Patch from: https://github.com/vadz/libtiff/commit/43c0b81a818640429317c80fea1e66771e85024b#diff-c8b4b355f9b5c06d585b23138e1c185f (From OE-Core rev: 9af5d5ea882c853e4cb15006f990d3814eeea9ae) (From OE-Core rev: 33cad1173f6d1b803b794a2ec57fe8a9ef19fb44) Signed-off-by: Mingli Yu Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Sona Sarmadi --- .../libtiff/files/CVE-2016-9538.patch | 67 ++++++++++++++++++++++ meta/recipes-multimedia/libtiff/tiff_4.0.6.bb | 1 + 2 files changed, 68 insertions(+) create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2016-9538.patch diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2016-9538.patch b/meta/recipes-multimedia/libtiff/files/CVE-2016-9538.patch new file mode 100644 index 0000000000..e1141dfb69 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/files/CVE-2016-9538.patch @@ -0,0 +1,67 @@ +From 43c0b81a818640429317c80fea1e66771e85024b Mon Sep 17 00:00:00 2001 +From: erouault +Date: Sat, 8 Oct 2016 15:04:31 +0000 +Subject: [PATCH] Fix CVE-2016-9538 +* tools/tiffcp.c: fix read of undefined variable in case of + missing required tags. Found on test case of MSVR 35100. * tools/tiffcrop.c: + fix read of undefined buffer in readContigStripsIntoBuffer() due to uint16 + overflow. Probably not a security issue but I can be wrong. Reported as MSVR + 35100 by Axel Souchet from the MSRC Vulnerabilities & Mitigations team. + +CVE: CVE-2016-9538 +Upstream-Status: Backport +https://github.com/vadz/libtiff/commit/43c0b81a818640429317c80fea1e66771e85024b#diff-c8b4b355f9b5c06d585b23138e1c185f + +Signed-off-by: Mingli Yu + +--- + tools/tiffcp.c | 4 ++-- + tools/tiffcrop.c | 9 ++++++--- + 2 files changed, 17 insertions(+), 5 deletions(-) + +diff --git a/tools/tiffcp.c b/tools/tiffcp.c +index ba2b715..4ad74d3 100644 +--- a/tools/tiffcp.c ++++ b/tools/tiffcp.c +@@ -592,8 +592,8 @@ static copyFunc pickCopyFunc(TIFF*, TIFF*, uint16, uint16); + static int + tiffcp(TIFF* in, TIFF* out) + { +- uint16 bitspersample, samplesperpixel; +- uint16 input_compression, input_photometric; ++ uint16 bitspersample, samplesperpixel = 1; ++ uint16 input_compression, input_photometric = PHOTOMETRIC_MINISBLACK; + copyFunc cf; + uint32 width, length; + struct cpTag* p; +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index 7685566..eb6de77 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -3628,7 +3628,7 @@ static int readContigStripsIntoBuffer (TIFF* in, uint8* buf) + { + uint8* bufp = buf; + int32 bytes_read = 0; +- uint16 strip, nstrips = TIFFNumberOfStrips(in); ++ uint32 strip, nstrips = TIFFNumberOfStrips(in); + uint32 stripsize = TIFFStripSize(in); + uint32 rows = 0; + uint32 rps = TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rps); +@@ -4711,9 +4711,12 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length, + uint32 width, uint16 spp, + struct dump_opts *dump) + { +- int i, j, bytes_per_sample, bytes_per_pixel, shift_width, result = 1; ++ int i, bytes_per_sample, bytes_per_pixel, shift_width, result = 1; ++ uint32 j; + int32 bytes_read = 0; +- uint16 bps, nstrips, planar, strips_per_sample; ++ uint16 bps, planar; ++ uint32 nstrips; ++ uint32 strips_per_sample; + uint32 src_rowsize, dst_rowsize, rows_processed, rps; + uint32 rows_this_strip = 0; + tsample_t s; +-- +2.9.3 + diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb index 7b5dd9cc91..8521fd7cf0 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb @@ -21,6 +21,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ file://CVE-2016-9539.patch \ file://CVE-2016-9535-1.patch \ file://CVE-2016-9535-2.patch \ + file://CVE-2016-9538.patch \ " SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72" -- cgit v1.2.3-54-g00ecf