Backport of: From de7bfd7d4377c266f81849579f696fa1ad5ba6c3 Mon Sep 17 00:00:00 2001 From: Even Rouault Date: Tue, 31 Oct 2023 20:13:45 +0100 Subject: [PATCH] TIFFFetchDirectory(): remove useless allocsize vs filesize check CoverityScan rightly points that the max value for dircount16 * dirsize is 4096 * 20. That's small enough not to do any check Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/tiff/tree/debian/patches/CVE-2023-6277-3.patch?h=ubuntu/focal-security Upstream commit https://gitlab.com/libtiff/libtiff/-/commit/de7bfd7d4377c266f81849579f696fa1ad5ba6c3] CVE: CVE-2023-6277 Signed-off-by: Vijay Anusuri --- libtiff/tif_dirread.c | 18 ------------------ 1 file changed, 18 deletions(-) --- tiff-4.1.0+git191117.orig/libtiff/tif_dirread.c +++ tiff-4.1.0+git191117/libtiff/tif_dirread.c @@ -4891,24 +4891,6 @@ TIFFFetchDirectory(TIFF* tif, uint64 dir dircount16 = (uint16)dircount64; dirsize = 20; } - const uint64 allocsize = (uint64)dircount16 * dirsize; - if (allocsize > 100 * 1024 * 1024) - { - /* Before allocating a huge amount of memory for corrupted files, - * check if size of requested memory is not greater than file size. - */ - const uint64 filesize = TIFFGetFileSize(tif); - if (allocsize > filesize) - { - TIFFWarningExt( - tif->tif_clientdata, module, - "Requested memory size for TIFF directory of %" PRIu64 - " is greater than filesize %" PRIu64 - ". Memory not allocated, TIFF directory not read", - allocsize, filesize); - return 0; - } - } origdir = _TIFFCheckMalloc(tif, dircount16, dirsize, "to read TIFF directory"); if (origdir == NULL)