summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-multimedia/libtiff/files/0001-fix-the-FPE-in-tiffcrop-415-427-and-428.patch184
-rw-r--r--meta/recipes-multimedia/libtiff/tiff_4.4.0.bb3
2 files changed, 186 insertions, 1 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/0001-fix-the-FPE-in-tiffcrop-415-427-and-428.patch b/meta/recipes-multimedia/libtiff/files/0001-fix-the-FPE-in-tiffcrop-415-427-and-428.patch
new file mode 100644
index 0000000000..c7c5f616ed
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/0001-fix-the-FPE-in-tiffcrop-415-427-and-428.patch
@@ -0,0 +1,184 @@
1CVE: CVE-2022-2056 CVE-2022-2057 CVE-2022-2058
2Upstream-Status: Backport
3Signed-off-by: Ross Burton <ross.burton@arm.com>
4
5From 22a205da86ca2d038d0066e1d70752d117258fb4 Mon Sep 17 00:00:00 2001
6From: 4ugustus <wangdw.augustus@qq.com>
7Date: Sat, 11 Jun 2022 09:31:43 +0000
8Subject: [PATCH] fix the FPE in tiffcrop (#415, #427, and #428)
9
10---
11 libtiff/tif_aux.c | 9 +++++++
12 libtiff/tiffiop.h | 1 +
13 tools/tiffcrop.c | 62 ++++++++++++++++++++++++++---------------------
14 3 files changed, 44 insertions(+), 28 deletions(-)
15
16diff --git a/libtiff/tif_aux.c b/libtiff/tif_aux.c
17index 140f26c7..5b88c8d0 100644
18--- a/libtiff/tif_aux.c
19+++ b/libtiff/tif_aux.c
20@@ -402,6 +402,15 @@ float _TIFFClampDoubleToFloat( double val )
21 return (float)val;
22 }
23
24+uint32_t _TIFFClampDoubleToUInt32(double val)
25+{
26+ if( val < 0 )
27+ return 0;
28+ if( val > 0xFFFFFFFFU || val != val )
29+ return 0xFFFFFFFFU;
30+ return (uint32_t)val;
31+}
32+
33 int _TIFFSeekOK(TIFF* tif, toff_t off)
34 {
35 /* Huge offsets, especially -1 / UINT64_MAX, can cause issues */
36diff --git a/libtiff/tiffiop.h b/libtiff/tiffiop.h
37index e3af461d..4e8bdac2 100644
38--- a/libtiff/tiffiop.h
39+++ b/libtiff/tiffiop.h
40@@ -365,6 +365,7 @@ extern double _TIFFUInt64ToDouble(uint64_t);
41 extern float _TIFFUInt64ToFloat(uint64_t);
42
43 extern float _TIFFClampDoubleToFloat(double);
44+extern uint32_t _TIFFClampDoubleToUInt32(double);
45
46 extern tmsize_t
47 _TIFFReadEncodedStripAndAllocBuffer(TIFF* tif, uint32_t strip,
48diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
49index 1f827b2b..90286a5e 100644
50--- a/tools/tiffcrop.c
51+++ b/tools/tiffcrop.c
52@@ -5268,17 +5268,17 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image,
53 {
54 if ((crop->res_unit == RESUNIT_INCH) || (crop->res_unit == RESUNIT_CENTIMETER))
55 {
56- x1 = (uint32_t) (crop->corners[i].X1 * scale * xres);
57- x2 = (uint32_t) (crop->corners[i].X2 * scale * xres);
58- y1 = (uint32_t) (crop->corners[i].Y1 * scale * yres);
59- y2 = (uint32_t) (crop->corners[i].Y2 * scale * yres);
60+ x1 = _TIFFClampDoubleToUInt32(crop->corners[i].X1 * scale * xres);
61+ x2 = _TIFFClampDoubleToUInt32(crop->corners[i].X2 * scale * xres);
62+ y1 = _TIFFClampDoubleToUInt32(crop->corners[i].Y1 * scale * yres);
63+ y2 = _TIFFClampDoubleToUInt32(crop->corners[i].Y2 * scale * yres);
64 }
65 else
66 {
67- x1 = (uint32_t) (crop->corners[i].X1);
68- x2 = (uint32_t) (crop->corners[i].X2);
69- y1 = (uint32_t) (crop->corners[i].Y1);
70- y2 = (uint32_t) (crop->corners[i].Y2);
71+ x1 = _TIFFClampDoubleToUInt32(crop->corners[i].X1);
72+ x2 = _TIFFClampDoubleToUInt32(crop->corners[i].X2);
73+ y1 = _TIFFClampDoubleToUInt32(crop->corners[i].Y1);
74+ y2 = _TIFFClampDoubleToUInt32(crop->corners[i].Y2);
75 }
76 /* a) Region needs to be within image sizes 0.. width-1; 0..length-1
77 * b) Corners are expected to be submitted as top-left to bottom-right.
78@@ -5357,17 +5357,17 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image,
79 {
80 if (crop->res_unit != RESUNIT_INCH && crop->res_unit != RESUNIT_CENTIMETER)
81 { /* User has specified pixels as reference unit */
82- tmargin = (uint32_t)(crop->margins[0]);
83- lmargin = (uint32_t)(crop->margins[1]);
84- bmargin = (uint32_t)(crop->margins[2]);
85- rmargin = (uint32_t)(crop->margins[3]);
86+ tmargin = _TIFFClampDoubleToUInt32(crop->margins[0]);
87+ lmargin = _TIFFClampDoubleToUInt32(crop->margins[1]);
88+ bmargin = _TIFFClampDoubleToUInt32(crop->margins[2]);
89+ rmargin = _TIFFClampDoubleToUInt32(crop->margins[3]);
90 }
91 else
92 { /* inches or centimeters specified */
93- tmargin = (uint32_t)(crop->margins[0] * scale * yres);
94- lmargin = (uint32_t)(crop->margins[1] * scale * xres);
95- bmargin = (uint32_t)(crop->margins[2] * scale * yres);
96- rmargin = (uint32_t)(crop->margins[3] * scale * xres);
97+ tmargin = _TIFFClampDoubleToUInt32(crop->margins[0] * scale * yres);
98+ lmargin = _TIFFClampDoubleToUInt32(crop->margins[1] * scale * xres);
99+ bmargin = _TIFFClampDoubleToUInt32(crop->margins[2] * scale * yres);
100+ rmargin = _TIFFClampDoubleToUInt32(crop->margins[3] * scale * xres);
101 }
102
103 if ((lmargin + rmargin) > image->width)
104@@ -5397,24 +5397,24 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image,
105 if (crop->res_unit != RESUNIT_INCH && crop->res_unit != RESUNIT_CENTIMETER)
106 {
107 if (crop->crop_mode & CROP_WIDTH)
108- width = (uint32_t)crop->width;
109+ width = _TIFFClampDoubleToUInt32(crop->width);
110 else
111 width = image->width - lmargin - rmargin;
112
113 if (crop->crop_mode & CROP_LENGTH)
114- length = (uint32_t)crop->length;
115+ length = _TIFFClampDoubleToUInt32(crop->length);
116 else
117 length = image->length - tmargin - bmargin;
118 }
119 else
120 {
121 if (crop->crop_mode & CROP_WIDTH)
122- width = (uint32_t)(crop->width * scale * image->xres);
123+ width = _TIFFClampDoubleToUInt32(crop->width * scale * image->xres);
124 else
125 width = image->width - lmargin - rmargin;
126
127 if (crop->crop_mode & CROP_LENGTH)
128- length = (uint32_t)(crop->length * scale * image->yres);
129+ length = _TIFFClampDoubleToUInt32(crop->length * scale * image->yres);
130 else
131 length = image->length - tmargin - bmargin;
132 }
133@@ -5868,13 +5868,13 @@ computeOutputPixelOffsets (struct crop_mask *crop, struct image_data *image,
134 {
135 if (page->res_unit == RESUNIT_INCH || page->res_unit == RESUNIT_CENTIMETER)
136 { /* inches or centimeters specified */
137- hmargin = (uint32_t)(page->hmargin * scale * page->hres * ((image->bps + 7) / 8));
138- vmargin = (uint32_t)(page->vmargin * scale * page->vres * ((image->bps + 7) / 8));
139+ hmargin = _TIFFClampDoubleToUInt32(page->hmargin * scale * page->hres * ((image->bps + 7) / 8));
140+ vmargin = _TIFFClampDoubleToUInt32(page->vmargin * scale * page->vres * ((image->bps + 7) / 8));
141 }
142 else
143 { /* Otherwise user has specified pixels as reference unit */
144- hmargin = (uint32_t)(page->hmargin * scale * ((image->bps + 7) / 8));
145- vmargin = (uint32_t)(page->vmargin * scale * ((image->bps + 7) / 8));
146+ hmargin = _TIFFClampDoubleToUInt32(page->hmargin * scale * ((image->bps + 7) / 8));
147+ vmargin = _TIFFClampDoubleToUInt32(page->vmargin * scale * ((image->bps + 7) / 8));
148 }
149
150 if ((hmargin * 2.0) > (pwidth * page->hres))
151@@ -5912,13 +5912,13 @@ computeOutputPixelOffsets (struct crop_mask *crop, struct image_data *image,
152 {
153 if (page->mode & PAGE_MODE_PAPERSIZE )
154 {
155- owidth = (uint32_t)((pwidth * page->hres) - (hmargin * 2));
156- olength = (uint32_t)((plength * page->vres) - (vmargin * 2));
157+ owidth = _TIFFClampDoubleToUInt32((pwidth * page->hres) - (hmargin * 2));
158+ olength = _TIFFClampDoubleToUInt32((plength * page->vres) - (vmargin * 2));
159 }
160 else
161 {
162- owidth = (uint32_t)(iwidth - (hmargin * 2 * page->hres));
163- olength = (uint32_t)(ilength - (vmargin * 2 * page->vres));
164+ owidth = _TIFFClampDoubleToUInt32(iwidth - (hmargin * 2 * page->hres));
165+ olength = _TIFFClampDoubleToUInt32(ilength - (vmargin * 2 * page->vres));
166 }
167 }
168
169@@ -5927,6 +5927,12 @@ computeOutputPixelOffsets (struct crop_mask *crop, struct image_data *image,
170 if (olength > ilength)
171 olength = ilength;
172
173+ if (owidth == 0 || olength == 0)
174+ {
175+ TIFFError("computeOutputPixelOffsets", "Integer overflow when calculating the number of pages");
176+ exit(EXIT_FAILURE);
177+ }
178+
179 /* Compute the number of pages required for Portrait or Landscape */
180 switch (page->orient)
181 {
182--
1832.34.1
184
diff --git a/meta/recipes-multimedia/libtiff/tiff_4.4.0.bb b/meta/recipes-multimedia/libtiff/tiff_4.4.0.bb
index c82965ffa1..0af956a8f0 100644
--- a/meta/recipes-multimedia/libtiff/tiff_4.4.0.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.4.0.bb
@@ -8,7 +8,8 @@ LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=34da3db46fab7501992f9615d7e158cf"
8 8
9CVE_PRODUCT = "libtiff" 9CVE_PRODUCT = "libtiff"
10 10
11SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz" 11SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
12 file://0001-fix-the-FPE-in-tiffcrop-415-427-and-428.patch"
12 13
13SRC_URI[sha256sum] = "917223b37538959aca3b790d2d73aa6e626b688e02dcda272aec24c2f498abed" 14SRC_URI[sha256sum] = "917223b37538959aca3b790d2d73aa6e626b688e02dcda272aec24c2f498abed"
14 15
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-03 12:39:45 +0000