summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/libtiff/files/CVE-2017-9935.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-multimedia/libtiff/files/CVE-2017-9935.patch')
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2017-9935.patch160
1 files changed, 160 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2017-9935.patch b/meta/recipes-multimedia/libtiff/files/CVE-2017-9935.patch
new file mode 100644
index 0000000000..60684dd2a6
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2017-9935.patch
@@ -0,0 +1,160 @@
1From abb0055d21c52a9925314d5b0628fb2b6307619c Mon Sep 17 00:00:00 2001
2From: Brian May <brian@linuxpenguins.xyz>
3Date: Thu, 7 Dec 2017 07:46:47 +1100
4Subject: [PATCH] tiff2pdf: Fix CVE-2017-9935
5
6Fix for http://bugzilla.maptools.org/show_bug.cgi?id=2704
7
8This vulnerability - at least for the supplied test case - is because we
9assume that a tiff will only have one transfer function that is the same
10for all pages. This is not required by the TIFF standards.
11
12We than read the transfer function for every page. Depending on the
13transfer function, we allocate either 2 or 4 bytes to the XREF buffer.
14We allocate this memory after we read in the transfer function for the
15page.
16
17For the first exploit - POC1, this file has 3 pages. For the first page
18we allocate 2 extra extra XREF entries. Then for the next page 2 more
19entries. Then for the last page the transfer function changes and we
20allocate 4 more entries.
21
22When we read the file into memory, we assume we have 4 bytes extra for
23each and every page (as per the last transfer function we read). Which
24is not correct, we only have 2 bytes extra for the first 2 pages. As a
25result, we end up writing past the end of the buffer.
26
27There are also some related issues that this also fixes. For example,
28TIFFGetField can return uninitalized pointer values, and the logic to
29detect a N=3 vs N=1 transfer function seemed rather strange.
30
31It is also strange that we declare the transfer functions to be of type
32float, when the standard says they are unsigned 16 bit values. This is
33fixed in another patch.
34
35This patch will check to ensure that the N value for every transfer
36function is the same for every page. If this changes, we abort with an
37error. In theory, we should perhaps check that the transfer function
38itself is identical for every page, however we don't do that due to the
39confusion of the type of the data in the transfer function.
40
41Upstream-Status: Backport
42[https://gitlab.com/libtiff/libtiff/commit/3dd8f6a357981a4090f126ab9025056c938b6940]
43
44CVE: CVE-2017-9935
45
46Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
47---
48 libtiff/tif_dir.c | 3 +++
49 tools/tiff2pdf.c | 65 +++++++++++++++++++++++++++++++++++++------------------
50 2 files changed, 47 insertions(+), 21 deletions(-)
51
52diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
53index f00f808..c36a5f3 100644
54--- a/libtiff/tif_dir.c
55+++ b/libtiff/tif_dir.c
56@@ -1067,6 +1067,9 @@ _TIFFVGetField(TIFF* tif, uint32 tag, va_list ap)
57 if (td->td_samplesperpixel - td->td_extrasamples > 1) {
58 *va_arg(ap, uint16**) = td->td_transferfunction[1];
59 *va_arg(ap, uint16**) = td->td_transferfunction[2];
60+ } else {
61+ *va_arg(ap, uint16**) = NULL;
62+ *va_arg(ap, uint16**) = NULL;
63 }
64 break;
65 case TIFFTAG_REFERENCEBLACKWHITE:
66diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
67index 454befb..0b5973e 100644
68--- a/tools/tiff2pdf.c
69+++ b/tools/tiff2pdf.c
70@@ -1047,6 +1047,8 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
71 uint16 pagen=0;
72 uint16 paged=0;
73 uint16 xuint16=0;
74+ uint16 tiff_transferfunctioncount=0;
75+ float* tiff_transferfunction[3];
76
77 directorycount=TIFFNumberOfDirectories(input);
78 t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE)));
79@@ -1147,26 +1149,48 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
80 }
81 #endif
82 if (TIFFGetField(input, TIFFTAG_TRANSFERFUNCTION,
83- &(t2p->tiff_transferfunction[0]),
84- &(t2p->tiff_transferfunction[1]),
85- &(t2p->tiff_transferfunction[2]))) {
86- if((t2p->tiff_transferfunction[1] != (float*) NULL) &&
87- (t2p->tiff_transferfunction[2] != (float*) NULL) &&
88- (t2p->tiff_transferfunction[1] !=
89- t2p->tiff_transferfunction[0])) {
90- t2p->tiff_transferfunctioncount = 3;
91- t2p->tiff_pages[i].page_extra += 4;
92- t2p->pdf_xrefcount += 4;
93- } else {
94- t2p->tiff_transferfunctioncount = 1;
95- t2p->tiff_pages[i].page_extra += 2;
96- t2p->pdf_xrefcount += 2;
97- }
98- if(t2p->pdf_minorversion < 2)
99- t2p->pdf_minorversion = 2;
100+ &(tiff_transferfunction[0]),
101+ &(tiff_transferfunction[1]),
102+ &(tiff_transferfunction[2]))) {
103+
104+ if((tiff_transferfunction[1] != (float*) NULL) &&
105+ (tiff_transferfunction[2] != (float*) NULL)
106+ ) {
107+ tiff_transferfunctioncount=3;
108+ } else {
109+ tiff_transferfunctioncount=1;
110+ }
111 } else {
112- t2p->tiff_transferfunctioncount=0;
113+ tiff_transferfunctioncount=0;
114 }
115+
116+ if (i > 0){
117+ if (tiff_transferfunctioncount != t2p->tiff_transferfunctioncount){
118+ TIFFError(
119+ TIFF2PDF_MODULE,
120+ "Different transfer function on page %d",
121+ i);
122+ t2p->t2p_error = T2P_ERR_ERROR;
123+ return;
124+ }
125+ }
126+
127+ t2p->tiff_transferfunctioncount = tiff_transferfunctioncount;
128+ t2p->tiff_transferfunction[0] = tiff_transferfunction[0];
129+ t2p->tiff_transferfunction[1] = tiff_transferfunction[1];
130+ t2p->tiff_transferfunction[2] = tiff_transferfunction[2];
131+ if(tiff_transferfunctioncount == 3){
132+ t2p->tiff_pages[i].page_extra += 4;
133+ t2p->pdf_xrefcount += 4;
134+ if(t2p->pdf_minorversion < 2)
135+ t2p->pdf_minorversion = 2;
136+ } else if (tiff_transferfunctioncount == 1){
137+ t2p->tiff_pages[i].page_extra += 2;
138+ t2p->pdf_xrefcount += 2;
139+ if(t2p->pdf_minorversion < 2)
140+ t2p->pdf_minorversion = 2;
141+ }
142+
143 if( TIFFGetField(
144 input,
145 TIFFTAG_ICCPROFILE,
146@@ -1828,9 +1852,8 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){
147 &(t2p->tiff_transferfunction[1]),
148 &(t2p->tiff_transferfunction[2]))) {
149 if((t2p->tiff_transferfunction[1] != (float*) NULL) &&
150- (t2p->tiff_transferfunction[2] != (float*) NULL) &&
151- (t2p->tiff_transferfunction[1] !=
152- t2p->tiff_transferfunction[0])) {
153+ (t2p->tiff_transferfunction[2] != (float*) NULL)
154+ ) {
155 t2p->tiff_transferfunctioncount=3;
156 } else {
157 t2p->tiff_transferfunctioncount=1;
158--
1592.7.4
160
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-22 22:00:06 +0000