libs/tiff/patches/018-CVE-2017-11335.patch

   1 From 69bfeec247899776b1b396651adb47436e5f1556 Mon Sep 17 00:00:00 2001
   2 From: Even Rouault <even.rouault@spatialys.com>
   3 Date: Sat, 15 Jul 2017 11:13:46 +0000
   4 Subject: [PATCH] * tools/tiff2pdf.c: prevent heap buffer overflow write in
   5  "Raw" mode on PlanarConfig=Contig input images. Fixes
   6  http://bugzilla.maptools.org/show_bug.cgi?id=2715 Reported by team OWL337
   7
   8 ---
   9  ChangeLog        | 7 +++++++
  10  tools/tiff2pdf.c | 7 ++++++-
  11  2 files changed, 13 insertions(+), 1 deletion(-)
  12
  13 diff --git a/ChangeLog b/ChangeLog
  14 index b4771234..1b5490f3 100644
  15 --- a/ChangeLog
  16 +++ b/ChangeLog
  17 @@ -1,3 +1,10 @@
  18 +2017-07-15  Even Rouault <even.rouault at spatialys.com>
  19 +
  20 +       * tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
  21 +       mode on PlanarConfig=Contig input images.
  22 +       Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2715
  23 +       Reported by team OWL337
  24 +
  25  2017-07-11  Even Rouault <even.rouault at spatialys.com>
  26
  27         * libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of old-style LZW
  28 diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
  29 index db196e04..cd1e2358 100644
  30 --- a/tools/tiff2pdf.c
  31 +++ b/tools/tiff2pdf.c
  32 @@ -1737,7 +1737,12 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){
  33             return;
  34
  35         t2p->pdf_transcode = T2P_TRANSCODE_ENCODE;
  36 -       if(t2p->pdf_nopassthrough==0){
  37 +        /* It seems that T2P_TRANSCODE_RAW mode doesn't support separate->contig */
  38 +        /* conversion. At least t2p_read_tiff_size and t2p_read_tiff_size_tile */
  39 +        /* do not take into account the number of samples, and thus */
  40 +        /* that can cause heap buffer overflows such as in */
  41 +        /* http://bugzilla.maptools.org/show_bug.cgi?id=2715 */
  42 +       if(t2p->pdf_nopassthrough==0 && t2p->tiff_planar!=PLANARCONFIG_SEPARATE){
  43  #ifdef CCITT_SUPPORT
  44                 if(t2p->tiff_compression==COMPRESSION_CCITTFAX4
  45                         ){