libs/tiff/patches/101-CVE.patch

   1 commit b412777317cabbf8ed89ca38fb180991cca89b8c
   2 Author: erouault <erouault>
   3 Date:   Fri Dec 2 22:13:32 2016 +0000
   4
   5     * tools/tiffcp.c: avoid uint32 underflow in cpDecodedStrips that
   6     can cause various issues, such as buffer overflows in the library.
   7     Reported by Agostino Sarubbo.
   8     Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2598
   9
  10 diff --git a/ChangeLog b/ChangeLog
  11 index 668b66a..0f154d6 100644
  12 --- a/ChangeLog
  13 +++ b/ChangeLog
  14 @@ -1,5 +1,12 @@
  15  2016-12-02 Even Rouault <even.rouault at spatialys.com>
  16
  17 +       * tools/tiffcp.c: avoid uint32 underflow in cpDecodedStrips that
  18 +       can cause various issues, such as buffer overflows in the library.
  19 +       Reported by Agostino Sarubbo.
  20 +       Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2598
  21 +
  22 +2016-12-02 Even Rouault <even.rouault at spatialys.com>
  23 +
  24         * libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow in
  25         TIFFReadEncodedStrip() that caused an integer division by zero.
  26         Reported by Agostino Sarubbo.
  27 diff --git a/tools/tiffcp.c b/tools/tiffcp.c
  28 index 338a3d1..6dfb9a9 100644
  29 --- a/tools/tiffcp.c
  30 +++ b/tools/tiffcp.c
  31 @@ -1,4 +1,4 @@
  32 -/* $Id: tiffcp.c,v 1.55 2016-10-08 15:54:57 erouault Exp $ */
  33 +/* $Id: tiffcp.c,v 1.56 2016-12-02 22:13:32 erouault Exp $ */
  34
  35  /*
  36   * Copyright (c) 1988-1997 Sam Leffler
  37 @@ -985,7 +985,7 @@ DECLAREcpFunc(cpDecodedStrips)
  38                 tstrip_t s, ns = TIFFNumberOfStrips(in);
  39                 uint32 row = 0;
  40                 _TIFFmemset(buf, 0, stripsize);
  41 -               for (s = 0; s < ns; s++) {
  42 +               for (s = 0; s < ns && row < imagelength; s++) {
  43                         tsize_t cc = (row + rowsperstrip > imagelength) ?
  44                             TIFFVStripSize(in, imagelength - row) : stripsize;
  45                         if (TIFFReadEncodedStrip(in, s, buf, cc) < 0