libs/tiff/patches/109-CVE.patch

   1 commit 6d3ef98b2415b2edfa36a5ba600d5a824c094309
   2 Author: erouault <erouault>
   3 Date:   Sat Dec 3 14:42:40 2016 +0000
   4
   5     * tools/tiffcp.c: avoid potential division by zero if BitsPerSamples tag is
   6     missing.
   7     Reported by Agostino Sarubbo.
   8     Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2597
   9
  10 diff --git a/ChangeLog b/ChangeLog
  11 index e41d00c..0d7b12d 100644
  12 --- a/ChangeLog
  13 +++ b/ChangeLog
  14 @@ -1,5 +1,12 @@
  15  2016-12-03 Even Rouault <even.rouault at spatialys.com>
  16
  17 +       * tools/tiffcp.c: avoid potential division by zero if BitsPerSamples tag is
  18 +       missing.
  19 +       Reported by Agostino Sarubbo.
  20 +       Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2597
  21 +
  22 +2016-12-03 Even Rouault <even.rouault at spatialys.com>
  23 +
  24         * tools/tiffinfo.c: fix null pointer dereference in -r mode when the image has
  25         no StripByteCount tag.
  26         Reported by Agostino Sarubbo.
  27 diff --git a/tools/tiffcp.c b/tools/tiffcp.c
  28 index 6dfb9a9..c8e48c3 100644
  29 --- a/tools/tiffcp.c
  30 +++ b/tools/tiffcp.c
  31 @@ -1,4 +1,4 @@
  32 -/* $Id: tiffcp.c,v 1.56 2016-12-02 22:13:32 erouault Exp $ */
  33 +/* $Id: tiffcp.c,v 1.57 2016-12-03 14:42:40 erouault Exp $ */
  34
  35  /*
  36   * Copyright (c) 1988-1997 Sam Leffler
  37 @@ -1378,7 +1378,7 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
  38         uint8* bufp = (uint8*) buf;
  39         uint32 tw, tl;
  40         uint32 row;
  41 -       uint16 bps, bytes_per_sample;
  42 +       uint16 bps = 0, bytes_per_sample;
  43
  44         tilebuf = _TIFFmalloc(tilesize);
  45         if (tilebuf == 0)
  46 @@ -1387,6 +1387,12 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
  47         (void) TIFFGetField(in, TIFFTAG_TILEWIDTH, &tw);
  48         (void) TIFFGetField(in, TIFFTAG_TILELENGTH, &tl);
  49         (void) TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps);
  50 +        if( bps == 0 )
  51 +        {
  52 +            TIFFError(TIFFFileName(in), "Error, cannot read BitsPerSample");
  53 +            status = 0;
  54 +            goto done;
  55 +        }
  56         assert( bps % 8 == 0 );
  57         bytes_per_sample = bps/8;
  58