libs/tiff/patches/111-CVE.patch

   1 commit 307a31765cb01245e3655ce168385dd7d51e14bd
   2 Author: erouault <erouault>
   3 Date:   Sat Dec 3 15:44:15 2016 +0000
   4
   5     * tools/tiffcp.c: avoid potential division by zero if BitsPerSamples tag is
   6     missing.
   7     Reported by Agostino Sarubbo.
   8     Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2607
   9
  10 diff --git a/ChangeLog b/ChangeLog
  11 index ac2d922..94be038 100644
  12 --- a/ChangeLog
  13 +++ b/ChangeLog
  14 @@ -1,5 +1,12 @@
  15  2016-12-03 Even Rouault <even.rouault at spatialys.com>
  16
  17 +       * tools/tiffcp.c: avoid potential division by zero if BitsPerSamples tag is
  18 +       missing.
  19 +       Reported by Agostino Sarubbo.
  20 +       Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2607
  21 +
  22 +2016-12-03 Even Rouault <even.rouault at spatialys.com>
  23 +
  24         * tools/tif_dir.c: when TIFFGetField(, TIFFTAG_NUMBEROFINKS, ) is called,
  25         limit the return number of inks to SamplesPerPixel, so that code that parses
  26         ink names doesn't go past the end of the buffer.
  27 diff --git a/tools/tiffcp.c b/tools/tiffcp.c
  28 index c8e48c3..142cbb0 100644
  29 --- a/tools/tiffcp.c
  30 +++ b/tools/tiffcp.c
  31 @@ -1,4 +1,4 @@
  32 -/* $Id: tiffcp.c,v 1.57 2016-12-03 14:42:40 erouault Exp $ */
  33 +/* $Id: tiffcp.c,v 1.58 2016-12-03 15:44:15 erouault Exp $ */
  34
  35  /*
  36   * Copyright (c) 1988-1997 Sam Leffler
  37 @@ -1569,7 +1569,7 @@ DECLAREwriteFunc(writeBufferToSeparateTiles)
  38         uint8* bufp = (uint8*) buf;
  39         uint32 tl, tw;
  40         uint32 row;
  41 -       uint16 bps, bytes_per_sample;
  42 +       uint16 bps = 0, bytes_per_sample;
  43
  44         obuf = _TIFFmalloc(TIFFTileSize(out));
  45         if (obuf == NULL)
  46 @@ -1578,6 +1578,12 @@ DECLAREwriteFunc(writeBufferToSeparateTiles)
  47         (void) TIFFGetField(out, TIFFTAG_TILELENGTH, &tl);
  48         (void) TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw);
  49         (void) TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps);
  50 +        if( bps == 0 )
  51 +        {
  52 +            TIFFError(TIFFFileName(out), "Error, cannot read BitsPerSample");
  53 +            _TIFFfree(obuf);
  54 +            return 0;
  55 +        }
  56         assert( bps % 8 == 0 );
  57         bytes_per_sample = bps/8;
  58