libs/tiff/patches/103-CVE.patch

   1 commit c533d200ecc45e00892a94f9bb2e762a5aa0b2ce
   2 Author: erouault <erouault>
   3 Date:   Sat Dec 3 11:02:15 2016 +0000
   4
   5     * libtiff/tif_dirread.c: modify ChopUpSingleUncompressedStrip() to
   6     instanciate compute ntrips as TIFFhowmany_32(td->td_imagelength, rowsperstrip),
   7     instead of a logic based on the total size of data. Which is faulty is
   8     the total size of data is not sufficient to fill the whole image, and thus
   9     results in reading outside of the StripByCounts/StripOffsets arrays when
  10     using TIFFReadScanline().
  11     Reported by Agostino Sarubbo.
  12     Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2608.
  13
  14     * libtiff/tif_strip.c: revert the change in TIFFNumberOfStrips() done
  15     for http://bugzilla.maptools.org/show_bug.cgi?id=2587 / CVE-2016-9273 since
  16     the above change is a better fix that makes it unnecessary.
  17
  18 diff --git a/ChangeLog b/ChangeLog
  19 index 93c01f8..9dbc7a0 100644
  20 --- a/ChangeLog
  21 +++ b/ChangeLog
  22 @@ -1,5 +1,20 @@
  23  2016-12-03 Even Rouault <even.rouault at spatialys.com>
  24
  25 +       * libtiff/tif_dirread.c: modify ChopUpSingleUncompressedStrip() to
  26 +       instanciate compute ntrips as TIFFhowmany_32(td->td_imagelength, rowsperstrip),
  27 +       instead of a logic based on the total size of data. Which is faulty is
  28 +       the total size of data is not sufficient to fill the whole image, and thus
  29 +       results in reading outside of the StripByCounts/StripOffsets arrays when
  30 +       using TIFFReadScanline().
  31 +       Reported by Agostino Sarubbo.
  32 +       Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2608.
  33 +
  34 +       * libtiff/tif_strip.c: revert the change in TIFFNumberOfStrips() done
  35 +       for http://bugzilla.maptools.org/show_bug.cgi?id=2587 / CVE-2016-9273 since
  36 +       the above change is a better fix that makes it unnecessary.
  37 +
  38 +2016-12-03 Even Rouault <even.rouault at spatialys.com>
  39 +
  40         * libtiff/tif_pixarlog.c, libtiff/tif_luv.c: fix heap-based buffer
  41         overflow on generation of PixarLog / LUV compressed files, with
  42         ColorMap, TransferFunction attached and nasty plays with bitspersample.
  43 diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
  44 index 01070f2..f290528 100644
  45 --- a/libtiff/tif_dirread.c
  46 +++ b/libtiff/tif_dirread.c
  47 @@ -1,4 +1,4 @@
  48 -/* $Id: tif_dirread.c,v 1.204 2016-11-16 15:14:15 erouault Exp $ */
  49 +/* $Id: tif_dirread.c,v 1.205 2016-12-03 11:02:15 erouault Exp $ */
  50
  51  /*
  52   * Copyright (c) 1988-1997 Sam Leffler
  53 @@ -5502,8 +5502,7 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
  54         uint64 rowblockbytes;
  55         uint64 stripbytes;
  56         uint32 strip;
  57 -       uint64 nstrips64;
  58 -       uint32 nstrips32;
  59 +       uint32 nstrips;
  60         uint32 rowsperstrip;
  61         uint64* newcounts;
  62         uint64* newoffsets;
  63 @@ -5534,18 +5533,17 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
  64             return;
  65
  66         /*
  67 -        * never increase the number of strips in an image
  68 +        * never increase the number of rows per strip
  69          */
  70         if (rowsperstrip >= td->td_rowsperstrip)
  71                 return;
  72 -       nstrips64 = TIFFhowmany_64(bytecount, stripbytes);
  73 -       if ((nstrips64==0)||(nstrips64>0xFFFFFFFF)) /* something is wonky, do nothing. */
  74 -           return;
  75 -       nstrips32 = (uint32)nstrips64;
  76 +        nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
  77 +        if( nstrips == 0 )
  78 +            return;
  79
  80 -       newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
  81 +       newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
  82                                 "for chopped \"StripByteCounts\" array");
  83 -       newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
  84 +       newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
  85                                 "for chopped \"StripOffsets\" array");
  86         if (newcounts == NULL || newoffsets == NULL) {
  87                 /*
  88 @@ -5562,18 +5560,18 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
  89          * Fill the strip information arrays with new bytecounts and offsets
  90          * that reflect the broken-up format.
  91          */
  92 -       for (strip = 0; strip < nstrips32; strip++) {
  93 +       for (strip = 0; strip < nstrips; strip++) {
  94                 if (stripbytes > bytecount)
  95                         stripbytes = bytecount;
  96                 newcounts[strip] = stripbytes;
  97 -               newoffsets[strip] = offset;
  98 +               newoffsets[strip] = stripbytes ? offset : 0;
  99                 offset += stripbytes;
 100                 bytecount -= stripbytes;
 101         }
 102         /*
 103          * Replace old single strip info with multi-strip info.
 104          */
 105 -       td->td_stripsperimage = td->td_nstrips = nstrips32;
 106 +       td->td_stripsperimage = td->td_nstrips = nstrips;
 107         TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
 108
 109         _TIFFfree(td->td_stripbytecount);
 110 diff --git a/libtiff/tif_strip.c b/libtiff/tif_strip.c
 111 index b6098dd..6e9f2ef 100644
 112 --- a/libtiff/tif_strip.c
 113 +++ b/libtiff/tif_strip.c
 114 @@ -1,4 +1,4 @@
 115 -/* $Id: tif_strip.c,v 1.37 2016-11-09 23:00:49 erouault Exp $ */
 116 +/* $Id: tif_strip.c,v 1.38 2016-12-03 11:02:15 erouault Exp $ */
 117
 118  /*
 119   * Copyright (c) 1991-1997 Sam Leffler
 120 @@ -63,15 +63,6 @@ TIFFNumberOfStrips(TIFF* tif)
 121         TIFFDirectory *td = &tif->tif_dir;
 122         uint32 nstrips;
 123
 124 -    /* If the value was already computed and store in td_nstrips, then return it,
 125 -       since ChopUpSingleUncompressedStrip might have altered and resized the
 126 -       since the td_stripbytecount and td_stripoffset arrays to the new value
 127 -       after the initial affectation of td_nstrips = TIFFNumberOfStrips() in
 128 -       tif_dirread.c ~line 3612.
 129 -       See http://bugzilla.maptools.org/show_bug.cgi?id=2587 */
 130 -    if( td->td_nstrips )
 131 -        return td->td_nstrips;
 132 -
 133         nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
 134              TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
 135         if (td->td_planarconfig == PLANARCONFIG_SEPARATE)