libs/tiff/patches/104-CVE.patch

   1 commit 43576568ed4af4bd43409b7ff36939340141dfd6
   2 Author: erouault <erouault>
   3 Date:   Sat Dec 3 11:15:18 2016 +0000
   4
   5     * libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of failure in
   6     OJPEGPreDecode(). This will avoid a divide by zero, and potential other issues.
   7     Reported by Agostino Sarubbo.
   8     Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2611
   9
  10 diff --git a/ChangeLog b/ChangeLog
  11 index 9dbc7a0..5b23665 100644
  12 --- a/ChangeLog
  13 +++ b/ChangeLog
  14 @@ -1,5 +1,12 @@
  15  2016-12-03 Even Rouault <even.rouault at spatialys.com>
  16
  17 +       * libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of failure in
  18 +       OJPEGPreDecode(). This will avoid a divide by zero, and potential other issues.
  19 +       Reported by Agostino Sarubbo.
  20 +       Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2611
  21 +
  22 +2016-12-03 Even Rouault <even.rouault at spatialys.com>
  23 +
  24         * libtiff/tif_dirread.c: modify ChopUpSingleUncompressedStrip() to
  25         instanciate compute ntrips as TIFFhowmany_32(td->td_imagelength, rowsperstrip),
  26         instead of a logic based on the total size of data. Which is faulty is
  27 diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
  28 index 30a1812..93839d8 100644
  29 --- a/libtiff/tif_ojpeg.c
  30 +++ b/libtiff/tif_ojpeg.c
  31 @@ -1,4 +1,4 @@
  32 -/* $Id: tif_ojpeg.c,v 1.65 2016-09-04 21:32:56 erouault Exp $ */
  33 +/* $Id: tif_ojpeg.c,v 1.66 2016-12-03 11:15:18 erouault Exp $ */
  34
  35  /* WARNING: The type of JPEG encapsulation defined by the TIFF Version 6.0
  36     specification is now totally obsolete and deprecated for new applications and
  37 @@ -244,6 +244,7 @@ typedef enum {
  38
  39  typedef struct {
  40         TIFF* tif;
  41 +        int decoder_ok;
  42         #ifndef LIBJPEG_ENCAP_EXTERNAL
  43         JMP_BUF exit_jmpbuf;
  44         #endif
  45 @@ -722,6 +723,7 @@ OJPEGPreDecode(TIFF* tif, uint16 s)
  46                 }
  47                 sp->write_curstrile++;
  48         }
  49 +       sp->decoder_ok = 1;
  50         return(1);
  51  }
  52
  53 @@ -784,8 +786,14 @@ OJPEGPreDecodeSkipScanlines(TIFF* tif)
  54  static int
  55  OJPEGDecode(TIFF* tif, uint8* buf, tmsize_t cc, uint16 s)
  56  {
  57 +        static const char module[]="OJPEGDecode";
  58         OJPEGState* sp=(OJPEGState*)tif->tif_data;
  59         (void)s;
  60 +        if( !sp->decoder_ok )
  61 +        {
  62 +            TIFFErrorExt(tif->tif_clientdata,module,"Cannot decode: decoder not correctly initialized");
  63 +            return 0;
  64 +        }
  65         if (sp->libjpeg_jpeg_query_style==0)
  66         {
  67                 if (OJPEGDecodeRaw(tif,buf,cc)==0)