libs/tiff/patches/119-CVE-2017-7596_CVE-2017-7597_CVE-2017-7599_CVE-2017-7600.patch

   1 From 3144e57770c1e4d26520d8abee750f8ac8b75490 Mon Sep 17 00:00:00 2001
   2 From: erouault <erouault>
   3 Date: Wed, 11 Jan 2017 16:09:02 +0000
   4 Subject: [PATCH] * libtiff/tif_dir.c, tif_dirread.c, tif_dirwrite.c: implement
   5  various clampings of double to other data types to avoid undefined behaviour
   6  if the output range isn't big enough to hold the input value. Fixes
   7  http://bugzilla.maptools.org/show_bug.cgi?id=2643
   8  http://bugzilla.maptools.org/show_bug.cgi?id=2642
   9  http://bugzilla.maptools.org/show_bug.cgi?id=2646
  10  http://bugzilla.maptools.org/show_bug.cgi?id=2647
  11
  12 ---
  13  ChangeLog              | 10 ++++++
  14  libtiff/tif_dir.c      | 18 +++++++---
  15  libtiff/tif_dirread.c  | 10 +++++-
  16  libtiff/tif_dirwrite.c | 90 ++++++++++++++++++++++++++++++++++++++++++++------
  17  4 files changed, 113 insertions(+), 15 deletions(-)
  18
  19 diff --git a/ChangeLog b/ChangeLog
  20 index 722a405..6517640 100644
  21 --- a/ChangeLog
  22 +++ b/ChangeLog
  23 @@ -1,5 +1,15 @@
  24  2017-01-11 Even Rouault <even.rouault at spatialys.com>
  25
  26 +       * libtiff/tif_dir.c, tif_dirread.c, tif_dirwrite.c: implement various clampings
  27 +       of double to other data types to avoid undefined behaviour if the output range
  28 +       isn't big enough to hold the input value.
  29 +       Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2643
  30 +       http://bugzilla.maptools.org/show_bug.cgi?id=2642
  31 +       http://bugzilla.maptools.org/show_bug.cgi?id=2646
  32 +       http://bugzilla.maptools.org/show_bug.cgi?id=2647
  33 +
  34 +2017-01-11 Even Rouault <even.rouault at spatialys.com>
  35 +
  36         * libtiff/tif_dirread.c: avoid division by floating point 0 in
  37         TIFFReadDirEntryCheckedRational() and TIFFReadDirEntryCheckedSrational(),
  38         and return 0 in that case (instead of infinity as before presumably)
  39 diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
  40 index 68a55af..a04d28f 100644
  41 --- a/libtiff/tif_dir.c
  42 +++ b/libtiff/tif_dir.c
  43 @@ -31,6 +31,7 @@
  44   * (and also some miscellaneous stuff)
  45   */
  46  #include "tiffiop.h"
  47 +#include <float.h>
  48
  49  /*
  50   * These are used in the backwards compatibility code...
  51 @@ -154,6 +155,15 @@ checkInkNamesString(TIFF* tif, uint32 slen, const char* s)
  52         return (0);
  53  }
  54
  55 +static float TIFFClampDoubleToFloat( double val )
  56 +{
  57 +    if( val > FLT_MAX )
  58 +        return FLT_MAX;
  59 +    if( val < -FLT_MAX )
  60 +        return -FLT_MAX;
  61 +    return (float)val;
  62 +}
  63 +
  64  static int
  65  _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
  66  {
  67 @@ -312,13 +322,13 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
  68          dblval = va_arg(ap, double);
  69          if( dblval < 0 )
  70              goto badvaluedouble;
  71 -               td->td_xresolution = (float) dblval;
  72 +               td->td_xresolution = TIFFClampDoubleToFloat( dblval );
  73                 break;
  74         case TIFFTAG_YRESOLUTION:
  75          dblval = va_arg(ap, double);
  76          if( dblval < 0 )
  77              goto badvaluedouble;
  78 -               td->td_yresolution = (float) dblval;
  79 +               td->td_yresolution = TIFFClampDoubleToFloat( dblval );
  80                 break;
  81         case TIFFTAG_PLANARCONFIG:
  82                 v = (uint16) va_arg(ap, uint16_vap);
  83 @@ -327,10 +337,10 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
  84                 td->td_planarconfig = (uint16) v;
  85                 break;
  86         case TIFFTAG_XPOSITION:
  87 -               td->td_xposition = (float) va_arg(ap, double);
  88 +               td->td_xposition = TIFFClampDoubleToFloat( va_arg(ap, double) );
  89                 break;
  90         case TIFFTAG_YPOSITION:
  91 -               td->td_yposition = (float) va_arg(ap, double);
  92 +               td->td_yposition = TIFFClampDoubleToFloat( va_arg(ap, double) );
  93                 break;
  94         case TIFFTAG_RESOLUTIONUNIT:
  95                 v = (uint16) va_arg(ap, uint16_vap);
  96 diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
  97 index 8a1e42a..77b0f37 100644
  98 --- a/libtiff/tif_dirread.c
  99 +++ b/libtiff/tif_dirread.c
 100 @@ -40,6 +40,7 @@
 101   */
 102
 103  #include "tiffiop.h"
 104 +#include <float.h>
 105
 106  #define IGNORE 0          /* tag placeholder used below */
 107  #define FAILED_FII    ((uint32) -1)
 108 @@ -2406,7 +2407,14 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEnt
 109                                 ma=(double*)origdata;
 110                                 mb=data;
 111                                 for (n=0; n<count; n++)
 112 -                                       *mb++=(float)(*ma++);
 113 +                                {
 114 +                                    double val = *ma++;
 115 +                                    if( val > FLT_MAX )
 116 +                                        val = FLT_MAX;
 117 +                                    else if( val < -FLT_MAX )
 118 +                                        val = -FLT_MAX;
 119 +                                    *mb++=(float)val;
 120 +                                }
 121                         }
 122                         break;
 123         }
 124 diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c
 125 index c9e871b..2967da5 100644
 126 --- a/libtiff/tif_dirwrite.c
 127 +++ b/libtiff/tif_dirwrite.c
 128 @@ -30,6 +30,7 @@
 129   * Directory Write Support Routines.
 130   */
 131  #include "tiffiop.h"
 132 +#include <float.h>
 133
 134  #ifdef HAVE_IEEEFP
 135  #define TIFFCvtNativeToIEEEFloat(tif, n, fp)
 136 @@ -939,6 +940,69 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
 137         return(0);
 138  }
 139
 140 +static float TIFFClampDoubleToFloat( double val )
 141 +{
 142 +    if( val > FLT_MAX )
 143 +        return FLT_MAX;
 144 +    if( val < -FLT_MAX )
 145 +        return -FLT_MAX;
 146 +    return (float)val;
 147 +}
 148 +
 149 +static int8 TIFFClampDoubleToInt8( double val )
 150 +{
 151 +    if( val > 127 )
 152 +        return 127;
 153 +    if( val < -128 || val != val )
 154 +        return -128;
 155 +    return (int8)val;
 156 +}
 157 +
 158 +static int16 TIFFClampDoubleToInt16( double val )
 159 +{
 160 +    if( val > 32767 )
 161 +        return 32767;
 162 +    if( val < -32768 || val != val )
 163 +        return -32768;
 164 +    return (int16)val;
 165 +}
 166 +
 167 +static int32 TIFFClampDoubleToInt32( double val )
 168 +{
 169 +    if( val > 0x7FFFFFFF )
 170 +        return 0x7FFFFFFF;
 171 +    if( val < -0x7FFFFFFF-1 || val != val )
 172 +        return -0x7FFFFFFF-1;
 173 +    return (int32)val;
 174 +}
 175 +
 176 +static uint8 TIFFClampDoubleToUInt8( double val )
 177 +{
 178 +    if( val < 0 )
 179 +        return 0;
 180 +    if( val > 255 || val != val )
 181 +        return 255;
 182 +    return (uint8)val;
 183 +}
 184 +
 185 +static uint16 TIFFClampDoubleToUInt16( double val )
 186 +{
 187 +    if( val < 0 )
 188 +        return 0;
 189 +    if( val > 65535 || val != val )
 190 +        return 65535;
 191 +    return (uint16)val;
 192 +}
 193 +
 194 +static uint32 TIFFClampDoubleToUInt32( double val )
 195 +{
 196 +    if( val < 0 )
 197 +        return 0;
 198 +    if( val > 0xFFFFFFFFU || val != val )
 199 +        return 0xFFFFFFFFU;
 200 +    return (uint32)val;
 201 +}
 202 +
 203  static int
 204  TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
 205  {
 206 @@ -959,7 +1023,7 @@ TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* di
 207                         if (tif->tif_dir.td_bitspersample<=32)
 208                         {
 209                                 for (i = 0; i < count; ++i)
 210 -                                       ((float*)conv)[i] = (float)value[i];
 211 +                                       ((float*)conv)[i] = TIFFClampDoubleToFloat(value[i]);
 212                                 ok = TIFFWriteDirectoryTagFloatArray(tif,ndir,dir,tag,count,(float*)conv);
 213                         }
 214                         else
 215 @@ -971,19 +1035,19 @@ TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* di
 216                         if (tif->tif_dir.td_bitspersample<=8)
 217                         {
 218                                 for (i = 0; i < count; ++i)
 219 -                                       ((int8*)conv)[i] = (int8)value[i];
 220 +                                       ((int8*)conv)[i] = TIFFClampDoubleToInt8(value[i]);
 221                                 ok = TIFFWriteDirectoryTagSbyteArray(tif,ndir,dir,tag,count,(int8*)conv);
 222                         }
 223                         else if (tif->tif_dir.td_bitspersample<=16)
 224                         {
 225                                 for (i = 0; i < count; ++i)
 226 -                                       ((int16*)conv)[i] = (int16)value[i];
 227 +                                       ((int16*)conv)[i] = TIFFClampDoubleToInt16(value[i]);
 228                                 ok = TIFFWriteDirectoryTagSshortArray(tif,ndir,dir,tag,count,(int16*)conv);
 229                         }
 230                         else
 231                         {
 232                                 for (i = 0; i < count; ++i)
 233 -                                       ((int32*)conv)[i] = (int32)value[i];
 234 +                                       ((int32*)conv)[i] = TIFFClampDoubleToInt32(value[i]);
 235                                 ok = TIFFWriteDirectoryTagSlongArray(tif,ndir,dir,tag,count,(int32*)conv);
 236                         }
 237                         break;
 238 @@ -991,19 +1055,19 @@ TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* di
 239                         if (tif->tif_dir.td_bitspersample<=8)
 240                         {
 241                                 for (i = 0; i < count; ++i)
 242 -                                       ((uint8*)conv)[i] = (uint8)value[i];
 243 +                                       ((uint8*)conv)[i] = TIFFClampDoubleToUInt8(value[i]);
 244                                 ok = TIFFWriteDirectoryTagByteArray(tif,ndir,dir,tag,count,(uint8*)conv);
 245                         }
 246                         else if (tif->tif_dir.td_bitspersample<=16)
 247                         {
 248                                 for (i = 0; i < count; ++i)
 249 -                                       ((uint16*)conv)[i] = (uint16)value[i];
 250 +                                       ((uint16*)conv)[i] = TIFFClampDoubleToUInt16(value[i]);
 251                                 ok = TIFFWriteDirectoryTagShortArray(tif,ndir,dir,tag,count,(uint16*)conv);
 252                         }
 253                         else
 254                         {
 255                                 for (i = 0; i < count; ++i)
 256 -                                       ((uint32*)conv)[i] = (uint32)value[i];
 257 +                                       ((uint32*)conv)[i] = TIFFClampDoubleToUInt32(value[i]);
 258                                 ok = TIFFWriteDirectoryTagLongArray(tif,ndir,dir,tag,count,(uint32*)conv);
 259                         }
 260                         break;
 261 @@ -2094,6 +2094,7 @@ TIFFWriteDirectoryTagCheckedSlong8Array(
 262  static int
 263  TIFFWriteDirectoryTagCheckedRational(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
 264  {
 265 +       static const char module[] = "TIFFWriteDirectoryTagCheckedRational";
 266         uint32 m[2];
 267         assert(value>=0.0);
 268         assert(sizeof(uint32)==4);
 269 @@ -2102,7 +2102,12 @@ TIFFWriteDirectoryTagCheckedRational(TIF
 270                 m[0]=0;
 271                 m[1]=1;
 272         }
 273 -       else if (value==(double)(uint32)value)
 274 +       else if( value != value )
 275 +       {
 276 +               TIFFErrorExt(tif->tif_clientdata,module,"Not-a-number value is illegal");
 277 +               return 0;
 278 +       }
 279 +       else if (value <= 0xFFFFFFFFU && value==(double)(uint32)value)
 280         {
 281                 m[0]=(uint32)value;
 282                 m[1]=1;
 283 @@ -2143,12 +2212,13 @@ TIFFWriteDirectoryTagCheckedRationalArray(TIFF* tif, uint32* ndir, TIFFDirEntry*
 284         }
 285         for (na=value, nb=m, nc=0; nc<count; na++, nb+=2, nc++)
 286         {
 287 -               if (*na<=0.0)
 288 +               if (*na<=0.0 || *na != *na)
 289                 {
 290                         nb[0]=0;
 291                         nb[1]=1;
 292                 }
 293 -               else if (*na==(float)(uint32)(*na))
 294 +               else if (*na >= 0 && *na <= (float)0xFFFFFFFFU &&
 295 +                         *na==(float)(uint32)(*na))
 296                 {
 297                         nb[0]=(uint32)(*na);
 298                         nb[1]=1;