Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 1 | From 333ba5599e87bd7747516d7863d61764e4ca2d92 Mon Sep 17 00:00:00 2001 |
| 2 | From: Even Rouault <even.rouault@spatialys.com> |
| 3 | Date: Fri, 30 Jun 2017 17:29:44 +0000 |
| 4 | Subject: [PATCH] * libtiff/tif_dirwrite.c: in |
| 5 | TIFFWriteDirectoryTagCheckedXXXX() functions associated with LONG8/SLONG8 |
| 6 | data type, replace assertion that the file is BigTIFF, by a non-fatal error. |
| 7 | Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712 Reported by team |
| 8 | OWL337 |
| 9 | |
| 10 | Upstream-Status: Backport |
| 11 | [https://github.com/vadz/libtiff/commit/6173a57d39e04d68b139f8c1aa499a24dbe74ba1] |
| 12 | |
| 13 | CVE: CVE-2017-10688 |
| 14 | |
| 15 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> |
| 16 | --- |
| 17 | ChangeLog | 8 ++++++++ |
| 18 | libtiff/tif_dirwrite.c | 20 ++++++++++++++++---- |
| 19 | 2 files changed, 24 insertions(+), 4 deletions(-) |
| 20 | |
| 21 | Index: tiff-4.0.7/ChangeLog |
| 22 | =================================================================== |
| 23 | --- tiff-4.0.7.orig/ChangeLog |
| 24 | +++ tiff-4.0.7/ChangeLog |
| 25 | @@ -1,3 +1,11 @@ |
| 26 | +2017-06-30 Even Rouault <even.rouault at spatialys.com> |
| 27 | + |
| 28 | + * libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX() |
| 29 | + functions associated with LONG8/SLONG8 data type, replace assertion that |
| 30 | + the file is BigTIFF, by a non-fatal error. |
| 31 | + Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712 |
| 32 | + Reported by team OWL337 |
| 33 | + |
| 34 | 2017-06-26 Even Rouault <even.rouault at spatialys.com> |
| 35 | |
| 36 | * libtiff/tif_jbig.c: fix memory leak in error code path of JBIGDecode() |
| 37 | Index: tiff-4.0.7/libtiff/tif_dirwrite.c |
| 38 | =================================================================== |
| 39 | --- tiff-4.0.7.orig/libtiff/tif_dirwrite.c |
| 40 | +++ tiff-4.0.7/libtiff/tif_dirwrite.c |
| 41 | @@ -2047,7 +2047,10 @@ TIFFWriteDirectoryTagCheckedLong8(TIFF* |
| 42 | { |
| 43 | uint64 m; |
| 44 | assert(sizeof(uint64)==8); |
| 45 | - assert(tif->tif_flags&TIFF_BIGTIFF); |
| 46 | + if( !(tif->tif_flags&TIFF_BIGTIFF) ) { |
| 47 | + TIFFErrorExt(tif->tif_clientdata,"TIFFWriteDirectoryTagCheckedLong8","LONG8 not allowed for ClassicTIFF"); |
| 48 | + return(0); |
| 49 | + } |
| 50 | m=value; |
| 51 | if (tif->tif_flags&TIFF_SWAB) |
| 52 | TIFFSwabLong8(&m); |
| 53 | @@ -2060,7 +2063,10 @@ TIFFWriteDirectoryTagCheckedLong8Array(T |
| 54 | { |
| 55 | assert(count<0x20000000); |
| 56 | assert(sizeof(uint64)==8); |
| 57 | - assert(tif->tif_flags&TIFF_BIGTIFF); |
| 58 | + if( !(tif->tif_flags&TIFF_BIGTIFF) ) { |
| 59 | + TIFFErrorExt(tif->tif_clientdata,"TIFFWriteDirectoryTagCheckedLong8","LONG8 not allowed for ClassicTIFF"); |
| 60 | + return(0); |
| 61 | + } |
| 62 | if (tif->tif_flags&TIFF_SWAB) |
| 63 | TIFFSwabArrayOfLong8(value,count); |
| 64 | return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG8,count,count*8,value)); |
| 65 | @@ -2072,7 +2078,10 @@ TIFFWriteDirectoryTagCheckedSlong8(TIFF* |
| 66 | { |
| 67 | int64 m; |
| 68 | assert(sizeof(int64)==8); |
| 69 | - assert(tif->tif_flags&TIFF_BIGTIFF); |
| 70 | + if( !(tif->tif_flags&TIFF_BIGTIFF) ) { |
| 71 | + TIFFErrorExt(tif->tif_clientdata,"TIFFWriteDirectoryTagCheckedLong8","SLONG8 not allowed for ClassicTIFF"); |
| 72 | + return(0); |
| 73 | + } |
| 74 | m=value; |
| 75 | if (tif->tif_flags&TIFF_SWAB) |
| 76 | TIFFSwabLong8((uint64*)(&m)); |
| 77 | @@ -2085,7 +2094,10 @@ TIFFWriteDirectoryTagCheckedSlong8Array( |
| 78 | { |
| 79 | assert(count<0x20000000); |
| 80 | assert(sizeof(int64)==8); |
| 81 | - assert(tif->tif_flags&TIFF_BIGTIFF); |
| 82 | + if( !(tif->tif_flags&TIFF_BIGTIFF) ) { |
| 83 | + TIFFErrorExt(tif->tif_clientdata,"TIFFWriteDirectoryTagCheckedLong8","SLONG8 not allowed for ClassicTIFF"); |
| 84 | + return(0); |
| 85 | + } |
| 86 | if (tif->tif_flags&TIFF_SWAB) |
| 87 | TIFFSwabArrayOfLong8((uint64*)value,count); |
| 88 | return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SLONG8,count,count*8,value)); |