Gitiles
Code Review Sign In
gerrit.openbmc.org / stefanberger / openbmc / 64c979e88e6d0917b6fe45e52e381affec150afd / . / poky / meta / recipes-multimedia / libtiff / tiff / CVE-2019-17546.patch
blob: 04c5410930a0a6cbd6a49b4038d9d033a637177a [file] [log] [blame]
Brad Bishop64c979e2019-11-04 13:55:29 -0500[diff] [blame^]1libtiff: fix CVE-2019-17546
2
3Added after 4.0.10 release.
4
5CVE: CVE-2019-17546
6Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff]
7Signed-off-by: Joe Slater <joe.slater@windriver.com>
8
9commit 4bb584a35f87af42d6cf09d15e9ce8909a839145
10Author: Even Rouault <even.rouault@spatialys.com>
11Date: Thu Aug 15 15:05:28 2019 +0200
12
13 RGBA interface: fix integer overflow potentially causing write heap buffer overflow, especially on 32 bit builds. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443. Credit to OSS Fuzz
14
15diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
16index c88b5fa..4da785d 100644
17--- a/libtiff/tif_getimage.c
18+++ b/libtiff/tif_getimage.c
19@@ -949,16 +949,23 @@ gtStripContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
20 fromskew = (w < imagewidth ? imagewidth - w : 0);
21 for (row = 0; row < h; row += nrow)
22 {
23+ uint32 temp;
24 rowstoread = rowsperstrip - (row + img->row_offset) % rowsperstrip;
25 nrow = (row + rowstoread > h ? h - row : rowstoread);
26 nrowsub = nrow;
27 if ((nrowsub%subsamplingver)!=0)
28 nrowsub+=subsamplingver-nrowsub%subsamplingver;
29+ temp = (row + img->row_offset)%rowsperstrip + nrowsub;
30+ if( scanline > 0 && temp > (size_t)(TIFF_TMSIZE_T_MAX / scanline) )
31+ {
32+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in gtStripContig");
33+ return 0;
34+ }
35 if (_TIFFReadEncodedStripAndAllocBuffer(tif,
36 TIFFComputeStrip(tif,row+img->row_offset, 0),
37 (void**)(&buf),
38 maxstripsize,
39- ((row + img->row_offset)%rowsperstrip + nrowsub) * scanline)==(tmsize_t)(-1)
40+ temp * scanline)==(tmsize_t)(-1)
41 && (buf == NULL || img->stoponerr))
42 {
43 ret = 0;
44@@ -1051,15 +1058,22 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
45 fromskew = (w < imagewidth ? imagewidth - w : 0);
46 for (row = 0; row < h; row += nrow)
47 {
48+ uint32 temp;
49 rowstoread = rowsperstrip - (row + img->row_offset) % rowsperstrip;
50 nrow = (row + rowstoread > h ? h - row : rowstoread);
51 offset_row = row + img->row_offset;
52+ temp = (row + img->row_offset)%rowsperstrip + nrow;
53+ if( scanline > 0 && temp > (size_t)(TIFF_TMSIZE_T_MAX / scanline) )
54+ {
55+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in gtStripSeparate");
56+ return 0;
57+ }
58 if( buf == NULL )
59 {
60 if (_TIFFReadEncodedStripAndAllocBuffer(
61 tif, TIFFComputeStrip(tif, offset_row, 0),
62 (void**) &buf, bufsize,
63- ((row + img->row_offset)%rowsperstrip + nrow) * scanline)==(tmsize_t)(-1)
64+ temp * scanline)==(tmsize_t)(-1)
65 && (buf == NULL || img->stoponerr))
66 {
67 ret = 0;
68@@ -1079,7 +1093,7 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
69 }
70 }
71 else if (TIFFReadEncodedStrip(tif, TIFFComputeStrip(tif, offset_row, 0),
72- p0, ((row + img->row_offset)%rowsperstrip + nrow) * scanline)==(tmsize_t)(-1)
73+ p0, temp * scanline)==(tmsize_t)(-1)
74 && img->stoponerr)
75 {
76 ret = 0;
77@@ -1087,7 +1101,7 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
78 }
79 if (colorchannels > 1
80 && TIFFReadEncodedStrip(tif, TIFFComputeStrip(tif, offset_row, 1),
81- p1, ((row + img->row_offset)%rowsperstrip + nrow) * scanline) == (tmsize_t)(-1)
82+ p1, temp * scanline) == (tmsize_t)(-1)
83 && img->stoponerr)
84 {
85 ret = 0;
86@@ -1095,7 +1109,7 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
87 }
88 if (colorchannels > 1
89 && TIFFReadEncodedStrip(tif, TIFFComputeStrip(tif, offset_row, 2),
90- p2, ((row + img->row_offset)%rowsperstrip + nrow) * scanline) == (tmsize_t)(-1)
91+ p2, temp * scanline) == (tmsize_t)(-1)
92 && img->stoponerr)
93 {
94 ret = 0;
95@@ -1104,7 +1118,7 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
96 if (alpha)
97 {
98 if (TIFFReadEncodedStrip(tif, TIFFComputeStrip(tif, offset_row, colorchannels),
99- pa, ((row + img->row_offset)%rowsperstrip + nrow) * scanline)==(tmsize_t)(-1)
100+ pa, temp * scanline)==(tmsize_t)(-1)
101 && img->stoponerr)
102 {
103 ret = 0;