mirror of
https://github.com/motioneye-project/motioneyeos.git
synced 2025-07-31 07:06:36 +00:00
tiff: add upstream security fixes
Add upstream post-4.0.7 commits (except for ChangeLog modifications) fixing the following security issues: CVE-2016-10266 - LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_read.c:351:22. CVE-2016-10267 - LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_ojpeg.c:816:8. CVE-2016-10269 - LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 512" and libtiff/tif_unix.c:340:2. CVE-2016-10270 - LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 8" and libtiff/tif_read.c:523:22. CVE-2017-5225 - LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value. CVE-2017-7592 - The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. CVE-2017-7593 - tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized, which might allow remote attackers to obtain sensitive information from process memory via a crafted image. CVE-2017-7594 - The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image. CVE-2017-7595 - The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image. CVE-2017-7598 - tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image. CVE-2017-7601 - LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. CVE-2017-7602 - LibTIFF 4.0.7 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Peter Korsgaard
parent
0135204868
commit
030fe340af
@ -0,0 +1,46 @@
|
|||||||
|
From 438274f938e046d33cb0e1230b41da32ffe223e1 Mon Sep 17 00:00:00 2001
|
||||||
|
From: erouault <erouault>
|
||||||
|
Date: Fri, 2 Dec 2016 21:56:56 +0000
|
||||||
|
Subject: [PATCH] * libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow
|
||||||
|
in TIFFReadEncodedStrip() that caused an integer division by zero. Reported
|
||||||
|
by Agostino Sarubbo. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2596
|
||||||
|
|
||||||
|
Fixes CVE-2016-10266
|
||||||
|
|
||||||
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||||
|
---
|
||||||
|
libtiff/tif_read.c | 2 +-
|
||||||
|
libtiff/tiffiop.h | 4 ++++
|
||||||
|
2 files changed, 12 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
|
||||||
|
index c26c55f4..52bbf507 100644
|
||||||
|
--- a/libtiff/tif_read.c
|
||||||
|
+++ b/libtiff/tif_read.c
|
||||||
|
@@ -346,7 +346,7 @@ TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
|
||||||
|
rowsperstrip=td->td_rowsperstrip;
|
||||||
|
if (rowsperstrip>td->td_imagelength)
|
||||||
|
rowsperstrip=td->td_imagelength;
|
||||||
|
- stripsperplane=((td->td_imagelength+rowsperstrip-1)/rowsperstrip);
|
||||||
|
+ stripsperplane= TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip);
|
||||||
|
stripinplane=(strip%stripsperplane);
|
||||||
|
plane=(uint16)(strip/stripsperplane);
|
||||||
|
rows=td->td_imagelength-stripinplane*rowsperstrip;
|
||||||
|
diff --git a/libtiff/tiffiop.h b/libtiff/tiffiop.h
|
||||||
|
index ffbb647b..cb59460a 100644
|
||||||
|
--- a/libtiff/tiffiop.h
|
||||||
|
+++ b/libtiff/tiffiop.h
|
||||||
|
@@ -250,6 +250,10 @@ struct tiff {
|
||||||
|
#define TIFFhowmany_32(x, y) (((uint32)x < (0xffffffff - (uint32)(y-1))) ? \
|
||||||
|
((((uint32)(x))+(((uint32)(y))-1))/((uint32)(y))) : \
|
||||||
|
0U)
|
||||||
|
+/* Variant of TIFFhowmany_32() that doesn't return 0 if x close to MAXUINT. */
|
||||||
|
+/* Caution: TIFFhowmany_32_maxuint_compat(x,y)*y might overflow */
|
||||||
|
+#define TIFFhowmany_32_maxuint_compat(x, y) \
|
||||||
|
+ (((uint32)(x) / (uint32)(y)) + ((((uint32)(x) % (uint32)(y)) != 0) ? 1 : 0))
|
||||||
|
#define TIFFhowmany8_32(x) (((x)&0x07)?((uint32)(x)>>3)+1:(uint32)(x)>>3)
|
||||||
|
#define TIFFroundup_32(x, y) (TIFFhowmany_32(x,y)*(y))
|
||||||
|
#define TIFFhowmany_64(x, y) ((((uint64)(x))+(((uint64)(y))-1))/((uint64)(y)))
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
||||||
@ -0,0 +1,53 @@
|
|||||||
|
From 43bc256d8ae44b92d2734a3c5bc73957a4d7c1ec Mon Sep 17 00:00:00 2001
|
||||||
|
From: erouault <erouault>
|
||||||
|
Date: Sat, 3 Dec 2016 11:15:18 +0000
|
||||||
|
Subject: [PATCH] * libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case
|
||||||
|
of failure in OJPEGPreDecode(). This will avoid a divide by zero, and
|
||||||
|
potential other issues. Reported by Agostino Sarubbo. Fixes
|
||||||
|
http://bugzilla.maptools.org/show_bug.cgi?id=2611
|
||||||
|
|
||||||
|
Fixes CVE-2016-10267
|
||||||
|
|
||||||
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||||
|
---
|
||||||
|
libtiff/tif_ojpeg.c | 8 ++++++++
|
||||||
|
1 files changed, 15 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
|
||||||
|
index 1ccc3f9b..f19e8fd0 100644
|
||||||
|
--- a/libtiff/tif_ojpeg.c
|
||||||
|
+++ b/libtiff/tif_ojpeg.c
|
||||||
|
@@ -244,6 +244,7 @@ typedef enum {
|
||||||
|
|
||||||
|
typedef struct {
|
||||||
|
TIFF* tif;
|
||||||
|
+ int decoder_ok;
|
||||||
|
#ifndef LIBJPEG_ENCAP_EXTERNAL
|
||||||
|
JMP_BUF exit_jmpbuf;
|
||||||
|
#endif
|
||||||
|
@@ -722,6 +723,7 @@ OJPEGPreDecode(TIFF* tif, uint16 s)
|
||||||
|
}
|
||||||
|
sp->write_curstrile++;
|
||||||
|
}
|
||||||
|
+ sp->decoder_ok = 1;
|
||||||
|
return(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -784,8 +786,14 @@ OJPEGPreDecodeSkipScanlines(TIFF* tif)
|
||||||
|
static int
|
||||||
|
OJPEGDecode(TIFF* tif, uint8* buf, tmsize_t cc, uint16 s)
|
||||||
|
{
|
||||||
|
+ static const char module[]="OJPEGDecode";
|
||||||
|
OJPEGState* sp=(OJPEGState*)tif->tif_data;
|
||||||
|
(void)s;
|
||||||
|
+ if( !sp->decoder_ok )
|
||||||
|
+ {
|
||||||
|
+ TIFFErrorExt(tif->tif_clientdata,module,"Cannot decode: decoder not correctly initialized");
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
if (sp->libjpeg_jpeg_query_style==0)
|
||||||
|
{
|
||||||
|
if (OJPEGDecodeRaw(tif,buf,cc)==0)
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
||||||
@ -0,0 +1,110 @@
|
|||||||
|
From 1044b43637fa7f70fb19b93593777b78bd20da86 Mon Sep 17 00:00:00 2001
|
||||||
|
From: erouault <erouault>
|
||||||
|
Date: Fri, 2 Dec 2016 23:05:51 +0000
|
||||||
|
Subject: [PATCH] * libtiff/tif_pixarlog.c, libtiff/tif_luv.c: fix heap-based
|
||||||
|
buffer overflow on generation of PixarLog / LUV compressed files, with
|
||||||
|
ColorMap, TransferFunction attached and nasty plays with bitspersample. The
|
||||||
|
fix for LUV has not been tested, but suffers from the same kind of issue of
|
||||||
|
PixarLog. Reported by Agostino Sarubbo. Fixes
|
||||||
|
http://bugzilla.maptools.org/show_bug.cgi?id=2604
|
||||||
|
|
||||||
|
Fixes CVE-2016-10269
|
||||||
|
|
||||||
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||||
|
---
|
||||||
|
libtiff/tif_luv.c | 18 ++++++++++++++----
|
||||||
|
libtiff/tif_pixarlog.c | 17 +++++++++++++++--
|
||||||
|
2 files changed, 39 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_luv.c b/libtiff/tif_luv.c
|
||||||
|
index f68a9b13..e6783db5 100644
|
||||||
|
--- a/libtiff/tif_luv.c
|
||||||
|
+++ b/libtiff/tif_luv.c
|
||||||
|
@@ -158,6 +158,7 @@
|
||||||
|
typedef struct logLuvState LogLuvState;
|
||||||
|
|
||||||
|
struct logLuvState {
|
||||||
|
+ int encoder_state; /* 1 if encoder correctly initialized */
|
||||||
|
int user_datafmt; /* user data format */
|
||||||
|
int encode_meth; /* encoding method */
|
||||||
|
int pixel_size; /* bytes per pixel */
|
||||||
|
@@ -1552,6 +1553,7 @@ LogLuvSetupEncode(TIFF* tif)
|
||||||
|
td->td_photometric, "must be either LogLUV or LogL");
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
+ sp->encoder_state = 1;
|
||||||
|
return (1);
|
||||||
|
notsupported:
|
||||||
|
TIFFErrorExt(tif->tif_clientdata, module,
|
||||||
|
@@ -1563,19 +1565,27 @@ notsupported:
|
||||||
|
static void
|
||||||
|
LogLuvClose(TIFF* tif)
|
||||||
|
{
|
||||||
|
+ LogLuvState* sp = (LogLuvState*) tif->tif_data;
|
||||||
|
TIFFDirectory *td = &tif->tif_dir;
|
||||||
|
|
||||||
|
+ assert(sp != 0);
|
||||||
|
/*
|
||||||
|
* For consistency, we always want to write out the same
|
||||||
|
* bitspersample and sampleformat for our TIFF file,
|
||||||
|
* regardless of the data format being used by the application.
|
||||||
|
* Since this routine is called after tags have been set but
|
||||||
|
* before they have been recorded in the file, we reset them here.
|
||||||
|
+ * Note: this is really a nasty approach. See PixarLogClose
|
||||||
|
*/
|
||||||
|
- td->td_samplesperpixel =
|
||||||
|
- (td->td_photometric == PHOTOMETRIC_LOGL) ? 1 : 3;
|
||||||
|
- td->td_bitspersample = 16;
|
||||||
|
- td->td_sampleformat = SAMPLEFORMAT_INT;
|
||||||
|
+ if( sp->encoder_state )
|
||||||
|
+ {
|
||||||
|
+ /* See PixarLogClose. Might avoid issues with tags whose size depends
|
||||||
|
+ * on those below, but not completely sure this is enough. */
|
||||||
|
+ td->td_samplesperpixel =
|
||||||
|
+ (td->td_photometric == PHOTOMETRIC_LOGL) ? 1 : 3;
|
||||||
|
+ td->td_bitspersample = 16;
|
||||||
|
+ td->td_sampleformat = SAMPLEFORMAT_INT;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
static void
|
||||||
|
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
|
||||||
|
index d1246c3d..aa99bc92 100644
|
||||||
|
--- a/libtiff/tif_pixarlog.c
|
||||||
|
+++ b/libtiff/tif_pixarlog.c
|
||||||
|
@@ -1233,8 +1233,10 @@ PixarLogPostEncode(TIFF* tif)
|
||||||
|
static void
|
||||||
|
PixarLogClose(TIFF* tif)
|
||||||
|
{
|
||||||
|
+ PixarLogState* sp = (PixarLogState*) tif->tif_data;
|
||||||
|
TIFFDirectory *td = &tif->tif_dir;
|
||||||
|
|
||||||
|
+ assert(sp != 0);
|
||||||
|
/* In a really sneaky (and really incorrect, and untruthful, and
|
||||||
|
* troublesome, and error-prone) maneuver that completely goes against
|
||||||
|
* the spirit of TIFF, and breaks TIFF, on close, we covertly
|
||||||
|
@@ -1243,8 +1245,19 @@ PixarLogClose(TIFF* tif)
|
||||||
|
* readers that don't know about PixarLog, or how to set
|
||||||
|
* the PIXARLOGDATFMT pseudo-tag.
|
||||||
|
*/
|
||||||
|
- td->td_bitspersample = 8;
|
||||||
|
- td->td_sampleformat = SAMPLEFORMAT_UINT;
|
||||||
|
+
|
||||||
|
+ if (sp->state&PLSTATE_INIT) {
|
||||||
|
+ /* We test the state to avoid an issue such as in
|
||||||
|
+ * http://bugzilla.maptools.org/show_bug.cgi?id=2604
|
||||||
|
+ * What appends in that case is that the bitspersample is 1 and
|
||||||
|
+ * a TransferFunction is set. The size of the TransferFunction
|
||||||
|
+ * depends on 1<<bitspersample. So if we increase it, an access
|
||||||
|
+ * out of the buffer will happen at directory flushing.
|
||||||
|
+ * Another option would be to clear those targs.
|
||||||
|
+ */
|
||||||
|
+ td->td_bitspersample = 8;
|
||||||
|
+ td->td_sampleformat = SAMPLEFORMAT_UINT;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
static void
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
||||||
@ -0,0 +1,107 @@
|
|||||||
|
From 9a72a69e035ee70ff5c41541c8c61cd97990d018 Mon Sep 17 00:00:00 2001
|
||||||
|
From: erouault <erouault>
|
||||||
|
Date: Sat, 3 Dec 2016 11:02:15 +0000
|
||||||
|
Subject: [PATCH] * libtiff/tif_dirread.c: modify
|
||||||
|
ChopUpSingleUncompressedStrip() to instanciate compute ntrips as
|
||||||
|
TIFFhowmany_32(td->td_imagelength, rowsperstrip), instead of a logic based on
|
||||||
|
the total size of data. Which is faulty is the total size of data is not
|
||||||
|
sufficient to fill the whole image, and thus results in reading outside of
|
||||||
|
the StripByCounts/StripOffsets arrays when using TIFFReadScanline(). Reported
|
||||||
|
by Agostino Sarubbo. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2608.
|
||||||
|
|
||||||
|
* libtiff/tif_strip.c: revert the change in TIFFNumberOfStrips() done
|
||||||
|
for http://bugzilla.maptools.org/show_bug.cgi?id=2587 / CVE-2016-9273 since
|
||||||
|
the above change is a better fix that makes it unnecessary.
|
||||||
|
|
||||||
|
Fixes CVE-2016-10270
|
||||||
|
|
||||||
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||||
|
---
|
||||||
|
libtiff/tif_dirread.c | 22 ++++++++++------------
|
||||||
|
libtiff/tif_strip.c | 9 ---------
|
||||||
|
2 files changed, 25 insertions(+), 21 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
|
||||||
|
index 3eec79c9..570d0c32 100644
|
||||||
|
--- a/libtiff/tif_dirread.c
|
||||||
|
+++ b/libtiff/tif_dirread.c
|
||||||
|
@@ -5502,8 +5502,7 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
|
||||||
|
uint64 rowblockbytes;
|
||||||
|
uint64 stripbytes;
|
||||||
|
uint32 strip;
|
||||||
|
- uint64 nstrips64;
|
||||||
|
- uint32 nstrips32;
|
||||||
|
+ uint32 nstrips;
|
||||||
|
uint32 rowsperstrip;
|
||||||
|
uint64* newcounts;
|
||||||
|
uint64* newoffsets;
|
||||||
|
@@ -5534,18 +5533,17 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
|
||||||
|
return;
|
||||||
|
|
||||||
|
/*
|
||||||
|
- * never increase the number of strips in an image
|
||||||
|
+ * never increase the number of rows per strip
|
||||||
|
*/
|
||||||
|
if (rowsperstrip >= td->td_rowsperstrip)
|
||||||
|
return;
|
||||||
|
- nstrips64 = TIFFhowmany_64(bytecount, stripbytes);
|
||||||
|
- if ((nstrips64==0)||(nstrips64>0xFFFFFFFF)) /* something is wonky, do nothing. */
|
||||||
|
- return;
|
||||||
|
- nstrips32 = (uint32)nstrips64;
|
||||||
|
+ nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
|
||||||
|
+ if( nstrips == 0 )
|
||||||
|
+ return;
|
||||||
|
|
||||||
|
- newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
|
||||||
|
+ newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
|
||||||
|
"for chopped \"StripByteCounts\" array");
|
||||||
|
- newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
|
||||||
|
+ newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
|
||||||
|
"for chopped \"StripOffsets\" array");
|
||||||
|
if (newcounts == NULL || newoffsets == NULL) {
|
||||||
|
/*
|
||||||
|
@@ -5562,18 +5560,18 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
|
||||||
|
* Fill the strip information arrays with new bytecounts and offsets
|
||||||
|
* that reflect the broken-up format.
|
||||||
|
*/
|
||||||
|
- for (strip = 0; strip < nstrips32; strip++) {
|
||||||
|
+ for (strip = 0; strip < nstrips; strip++) {
|
||||||
|
if (stripbytes > bytecount)
|
||||||
|
stripbytes = bytecount;
|
||||||
|
newcounts[strip] = stripbytes;
|
||||||
|
- newoffsets[strip] = offset;
|
||||||
|
+ newoffsets[strip] = stripbytes ? offset : 0;
|
||||||
|
offset += stripbytes;
|
||||||
|
bytecount -= stripbytes;
|
||||||
|
}
|
||||||
|
/*
|
||||||
|
* Replace old single strip info with multi-strip info.
|
||||||
|
*/
|
||||||
|
- td->td_stripsperimage = td->td_nstrips = nstrips32;
|
||||||
|
+ td->td_stripsperimage = td->td_nstrips = nstrips;
|
||||||
|
TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
|
||||||
|
|
||||||
|
_TIFFfree(td->td_stripbytecount);
|
||||||
|
diff --git a/libtiff/tif_strip.c b/libtiff/tif_strip.c
|
||||||
|
index 4c46ecf5..1676e47d 100644
|
||||||
|
--- a/libtiff/tif_strip.c
|
||||||
|
+++ b/libtiff/tif_strip.c
|
||||||
|
@@ -63,15 +63,6 @@ TIFFNumberOfStrips(TIFF* tif)
|
||||||
|
TIFFDirectory *td = &tif->tif_dir;
|
||||||
|
uint32 nstrips;
|
||||||
|
|
||||||
|
- /* If the value was already computed and store in td_nstrips, then return it,
|
||||||
|
- since ChopUpSingleUncompressedStrip might have altered and resized the
|
||||||
|
- since the td_stripbytecount and td_stripoffset arrays to the new value
|
||||||
|
- after the initial affectation of td_nstrips = TIFFNumberOfStrips() in
|
||||||
|
- tif_dirread.c ~line 3612.
|
||||||
|
- See http://bugzilla.maptools.org/show_bug.cgi?id=2587 */
|
||||||
|
- if( td->td_nstrips )
|
||||||
|
- return td->td_nstrips;
|
||||||
|
-
|
||||||
|
nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
|
||||||
|
TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
|
||||||
|
if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
||||||
@ -0,0 +1,74 @@
|
|||||||
|
From 5c080298d59efa53264d7248bbe3a04660db6ef7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: erouault <erouault>
|
||||||
|
Date: Wed, 11 Jan 2017 19:25:44 +0000
|
||||||
|
Subject: [PATCH] * tools/tiffcp.c: error out cleanly in cpContig2SeparateByRow
|
||||||
|
and cpSeparate2ContigByRow if BitsPerSample != 8 to avoid heap based
|
||||||
|
overflow. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2656 and
|
||||||
|
http://bugzilla.maptools.org/show_bug.cgi?id=2657
|
||||||
|
|
||||||
|
Fixes CVE-2017-5225
|
||||||
|
|
||||||
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||||
|
---
|
||||||
|
tools/tiffcp.c | 24 ++++++++++++++++++++++--
|
||||||
|
1 file changed, 29 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/tools/tiffcp.c b/tools/tiffcp.c
|
||||||
|
index bdf754c3..8bbcd52f 100644
|
||||||
|
--- a/tools/tiffcp.c
|
||||||
|
+++ b/tools/tiffcp.c
|
||||||
|
@@ -591,7 +591,7 @@ static copyFunc pickCopyFunc(TIFF*, TIFF*, uint16, uint16);
|
||||||
|
static int
|
||||||
|
tiffcp(TIFF* in, TIFF* out)
|
||||||
|
{
|
||||||
|
- uint16 bitspersample, samplesperpixel = 1;
|
||||||
|
+ uint16 bitspersample = 1, samplesperpixel = 1;
|
||||||
|
uint16 input_compression, input_photometric = PHOTOMETRIC_MINISBLACK;
|
||||||
|
copyFunc cf;
|
||||||
|
uint32 width, length;
|
||||||
|
@@ -1067,6 +1067,16 @@ DECLAREcpFunc(cpContig2SeparateByRow)
|
||||||
|
register uint32 n;
|
||||||
|
uint32 row;
|
||||||
|
tsample_t s;
|
||||||
|
+ uint16 bps = 0;
|
||||||
|
+
|
||||||
|
+ (void) TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps);
|
||||||
|
+ if( bps != 8 )
|
||||||
|
+ {
|
||||||
|
+ TIFFError(TIFFFileName(in),
|
||||||
|
+ "Error, can only handle BitsPerSample=8 in %s",
|
||||||
|
+ "cpContig2SeparateByRow");
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
inbuf = _TIFFmalloc(scanlinesizein);
|
||||||
|
outbuf = _TIFFmalloc(scanlinesizeout);
|
||||||
|
@@ -1120,6 +1130,16 @@ DECLAREcpFunc(cpSeparate2ContigByRow)
|
||||||
|
register uint32 n;
|
||||||
|
uint32 row;
|
||||||
|
tsample_t s;
|
||||||
|
+ uint16 bps = 0;
|
||||||
|
+
|
||||||
|
+ (void) TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps);
|
||||||
|
+ if( bps != 8 )
|
||||||
|
+ {
|
||||||
|
+ TIFFError(TIFFFileName(in),
|
||||||
|
+ "Error, can only handle BitsPerSample=8 in %s",
|
||||||
|
+ "cpSeparate2ContigByRow");
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
inbuf = _TIFFmalloc(scanlinesizein);
|
||||||
|
outbuf = _TIFFmalloc(scanlinesizeout);
|
||||||
|
@@ -1784,7 +1804,7 @@ pickCopyFunc(TIFF* in, TIFF* out, uint16 bitspersample, uint16 samplesperpixel)
|
||||||
|
uint32 w, l, tw, tl;
|
||||||
|
int bychunk;
|
||||||
|
|
||||||
|
- (void) TIFFGetField(in, TIFFTAG_PLANARCONFIG, &shortv);
|
||||||
|
+ (void) TIFFGetFieldDefaulted(in, TIFFTAG_PLANARCONFIG, &shortv);
|
||||||
|
if (shortv != config && bitspersample != 8 && samplesperpixel > 1) {
|
||||||
|
fprintf(stderr,
|
||||||
|
"%s: Cannot handle different planar configuration w/ bits/sample != 8\n",
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
||||||
@ -0,0 +1,31 @@
|
|||||||
|
From 48780b4fcc425cddc4ef8ffdf536f96a0d1b313b Mon Sep 17 00:00:00 2001
|
||||||
|
From: erouault <erouault>
|
||||||
|
Date: Wed, 11 Jan 2017 16:38:26 +0000
|
||||||
|
Subject: [PATCH] libtiff/tif_getimage.c: add explicit uint32 cast in putagreytile to
|
||||||
|
avoid UndefinedBehaviorSanitizer warning.
|
||||||
|
Patch by Nicolás Peña.
|
||||||
|
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2658
|
||||||
|
|
||||||
|
Fixes CVE-2017-7592
|
||||||
|
|
||||||
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||||
|
---
|
||||||
|
libtiff/tif_getimage.c | 2 +-
|
||||||
|
1 file changed, 8 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
|
||||||
|
index fed31f1f..2fa1775c 100644
|
||||||
|
--- a/libtiff/tif_getimage.c
|
||||||
|
+++ b/libtiff/tif_getimage.c
|
||||||
|
@@ -1302,7 +1302,7 @@ DECLAREContigPutFunc(putagreytile)
|
||||||
|
while (h-- > 0) {
|
||||||
|
for (x = w; x-- > 0;)
|
||||||
|
{
|
||||||
|
- *cp++ = BWmap[*pp][0] & (*(pp+1) << 24 | ~A1);
|
||||||
|
+ *cp++ = BWmap[*pp][0] & ((uint32)*(pp+1) << 24 | ~A1);
|
||||||
|
pp += samplesperpixel;
|
||||||
|
}
|
||||||
|
cp += toskew;
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
||||||
@ -0,0 +1,88 @@
|
|||||||
|
From d60332057b9575ada4f264489582b13e30137be1 Mon Sep 17 00:00:00 2001
|
||||||
|
From: erouault <erouault>
|
||||||
|
Date: Wed, 11 Jan 2017 19:02:49 +0000
|
||||||
|
Subject: [PATCH] * libtiff/tiffiop.h, tif_unix.c, tif_win32.c, tif_vms.c: add
|
||||||
|
_TIFFcalloc()
|
||||||
|
|
||||||
|
* libtiff/tif_read.c: TIFFReadBufferSetup(): use _TIFFcalloc() to zero
|
||||||
|
initialize tif_rawdata.
|
||||||
|
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2651
|
||||||
|
|
||||||
|
Fixes CVE-2017-7593
|
||||||
|
|
||||||
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||||
|
---
|
||||||
|
libtiff/tif_read.c | 4 +++-
|
||||||
|
libtiff/tif_unix.c | 8 ++++++++
|
||||||
|
libtiff/tif_win32.c | 8 ++++++++
|
||||||
|
libtiff/tiffio.h | 1 +
|
||||||
|
4 files changed, 36 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
|
||||||
|
index 277fdd69..4535ccb3 100644
|
||||||
|
--- a/libtiff/tif_read.c
|
||||||
|
+++ b/libtiff/tif_read.c
|
||||||
|
@@ -985,7 +985,9 @@ TIFFReadBufferSetup(TIFF* tif, void* bp, tmsize_t size)
|
||||||
|
"Invalid buffer size");
|
||||||
|
return (0);
|
||||||
|
}
|
||||||
|
- tif->tif_rawdata = (uint8*) _TIFFmalloc(tif->tif_rawdatasize);
|
||||||
|
+ /* Initialize to zero to avoid uninitialized buffers in case of */
|
||||||
|
+ /* short reads (http://bugzilla.maptools.org/show_bug.cgi?id=2651) */
|
||||||
|
+ tif->tif_rawdata = (uint8*) _TIFFcalloc(1, tif->tif_rawdatasize);
|
||||||
|
tif->tif_flags |= TIFF_MYBUFFER;
|
||||||
|
}
|
||||||
|
if (tif->tif_rawdata == NULL) {
|
||||||
|
diff --git a/libtiff/tif_unix.c b/libtiff/tif_unix.c
|
||||||
|
index 7c7bc961..89dd32e8 100644
|
||||||
|
--- a/libtiff/tif_unix.c
|
||||||
|
+++ b/libtiff/tif_unix.c
|
||||||
|
@@ -316,6 +316,14 @@ _TIFFmalloc(tmsize_t s)
|
||||||
|
return (malloc((size_t) s));
|
||||||
|
}
|
||||||
|
|
||||||
|
+void* _TIFFcalloc(tmsize_t nmemb, tmsize_t siz)
|
||||||
|
+{
|
||||||
|
+ if( nmemb == 0 || siz == 0 )
|
||||||
|
+ return ((void *) NULL);
|
||||||
|
+
|
||||||
|
+ return calloc((size_t) nmemb, (size_t)siz);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
void
|
||||||
|
_TIFFfree(void* p)
|
||||||
|
{
|
||||||
|
diff --git a/libtiff/tif_win32.c b/libtiff/tif_win32.c
|
||||||
|
index d730b3ab..3e9001b7 100644
|
||||||
|
--- a/libtiff/tif_win32.c
|
||||||
|
+++ b/libtiff/tif_win32.c
|
||||||
|
@@ -360,6 +360,14 @@ _TIFFmalloc(tmsize_t s)
|
||||||
|
return (malloc((size_t) s));
|
||||||
|
}
|
||||||
|
|
||||||
|
+void* _TIFFcalloc(tmsize_t nmemb, tmsize_t siz)
|
||||||
|
+{
|
||||||
|
+ if( nmemb == 0 || siz == 0 )
|
||||||
|
+ return ((void *) NULL);
|
||||||
|
+
|
||||||
|
+ return calloc((size_t) nmemb, (size_t)siz);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
void
|
||||||
|
_TIFFfree(void* p)
|
||||||
|
{
|
||||||
|
diff --git a/libtiff/tiffio.h b/libtiff/tiffio.h
|
||||||
|
index 732da17f..fbd9171f 100644
|
||||||
|
--- a/libtiff/tiffio.h
|
||||||
|
+++ b/libtiff/tiffio.h
|
||||||
|
@@ -293,6 +293,7 @@ extern TIFFCodec* TIFFGetConfiguredCODECs(void);
|
||||||
|
*/
|
||||||
|
|
||||||
|
extern void* _TIFFmalloc(tmsize_t s);
|
||||||
|
+extern void* _TIFFcalloc(tmsize_t nmemb, tmsize_t siz);
|
||||||
|
extern void* _TIFFrealloc(void* p, tmsize_t s);
|
||||||
|
extern void _TIFFmemset(void* p, int v, tmsize_t c);
|
||||||
|
extern void _TIFFmemcpy(void* d, const void* s, tmsize_t c);
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
||||||
@ -0,0 +1,43 @@
|
|||||||
|
From 2ea32f7372b65c24b2816f11c04bf59b5090d05b Mon Sep 17 00:00:00 2001
|
||||||
|
From: erouault <erouault>
|
||||||
|
Date: Thu, 12 Jan 2017 19:23:20 +0000
|
||||||
|
Subject: [PATCH] * libtiff/tif_ojpeg.c: fix leak in
|
||||||
|
OJPEGReadHeaderInfoSecTablesQTable, OJPEGReadHeaderInfoSecTablesDcTable and
|
||||||
|
OJPEGReadHeaderInfoSecTablesAcTable
|
||||||
|
|
||||||
|
Fixes CVE-2017-7594
|
||||||
|
|
||||||
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||||
|
---
|
||||||
|
libtiff/tif_ojpeg.c | 6 ++++++
|
||||||
|
1 file changed, 8 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
|
||||||
|
index b92f0ebd..5f6c684c 100644
|
||||||
|
--- a/libtiff/tif_ojpeg.c
|
||||||
|
+++ b/libtiff/tif_ojpeg.c
|
||||||
|
@@ -1790,7 +1790,10 @@ OJPEGReadHeaderInfoSecTablesQTable(TIFF* tif)
|
||||||
|
TIFFSeekFile(tif,sp->qtable_offset[m],SEEK_SET);
|
||||||
|
p=(uint32)TIFFReadFile(tif,&ob[sizeof(uint32)+5],64);
|
||||||
|
if (p!=64)
|
||||||
|
+ {
|
||||||
|
+ _TIFFfree(ob);
|
||||||
|
return(0);
|
||||||
|
+ }
|
||||||
|
sp->qtable[m]=ob;
|
||||||
|
sp->sof_tq[m]=m;
|
||||||
|
}
|
||||||
|
@@ -1854,7 +1857,10 @@ OJPEGReadHeaderInfoSecTablesDcTable(TIFF* tif)
|
||||||
|
rb[sizeof(uint32)+5+n]=o[n];
|
||||||
|
p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q);
|
||||||
|
if (p!=q)
|
||||||
|
+ {
|
||||||
|
+ _TIFFfree(rb);
|
||||||
|
return(0);
|
||||||
|
+ }
|
||||||
|
sp->dctable[m]=rb;
|
||||||
|
sp->sos_tda[m]=(m<<4);
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
||||||
@ -0,0 +1,36 @@
|
|||||||
|
From 8283e4d1b7e53340684d12932880cbcbaf23a8c1 Mon Sep 17 00:00:00 2001
|
||||||
|
From: erouault <erouault>
|
||||||
|
Date: Thu, 12 Jan 2017 17:43:25 +0000
|
||||||
|
Subject: [PATCH] libtiff/tif_ojpeg.c: fix leak in
|
||||||
|
OJPEGReadHeaderInfoSecTablesAcTable when read fails.
|
||||||
|
Patch by Nicolás Peña.
|
||||||
|
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2659
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
Fixes CVE-2017-7594
|
||||||
|
|
||||||
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||||
|
---
|
||||||
|
libtiff/tif_ojpeg.c | 3 +++
|
||||||
|
1 file changed, 10 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
|
||||||
|
index f19e8fd0..b92f0ebd 100644
|
||||||
|
--- a/libtiff/tif_ojpeg.c
|
||||||
|
+++ b/libtiff/tif_ojpeg.c
|
||||||
|
@@ -1918,7 +1918,10 @@ OJPEGReadHeaderInfoSecTablesAcTable(TIFF* tif)
|
||||||
|
rb[sizeof(uint32)+5+n]=o[n];
|
||||||
|
p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q);
|
||||||
|
if (p!=q)
|
||||||
|
+ {
|
||||||
|
+ _TIFFfree(rb);
|
||||||
|
return(0);
|
||||||
|
+ }
|
||||||
|
sp->actable[m]=rb;
|
||||||
|
sp->sos_tda[m]=(sp->sos_tda[m]|m);
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
||||||
@ -0,0 +1,35 @@
|
|||||||
|
From 47f2fb61a3a64667bce1a8398a8fcb1b348ff122 Mon Sep 17 00:00:00 2001
|
||||||
|
From: erouault <erouault>
|
||||||
|
Date: Wed, 11 Jan 2017 12:15:01 +0000
|
||||||
|
Subject: [PATCH] * libtiff/tif_jpeg.c: avoid integer division by zero in
|
||||||
|
JPEGSetupEncode() when horizontal or vertical sampling is set to 0. Fixes
|
||||||
|
http://bugzilla.maptools.org/show_bug.cgi?id=2653
|
||||||
|
|
||||||
|
Fixes CVE-2017-7595
|
||||||
|
|
||||||
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||||
|
---
|
||||||
|
libtiff/tif_jpeg.c | 7 +++++++
|
||||||
|
1 file changed, 13 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_jpeg.c b/libtiff/tif_jpeg.c
|
||||||
|
index 38595f98..6c17c388 100644
|
||||||
|
--- a/libtiff/tif_jpeg.c
|
||||||
|
+++ b/libtiff/tif_jpeg.c
|
||||||
|
@@ -1626,6 +1626,13 @@ JPEGSetupEncode(TIFF* tif)
|
||||||
|
case PHOTOMETRIC_YCBCR:
|
||||||
|
sp->h_sampling = td->td_ycbcrsubsampling[0];
|
||||||
|
sp->v_sampling = td->td_ycbcrsubsampling[1];
|
||||||
|
+ if( sp->h_sampling == 0 || sp->v_sampling == 0 )
|
||||||
|
+ {
|
||||||
|
+ TIFFErrorExt(tif->tif_clientdata, module,
|
||||||
|
+ "Invalig horizontal/vertical sampling value");
|
||||||
|
+ return (0);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* A ReferenceBlackWhite field *must* be present since the
|
||||||
|
* default value is inappropriate for YCbCr. Fill in the
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
||||||
@ -0,0 +1,47 @@
|
|||||||
|
From 3cfd62d77c2a7e147a05bd678524c345fa9c2bb8 Mon Sep 17 00:00:00 2001
|
||||||
|
From: erouault <erouault>
|
||||||
|
Date: Wed, 11 Jan 2017 13:28:01 +0000
|
||||||
|
Subject: [PATCH] * libtiff/tif_dirread.c: avoid division by floating point 0
|
||||||
|
in TIFFReadDirEntryCheckedRational() and TIFFReadDirEntryCheckedSrational(),
|
||||||
|
and return 0 in that case (instead of infinity as before presumably)
|
||||||
|
Apparently some sanitizers do not like those divisions by zero. Fixes
|
||||||
|
http://bugzilla.maptools.org/show_bug.cgi?id=2644
|
||||||
|
|
||||||
|
Fixes CVE-2017-7598
|
||||||
|
|
||||||
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||||
|
---
|
||||||
|
libtiff/tif_dirread.c | 10 ++++++++--
|
||||||
|
1 file changed, 16 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
|
||||||
|
index 570d0c32..8a1e42aa 100644
|
||||||
|
--- a/libtiff/tif_dirread.c
|
||||||
|
+++ b/libtiff/tif_dirread.c
|
||||||
|
@@ -2872,7 +2872,10 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFD
|
||||||
|
m.l = direntry->tdir_offset.toff_long8;
|
||||||
|
if (tif->tif_flags&TIFF_SWAB)
|
||||||
|
TIFFSwabArrayOfLong(m.i,2);
|
||||||
|
- if (m.i[0]==0)
|
||||||
|
+ /* Not completely sure what we should do when m.i[1]==0, but some */
|
||||||
|
+ /* sanitizers do not like division by 0.0: */
|
||||||
|
+ /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
|
||||||
|
+ if (m.i[0]==0 || m.i[1]==0)
|
||||||
|
*value=0.0;
|
||||||
|
else
|
||||||
|
*value=(double)m.i[0]/(double)m.i[1];
|
||||||
|
@@ -2900,7 +2903,10 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFF
|
||||||
|
m.l=direntry->tdir_offset.toff_long8;
|
||||||
|
if (tif->tif_flags&TIFF_SWAB)
|
||||||
|
TIFFSwabArrayOfLong(m.i,2);
|
||||||
|
- if ((int32)m.i[0]==0)
|
||||||
|
+ /* Not completely sure what we should do when m.i[1]==0, but some */
|
||||||
|
+ /* sanitizers do not like division by 0.0: */
|
||||||
|
+ /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
|
||||||
|
+ if ((int32)m.i[0]==0 || m.i[1]==0)
|
||||||
|
*value=0.0;
|
||||||
|
else
|
||||||
|
*value=(double)((int32)m.i[0])/(double)m.i[1];
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
||||||
@ -0,0 +1,35 @@
|
|||||||
|
From 0a76a8c765c7b8327c59646284fa78c3c27e5490 Mon Sep 17 00:00:00 2001
|
||||||
|
From: erouault <erouault>
|
||||||
|
Date: Wed, 11 Jan 2017 16:13:50 +0000
|
||||||
|
Subject: [PATCH] * libtiff/tif_jpeg.c: validate BitsPerSample in
|
||||||
|
JPEGSetupEncode() to avoid undefined behaviour caused by invalid shift
|
||||||
|
exponent. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2648
|
||||||
|
|
||||||
|
Fixes CVE-2017-7601
|
||||||
|
|
||||||
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||||
|
---
|
||||||
|
libtiff/tif_jpeg.c | 7 +++++++
|
||||||
|
1 file changed, 13 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_jpeg.c b/libtiff/tif_jpeg.c
|
||||||
|
index 6c17c388..192989a9 100644
|
||||||
|
--- a/libtiff/tif_jpeg.c
|
||||||
|
+++ b/libtiff/tif_jpeg.c
|
||||||
|
@@ -1632,6 +1632,13 @@ JPEGSetupEncode(TIFF* tif)
|
||||||
|
"Invalig horizontal/vertical sampling value");
|
||||||
|
return (0);
|
||||||
|
}
|
||||||
|
+ if( td->td_bitspersample > 16 )
|
||||||
|
+ {
|
||||||
|
+ TIFFErrorExt(tif->tif_clientdata, module,
|
||||||
|
+ "BitsPerSample %d not allowed for JPEG",
|
||||||
|
+ td->td_bitspersample);
|
||||||
|
+ return (0);
|
||||||
|
+ }
|
||||||
|
|
||||||
|
/*
|
||||||
|
* A ReferenceBlackWhite field *must* be present since the
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
||||||
@ -0,0 +1,56 @@
|
|||||||
|
From 66e7bd59520996740e4df5495a830b42fae48bc4 Mon Sep 17 00:00:00 2001
|
||||||
|
From: erouault <erouault>
|
||||||
|
Date: Wed, 11 Jan 2017 16:33:34 +0000
|
||||||
|
Subject: [PATCH] * libtiff/tif_read.c: avoid potential undefined behaviour on
|
||||||
|
signed integer addition in TIFFReadRawStrip1() in isMapped() case. Fixes
|
||||||
|
http://bugzilla.maptools.org/show_bug.cgi?id=2650
|
||||||
|
|
||||||
|
Fixes CVE-2017-7602
|
||||||
|
|
||||||
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||||
|
---
|
||||||
|
libtiff/tif_read.c | 27 ++++++++++++++++++---------
|
||||||
|
1 file changed, 24 insertions(+), 9 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
|
||||||
|
index 52bbf507..b7aacbda 100644
|
||||||
|
--- a/libtiff/tif_read.c
|
||||||
|
+++ b/libtiff/tif_read.c
|
||||||
|
@@ -420,16 +420,25 @@ TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size,
|
||||||
|
return ((tmsize_t)(-1));
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
- tmsize_t ma,mb;
|
||||||
|
+ tmsize_t ma;
|
||||||
|
tmsize_t n;
|
||||||
|
- ma=(tmsize_t)td->td_stripoffset[strip];
|
||||||
|
- mb=ma+size;
|
||||||
|
- if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||(ma>tif->tif_size))
|
||||||
|
- n=0;
|
||||||
|
- else if ((mb<ma)||(mb<size)||(mb>tif->tif_size))
|
||||||
|
- n=tif->tif_size-ma;
|
||||||
|
- else
|
||||||
|
- n=size;
|
||||||
|
+ if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||
|
||||||
|
+ ((ma=(tmsize_t)td->td_stripoffset[strip])>tif->tif_size))
|
||||||
|
+ {
|
||||||
|
+ n=0;
|
||||||
|
+ }
|
||||||
|
+ else if( ma > TIFF_TMSIZE_T_MAX - size )
|
||||||
|
+ {
|
||||||
|
+ n=0;
|
||||||
|
+ }
|
||||||
|
+ else
|
||||||
|
+ {
|
||||||
|
+ tmsize_t mb=ma+size;
|
||||||
|
+ if (mb>tif->tif_size)
|
||||||
|
+ n=tif->tif_size-ma;
|
||||||
|
+ else
|
||||||
|
+ n=size;
|
||||||
|
+ }
|
||||||
|
if (n!=size) {
|
||||||
|
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
|
||||||
|
TIFFErrorExt(tif->tif_clientdata, module,
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
||||||
Loading…
x
Reference in New Issue
Block a user