|
 |
edc570 |
From 44ef4d3a8e92171f7470620649e8911a8056297c Mon Sep 17 00:00:00 2001
|
|
|
b03815 |
From: Even Rouault <even.rouault@spatialys.com>
|
|
|
b03815 |
Date: Tue, 30 Oct 2018 18:50:27 +0100
|
|
|
edc570 |
Subject: [PATCH] (CVE-2018-18661) tiff2bw: avoid null pointer dereference in
|
|
|
edc570 |
case of out of memory situation. Fixes
|
|
|
edc570 |
http://bugzilla.maptools.org/show_bug.cgi?id=2819 / CVE-2018-18661
|
|
|
b03815 |
|
|
|
edc570 |
(cherry picked from commit 99b10edde9a0fc28cc0e7b7757aa18ac4c8c225f)
|
|
|
b03815 |
---
|
|
|
b03815 |
libtiff/tiffiop.h | 1 +
|
|
|
b03815 |
tools/tiff2bw.c | 30 ++++++++++++++++++++++++++----
|
|
|
b03815 |
tools/tiffcrop.c | 5 -----
|
|
|
b03815 |
3 files changed, 27 insertions(+), 9 deletions(-)
|
|
|
b03815 |
|
|
|
b03815 |
diff --git a/libtiff/tiffiop.h b/libtiff/tiffiop.h
|
|
|
edc570 |
index daa291c0..08e5dc44 100644
|
|
|
b03815 |
--- a/libtiff/tiffiop.h
|
|
|
b03815 |
+++ b/libtiff/tiffiop.h
|
|
|
b03815 |
@@ -72,6 +72,7 @@ extern int snprintf(char* str, size_t size, const char* format, ...);
|
|
|
b03815 |
#endif
|
|
|
b03815 |
|
|
|
b03815 |
#define streq(a,b) (strcmp(a,b) == 0)
|
|
|
b03815 |
+#define strneq(a,b,n) (strncmp(a,b,n) == 0)
|
|
|
b03815 |
|
|
|
b03815 |
#ifndef TRUE
|
|
|
b03815 |
#define TRUE 1
|
|
|
b03815 |
diff --git a/tools/tiff2bw.c b/tools/tiff2bw.c
|
|
|
edc570 |
index dad54afa..1f3bb2cd 100644
|
|
|
b03815 |
--- a/tools/tiff2bw.c
|
|
|
b03815 |
+++ b/tools/tiff2bw.c
|
|
|
b03815 |
@@ -40,9 +40,7 @@
|
|
|
b03815 |
#endif
|
|
|
b03815 |
|
|
|
b03815 |
#include "tiffio.h"
|
|
|
b03815 |
-
|
|
|
b03815 |
-#define streq(a,b) (strcmp((a),(b)) == 0)
|
|
|
b03815 |
-#define strneq(a,b,n) (strncmp(a,b,n) == 0)
|
|
|
b03815 |
+#include "tiffiop.h"
|
|
|
b03815 |
|
|
|
b03815 |
/* x% weighting -> fraction of full color */
|
|
|
b03815 |
#define PCT(x) (((x)*256+50)/100)
|
|
|
b03815 |
@@ -223,6 +221,11 @@ main(int argc, char* argv[])
|
|
|
b03815 |
TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, thing);
|
|
|
b03815 |
TIFFSetField(out, TIFFTAG_SOFTWARE, "tiff2bw");
|
|
|
b03815 |
outbuf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
|
|
|
b03815 |
+ if( !outbuf )
|
|
|
b03815 |
+ {
|
|
|
b03815 |
+ fprintf(stderr, "Out of memory\n");
|
|
|
b03815 |
+ goto tiff2bw_error;
|
|
|
b03815 |
+ }
|
|
|
b03815 |
TIFFSetField(out, TIFFTAG_ROWSPERSTRIP,
|
|
|
b03815 |
TIFFDefaultStripSize(out, rowsperstrip));
|
|
|
b03815 |
|
|
|
b03815 |
@@ -246,6 +249,11 @@ main(int argc, char* argv[])
|
|
|
b03815 |
#undef CVT
|
|
|
b03815 |
}
|
|
|
b03815 |
inbuf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
|
|
|
b03815 |
+ if( !inbuf )
|
|
|
b03815 |
+ {
|
|
|
b03815 |
+ fprintf(stderr, "Out of memory\n");
|
|
|
b03815 |
+ goto tiff2bw_error;
|
|
|
b03815 |
+ }
|
|
|
b03815 |
for (row = 0; row < h; row++) {
|
|
|
b03815 |
if (TIFFReadScanline(in, inbuf, row, 0) < 0)
|
|
|
b03815 |
break;
|
|
|
b03815 |
@@ -256,6 +264,11 @@ main(int argc, char* argv[])
|
|
|
b03815 |
break;
|
|
|
b03815 |
case pack(PHOTOMETRIC_RGB, PLANARCONFIG_CONTIG):
|
|
|
b03815 |
inbuf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
|
|
|
b03815 |
+ if( !inbuf )
|
|
|
b03815 |
+ {
|
|
|
b03815 |
+ fprintf(stderr, "Out of memory\n");
|
|
|
b03815 |
+ goto tiff2bw_error;
|
|
|
b03815 |
+ }
|
|
|
b03815 |
for (row = 0; row < h; row++) {
|
|
|
b03815 |
if (TIFFReadScanline(in, inbuf, row, 0) < 0)
|
|
|
b03815 |
break;
|
|
|
b03815 |
@@ -265,8 +278,16 @@ main(int argc, char* argv[])
|
|
|
b03815 |
}
|
|
|
b03815 |
break;
|
|
|
b03815 |
case pack(PHOTOMETRIC_RGB, PLANARCONFIG_SEPARATE):
|
|
|
b03815 |
+ {
|
|
|
b03815 |
+ tmsize_t inbufsize;
|
|
|
b03815 |
rowsize = TIFFScanlineSize(in);
|
|
|
b03815 |
- inbuf = (unsigned char *)_TIFFmalloc(3*rowsize);
|
|
|
b03815 |
+ inbufsize = TIFFSafeMultiply(tmsize_t, 3, rowsize);
|
|
|
b03815 |
+ inbuf = (unsigned char *)_TIFFmalloc(inbufsize);
|
|
|
b03815 |
+ if( !inbuf )
|
|
|
b03815 |
+ {
|
|
|
b03815 |
+ fprintf(stderr, "Out of memory\n");
|
|
|
b03815 |
+ goto tiff2bw_error;
|
|
|
b03815 |
+ }
|
|
|
b03815 |
for (row = 0; row < h; row++) {
|
|
|
b03815 |
for (s = 0; s < 3; s++)
|
|
|
b03815 |
if (TIFFReadScanline(in,
|
|
|
b03815 |
@@ -278,6 +299,7 @@ main(int argc, char* argv[])
|
|
|
b03815 |
break;
|
|
|
b03815 |
}
|
|
|
b03815 |
break;
|
|
|
b03815 |
+ }
|
|
|
b03815 |
}
|
|
|
b03815 |
#undef pack
|
|
|
b03815 |
if (inbuf)
|
|
|
b03815 |
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
|
|
|
edc570 |
index c60cb389..3862b1ca 100644
|
|
|
b03815 |
--- a/tools/tiffcrop.c
|
|
|
b03815 |
+++ b/tools/tiffcrop.c
|
|
|
b03815 |
@@ -150,11 +150,6 @@ extern int getopt(int argc, char * const argv[], const char *optstring);
|
|
|
b03815 |
|
|
|
b03815 |
#define TIFF_UINT32_MAX 0xFFFFFFFFU
|
|
|
b03815 |
|
|
|
b03815 |
-#ifndef streq
|
|
|
b03815 |
-#define streq(a,b) (strcmp((a),(b)) == 0)
|
|
|
b03815 |
-#endif
|
|
|
b03815 |
-#define strneq(a,b,n) (strncmp((a),(b),(n)) == 0)
|
|
|
b03815 |
-
|
|
|
b03815 |
#define TRUE 1
|
|
|
b03815 |
#define FALSE 0
|
|
|
b03815 |
|