Blame SOURCES/0016-CVE-2019-17546-RGBA-interface-fix-integer-overflow-p.patch

edc570
From a1c493aa4f22f9d1a4757c05a60addc877519cea Mon Sep 17 00:00:00 2001
8dbc14
From: Even Rouault <even.rouault@spatialys.com>
8dbc14
Date: Thu, 15 Aug 2019 15:05:28 +0200
edc570
Subject: [PATCH] (CVE-2019-17546) RGBA interface: fix integer overflow
edc570
 potentially causing write heap buffer overflow, especially on 32 bit builds.
edc570
 Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443. Credit to
edc570
 OSS Fuzz
8dbc14
edc570
(cherry picked from commit 4bb584a35f87af42d6cf09d15e9ce8909a839145)
8dbc14
---
8dbc14
 libtiff/tif_getimage.c | 26 ++++++++++++++++++++------
8dbc14
 1 file changed, 20 insertions(+), 6 deletions(-)
8dbc14
8dbc14
diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
edc570
index ec09feaf..c6edd27c 100644
8dbc14
--- a/libtiff/tif_getimage.c
8dbc14
+++ b/libtiff/tif_getimage.c
8dbc14
@@ -951,16 +951,23 @@ gtStripContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
8dbc14
 	fromskew = (w < imagewidth ? imagewidth - w : 0);
8dbc14
 	for (row = 0; row < h; row += nrow)
8dbc14
 	{
8dbc14
+		uint32 temp;
8dbc14
 		rowstoread = rowsperstrip - (row + img->row_offset) % rowsperstrip;
8dbc14
 		nrow = (row + rowstoread > h ? h - row : rowstoread);
8dbc14
 		nrowsub = nrow;
8dbc14
 		if ((nrowsub%subsamplingver)!=0)
8dbc14
 			nrowsub+=subsamplingver-nrowsub%subsamplingver;
8dbc14
+		temp = (row + img->row_offset)%rowsperstrip + nrowsub;
8dbc14
+		if( scanline > 0 && temp > (size_t)(TIFF_TMSIZE_T_MAX / scanline) )
8dbc14
+		{
8dbc14
+			TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in gtStripContig");
8dbc14
+			return 0;
8dbc14
+		}
8dbc14
 		if (_TIFFReadEncodedStripAndAllocBuffer(tif,
8dbc14
 		    TIFFComputeStrip(tif,row+img->row_offset, 0),
8dbc14
 		    (void**)(&buf),
8dbc14
                     maxstripsize,
8dbc14
-		    ((row + img->row_offset)%rowsperstrip + nrowsub) * scanline)==(tmsize_t)(-1)
8dbc14
+		    temp * scanline)==(tmsize_t)(-1)
8dbc14
 		    && (buf == NULL || img->stoponerr))
8dbc14
 		{
8dbc14
 			ret = 0;
8dbc14
@@ -1053,15 +1060,22 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
8dbc14
 	fromskew = (w < imagewidth ? imagewidth - w : 0);
8dbc14
 	for (row = 0; row < h; row += nrow)
8dbc14
 	{
8dbc14
+                uint32 temp;
8dbc14
 		rowstoread = rowsperstrip - (row + img->row_offset) % rowsperstrip;
8dbc14
 		nrow = (row + rowstoread > h ? h - row : rowstoread);
8dbc14
 		offset_row = row + img->row_offset;
8dbc14
+                temp = (row + img->row_offset)%rowsperstrip + nrow;
8dbc14
+                if( scanline > 0 && temp > (size_t)(TIFF_TMSIZE_T_MAX / scanline) )
8dbc14
+                {
8dbc14
+                        TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in gtStripSeparate");
8dbc14
+                        return 0;
8dbc14
+                }
8dbc14
                 if( buf == NULL )
8dbc14
                 {
8dbc14
                     if (_TIFFReadEncodedStripAndAllocBuffer(
8dbc14
                             tif, TIFFComputeStrip(tif, offset_row, 0),
8dbc14
                             (void**) &buf, bufsize,
8dbc14
-                            ((row + img->row_offset)%rowsperstrip + nrow) * scanline)==(tmsize_t)(-1)
8dbc14
+                            temp * scanline)==(tmsize_t)(-1)
8dbc14
                         && (buf == NULL || img->stoponerr))
8dbc14
                     {
8dbc14
                             ret = 0;
8dbc14
@@ -1081,7 +1095,7 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
8dbc14
                     }
8dbc14
                 }
8dbc14
 		else if (TIFFReadEncodedStrip(tif, TIFFComputeStrip(tif, offset_row, 0),
8dbc14
-		    p0, ((row + img->row_offset)%rowsperstrip + nrow) * scanline)==(tmsize_t)(-1)
8dbc14
+		    p0, temp * scanline)==(tmsize_t)(-1)
8dbc14
 		    && img->stoponerr)
8dbc14
 		{
8dbc14
 			ret = 0;
8dbc14
@@ -1089,7 +1103,7 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
8dbc14
 		}
8dbc14
 		if (colorchannels > 1 
8dbc14
                     && TIFFReadEncodedStrip(tif, TIFFComputeStrip(tif, offset_row, 1),
8dbc14
-                                            p1, ((row + img->row_offset)%rowsperstrip + nrow) * scanline) == (tmsize_t)(-1)
8dbc14
+                                            p1, temp * scanline) == (tmsize_t)(-1)
8dbc14
 		    && img->stoponerr)
8dbc14
 		{
8dbc14
 			ret = 0;
8dbc14
@@ -1097,7 +1111,7 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
8dbc14
 		}
8dbc14
 		if (colorchannels > 1 
8dbc14
                     && TIFFReadEncodedStrip(tif, TIFFComputeStrip(tif, offset_row, 2),
8dbc14
-                                            p2, ((row + img->row_offset)%rowsperstrip + nrow) * scanline) == (tmsize_t)(-1)
8dbc14
+                                            p2, temp * scanline) == (tmsize_t)(-1)
8dbc14
 		    && img->stoponerr)
8dbc14
 		{
8dbc14
 			ret = 0;
8dbc14
@@ -1106,7 +1120,7 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
8dbc14
 		if (alpha)
8dbc14
 		{
8dbc14
 			if (TIFFReadEncodedStrip(tif, TIFFComputeStrip(tif, offset_row, colorchannels),
8dbc14
-			    pa, ((row + img->row_offset)%rowsperstrip + nrow) * scanline)==(tmsize_t)(-1)
8dbc14
+			    pa, temp * scanline)==(tmsize_t)(-1)
8dbc14
 			    && img->stoponerr)
8dbc14
 			{
8dbc14
 				ret = 0;
8dbc14
-- 
edc570
2.34.1
8dbc14