|
 |
ccba1e |
From 8f70b086e6553b4d41aaff2c5fb4266859436626 Mon Sep 17 00:00:00 2001
|
|
|
4d0001 |
From: Thomas Bernard <miniupnp@free.fr>
|
|
|
4d0001 |
Date: Sun, 15 Nov 2020 17:02:51 +0100
|
|
|
ccba1e |
Subject: [PATCH] (CVE-2020-35521 CVE-2020-35522) enforce (configurable) memory
|
|
|
ccba1e |
limit in tiff2rgba
|
|
|
4d0001 |
|
|
|
4d0001 |
fixes #207
|
|
|
4d0001 |
fixes #209
|
|
|
ccba1e |
|
|
|
ccba1e |
(cherry picked from commit 98a254f5b92cea22f5436555ff7fceb12afee84d)
|
|
|
4d0001 |
---
|
|
|
4d0001 |
tools/tiff2rgba.c | 25 +++++++++++++++++++++++--
|
|
|
4d0001 |
1 file changed, 23 insertions(+), 2 deletions(-)
|
|
|
4d0001 |
|
|
|
4d0001 |
diff --git a/tools/tiff2rgba.c b/tools/tiff2rgba.c
|
|
|
ccba1e |
index 4de96aec..e6de2209 100644
|
|
|
4d0001 |
--- a/tools/tiff2rgba.c
|
|
|
4d0001 |
+++ b/tools/tiff2rgba.c
|
|
|
4d0001 |
@@ -55,6 +55,10 @@ uint32 rowsperstrip = (uint32) -1;
|
|
|
4d0001 |
int process_by_block = 0; /* default is whole image at once */
|
|
|
4d0001 |
int no_alpha = 0;
|
|
|
4d0001 |
int bigtiff_output = 0;
|
|
|
4d0001 |
+#define DEFAULT_MAX_MALLOC (256 * 1024 * 1024)
|
|
|
4d0001 |
+/* malloc size limit (in bytes)
|
|
|
4d0001 |
+ * disabled when set to 0 */
|
|
|
4d0001 |
+static tmsize_t maxMalloc = DEFAULT_MAX_MALLOC;
|
|
|
4d0001 |
|
|
|
4d0001 |
|
|
|
4d0001 |
static int tiffcvt(TIFF* in, TIFF* out);
|
|
|
4d0001 |
@@ -70,8 +74,11 @@ main(int argc, char* argv[])
|
|
|
4d0001 |
extern char *optarg;
|
|
|
4d0001 |
#endif
|
|
|
4d0001 |
|
|
|
4d0001 |
- while ((c = getopt(argc, argv, "c:r:t:bn8")) != -1)
|
|
|
4d0001 |
+ while ((c = getopt(argc, argv, "c:r:t:bn8M:")) != -1)
|
|
|
4d0001 |
switch (c) {
|
|
|
4d0001 |
+ case 'M':
|
|
|
4d0001 |
+ maxMalloc = (tmsize_t)strtoul(optarg, NULL, 0) << 20;
|
|
|
4d0001 |
+ break;
|
|
|
4d0001 |
case 'b':
|
|
|
4d0001 |
process_by_block = 1;
|
|
|
4d0001 |
break;
|
|
|
4d0001 |
@@ -397,6 +404,12 @@ cvt_whole_image( TIFF *in, TIFF *out )
|
|
|
4d0001 |
(unsigned long)width, (unsigned long)height);
|
|
|
4d0001 |
return 0;
|
|
|
4d0001 |
}
|
|
|
4d0001 |
+ if (maxMalloc != 0 && (tmsize_t)pixel_count * (tmsize_t)sizeof(uint32) > maxMalloc) {
|
|
|
4d0001 |
+ TIFFError(TIFFFileName(in),
|
|
|
4d0001 |
+ "Raster size " TIFF_UINT64_FORMAT " over memory limit (" TIFF_UINT64_FORMAT "), try -b option.",
|
|
|
4d0001 |
+ (uint64)pixel_count * sizeof(uint32), (uint64)maxMalloc);
|
|
|
4d0001 |
+ return 0;
|
|
|
4d0001 |
+ }
|
|
|
4d0001 |
|
|
|
4d0001 |
rowsperstrip = TIFFDefaultStripSize(out, rowsperstrip);
|
|
|
4d0001 |
TIFFSetField(out, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
|
|
|
4d0001 |
@@ -522,6 +535,13 @@ tiffcvt(TIFF* in, TIFF* out)
|
|
|
4d0001 |
TIFFSetField(out, TIFFTAG_SOFTWARE, TIFFGetVersion());
|
|
|
4d0001 |
CopyField(TIFFTAG_DOCUMENTNAME, stringv);
|
|
|
4d0001 |
|
|
|
4d0001 |
+ if (maxMalloc != 0 && TIFFStripSize(in) > maxMalloc)
|
|
|
4d0001 |
+ {
|
|
|
4d0001 |
+ TIFFError(TIFFFileName(in),
|
|
|
4d0001 |
+ "Strip Size " TIFF_UINT64_FORMAT " over memory limit (" TIFF_UINT64_FORMAT ")",
|
|
|
4d0001 |
+ (uint64)TIFFStripSize(in), (uint64)maxMalloc);
|
|
|
4d0001 |
+ return 0;
|
|
|
4d0001 |
+ }
|
|
|
4d0001 |
if( process_by_block && TIFFIsTiled( in ) )
|
|
|
4d0001 |
return( cvt_by_tile( in, out ) );
|
|
|
4d0001 |
else if( process_by_block )
|
|
|
4d0001 |
@@ -531,7 +551,7 @@ tiffcvt(TIFF* in, TIFF* out)
|
|
|
4d0001 |
}
|
|
|
4d0001 |
|
|
|
4d0001 |
static char* stuff[] = {
|
|
|
4d0001 |
- "usage: tiff2rgba [-c comp] [-r rows] [-b] [-n] [-8] input... output",
|
|
|
4d0001 |
+ "usage: tiff2rgba [-c comp] [-r rows] [-b] [-n] [-8] [-M size] input... output",
|
|
|
4d0001 |
"where comp is one of the following compression algorithms:",
|
|
|
4d0001 |
" jpeg\t\tJPEG encoding",
|
|
|
4d0001 |
" zip\t\tZip/Deflate encoding",
|
|
|
4d0001 |
@@ -543,6 +563,7 @@ static char* stuff[] = {
|
|
|
4d0001 |
" -b (progress by block rather than as a whole image)",
|
|
|
4d0001 |
" -n don't emit alpha component.",
|
|
|
4d0001 |
" -8 write BigTIFF file instead of ClassicTIFF",
|
|
|
4d0001 |
+ " -M set the memory allocation limit in MiB. 0 to disable limit",
|
|
|
4d0001 |
NULL
|
|
|
4d0001 |
};
|
|
|
4d0001 |
|