|
 |
1ad933 |
From a777efdb86da87073511e56e8fc4ef63fc111b5f Mon Sep 17 00:00:00 2001
|
|
|
1ad933 |
From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
|
|
|
1ad933 |
Date: Mon, 11 Jul 2016 15:50:56 +0200
|
|
|
1ad933 |
Subject: [PATCH 1/8] Fix CVE-2014-9655
|
|
|
1ad933 |
|
|
|
1ad933 |
---
|
|
|
1ad933 |
libtiff/tif_getimage.c | 20 ++++++++++++++------
|
|
|
1ad933 |
libtiff/tif_next.c | 4 +++-
|
|
|
1ad933 |
2 files changed, 17 insertions(+), 7 deletions(-)
|
|
|
1ad933 |
|
|
|
1ad933 |
diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
|
|
|
1ad933 |
index a85273c..1c1cf9e 100644
|
|
|
1ad933 |
--- a/libtiff/tif_getimage.c
|
|
|
1ad933 |
+++ b/libtiff/tif_getimage.c
|
|
|
1ad933 |
@@ -842,6 +842,12 @@ gtStripContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
|
|
|
1ad933 |
int32 fromskew, toskew;
|
|
|
1ad933 |
int ret = 1, flip;
|
|
|
1ad933 |
|
|
|
1ad933 |
+ TIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING, &subsamplinghor, &subsamplingver);
|
|
|
1ad933 |
+ if( subsamplingver == 0 ) {
|
|
|
1ad933 |
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Invalid vertical YCbCr subsampling");
|
|
|
1ad933 |
+ return (0);
|
|
|
1ad933 |
+ }
|
|
|
1ad933 |
+
|
|
|
1ad933 |
buf = (unsigned char*) _TIFFmalloc(TIFFStripSize(tif));
|
|
|
1ad933 |
if (buf == 0) {
|
|
|
1ad933 |
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for strip buffer");
|
|
|
1ad933 |
@@ -859,7 +865,7 @@ gtStripContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
|
|
|
1ad933 |
}
|
|
|
1ad933 |
|
|
|
1ad933 |
TIFFGetFieldDefaulted(tif, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
|
|
|
1ad933 |
- TIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING, &subsamplinghor, &subsamplingver);
|
|
|
1ad933 |
+
|
|
|
1ad933 |
scanline = TIFFScanlineSize(tif);
|
|
|
1ad933 |
fromskew = (w < imagewidth ? imagewidth - w : 0);
|
|
|
1ad933 |
for (row = 0; row < h; row += nrow)
|
|
|
1ad933 |
@@ -1852,7 +1858,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
|
|
|
1ad933 |
|
|
|
1ad933 |
(void) y;
|
|
|
1ad933 |
fromskew = (fromskew * 10) / 4;
|
|
|
1ad933 |
- if ((h & 3) == 0 && (w & 1) == 0) {
|
|
|
1ad933 |
+ if ((w & 3) == 0 && (h & 1) == 0) {
|
|
|
1ad933 |
for (; h >= 2; h -= 2) {
|
|
|
1ad933 |
x = w>>2;
|
|
|
1ad933 |
do {
|
|
|
1ad933 |
@@ -1929,7 +1935,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr41tile)
|
|
|
1ad933 |
/* XXX adjust fromskew */
|
|
|
1ad933 |
do {
|
|
|
1ad933 |
x = w>>2;
|
|
|
1ad933 |
- do {
|
|
|
1ad933 |
+ while(x>0) {
|
|
|
1ad933 |
int32 Cb = pp[4];
|
|
|
1ad933 |
int32 Cr = pp[5];
|
|
|
1ad933 |
|
|
|
1ad933 |
@@ -1940,7 +1946,8 @@ DECLAREContigPutFunc(putcontig8bitYCbCr41tile)
|
|
|
1ad933 |
|
|
|
1ad933 |
cp += 4;
|
|
|
1ad933 |
pp += 6;
|
|
|
1ad933 |
- } while (--x);
|
|
|
1ad933 |
+ x--;
|
|
|
1ad933 |
+ }
|
|
|
1ad933 |
|
|
|
1ad933 |
if( (w&3) != 0 )
|
|
|
1ad933 |
{
|
|
|
1ad933 |
@@ -2031,7 +2038,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr21tile)
|
|
|
1ad933 |
fromskew = (fromskew * 4) / 2;
|
|
|
1ad933 |
do {
|
|
|
1ad933 |
x = w>>1;
|
|
|
1ad933 |
- do {
|
|
|
1ad933 |
+ while(x>0) {
|
|
|
1ad933 |
int32 Cb = pp[2];
|
|
|
1ad933 |
int32 Cr = pp[3];
|
|
|
1ad933 |
|
|
|
1ad933 |
@@ -2040,7 +2047,8 @@ DECLAREContigPutFunc(putcontig8bitYCbCr21tile)
|
|
|
1ad933 |
|
|
|
1ad933 |
cp += 2;
|
|
|
1ad933 |
pp += 4;
|
|
|
1ad933 |
- } while (--x);
|
|
|
1ad933 |
+ x --;
|
|
|
1ad933 |
+ }
|
|
|
1ad933 |
|
|
|
1ad933 |
if( (w&1) != 0 )
|
|
|
1ad933 |
{
|
|
|
1ad933 |
diff --git a/libtiff/tif_next.c b/libtiff/tif_next.c
|
|
|
1ad933 |
index 524e127..92ef6ee 100644
|
|
|
1ad933 |
--- a/libtiff/tif_next.c
|
|
|
1ad933 |
+++ b/libtiff/tif_next.c
|
|
|
1ad933 |
@@ -71,7 +71,7 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
|
|
|
1ad933 |
TIFFErrorExt(tif->tif_clientdata, module, "Fractional scanlines cannot be read");
|
|
|
1ad933 |
return (0);
|
|
|
1ad933 |
}
|
|
|
1ad933 |
- for (row = buf; occ > 0; occ -= scanline, row += scanline) {
|
|
|
1ad933 |
+ for (row = buf; cc > 0 && occ > 0; occ -= scanline, row += scanline) {
|
|
|
1ad933 |
n = *bp++, cc--;
|
|
|
1ad933 |
switch (n) {
|
|
|
1ad933 |
case LITERALROW:
|
|
|
1ad933 |
@@ -90,6 +90,8 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
|
|
|
1ad933 |
* The scanline has a literal span that begins at some
|
|
|
1ad933 |
* offset.
|
|
|
1ad933 |
*/
|
|
|
1ad933 |
+ if( cc < 4 )
|
|
|
1ad933 |
+ goto bad;
|
|
|
1ad933 |
off = (bp[0] * 256) + bp[1];
|
|
|
1ad933 |
n = (bp[2] * 256) + bp[3];
|
|
|
1ad933 |
if (cc < 4+n || off+n > scanline)
|
|
|
1ad933 |
--
|
|
|
1ad933 |
2.7.4
|
|
|
1ad933 |
|