|
 |
1ad933 |
From 46d1b6c09939eef09e45ccec345c6724cabc454e Mon Sep 17 00:00:00 2001
|
|
|
1ad933 |
From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
|
|
|
1ad933 |
Date: Mon, 11 Jul 2016 16:44:22 +0200
|
|
|
1ad933 |
Subject: [PATCH 6/8] Fix CVE-2016-3990
|
|
|
1ad933 |
|
|
|
1ad933 |
---
|
|
|
1ad933 |
libtiff/tif_pixarlog.c | 18 +++++++++++++++++-
|
|
|
1ad933 |
1 file changed, 17 insertions(+), 1 deletion(-)
|
|
|
1ad933 |
|
|
|
1ad933 |
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
|
|
|
1ad933 |
index 2793b22..c9f056e 100644
|
|
|
1ad933 |
--- a/libtiff/tif_pixarlog.c
|
|
|
1ad933 |
+++ b/libtiff/tif_pixarlog.c
|
|
|
1ad933 |
@@ -462,6 +462,7 @@ typedef struct {
|
|
|
1ad933 |
int state;
|
|
|
1ad933 |
int user_datafmt;
|
|
|
1ad933 |
int quality;
|
|
|
1ad933 |
+ tsize_t tbuf_size;
|
|
|
1ad933 |
#define PLSTATE_INIT 1
|
|
|
1ad933 |
|
|
|
1ad933 |
TIFFVSetMethod vgetparent; /* super-class method */
|
|
|
1ad933 |
@@ -885,6 +886,7 @@ PixarLogSetupEncode(TIFF* tif)
|
|
|
1ad933 |
td->td_samplesperpixel : 1);
|
|
|
1ad933 |
tbuf_size = multiply_ms(multiply_ms(multiply_ms(sp->stride, td->td_imagewidth),
|
|
|
1ad933 |
td->td_rowsperstrip), sizeof(uint16));
|
|
|
1ad933 |
+ sp->tbuf_size = tbuf_size;
|
|
|
1ad933 |
if (tbuf_size == 0)
|
|
|
1ad933 |
return (0); /* TODO: this is an error return without error report through TIFFErrorExt */
|
|
|
1ad933 |
sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size);
|
|
|
1ad933 |
@@ -1131,8 +1133,17 @@ PixarLogEncode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
|
|
|
1ad933 |
}
|
|
|
1ad933 |
|
|
|
1ad933 |
llen = sp->stride * td->td_imagewidth;
|
|
|
1ad933 |
-
|
|
|
1ad933 |
+ if (llen > sp->tbuf_size)
|
|
|
1ad933 |
+ {
|
|
|
1ad933 |
+ TIFFErrorExt(tif->tif_clientdata, module, "%s: Encoder error: Buffer limit reached.", tif->tif_name);
|
|
|
1ad933 |
+ exit (0);
|
|
|
1ad933 |
+ }
|
|
|
1ad933 |
for (i = 0, up = sp->tbuf; i < n; i += llen, up += llen) {
|
|
|
1ad933 |
+ if (up > sp->tbuf+sp->tbuf_size)
|
|
|
1ad933 |
+ {
|
|
|
1ad933 |
+ TIFFErrorExt(tif->tif_clientdata, module, "%s: Encoder error: Buffer limit reached.", tif->tif_name);
|
|
|
1ad933 |
+ exit (0);
|
|
|
1ad933 |
+ }
|
|
|
1ad933 |
switch (sp->user_datafmt) {
|
|
|
1ad933 |
case PIXARLOGDATAFMT_FLOAT:
|
|
|
1ad933 |
horizontalDifferenceF((float *)bp, llen,
|
|
|
1ad933 |
@@ -1169,6 +1180,11 @@ PixarLogEncode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
|
|
|
1ad933 |
"ZLib cannot deal with buffers this size");
|
|
|
1ad933 |
return (0);
|
|
|
1ad933 |
}
|
|
|
1ad933 |
+ if (sp->stream.avail_in > sp->tbuf_size)
|
|
|
1ad933 |
+ {
|
|
|
1ad933 |
+ TIFFErrorExt(tif->tif_clientdata, module, "%s: Encoder error: Error within the calculation on ZLib buffer size.", tif->tif_name);
|
|
|
1ad933 |
+ return (0);
|
|
|
1ad933 |
+ }
|
|
|
1ad933 |
|
|
|
1ad933 |
do {
|
|
|
1ad933 |
if (deflate(&sp->stream, Z_NO_FLUSH) != Z_OK) {
|
|
|
1ad933 |
--
|
|
|
1ad933 |
2.7.4
|
|
|
1ad933 |
|