|
 |
460672 |
From 5f3ae40bcaf5518aae18eedc90cd9b326d7bd640 Mon Sep 17 00:00:00 2001
|
|
|
460672 |
From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
|
|
|
460672 |
Date: Mon, 11 Jul 2016 16:54:49 +0200
|
|
|
460672 |
Subject: [PATCH 8/8] Fix CVE-2016-5320
|
|
|
460672 |
|
|
|
460672 |
---
|
|
|
460672 |
libtiff/tif_pixarlog.c | 8 +++++++-
|
|
|
460672 |
1 file changed, 7 insertions(+), 1 deletion(-)
|
|
|
460672 |
|
|
|
460672 |
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
|
|
|
460672 |
index c9f056e..c961529 100644
|
|
|
460672 |
--- a/libtiff/tif_pixarlog.c
|
|
|
460672 |
+++ b/libtiff/tif_pixarlog.c
|
|
|
460672 |
@@ -462,7 +462,7 @@ typedef struct {
|
|
|
460672 |
int state;
|
|
|
460672 |
int user_datafmt;
|
|
|
460672 |
int quality;
|
|
|
460672 |
- tsize_t tbuf_size;
|
|
|
460672 |
+ tmsize_t tbuf_size;
|
|
|
460672 |
#define PLSTATE_INIT 1
|
|
|
460672 |
|
|
|
460672 |
TIFFVSetMethod vgetparent; /* super-class method */
|
|
|
460672 |
@@ -691,6 +691,7 @@ PixarLogSetupDecode(TIFF* tif)
|
|
|
460672 |
if (tbuf_size == 0)
|
|
|
460672 |
return (0); /* TODO: this is an error return without error report through TIFFErrorExt */
|
|
|
460672 |
sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size);
|
|
|
460672 |
+ sp->tbuf_size = tbuf_size;
|
|
|
460672 |
if (sp->tbuf == NULL)
|
|
|
460672 |
return (0);
|
|
|
460672 |
if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN)
|
|
|
460672 |
@@ -782,6 +783,11 @@ PixarLogDecode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s)
|
|
|
460672 |
TIFFErrorExt(tif->tif_clientdata, module, "ZLib cannot deal with buffers this size");
|
|
|
460672 |
return (0);
|
|
|
460672 |
}
|
|
|
460672 |
+ if (sp->stream.avail_out > sp->tbuf_size)
|
|
|
460672 |
+ {
|
|
|
460672 |
+ TIFFErrorExt(tif->tif_clientdata, module, "Error within the calculation of ZLib buffer size");
|
|
|
460672 |
+ return (0);
|
|
|
460672 |
+ }
|
|
|
460672 |
do {
|
|
|
460672 |
int state = inflate(&sp->stream, Z_PARTIAL_FLUSH);
|
|
|
460672 |
if (state == Z_STREAM_END) {
|
|
|
460672 |
--
|
|
|
460672 |
2.7.4
|
|
|
460672 |
|