|
 |
3528ec |
From ac1ad5a48fe981a8a9b6911886894520bbe0c71e Mon Sep 17 00:00:00 2001
|
|
|
3528ec |
From: Even Rouault <even.rouault@spatialys.com>
|
|
|
3528ec |
Date: Sun, 14 Oct 2018 16:38:29 +0200
|
|
|
3528ec |
Subject: [PATCH 09/10] JBIG: fix potential out-of-bounds write in JBIGDecode()
|
|
|
3528ec |
|
|
|
3528ec |
JBIGDecode doesn't check if the user provided buffer is large enough
|
|
|
3528ec |
to store the JBIG decoded image, which can potentially cause out-of-bounds
|
|
|
3528ec |
write in the buffer.
|
|
|
3528ec |
This issue was reported and analyzed by Thomas Dullien.
|
|
|
3528ec |
|
|
|
3528ec |
Also fixes a (harmless) potential use of uninitialized memory when
|
|
|
3528ec |
tif->tif_rawsize > tif->tif_rawcc
|
|
|
3528ec |
|
|
|
3528ec |
And in case libtiff is compiled with CHUNKY_STRIP_READ_SUPPORT, make sure
|
|
|
3528ec |
that whole strip data is provided to JBIGDecode()
|
|
|
3528ec |
---
|
|
|
3528ec |
libtiff/tif_jbig.c | 32 ++++++++++++++++++++++++++------
|
|
|
3528ec |
1 file changed, 26 insertions(+), 6 deletions(-)
|
|
|
3528ec |
|
|
|
3528ec |
diff --git a/libtiff/tif_jbig.c b/libtiff/tif_jbig.c
|
|
|
3528ec |
index 37878f6..667f3ff 100644
|
|
|
3528ec |
--- a/libtiff/tif_jbig.c
|
|
|
3528ec |
+++ b/libtiff/tif_jbig.c
|
|
|
3528ec |
@@ -53,17 +53,18 @@ static int JBIGDecode(TIFF* tif, uint8* buffer, tmsize_t size, uint16 s)
|
|
|
3528ec |
struct jbg_dec_state decoder;
|
|
|
3528ec |
int decodeStatus = 0;
|
|
|
3528ec |
unsigned char* pImage = NULL;
|
|
|
3528ec |
- (void) size, (void) s;
|
|
|
3528ec |
+ unsigned long decodedSize;
|
|
|
3528ec |
+ (void) s;
|
|
|
3528ec |
|
|
|
3528ec |
if (isFillOrder(tif, tif->tif_dir.td_fillorder))
|
|
|
3528ec |
{
|
|
|
3528ec |
- TIFFReverseBits(tif->tif_rawdata, tif->tif_rawdatasize);
|
|
|
3528ec |
+ TIFFReverseBits(tif->tif_rawcp, tif->tif_rawcc);
|
|
|
3528ec |
}
|
|
|
3528ec |
|
|
|
3528ec |
jbg_dec_init(&decoder);
|
|
|
3528ec |
|
|
|
3528ec |
#if defined(HAVE_JBG_NEWLEN)
|
|
|
3528ec |
- jbg_newlen(tif->tif_rawdata, (size_t)tif->tif_rawdatasize);
|
|
|
3528ec |
+ jbg_newlen(tif->tif_rawcp, (size_t)tif->tif_rawcc);
|
|
|
3528ec |
/*
|
|
|
3528ec |
* I do not check the return status of jbg_newlen because even if this
|
|
|
3528ec |
* function fails it does not necessarily mean that decoding the image
|
|
|
3528ec |
@@ -76,8 +77,8 @@ static int JBIGDecode(TIFF* tif, uint8* buffer, tmsize_t size, uint16 s)
|
|
|
3528ec |
*/
|
|
|
3528ec |
#endif /* HAVE_JBG_NEWLEN */
|
|
|
3528ec |
|
|
|
3528ec |
- decodeStatus = jbg_dec_in(&decoder, (unsigned char*)tif->tif_rawdata,
|
|
|
3528ec |
- (size_t)tif->tif_rawdatasize, NULL);
|
|
|
3528ec |
+ decodeStatus = jbg_dec_in(&decoder, (unsigned char*)tif->tif_rawcp,
|
|
|
3528ec |
+ (size_t)tif->tif_rawcc, NULL);
|
|
|
3528ec |
if (JBG_EOK != decodeStatus)
|
|
|
3528ec |
{
|
|
|
3528ec |
/*
|
|
|
3528ec |
@@ -97,9 +98,28 @@ static int JBIGDecode(TIFF* tif, uint8* buffer, tmsize_t size, uint16 s)
|
|
|
3528ec |
return 0;
|
|
|
3528ec |
}
|
|
|
3528ec |
|
|
|
3528ec |
+ decodedSize = jbg_dec_getsize(&decoder);
|
|
|
3528ec |
+ if( (tmsize_t)decodedSize < size )
|
|
|
3528ec |
+ {
|
|
|
3528ec |
+ TIFFWarningExt(tif->tif_clientdata, "JBIG",
|
|
|
3528ec |
+ "Only decoded %lu bytes, whereas %lu requested",
|
|
|
3528ec |
+ decodedSize, (unsigned long)size);
|
|
|
3528ec |
+ }
|
|
|
3528ec |
+ else if( (tmsize_t)decodedSize > size )
|
|
|
3528ec |
+ {
|
|
|
3528ec |
+ TIFFErrorExt(tif->tif_clientdata, "JBIG",
|
|
|
3528ec |
+ "Decoded %lu bytes, whereas %lu were requested",
|
|
|
3528ec |
+ decodedSize, (unsigned long)size);
|
|
|
3528ec |
+ jbg_dec_free(&decoder);
|
|
|
3528ec |
+ return 0;
|
|
|
3528ec |
+ }
|
|
|
3528ec |
pImage = jbg_dec_getimage(&decoder, 0);
|
|
|
3528ec |
- _TIFFmemcpy(buffer, pImage, jbg_dec_getsize(&decoder));
|
|
|
3528ec |
+ _TIFFmemcpy(buffer, pImage, decodedSize);
|
|
|
3528ec |
jbg_dec_free(&decoder);
|
|
|
3528ec |
+
|
|
|
3528ec |
+ tif->tif_rawcp += tif->tif_rawcc;
|
|
|
3528ec |
+ tif->tif_rawcc = 0;
|
|
|
3528ec |
+
|
|
|
3528ec |
return 1;
|
|
|
3528ec |
}
|
|
|
3528ec |
|
|
|
3528ec |
--
|
|
|
3528ec |
2.17.2
|
|
|
3528ec |
|