Blame SOURCES/libtiff-CVE-2018-5784.patch

b03815
From 49723b0eb683cca80142b01a48ba1475fed5188a Mon Sep 17 00:00:00 2001
b03815
From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
b03815
Date: Fri, 23 Mar 2018 15:35:39 +0100
b03815
Subject: [PATCH] Fix for bug 2772
b03815
b03815
It is possible to craft a TIFF document where the IFD list is circular,
b03815
leading to an infinite loop while traversing the chain. The libtiff
b03815
directory reader has a failsafe that will break out of this loop after
b03815
reading 65535 directory entries, but it will continue processing,
b03815
consuming time and resources to process what is essentially a bogus TIFF
b03815
document.
b03815
b03815
This change fixes the above behavior by breaking out of processing when
b03815
a TIFF document has >= 65535 directories and terminating with an error.
b03815
---
b03815
 contrib/addtiffo/tif_overview.c | 14 +++++++++++++-
b03815
 tools/tiff2pdf.c                | 10 ++++++++++
b03815
 tools/tiffcrop.c                | 13 +++++++++++--
b03815
 3 files changed, 34 insertions(+), 3 deletions(-)
b03815
b03815
diff --git a/contrib/addtiffo/tif_overview.c b/contrib/addtiffo/tif_overview.c
b03815
index c61ffbb..03b3573 100644
b03815
--- a/contrib/addtiffo/tif_overview.c
b03815
+++ b/contrib/addtiffo/tif_overview.c
b03815
@@ -65,6 +65,8 @@
b03815
 #  define MAX(a,b)      ((a>b) ? a : b)
b03815
 #endif
b03815
 
b03815
+#define TIFF_DIR_MAX  65534
b03815
+
b03815
 void TIFFBuildOverviews( TIFF *, int, int *, int, const char *,
b03815
                          int (*)(double,void*), void * );
b03815
 
b03815
@@ -91,6 +93,7 @@ uint32 TIFF_WriteOverview( TIFF *hTIFF, uint32 nXSize, uint32 nYSize,
b03815
 {
b03815
     toff_t	nBaseDirOffset;
b03815
     toff_t	nOffset;
b03815
+    tdir_t	iNumDir;
b03815
 
b03815
     (void) bUseSubIFDs;
b03815
 
b03815
@@ -147,7 +150,16 @@ uint32 TIFF_WriteOverview( TIFF *hTIFF, uint32 nXSize, uint32 nYSize,
b03815
         return 0;
b03815
 
b03815
     TIFFWriteDirectory( hTIFF );
b03815
-    TIFFSetDirectory( hTIFF, (tdir_t) (TIFFNumberOfDirectories(hTIFF)-1) );
b03815
+    iNumDir = TIFFNumberOfDirectories(hTIFF);
b03815
+    if( iNumDir > TIFF_DIR_MAX )
b03815
+    {
b03815
+        TIFFErrorExt( TIFFClientdata(hTIFF),
b03815
+                      "TIFF_WriteOverview",
b03815
+                      "File `%s' has too many directories.\n",
b03815
+                      TIFFFileName(hTIFF) );
b03815
+        exit(-1);
b03815
+    }
b03815
+    TIFFSetDirectory( hTIFF, (tdir_t) (iNumDir - 1) );
b03815
 
b03815
     nOffset = TIFFCurrentDirOffset( hTIFF );
b03815
 
b03815
diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
b03815
index 454befb..bdb9126 100644
b03815
--- a/tools/tiff2pdf.c
b03815
+++ b/tools/tiff2pdf.c
b03815
@@ -68,6 +68,8 @@ extern int getopt(int, char**, char*);
b03815
 
b03815
 #define PS_UNIT_SIZE	72.0F
b03815
 
b03815
+#define TIFF_DIR_MAX    65534
b03815
+
b03815
 /* This type is of PDF color spaces. */
b03815
 typedef enum {
b03815
 	T2P_CS_BILEVEL = 0x01,	/* Bilevel, black and white */
b03815
@@ -1049,6 +1051,14 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
b03815
 	uint16 xuint16=0;
b03815
 
b03815
 	directorycount=TIFFNumberOfDirectories(input);
b03815
+	if(directorycount > TIFF_DIR_MAX) {
b03815
+		TIFFError(
b03815
+			TIFF2PDF_MODULE,
b03815
+			"TIFF contains too many directories, %s",
b03815
+			TIFFFileName(input));
b03815
+		t2p->t2p_error = T2P_ERR_ERROR;
b03815
+		return;
b03815
+	}
b03815
 	t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE)));
b03815
 	if(t2p->tiff_pages==NULL){
b03815
 		TIFFError(
b03815
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
b03815
index c69177e..c60cb38 100644
b03815
--- a/tools/tiffcrop.c
b03815
+++ b/tools/tiffcrop.c
b03815
@@ -217,6 +217,8 @@ extern int getopt(int argc, char * const argv[], const char *optstring);
b03815
 #define DUMP_TEXT   1
b03815
 #define DUMP_RAW    2
b03815
 
b03815
+#define TIFF_DIR_MAX  65534
b03815
+
b03815
 /* Offsets into buffer for margins and fixed width and length segments */
b03815
 struct offset {
b03815
   uint32  tmargin;
b03815
@@ -2233,7 +2235,7 @@ main(int argc, char* argv[])
b03815
     pageNum = -1;
b03815
   else
b03815
     total_images = 0;
b03815
-  /* read multiple input files and write to output file(s) */
b03815
+  /* Read multiple input files and write to output file(s) */
b03815
   while (optind < argc - 1)
b03815
     {
b03815
     in = TIFFOpen (argv[optind], "r");
b03815
@@ -2241,7 +2243,14 @@ main(int argc, char* argv[])
b03815
       return (-3);
b03815
 
b03815
     /* If only one input file is specified, we can use directory count */
b03815
-    total_images = TIFFNumberOfDirectories(in); 
b03815
+    total_images = TIFFNumberOfDirectories(in);
b03815
+    if (total_images > TIFF_DIR_MAX)
b03815
+      {
b03815
+      TIFFError (TIFFFileName(in), "File contains too many directories");
b03815
+      if (out != NULL)
b03815
+        (void) TIFFClose(out);
b03815
+      return (1);
b03815
+      }
b03815
     if (image_count == 0)
b03815
       {
b03815
       dirnum = 0;
b03815
-- 
b03815
2.13.6
b03815