mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-20 18:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

tiff: fix CVE-2020-35523 CVE-2020-35524

Browse Source 
(From OE-Core rev: 84239e11227bc0b0e2e6d3b2faa7a9ee63025dd1)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Lee Chee Yang
2021-05-11 18:59:10 +08:00
committed by Richard Purdie
parent 60e33c1c4a
commit 5471428610
4 changed files with 136 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
meta/recipes-multimedia/libtiff/files/CVE-2020-35523.patch Normal file
View File

@@ -0,0 +1,55 @@
From c8d613ef497058fe653c467fc84c70a62a4a71b2 Mon Sep 17 00:00:00 2001
From: Thomas Bernard <miniupnp@free.fr>
Date: Tue, 10 Nov 2020 01:54:30 +0100
Subject: [PATCH] gtTileContig(): check Tile width for overflow
fixes #211
Upstream-Status: Backport [ https://gitlab.com/libtiff/libtiff/-/commit/c8d613ef497058fe653c467fc84c70a62a4a71b2 ]
CVE: CVE-2020-35523
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
---
libtiff/tif_getimage.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
index 4da785d3..96ab1460 100644
--- a/libtiff/tif_getimage.c
+++ b/libtiff/tif_getimage.c
@@ -29,6 +29,7 @@
*/
#include "tiffiop.h"
#include <stdio.h>
+#include <limits.h>
static int gtTileContig(TIFFRGBAImage*, uint32*, uint32, uint32);
static int gtTileSeparate(TIFFRGBAImage*, uint32*, uint32, uint32);
@@ -645,12 +646,20 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
flip = setorientation(img);
if (flip & FLIP_VERTICALLY) {
- y = h - 1;
- toskew = -(int32)(tw + w);
+ if ((tw + w) > INT_MAX) {
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)");
+ return (0);
+ }
+ y = h - 1;
+ toskew = -(int32)(tw + w);
}
else {
- y = 0;
- toskew = -(int32)(tw - w);
+ if (tw > (INT_MAX + w)) {
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)");
+ return (0);
+ }
+ y = 0;
+ toskew = -(int32)(tw - w);
}
/*
--
GitLab

42
meta/recipes-multimedia/libtiff/files/CVE-2020-35524-1.patch Normal file
View File

@@ -0,0 +1,42 @@
From c6a12721b46f1a72974f91177890301730d7b330 Mon Sep 17 00:00:00 2001
From: Thomas Bernard <miniupnp@free.fr>
Date: Tue, 10 Nov 2020 01:01:59 +0100
Subject: [PATCH] tiff2pdf.c: properly calculate datasize when saving to JPEG
YCbCr
fixes #220
Upstream-Status: Backport
https://gitlab.com/libtiff/libtiff/-/commit/c6a12721b46f1a72974f91177890301730d7b330
https://gitlab.com/libtiff/libtiff/-/merge_requests/159/commits
CVE: CVE-2021-35524
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
---
tools/tiff2pdf.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
index 719811ea..dc69d2f9 100644
--- a/tools/tiff2pdf.c
+++ b/tools/tiff2pdf.c
@@ -2087,9 +2087,14 @@ void t2p_read_tiff_size(T2P* t2p, TIFF* input){
#endif
(void) 0;
}
- k = checkMultiply64(TIFFScanlineSize(input), t2p->tiff_length, t2p);
- if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){
- k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
+ if(t2p->pdf_compression == T2P_COMPRESS_JPEG
+ && t2p->tiff_photometric == PHOTOMETRIC_YCBCR) {
+ k = checkMultiply64(TIFFNumberOfStrips(input), TIFFStripSize(input), t2p);
+ } else {
+ k = checkMultiply64(TIFFScanlineSize(input), t2p->tiff_length, t2p);
+ if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){
+ k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
+ }
}
if (k == 0) {
/* Assume we had overflow inside TIFFScanlineSize */
--
GitLab

36
meta/recipes-multimedia/libtiff/files/CVE-2020-35524-2.patch Normal file
View File

@@ -0,0 +1,36 @@
From d74f56e3b7ea55c8a18a03bc247cd5fd0ca288b2 Mon Sep 17 00:00:00 2001
From: Thomas Bernard <miniupnp@free.fr>
Date: Tue, 10 Nov 2020 02:05:05 +0100
Subject: [PATCH] Fix for building without JPEG support
Upstream-Status: Backport
https://gitlab.com/libtiff/libtiff/-/commit/d74f56e3b7ea55c8a18a03bc247cd5fd0ca288b2
https://gitlab.com/libtiff/libtiff/-/merge_requests/159/commits
CVE: CVE-2021-35524
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
---
tools/tiff2pdf.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
index dc69d2f9..d0b0ede7 100644
--- a/tools/tiff2pdf.c
+++ b/tools/tiff2pdf.c
@@ -2087,10 +2087,13 @@ void t2p_read_tiff_size(T2P* t2p, TIFF* input){
#endif
(void) 0;
}
+#ifdef JPEG_SUPPORT
if(t2p->pdf_compression == T2P_COMPRESS_JPEG
&& t2p->tiff_photometric == PHOTOMETRIC_YCBCR) {
k = checkMultiply64(TIFFNumberOfStrips(input), TIFFStripSize(input), t2p);
- } else {
+ } else
+#endif
+ {
k = checkMultiply64(TIFFScanlineSize(input), t2p->tiff_length, t2p);
if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){
k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
--
GitLab

3
meta/recipes-multimedia/libtiff/tiff_4.1.0.bb
View File

@@ -9,6 +9,9 @@ LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=34da3db46fab7501992f9615d7e158cf"
CVE_PRODUCT = "libtiff"
SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
file://CVE-2020-35523.patch \
file://CVE-2020-35524-1.patch \
file://CVE-2020-35524-2.patch \
"
SRC_URI[md5sum] = "2165e7aba557463acc0664e71a3ed424"
SRC_URI[sha256sum] = "5d29f32517dadb6dbcd1255ea5bbc93a2b54b94fbf83653b4d65c7d6775b8634"