mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-18 12:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Tiff: Security fix for CVE-2024-7006

Browse Source 
Upstream-Status: Backport from [818fb8ce88]

CVE's Fixed:
CVE-2024-7006 libtiff: NULL pointer dereference in tif_dirinfo.c

(From OE-Core rev: bacab52b3d101ee99753f14542a56340dd589425)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Siddharth Doshi
2024-08-16 12:26:19 +05:30
committed by Steve Sakoman
parent 0d356a401d
commit 784646063b
2 changed files with 65 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
meta/recipes-multimedia/libtiff/tiff/CVE-2024-7006.patch Normal file
View File

@@ -0,0 +1,64 @@
From 818fb8ce881cf839fbc710f6690aadb992aa0f9e Mon Sep 17 00:00:00 2001
From: Su_Laus <sulau@freenet.de>
Date: Fri, 1 Dec 2023 20:12:25 +0100
Subject: [PATCH] Check return value of _TIFFCreateAnonField().
Fixes #624
Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/818fb8ce881cf839fbc710f6690aadb992aa0f9e]
CVE: CVE-2024-7006
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
---
libtiff/tif_dirinfo.c | 2 +-
libtiff/tif_dirread.c | 15 ++++++---------
2 files changed, 7 insertions(+), 10 deletions(-)
diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c
index a212d01..95226a8 100644
--- a/libtiff/tif_dirinfo.c
+++ b/libtiff/tif_dirinfo.c
@@ -797,7 +797,7 @@ _TIFFFindOrRegisterField(TIFF *tif, uint32_t tag, TIFFDataType dt)
fld = TIFFFindField(tif, tag, dt);
if (fld == NULL) {
fld = _TIFFCreateAnonField(tif, tag, dt);
- if (!_TIFFMergeFields(tif, fld, 1))
+ if (fld == NULL || !_TIFFMergeFields(tif, fld, 1))
return NULL;
}
diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
index 0e283fc..1781166 100644
--- a/libtiff/tif_dirread.c
+++ b/libtiff/tif_dirread.c
@@ -3735,11 +3735,9 @@ TIFFReadDirectory(TIFF* tif)
dp->tdir_tag,dp->tdir_tag);
/* the following knowingly leaks the
anonymous field structure */
- if (!_TIFFMergeFields(tif,
- _TIFFCreateAnonField(tif,
- dp->tdir_tag,
- (TIFFDataType) dp->tdir_type),
- 1)) {
+ const TIFFField *fld = _TIFFCreateAnonField(
+ tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type);
+ if (fld == NULL || !_TIFFMergeFields(tif, fld, 1)) {
TIFFWarningExt(tif->tif_clientdata,
module,
"Registering anonymous field with tag %"PRIu16" (0x%"PRIx16") failed",
@@ -4502,10 +4500,9 @@ TIFFReadCustomDirectory(TIFF* tif, toff_t diroff,
TIFFWarningExt(tif->tif_clientdata, module,
"Unknown field with tag %"PRIu16" (0x%"PRIx16") encountered",
dp->tdir_tag, dp->tdir_tag);
- if (!_TIFFMergeFields(tif, _TIFFCreateAnonField(tif,
- dp->tdir_tag,
- (TIFFDataType) dp->tdir_type),
- 1)) {
+ const TIFFField *fld = _TIFFCreateAnonField(
+ tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type);
+ if (fld == NULL || !_TIFFMergeFields(tif, fld, 1)) {
TIFFWarningExt(tif->tif_clientdata, module,
"Registering anonymous field with tag %"PRIu16" (0x%"PRIx16") failed",
dp->tdir_tag, dp->tdir_tag);
--
2.35.7

1
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb
View File

@@ -53,6 +53,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
file://CVE-2023-6277-2.patch \
file://CVE-2023-6277-3.patch \
file://CVE-2023-6277-4.patch \
file://CVE-2024-7006.patch \
"
SRC_URI[sha256sum] = "0e46e5acb087ce7d1ac53cf4f56a09b221537fc86dfc5daaad1c2e89e1b37ac8"