mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-21 03:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

tiff: fix CVE-2025-8851

Browse Source 
A vulnerability was determined in LibTIFF up to 4.5.1. Affected
by this issue is the function readSeparateStripsetoBuffer of the
file tools/tiffcrop.c of the component tiffcrop. The manipulation
leads to stack-based buffer overflow. Local access is required to
approach this attack. The patch is identified as
8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to
apply a patch to fix this issue.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-8851

Upstream patch:
8a7a48d7a6

(From OE-Core rev: 1ced84bbd4ab15f0f16176e367744b496a0ea97c)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Yogita Urade
2025-08-26 16:18:34 +05:30
committed by Steve Sakoman
parent 999a2e1aa4
commit 7e420c5834
2 changed files with 72 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
meta/recipes-multimedia/libtiff/tiff/CVE-2025-8851.patch Normal file
View File

@@ -0,0 +1,71 @@
From 8a7a48d7a645992ca83062b3a1873c951661e2b3 Mon Sep 17 00:00:00 2001
From: Lee Howard <faxguy@howardsilvan.com>
Date: Sun, 11 Aug 2024 16:01:07 +0000
Subject: [PATCH] Attempt to address tiffcrop Coverity scan issues 1605444,
1605445, and 1605449.
CVE: CVE-2025-8851
Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/8a7a48d7a645992ca83062b3a1873c951661e2b3]
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
---
tools/tiffcrop.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index 1b072d4..e16bc2d 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -5024,7 +5024,14 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8_t *obuf, uint32_t lengt
buff = srcbuffs[s];
strip = (s * strips_per_sample) + j;
bytes_read = TIFFReadEncodedStrip (in, strip, buff, stripsize);
- rows_this_strip = (uint32_t)(bytes_read / src_rowsize);
+ if (bytes_read < 0)
+ {
+ rows_this_strip = 0;
+ }
+ else
+ {
+ rows_this_strip = (uint32_t)(bytes_read / src_rowsize);
+ }
if (bytes_read < 0 && !ignore)
{
TIFFError(TIFFFileName(in),
@@ -5434,14 +5441,14 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image,
rmargin = _TIFFClampDoubleToUInt32(crop->margins[3] * scale * xres);
}
- if ((lmargin + rmargin) > image->width)
+ if (lmargin == 0xFFFFFFFFU || rmargin == 0xFFFFFFFFU || (lmargin + rmargin) > image->width)
{
TIFFError("computeInputPixelOffsets", "Combined left and right margins exceed image width");
lmargin = (uint32_t) 0;
rmargin = (uint32_t) 0;
return (-1);
}
- if ((tmargin + bmargin) > image->length)
+ if (tmargin == 0xFFFFFFFFU || bmargin == 0xFFFFFFFFU || (tmargin + bmargin) > image->length)
{
TIFFError("computeInputPixelOffsets", "Combined top and bottom margins exceed image length");
tmargin = (uint32_t) 0;
@@ -5977,14 +5984,14 @@ computeOutputPixelOffsets (struct crop_mask *crop, struct image_data *image,
vmargin = _TIFFClampDoubleToUInt32(page->vmargin * scale * ((image->bps + 7) / 8));
}
- if ((hmargin * 2.0) > (pwidth * page->hres))
+ if (hmargin == 0xFFFFFFFFU || (hmargin * 2.0) > (pwidth * page->hres))
{
TIFFError("computeOutputPixelOffsets",
"Combined left and right margins exceed page width");
hmargin = (uint32_t) 0;
return (-1);
}
- if ((vmargin * 2.0) > (plength * page->vres))
+ if (vmargin == 0xFFFFFFFFU || (vmargin * 2.0) > (plength * page->vres))
{
TIFFError("computeOutputPixelOffsets",
"Combined top and bottom margins exceed page length");
--
2.40.0

1
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb
View File

@@ -61,6 +61,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
file://CVE-2025-8177.patch \
file://CVE-2024-13978.patch \
file://CVE-2025-8534.patch \
file://CVE-2025-8851.patch \
"
SRC_URI[sha256sum] = "0e46e5acb087ce7d1ac53cf4f56a09b221537fc86dfc5daaad1c2e89e1b37ac8"