mirror of
https://git.yoctoproject.org/poky
synced 2026-04-20 00:32:13 +02:00
tiff: fix multiple CVEs
import patch from debian to fix
CVE-2022-48281
http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.2.0-1+deb11u4.debian.tar.xz
import patch from fedora to fix
CVE-2023-0800
CVE-2023-0801
CVE-2023-0802
CVE-2023-0803
CVE-2023-0804
91856895aa
(From OE-Core rev: f2782b4cac461909cf432db13516e443fee8c3de)
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
(cherry picked from commit d9ce9b37236f5c16ffba4572ad720aeb50edeee9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Chee Yang Lee
committed by
Richard Purdie
Richard Purdie
parent
b7da7c8996
commit
857a8bdd9c
26
meta/recipes-multimedia/libtiff/tiff/CVE-2022-48281.patch
Normal file
26
meta/recipes-multimedia/libtiff/tiff/CVE-2022-48281.patch
Normal file
@@ -0,0 +1,26 @@
|
||||
From 97d65859bc29ee334012e9c73022d8a8e55ed586 Mon Sep 17 00:00:00 2001
|
||||
From: Su Laus <sulau@freenet.de>
|
||||
Date: Sat, 21 Jan 2023 15:58:10 +0000
|
||||
Subject: [PATCH] tiffcrop: Correct simple copy paste error. Fix #488.
|
||||
|
||||
|
||||
Upstream-Status: Backport [import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.2.0-1+deb11u4.debian.tar.xz]
|
||||
CVE: CVE-2022-48281
|
||||
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
|
||||
---
|
||||
tools/tiffcrop.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
Index: tiff-4.2.0/tools/tiffcrop.c
|
||||
===================================================================
|
||||
--- tiff-4.2.0.orig/tools/tiffcrop.c
|
||||
+++ tiff-4.2.0/tools/tiffcrop.c
|
||||
@@ -7516,7 +7516,7 @@ processCropSelections(struct image_data
|
||||
crop_buff = (unsigned char *)limitMalloc(cropsize + NUM_BUFF_OVERSIZE_BYTES);
|
||||
else
|
||||
{
|
||||
- prev_cropsize = seg_buffs[0].size;
|
||||
+ prev_cropsize = seg_buffs[1].size;
|
||||
if (prev_cropsize < cropsize)
|
||||
{
|
||||
next_buff = _TIFFrealloc(crop_buff, cropsize + NUM_BUFF_OVERSIZE_BYTES);
|
||||
@@ -0,0 +1,128 @@
|
||||
From 82a7fbb1fa7228499ffeb3a57a1d106a9626d57c Mon Sep 17 00:00:00 2001
|
||||
From: Su Laus <sulau@freenet.de>
|
||||
Date: Sun, 5 Feb 2023 15:53:15 +0000
|
||||
Subject: [PATCH] tiffcrop: added check for assumption on composite images
|
||||
(fixes #496)
|
||||
|
||||
tiffcrop: For composite images with more than one region, the combined_length or combined_width always needs to be equal, respectively. Otherwise, even the first section/region copy action might cause buffer overrun. This is now checked before the first copy action.
|
||||
|
||||
Closes #496, #497, #498, #500, #501.
|
||||
|
||||
Upstream-Status: Backport [import from fedora https://src.fedoraproject.org/rpms/libtiff/c/91856895aadf3cce6353f40c2feef9bf0b486440 ]
|
||||
CVE: CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
|
||||
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
|
||||
---
|
||||
tools/tiffcrop.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++--
|
||||
1 file changed, 66 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
|
||||
index 84e26ac6..480b927c 100644
|
||||
--- a/tools/tiffcrop.c
|
||||
+++ b/tools/tiffcrop.c
|
||||
@@ -5329,18 +5329,39 @@
|
||||
|
||||
crop->regionlist[i].buffsize = buffsize;
|
||||
crop->bufftotal += buffsize;
|
||||
+ /* For composite images with more than one region, the
|
||||
+ * combined_length or combined_width always needs to be equal,
|
||||
+ * respectively.
|
||||
+ * Otherwise, even the first section/region copy
|
||||
+ * action might cause buffer overrun. */
|
||||
if (crop->img_mode == COMPOSITE_IMAGES)
|
||||
{
|
||||
switch (crop->edge_ref)
|
||||
{
|
||||
case EDGE_LEFT:
|
||||
case EDGE_RIGHT:
|
||||
+ if (i > 0 && zlength != crop->combined_length)
|
||||
+ {
|
||||
+ TIFFError(
|
||||
+ "computeInputPixelOffsets",
|
||||
+ "Only equal length regions can be combined for "
|
||||
+ "-E left or right");
|
||||
+ return (-1);
|
||||
+ }
|
||||
crop->combined_length = zlength;
|
||||
crop->combined_width += zwidth;
|
||||
break;
|
||||
case EDGE_BOTTOM:
|
||||
case EDGE_TOP: /* width from left, length from top */
|
||||
default:
|
||||
+ if (i > 0 && zwidth != crop->combined_width)
|
||||
+ {
|
||||
+ TIFFError("computeInputPixelOffsets",
|
||||
+ "Only equal width regions can be "
|
||||
+ "combined for -E "
|
||||
+ "top or bottom");
|
||||
+ return (-1);
|
||||
+ }
|
||||
crop->combined_width = zwidth;
|
||||
crop->combined_length += zlength;
|
||||
break;
|
||||
@@ -6546,6 +6567,46 @@
|
||||
crop->combined_width = 0;
|
||||
crop->combined_length = 0;
|
||||
|
||||
+ /* If there is more than one region, check beforehand whether all the width
|
||||
+ * and length values of the regions are the same, respectively. */
|
||||
+ switch (crop->edge_ref)
|
||||
+ {
|
||||
+ default:
|
||||
+ case EDGE_TOP:
|
||||
+ case EDGE_BOTTOM:
|
||||
+ for (i = 1; i < crop->selections; i++)
|
||||
+ {
|
||||
+ uint32_t crop_width0 =
|
||||
+ crop->regionlist[i - 1].x2 - crop->regionlist[i - 1].x1 + 1;
|
||||
+ uint32_t crop_width1 =
|
||||
+ crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1;
|
||||
+ if (crop_width0 != crop_width1)
|
||||
+ {
|
||||
+ TIFFError("extractCompositeRegions",
|
||||
+ "Only equal width regions can be combined for -E "
|
||||
+ "top or bottom");
|
||||
+ return (1);
|
||||
+ }
|
||||
+ }
|
||||
+ break;
|
||||
+ case EDGE_LEFT:
|
||||
+ case EDGE_RIGHT:
|
||||
+ for (i = 1; i < crop->selections; i++)
|
||||
+ {
|
||||
+ uint32_t crop_length0 =
|
||||
+ crop->regionlist[i - 1].y2 - crop->regionlist[i - 1].y1 + 1;
|
||||
+ uint32_t crop_length1 =
|
||||
+ crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1;
|
||||
+ if (crop_length0 != crop_length1)
|
||||
+ {
|
||||
+ TIFFError("extractCompositeRegions",
|
||||
+ "Only equal length regions can be combined for "
|
||||
+ "-E left or right");
|
||||
+ return (1);
|
||||
+ }
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
for (i = 0; i < crop->selections; i++)
|
||||
{
|
||||
/* rows, columns, width, length are expressed in pixels */
|
||||
@@ -6570,7 +6631,8 @@
|
||||
default:
|
||||
case EDGE_TOP:
|
||||
case EDGE_BOTTOM:
|
||||
- if ((i > 0) && (crop_width != crop->regionlist[i - 1].width))
|
||||
+ if ((crop->selections > i + 1) &&
|
||||
+ (crop_width != crop->regionlist[i + 1].width))
|
||||
{
|
||||
TIFFError ("extractCompositeRegions",
|
||||
"Only equal width regions can be combined for -E top or bottom");
|
||||
@@ -6651,7 +6713,8 @@
|
||||
break;
|
||||
case EDGE_LEFT: /* splice the pieces of each row together, side by side */
|
||||
case EDGE_RIGHT:
|
||||
- if ((i > 0) && (crop_length != crop->regionlist[i - 1].length))
|
||||
+ if ((crop->selections > i + 1) &&
|
||||
+ (crop_length != crop->regionlist[i + 1].length))
|
||||
{
|
||||
TIFFError ("extractCompositeRegions",
|
||||
"Only equal length regions can be combined for -E left or right");
|
||||
@@ -32,6 +32,8 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
|
||||
file://0001-tiffcrop-S-option-Make-decision-simpler.patch \
|
||||
file://0001-tiffcrop-disable-incompatibility-of-Z-X-Y-z-options-.patch \
|
||||
file://0001-tiffcrop-subroutines-require-a-larger-buffer-fixes-2.patch \
|
||||
file://CVE-2022-48281.patch \
|
||||
file://CVE-2023-0800_0801_0802_0803_0804.patch \
|
||||
"
|
||||
|
||||
SRC_URI[sha256sum] = "0e46e5acb087ce7d1ac53cf4f56a09b221537fc86dfc5daaad1c2e89e1b37ac8"
|
||||
|
||||
Reference in New Issue
Block a user