mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-03 02:02:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

tiff: fix multiple CVEs

Browse Source 
Backport fixes for:
* CVE-2023-2908 - Upstream-Status: Backport from 9bd48f0dbd
* CVE-2023-3316 - Upstream-Status: Backport from d63de61b1e
* CVE-2023-3618 - Upstream-Status: Backport from 881a070194 && b5c7d4c4e0

(From OE-Core rev: 4929d08cefac9ae2ebbdf94ccdc51a0f67f28164)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Hitendra Prajapati
2023-08-02 11:05:52 +05:30
committed by Steve Sakoman
parent b5f81a875d
commit ebca640cbb
5 changed files with 177 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
meta/recipes-multimedia/libtiff/files/CVE-2023-2908.patch Normal file
View File

@@ -0,0 +1,33 @@
From 8c0859a80444c90b8dfb862a9f16de74e16f0a9e Mon Sep 17 00:00:00 2001
From: xiaoxiaoafeifei <lliangliang2007@163.com>
Date: Fri, 21 Apr 2023 13:01:34 +0000
Subject: [PATCH] countInkNamesString(): fix `UndefinedBehaviorSanitizer`:
applying zero offset to null pointer
Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f]
CVE: CVE-2023-2908
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
libtiff/tif_dir.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
index 9d8267a..6389b40 100644
--- a/libtiff/tif_dir.c
+++ b/libtiff/tif_dir.c
@@ -145,10 +145,10 @@ static uint16
countInkNamesString(TIFF *tif, uint32 slen, const char *s)
{
uint16 i = 0;
- const char *ep = s + slen;
- const char *cp = s;
if (slen > 0) {
+ const char *ep = s + slen;
+ const char *cp = s;
do {
for (; cp < ep && *cp != '\0'; cp++) {}
if (cp >= ep)
--
2.25.1

59
meta/recipes-multimedia/libtiff/files/CVE-2023-3316.patch Normal file
View File

@@ -0,0 +1,59 @@
From d63de61b1ec3385f6383ef9a1f453e4b8b11d536 Mon Sep 17 00:00:00 2001
From: Su_Laus <sulau@freenet.de>
Date: Fri, 3 Feb 2023 17:38:55 +0100
Subject: [PATCH] TIFFClose() avoid NULL pointer dereferencing. fix#515
Closes #515
Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/d63de61b1ec3385f6383ef9a1f453e4b8b11d536]
CVE: CVE-2023-3316
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
libtiff/tif_close.c | 11 +++++++----
tools/tiffcrop.c | 5 ++++-
2 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/libtiff/tif_close.c b/libtiff/tif_close.c
index e4228df..335e80f 100644
--- a/libtiff/tif_close.c
+++ b/libtiff/tif_close.c
@@ -118,13 +118,16 @@ TIFFCleanup(TIFF* tif)
*/
void
-TIFFClose(TIFF* tif)
+TIFFClose(TIFF *tif)
{
- TIFFCloseProc closeproc = tif->tif_closeproc;
- thandle_t fd = tif->tif_clientdata;
+ if (tif != NULL)
+ {
+ TIFFCloseProc closeproc = tif->tif_closeproc;
+ thandle_t fd = tif->tif_clientdata;
TIFFCleanup(tif);
- (void) (*closeproc)(fd);
+ (void)(*closeproc)(fd);
+ }
}
/* vim: set ts=8 sts=8 sw=8 noet: */
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index a533089..f14bb0c 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -2526,7 +2526,10 @@ main(int argc, char* argv[])
}
}
- TIFFClose(out);
+ if (out != NULL)
+ {
+ TIFFClose(out);
+ }
return (0);
} /* end main */
--
2.25.1

34
meta/recipes-multimedia/libtiff/files/CVE-2023-3618-1.patch Normal file
View File

@@ -0,0 +1,34 @@
From 881a070194783561fd209b7c789a4e75566f7f37 Mon Sep 17 00:00:00 2001
From: zhailiangliang <zhailiangliang@loongson.cn>
Date: Tue, 7 Mar 2023 15:02:08 +0800
Subject: [PATCH] Fix memory leak in tiffcrop.c
Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/881a070194783561fd209b7c789a4e75566f7f37]
CVE: CVE-2023-3618
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
tools/tiffcrop.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index f14bb0c..7121c7c 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -7746,8 +7746,13 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop,
read_buff = *read_buff_ptr;
+ /* Memory is freed before crop_buff_ptr is overwritten */
+ if (*crop_buff_ptr != NULL)
+ {
+ _TIFFfree(*crop_buff_ptr);
+ }
+
/* process full image, no crop buffer needed */
- crop_buff = read_buff;
*crop_buff_ptr = read_buff;
crop->combined_width = image->width;
crop->combined_length = image->length;
--
2.25.1

47
meta/recipes-multimedia/libtiff/files/CVE-2023-3618-2.patch Normal file
View File

@@ -0,0 +1,47 @@
From b5c7d4c4e03333ac16b5cfb11acaaeaa493334f8 Mon Sep 17 00:00:00 2001
From: Su_Laus <sulau@freenet.de>
Date: Fri, 5 May 2023 19:43:46 +0200
Subject: [PATCH] Consider error return of writeSelections(). Fixes #553
Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/b5c7d4c4e03333ac16b5cfb11acaaeaa493334f8]
CVE: CVE-2023-3618
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
tools/tiffcrop.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index 7121c7c..93b7f96 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -2437,9 +2437,15 @@ main(int argc, char* argv[])
{ /* Whole image or sections not based on output page size */
if (crop.selections > 0)
{
- writeSelections(in, &out, &crop, &image, &dump, seg_buffs,
- mp, argv[argc - 1], &next_page, total_pages);
- }
+ if (writeSelections(in, &out, &crop, &image, &dump,
+ seg_buffs, mp, argv[argc - 1],
+ &next_page, total_pages))
+ {
+ TIFFError("main",
+ "Unable to write new image selections");
+ exit(EXIT_FAILURE);
+ }
+ }
else /* One file all images and sections */
{
if (update_output_file (&out, mp, crop.exp_mode, argv[argc - 1],
@@ -7749,7 +7755,7 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop,
/* Memory is freed before crop_buff_ptr is overwritten */
if (*crop_buff_ptr != NULL)
{
- _TIFFfree(*crop_buff_ptr);
+ _TIFFfree(*crop_buff_ptr);
}
/* process full image, no crop buffer needed */
--
2.25.1

4
meta/recipes-multimedia/libtiff/tiff_4.1.0.bb
View File

@@ -40,6 +40,10 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
file://CVE-2023-25434-CVE-2023-25435.patch \
file://CVE-2023-26965.patch \
file://CVE-2023-26966.patch \
file://CVE-2023-2908.patch \
file://CVE-2023-3316.patch \
file://CVE-2023-3618-1.patch \
file://CVE-2023-3618-2.patch \
"
SRC_URI[md5sum] = "2165e7aba557463acc0664e71a3ed424"
SRC_URI[sha256sum] = "5d29f32517dadb6dbcd1255ea5bbc93a2b54b94fbf83653b4d65c7d6775b8634"