forked from brl/citadel
207 lines
6.8 KiB
Diff
207 lines
6.8 KiB
Diff
From 0acf01fea714af573b814e10cf105c3359a236c3 Mon Sep 17 00:00:00 2001
|
|
From: erouault <erouault>
|
|
Date: Thu, 1 Jun 2017 12:44:04 +0000
|
|
Subject: [PATCH] * libtiff/tif_dirinfo.c, tif_dirread.c: add _TIFFCheckFieldIsValidForCodec(),
|
|
and use it in TIFFReadDirectory() so as to ignore fields whose tag is a
|
|
codec-specified tag but this codec is not enabled. This avoids TIFFGetField()
|
|
to behave differently depending on whether the codec is enabled or not, and
|
|
thus can avoid stack based buffer overflows in a number of TIFF utilities
|
|
such as tiffsplit, tiffcmp, thumbnail, etc.
|
|
Patch derived from 0063-Handle-properly-CODEC-specific-tags.patch
|
|
(http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël Hertzog.
|
|
Fixes:
|
|
http://bugzilla.maptools.org/show_bug.cgi?id=2580
|
|
http://bugzilla.maptools.org/show_bug.cgi?id=2693
|
|
http://bugzilla.maptools.org/show_bug.cgi?id=2625 (CVE-2016-10095)
|
|
http://bugzilla.maptools.org/show_bug.cgi?id=2564 (CVE-2015-7554)
|
|
http://bugzilla.maptools.org/show_bug.cgi?id=2561 (CVE-2016-5318)
|
|
http://bugzilla.maptools.org/show_bug.cgi?id=2499 (CVE-2014-8128)
|
|
http://bugzilla.maptools.org/show_bug.cgi?id=2441
|
|
http://bugzilla.maptools.org/show_bug.cgi?id=2433
|
|
|
|
Upstream-Status: Backport
|
|
[https://github.com/vadz/libtiff/commit/4d4fa0b68ae9ae038959ee4f69ebe288ec892f06]
|
|
|
|
CVE: CVE-2017-9147
|
|
|
|
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
|
|
---
|
|
ChangeLog | 20 ++++++++++
|
|
libtiff/tif_dir.h | 1 +
|
|
libtiff/tif_dirinfo.c | 103 ++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
libtiff/tif_dirread.c | 4 ++
|
|
4 files changed, 128 insertions(+)
|
|
|
|
diff --git a/ChangeLog b/ChangeLog
|
|
index ee8d9d0..5739292 100644
|
|
--- a/ChangeLog
|
|
+++ b/ChangeLog
|
|
@@ -1,3 +1,23 @@
|
|
+2017-06-01 Even Rouault <even.rouault at spatialys.com>
|
|
+
|
|
+ * libtiff/tif_dirinfo.c, tif_dirread.c: add _TIFFCheckFieldIsValidForCodec(),
|
|
+ and use it in TIFFReadDirectory() so as to ignore fields whose tag is a
|
|
+ codec-specified tag but this codec is not enabled. This avoids TIFFGetField()
|
|
+ to behave differently depending on whether the codec is enabled or not, and
|
|
+ thus can avoid stack based buffer overflows in a number of TIFF utilities
|
|
+ such as tiffsplit, tiffcmp, thumbnail, etc.
|
|
+ Patch derived from 0063-Handle-properly-CODEC-specific-tags.patch
|
|
+ (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël Hertzog.
|
|
+ Fixes:
|
|
+ http://bugzilla.maptools.org/show_bug.cgi?id=2580
|
|
+ http://bugzilla.maptools.org/show_bug.cgi?id=2693
|
|
+ http://bugzilla.maptools.org/show_bug.cgi?id=2625 (CVE-2016-10095)
|
|
+ http://bugzilla.maptools.org/show_bug.cgi?id=2564 (CVE-2015-7554)
|
|
+ http://bugzilla.maptools.org/show_bug.cgi?id=2561 (CVE-2016-5318)
|
|
+ http://bugzilla.maptools.org/show_bug.cgi?id=2499 (CVE-2014-8128)
|
|
+ http://bugzilla.maptools.org/show_bug.cgi?id=2441
|
|
+ http://bugzilla.maptools.org/show_bug.cgi?id=2433
|
|
+
|
|
2017-05-21 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
|
|
|
|
* configure.ac: libtiff 4.0.8 released.
|
|
diff --git a/libtiff/tif_dir.h b/libtiff/tif_dir.h
|
|
index e12b44b..5206be4 100644
|
|
--- a/libtiff/tif_dir.h
|
|
+++ b/libtiff/tif_dir.h
|
|
@@ -291,6 +291,7 @@ struct _TIFFField {
|
|
extern int _TIFFMergeFields(TIFF*, const TIFFField[], uint32);
|
|
extern const TIFFField* _TIFFFindOrRegisterField(TIFF *, uint32, TIFFDataType);
|
|
extern TIFFField* _TIFFCreateAnonField(TIFF *, uint32, TIFFDataType);
|
|
+extern int _TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag);
|
|
|
|
#if defined(__cplusplus)
|
|
}
|
|
diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c
|
|
index 0c8ef42..97c0df0 100644
|
|
--- a/libtiff/tif_dirinfo.c
|
|
+++ b/libtiff/tif_dirinfo.c
|
|
@@ -956,6 +956,109 @@ TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
|
|
return 0;
|
|
}
|
|
|
|
+int
|
|
+_TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag)
|
|
+{
|
|
+ /* Filter out non-codec specific tags */
|
|
+ switch (tag) {
|
|
+ /* Shared tags */
|
|
+ case TIFFTAG_PREDICTOR:
|
|
+ /* JPEG tags */
|
|
+ case TIFFTAG_JPEGTABLES:
|
|
+ /* OJPEG tags */
|
|
+ case TIFFTAG_JPEGIFOFFSET:
|
|
+ case TIFFTAG_JPEGIFBYTECOUNT:
|
|
+ case TIFFTAG_JPEGQTABLES:
|
|
+ case TIFFTAG_JPEGDCTABLES:
|
|
+ case TIFFTAG_JPEGACTABLES:
|
|
+ case TIFFTAG_JPEGPROC:
|
|
+ case TIFFTAG_JPEGRESTARTINTERVAL:
|
|
+ /* CCITT* */
|
|
+ case TIFFTAG_BADFAXLINES:
|
|
+ case TIFFTAG_CLEANFAXDATA:
|
|
+ case TIFFTAG_CONSECUTIVEBADFAXLINES:
|
|
+ case TIFFTAG_GROUP3OPTIONS:
|
|
+ case TIFFTAG_GROUP4OPTIONS:
|
|
+ break;
|
|
+ default:
|
|
+ return 1;
|
|
+ }
|
|
+ /* Check if codec specific tags are allowed for the current
|
|
+ * compression scheme (codec) */
|
|
+ switch (tif->tif_dir.td_compression) {
|
|
+ case COMPRESSION_LZW:
|
|
+ if (tag == TIFFTAG_PREDICTOR)
|
|
+ return 1;
|
|
+ break;
|
|
+ case COMPRESSION_PACKBITS:
|
|
+ /* No codec-specific tags */
|
|
+ break;
|
|
+ case COMPRESSION_THUNDERSCAN:
|
|
+ /* No codec-specific tags */
|
|
+ break;
|
|
+ case COMPRESSION_NEXT:
|
|
+ /* No codec-specific tags */
|
|
+ break;
|
|
+ case COMPRESSION_JPEG:
|
|
+ if (tag == TIFFTAG_JPEGTABLES)
|
|
+ return 1;
|
|
+ break;
|
|
+ case COMPRESSION_OJPEG:
|
|
+ switch (tag) {
|
|
+ case TIFFTAG_JPEGIFOFFSET:
|
|
+ case TIFFTAG_JPEGIFBYTECOUNT:
|
|
+ case TIFFTAG_JPEGQTABLES:
|
|
+ case TIFFTAG_JPEGDCTABLES:
|
|
+ case TIFFTAG_JPEGACTABLES:
|
|
+ case TIFFTAG_JPEGPROC:
|
|
+ case TIFFTAG_JPEGRESTARTINTERVAL:
|
|
+ return 1;
|
|
+ }
|
|
+ break;
|
|
+ case COMPRESSION_CCITTRLE:
|
|
+ case COMPRESSION_CCITTRLEW:
|
|
+ case COMPRESSION_CCITTFAX3:
|
|
+ case COMPRESSION_CCITTFAX4:
|
|
+ switch (tag) {
|
|
+ case TIFFTAG_BADFAXLINES:
|
|
+ case TIFFTAG_CLEANFAXDATA:
|
|
+ case TIFFTAG_CONSECUTIVEBADFAXLINES:
|
|
+ return 1;
|
|
+ case TIFFTAG_GROUP3OPTIONS:
|
|
+ if (tif->tif_dir.td_compression == COMPRESSION_CCITTFAX3)
|
|
+ return 1;
|
|
+ break;
|
|
+ case TIFFTAG_GROUP4OPTIONS:
|
|
+ if (tif->tif_dir.td_compression == COMPRESSION_CCITTFAX4)
|
|
+ return 1;
|
|
+ break;
|
|
+ }
|
|
+ break;
|
|
+ case COMPRESSION_JBIG:
|
|
+ /* No codec-specific tags */
|
|
+ break;
|
|
+ case COMPRESSION_DEFLATE:
|
|
+ case COMPRESSION_ADOBE_DEFLATE:
|
|
+ if (tag == TIFFTAG_PREDICTOR)
|
|
+ return 1;
|
|
+ break;
|
|
+ case COMPRESSION_PIXARLOG:
|
|
+ if (tag == TIFFTAG_PREDICTOR)
|
|
+ return 1;
|
|
+ break;
|
|
+ case COMPRESSION_SGILOG:
|
|
+ case COMPRESSION_SGILOG24:
|
|
+ /* No codec-specific tags */
|
|
+ break;
|
|
+ case COMPRESSION_LZMA:
|
|
+ if (tag == TIFFTAG_PREDICTOR)
|
|
+ return 1;
|
|
+ break;
|
|
+
|
|
+ }
|
|
+ return 0;
|
|
+}
|
|
+
|
|
/* vim: set ts=8 sts=8 sw=8 noet: */
|
|
|
|
/*
|
|
diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
|
|
index 1d4f0b9..f1dc3d7 100644
|
|
--- a/libtiff/tif_dirread.c
|
|
+++ b/libtiff/tif_dirread.c
|
|
@@ -3580,6 +3580,10 @@ TIFFReadDirectory(TIFF* tif)
|
|
goto bad;
|
|
dp->tdir_tag=IGNORE;
|
|
break;
|
|
+ default:
|
|
+ if( !_TIFFCheckFieldIsValidForCodec(tif, dp->tdir_tag) )
|
|
+ dp->tdir_tag=IGNORE;
|
|
+ break;
|
|
}
|
|
}
|
|
}
|
|
--
|
|
2.7.4
|
|
|