summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/libtiff/files/CVE-2016-3945.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-multimedia/libtiff/files/CVE-2016-3945.patch')
-rw-r--r--meta/recipes-multimedia/libtiff/files/CVE-2016-3945.patch118
1 files changed, 0 insertions, 118 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2016-3945.patch b/meta/recipes-multimedia/libtiff/files/CVE-2016-3945.patch
deleted file mode 100644
index 4d965be9ff..0000000000
--- a/meta/recipes-multimedia/libtiff/files/CVE-2016-3945.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-From 7c39352ccd9060d311d3dc9a1f1bc00133a160e6 Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Mon, 15 Aug 2016 20:06:40 +0000
-Subject: [PATCH] * tools/tiff2rgba.c: Fix integer overflow in size of
- allocated buffer, when -b mode is enabled, that could result in out-of-bounds
- write. Based initially on patch tiff-CVE-2016-3945.patch from
- libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with correction for invalid
- tests that rejected valid files.
-
-CVE: CVE-2016-3945
-Upstream-Status: Backport
-https://github.com/vadz/libtiff/commit/7c39352ccd9060d311d3dc9a1f1bc00133a160e6
-
-Signed-off-by: Yi Zhao <yi.zhao@windirver.com>
----
- ChangeLog | 8 ++++++++
- tools/tiff2rgba.c | 34 ++++++++++++++++++++++++++++++----
- 2 files changed, 38 insertions(+), 4 deletions(-)
-
-diff --git a/ChangeLog b/ChangeLog
-index 62dc1b5..9c0ab29 100644
---- a/ChangeLog
-+++ b/ChangeLog
-@@ -1,3 +1,11 @@
-+2016-08-15 Even Rouault <even.rouault at spatialys.com>
-+
-+ * tools/tiff2rgba.c: Fix integer overflow in size of allocated
-+ buffer, when -b mode is enabled, that could result in out-of-bounds
-+ write. Based initially on patch tiff-CVE-2016-3945.patch from
-+ libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with correction for
-+ invalid tests that rejected valid files.
-+
- 2016-07-11 Even Rouault <even.rouault at spatialys.com>
-
- * tools/tiffcrop.c: Avoid access outside of stack allocated array
-diff --git a/tools/tiff2rgba.c b/tools/tiff2rgba.c
-index b7a81eb..16e3dc4 100644
---- a/tools/tiff2rgba.c
-+++ b/tools/tiff2rgba.c
-@@ -147,6 +147,7 @@ cvt_by_tile( TIFF *in, TIFF *out )
- uint32 row, col;
- uint32 *wrk_line;
- int ok = 1;
-+ uint32 rastersize, wrk_linesize;
-
- TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);
- TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);
-@@ -163,7 +164,13 @@ cvt_by_tile( TIFF *in, TIFF *out )
- /*
- * Allocate tile buffer
- */
-- raster = (uint32*)_TIFFmalloc(tile_width * tile_height * sizeof (uint32));
-+ rastersize = tile_width * tile_height * sizeof (uint32);
-+ if (tile_width != (rastersize / tile_height) / sizeof( uint32))
-+ {
-+ TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");
-+ exit(-1);
-+ }
-+ raster = (uint32*)_TIFFmalloc(rastersize);
- if (raster == 0) {
- TIFFError(TIFFFileName(in), "No space for raster buffer");
- return (0);
-@@ -173,7 +180,13 @@ cvt_by_tile( TIFF *in, TIFF *out )
- * Allocate a scanline buffer for swapping during the vertical
- * mirroring pass.
- */
-- wrk_line = (uint32*)_TIFFmalloc(tile_width * sizeof (uint32));
-+ wrk_linesize = tile_width * sizeof (uint32);
-+ if (tile_width != wrk_linesize / sizeof (uint32))
-+ {
-+ TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");
-+ exit(-1);
-+ }
-+ wrk_line = (uint32*)_TIFFmalloc(wrk_linesize);
- if (!wrk_line) {
- TIFFError(TIFFFileName(in), "No space for raster scanline buffer");
- ok = 0;
-@@ -249,6 +262,7 @@ cvt_by_strip( TIFF *in, TIFF *out )
- uint32 row;
- uint32 *wrk_line;
- int ok = 1;
-+ uint32 rastersize, wrk_linesize;
-
- TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);
- TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);
-@@ -263,7 +277,13 @@ cvt_by_strip( TIFF *in, TIFF *out )
- /*
- * Allocate strip buffer
- */
-- raster = (uint32*)_TIFFmalloc(width * rowsperstrip * sizeof (uint32));
-+ rastersize = width * rowsperstrip * sizeof (uint32);
-+ if (width != (rastersize / rowsperstrip) / sizeof( uint32))
-+ {
-+ TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");
-+ exit(-1);
-+ }
-+ raster = (uint32*)_TIFFmalloc(rastersize);
- if (raster == 0) {
- TIFFError(TIFFFileName(in), "No space for raster buffer");
- return (0);
-@@ -273,7 +293,13 @@ cvt_by_strip( TIFF *in, TIFF *out )
- * Allocate a scanline buffer for swapping during the vertical
- * mirroring pass.
- */
-- wrk_line = (uint32*)_TIFFmalloc(width * sizeof (uint32));
-+ wrk_linesize = width * sizeof (uint32);
-+ if (width != wrk_linesize / sizeof (uint32))
-+ {
-+ TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");
-+ exit(-1);
-+ }
-+ wrk_line = (uint32*)_TIFFmalloc(wrk_linesize);
- if (!wrk_line) {
- TIFFError(TIFFFileName(in), "No space for raster scanline buffer");
- ok = 0;
---
-2.7.4
-