amaharaneko/guix-mirrors
1
1
Fork 0
mirror of https://codeberg.org/guix/guix.git synced 2025-10-02 02:15:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: libtiff: Update to 4.0.6. Add fixes for CVE-2015-{8665,8683}.

Browse source 
* gnu/packages/patches/libtiff-CVE-2015-8665+CVE-2015-8683.patch,
  gnu/packages/patches/libtiff-oob-accesses-in-decode.patch,
  gnu/packages/patches/libtiff-oob-write-in-nextdecode.patch: New files.
* gnu-system.am (dist_patch_DATA): Add them.
* gnu/packages/image.scm (libtiff): Update to 4.0.6.
  [source]: Add patches.
This commit is contained in:
Mark H Weaver 2016-01-21 00:28:03 -05:00
parent a2190cccc2
commit 86fa2ea92f
5 changed files with 337 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

49
gnu/packages/patches/libtiff-oob-write-in-nextdecode.patch Normal file
View file

@ -0,0 +1,49 @@
2015-12-27 Even Rouault <even.rouault at spatialys.com>
* libtiff/tif_next.c: fix potential out-of-bound write in NeXTDecode()
triggered by http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif
(bugzilla #2508)
diff -u -r1.16 -r1.18
--- libtiff/libtiff/tif_next.c 29 Dec 2014 12:09:11 -0000 1.16
+++ libtiff/libtiff/tif_next.c 27 Dec 2015 17:14:52 -0000 1.18
@@ -1,4 +1,4 @@
-/* $Id: tif_next.c,v 1.16 2014-12-29 12:09:11 erouault Exp $ */
+/* $Id: tif_next.c,v 1.18 2015-12-27 17:14:52 erouault Exp $ */
/*
* Copyright (c) 1988-1997 Sam Leffler
@@ -37,7 +37,7 @@
case 0: op[0] = (unsigned char) ((v) << 6); break; \
case 1: op[0] |= (v) << 4; break; \
case 2: op[0] |= (v) << 2; break; \
- case 3: *op++ |= (v); break; \
+ case 3: *op++ |= (v); op_offset++; break; \
} \
}
@@ -103,6 +103,7 @@
}
default: {
uint32 npixels = 0, grey;
+ tmsize_t op_offset = 0;
uint32 imagewidth = tif->tif_dir.td_imagewidth;
if( isTiled(tif) )
imagewidth = tif->tif_dir.td_tilewidth;
@@ -122,10 +123,15 @@
* bounds, potentially resulting in a security
* issue.
*/
- while (n-- > 0 && npixels < imagewidth)
+ while (n-- > 0 && npixels < imagewidth && op_offset < scanline)
SETPIXEL(op, grey);
if (npixels >= imagewidth)
break;
+ if (op_offset >= scanline ) {
+ TIFFErrorExt(tif->tif_clientdata, module, "Invalid data for scanline %ld",
+ (long) tif->tif_row);
+ return (0);
+ }
if (cc == 0)
goto bad;
n = *bp++, cc--;