192 lines
5.6 KiB
Diff
192 lines
5.6 KiB
Diff
Upstream patch for CVE-2012-4447. This also covers an out-of-bounds-read
|
|
possibility in the same file, which wasn't given a separate CVE.
|
|
|
|
|
|
diff -Naur tiff-3.9.4.orig/libtiff/tif_pixarlog.c tiff-3.9.4/libtiff/tif_pixarlog.c
|
|
--- tiff-3.9.4.orig/libtiff/tif_pixarlog.c 2010-06-08 14:50:42.000000000 -0400
|
|
+++ tiff-3.9.4/libtiff/tif_pixarlog.c 2012-12-10 15:50:14.421538317 -0500
|
|
@@ -117,9 +117,9 @@
|
|
if (n >= stride) {
|
|
mask = CODE_MASK;
|
|
if (stride == 3) {
|
|
- t0 = ToLinearF[cr = wp[0]];
|
|
- t1 = ToLinearF[cg = wp[1]];
|
|
- t2 = ToLinearF[cb = wp[2]];
|
|
+ t0 = ToLinearF[cr = (wp[0] & mask)];
|
|
+ t1 = ToLinearF[cg = (wp[1] & mask)];
|
|
+ t2 = ToLinearF[cb = (wp[2] & mask)];
|
|
op[0] = t0;
|
|
op[1] = t1;
|
|
op[2] = t2;
|
|
@@ -136,10 +136,10 @@
|
|
op[2] = t2;
|
|
}
|
|
} else if (stride == 4) {
|
|
- t0 = ToLinearF[cr = wp[0]];
|
|
- t1 = ToLinearF[cg = wp[1]];
|
|
- t2 = ToLinearF[cb = wp[2]];
|
|
- t3 = ToLinearF[ca = wp[3]];
|
|
+ t0 = ToLinearF[cr = (wp[0] & mask)];
|
|
+ t1 = ToLinearF[cg = (wp[1] & mask)];
|
|
+ t2 = ToLinearF[cb = (wp[2] & mask)];
|
|
+ t3 = ToLinearF[ca = (wp[3] & mask)];
|
|
op[0] = t0;
|
|
op[1] = t1;
|
|
op[2] = t2;
|
|
@@ -183,9 +183,9 @@
|
|
if (n >= stride) {
|
|
mask = CODE_MASK;
|
|
if (stride == 3) {
|
|
- t0 = ToLinearF[cr = wp[0]] * SCALE12;
|
|
- t1 = ToLinearF[cg = wp[1]] * SCALE12;
|
|
- t2 = ToLinearF[cb = wp[2]] * SCALE12;
|
|
+ t0 = ToLinearF[cr = (wp[0] & mask)] * SCALE12;
|
|
+ t1 = ToLinearF[cg = (wp[1] & mask)] * SCALE12;
|
|
+ t2 = ToLinearF[cb = (wp[2] & mask)] * SCALE12;
|
|
op[0] = CLAMP12(t0);
|
|
op[1] = CLAMP12(t1);
|
|
op[2] = CLAMP12(t2);
|
|
@@ -202,10 +202,10 @@
|
|
op[2] = CLAMP12(t2);
|
|
}
|
|
} else if (stride == 4) {
|
|
- t0 = ToLinearF[cr = wp[0]] * SCALE12;
|
|
- t1 = ToLinearF[cg = wp[1]] * SCALE12;
|
|
- t2 = ToLinearF[cb = wp[2]] * SCALE12;
|
|
- t3 = ToLinearF[ca = wp[3]] * SCALE12;
|
|
+ t0 = ToLinearF[cr = (wp[0] & mask)] * SCALE12;
|
|
+ t1 = ToLinearF[cg = (wp[1] & mask)] * SCALE12;
|
|
+ t2 = ToLinearF[cb = (wp[2] & mask)] * SCALE12;
|
|
+ t3 = ToLinearF[ca = (wp[3] & mask)] * SCALE12;
|
|
op[0] = CLAMP12(t0);
|
|
op[1] = CLAMP12(t1);
|
|
op[2] = CLAMP12(t2);
|
|
@@ -247,9 +247,9 @@
|
|
if (n >= stride) {
|
|
mask = CODE_MASK;
|
|
if (stride == 3) {
|
|
- op[0] = ToLinear16[cr = wp[0]];
|
|
- op[1] = ToLinear16[cg = wp[1]];
|
|
- op[2] = ToLinear16[cb = wp[2]];
|
|
+ op[0] = ToLinear16[cr = (wp[0] & mask)];
|
|
+ op[1] = ToLinear16[cg = (wp[1] & mask)];
|
|
+ op[2] = ToLinear16[cb = (wp[2] & mask)];
|
|
n -= 3;
|
|
while (n > 0) {
|
|
wp += 3;
|
|
@@ -260,10 +260,10 @@
|
|
op[2] = ToLinear16[(cb += wp[2]) & mask];
|
|
}
|
|
} else if (stride == 4) {
|
|
- op[0] = ToLinear16[cr = wp[0]];
|
|
- op[1] = ToLinear16[cg = wp[1]];
|
|
- op[2] = ToLinear16[cb = wp[2]];
|
|
- op[3] = ToLinear16[ca = wp[3]];
|
|
+ op[0] = ToLinear16[cr = (wp[0] & mask)];
|
|
+ op[1] = ToLinear16[cg = (wp[1] & mask)];
|
|
+ op[2] = ToLinear16[cb = (wp[2] & mask)];
|
|
+ op[3] = ToLinear16[ca = (wp[3] & mask)];
|
|
n -= 4;
|
|
while (n > 0) {
|
|
wp += 4;
|
|
@@ -342,9 +342,9 @@
|
|
if (n >= stride) {
|
|
mask = CODE_MASK;
|
|
if (stride == 3) {
|
|
- op[0] = ToLinear8[cr = wp[0]];
|
|
- op[1] = ToLinear8[cg = wp[1]];
|
|
- op[2] = ToLinear8[cb = wp[2]];
|
|
+ op[0] = ToLinear8[cr = (wp[0] & mask)];
|
|
+ op[1] = ToLinear8[cg = (wp[1] & mask)];
|
|
+ op[2] = ToLinear8[cb = (wp[2] & mask)];
|
|
n -= 3;
|
|
while (n > 0) {
|
|
n -= 3;
|
|
@@ -355,10 +355,10 @@
|
|
op[2] = ToLinear8[(cb += wp[2]) & mask];
|
|
}
|
|
} else if (stride == 4) {
|
|
- op[0] = ToLinear8[cr = wp[0]];
|
|
- op[1] = ToLinear8[cg = wp[1]];
|
|
- op[2] = ToLinear8[cb = wp[2]];
|
|
- op[3] = ToLinear8[ca = wp[3]];
|
|
+ op[0] = ToLinear8[cr = (wp[0] & mask)];
|
|
+ op[1] = ToLinear8[cg = (wp[1] & mask)];
|
|
+ op[2] = ToLinear8[cb = (wp[2] & mask)];
|
|
+ op[3] = ToLinear8[ca = (wp[3] & mask)];
|
|
n -= 4;
|
|
while (n > 0) {
|
|
n -= 4;
|
|
@@ -393,9 +393,9 @@
|
|
mask = CODE_MASK;
|
|
if (stride == 3) {
|
|
op[0] = 0;
|
|
- t1 = ToLinear8[cb = wp[2]];
|
|
- t2 = ToLinear8[cg = wp[1]];
|
|
- t3 = ToLinear8[cr = wp[0]];
|
|
+ t1 = ToLinear8[cb = (wp[2] & mask)];
|
|
+ t2 = ToLinear8[cg = (wp[1] & mask)];
|
|
+ t3 = ToLinear8[cr = (wp[0] & mask)];
|
|
op[1] = t1;
|
|
op[2] = t2;
|
|
op[3] = t3;
|
|
@@ -413,10 +413,10 @@
|
|
op[3] = t3;
|
|
}
|
|
} else if (stride == 4) {
|
|
- t0 = ToLinear8[ca = wp[3]];
|
|
- t1 = ToLinear8[cb = wp[2]];
|
|
- t2 = ToLinear8[cg = wp[1]];
|
|
- t3 = ToLinear8[cr = wp[0]];
|
|
+ t0 = ToLinear8[ca = (wp[3] & mask)];
|
|
+ t1 = ToLinear8[cb = (wp[2] & mask)];
|
|
+ t2 = ToLinear8[cg = (wp[1] & mask)];
|
|
+ t3 = ToLinear8[cr = (wp[0] & mask)];
|
|
op[0] = t0;
|
|
op[1] = t1;
|
|
op[2] = t2;
|
|
@@ -630,10 +630,10 @@
|
|
return guess;
|
|
}
|
|
|
|
-static uint32
|
|
-multiply(size_t m1, size_t m2)
|
|
+static tsize_t
|
|
+multiply(tsize_t m1, tsize_t m2)
|
|
{
|
|
- uint32 bytes = m1 * m2;
|
|
+ tsize_t bytes = m1 * m2;
|
|
|
|
if (m1 && bytes / m1 != m2)
|
|
bytes = 0;
|
|
@@ -641,6 +641,20 @@
|
|
return bytes;
|
|
}
|
|
|
|
+static tsize_t
|
|
+add_ms(tsize_t m1, tsize_t m2)
|
|
+{
|
|
+ tsize_t bytes = m1 + m2;
|
|
+
|
|
+ /* if either input is zero, assume overflow already occurred */
|
|
+ if (m1 == 0 || m2 == 0)
|
|
+ bytes = 0;
|
|
+ else if (bytes <= m1 || bytes <= m2)
|
|
+ bytes = 0;
|
|
+
|
|
+ return bytes;
|
|
+}
|
|
+
|
|
static int
|
|
PixarLogSetupDecode(TIFF* tif)
|
|
{
|
|
@@ -661,6 +675,8 @@
|
|
td->td_samplesperpixel : 1);
|
|
tbuf_size = multiply(multiply(multiply(sp->stride, td->td_imagewidth),
|
|
td->td_rowsperstrip), sizeof(uint16));
|
|
+ /* add one more stride in case input ends mid-stride */
|
|
+ tbuf_size = add_ms(tbuf_size, sizeof(uint16) * sp->stride);
|
|
if (tbuf_size == 0)
|
|
return (0);
|
|
sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size);
|