rpms/libtiff
7
0
Fork 0
Code Issues Pull Requests Releases Activity

fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189371)

Browse Source 
Resolves: RHEL-189371
This commit is contained in:
Michal Hlavinka 2026-07-16 11:22:29 +02:00
parent 69a151f61d
commit 2f8ff9a49e
3 changed files with 106 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
libtiff-4.4.0-cve-2026-12912p1of2.patch Normal file
View File

@ -0,0 +1,39 @@
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
index 8bc1529d7f5e4a20b9e20e637df8e500dd4b0de0..8efd92737bd0954baeec27c7525886cb82fdd39b 100644
--- a/libtiff/tif_pixarlog.c
+++ b/libtiff/tif_pixarlog.c
@@ -876,6 +876,19 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
llen = sp->stride * td->td_imagewidth;
+ /* Fix: ABGR with stride=3 expands 3 samples to 4 output bytes per pixel */
+ if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3)
+ {
+ tmsize_t required = (tmsize_t)td->td_imagewidth * 4;
+ if (occ < required)
+ {
+ TIFFErrorExt(tif->tif_clientdata, module,
+ "Output buffer too small for PixarLog ABGR data");
+ memset(op, 0, (size_t)occ);
+ return (0);
+ }
+ }
+
(void) s;
assert(sp != NULL);
@@ -991,7 +1004,13 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
case PIXARLOGDATAFMT_8BITABGR:
horizontalAccumulate8abgr(up, llen, sp->stride,
(unsigned char *)op, sp->ToLinear8);
- op += llen * sizeof(unsigned char);
+
+ /* For stride == 3 (RGB), horizontalAccumulate8abgr expands to 4
+ * bytes/pixel (ABGR) */
+ if (sp->stride == 3)
+ op += (unsigned long)td->td_imagewidth * 4;
+ else
+ op += (unsigned long)llen * sizeof(unsigned char);
break;
default:
TIFFErrorExt(tif->tif_clientdata, module,

57
libtiff-4.4.0-cve-2026-12912p2of2.patch Normal file
View File

@ -0,0 +1,57 @@
From f9bda11bf2fc819b971517582666d56f18b1bc3f Mon Sep 17 00:00:00 2001
From: waugustus <wangdw.augustus@qq.com>
Date: Thu, 7 May 2026 12:48:42 +0800
Subject: [PATCH] pixarlog: complete ABGR bounds check for multi-row strip
decoding
---
libtiff/tif_pixarlog.c | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
index f35f3fb01..a6f62f18b 100644
--- a/libtiff/tif_pixarlog.c
+++ b/libtiff/tif_pixarlog.c
@@ -880,6 +880,12 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3)
{
tmsize_t required = (tmsize_t)td->td_imagewidth * 4;
+ tmsize_t max_rows;
+ tmsize_t max_nsamples;
+
+ /*
+ * Ensure at least one expanded output row fits.
+ */
if (occ < required)
{
TIFFErrorExt(tif->tif_clientdata, module,
@@ -887,6 +893,26 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
memset(op, 0, (size_t)occ);
return (0);
}
+
+ /*
+ * PixarLogDecode() may process multiple rows per call
+ * (e.g. strip decoding). Limit nsamples so the total
+ * output written by the loop below never exceeds occ.
+ */
+ max_rows = occ / required;
+ max_nsamples = max_rows * llen;
+
+ /*
+ * Truncate excess rows to preserve as much decoded data
+ * as possible while avoiding output buffer overflow.
+ */
+ if (nsamples > max_nsamples)
+ {
+ TIFFWarningExt(tif->tif_clientdata, module,
+ "PixarLog ABGR decode truncated to avoid "
+ "output buffer overflow");
+ nsamples = max_nsamples;
+ }
}
(void) s;
--
GitLab

11
libtiff.spec
View File

@ -1,7 +1,7 @@
Summary: Library of functions for manipulating TIFF format image files
Name: libtiff
Version: 4.0.9
Release: 37%{?dist}
Release: 38%{?dist}
License: libtiff
Group: System Environment/Libraries
URL: http://www.simplesystems.org/libtiff/
@ -75,6 +75,12 @@ Patch47: RHEL-120230.patch
# https://gitlab.com/libtiff/libtiff/-/commit/782a11d6b5b61c6dc21e714950a4af5bf89f023c
Patch48: libtiff-4.4.0-CVE-2026-4775.patch
# from upstream, for < 4.7.2, RHEL-189387
# https://gitlab.com/libtiff/libtiff/-/merge_requests/873
Patch49: libtiff-4.4.0-cve-2026-12912p1of2.patch
# https://gitlab.com/libtiff/libtiff/-/commit/f9bda11bf2fc819b971517582666d56f18b1bc3f
Patch50: libtiff-4.4.0-cve-2026-12912p2of2.patch
BuildRequires: gcc, gcc-c++
BuildRequires: zlib-devel libjpeg-devel jbigkit-devel
BuildRequires: libtool automake autoconf pkgconfig
@ -227,6 +233,9 @@ find html -name 'Makefile*' | xargs rm
%{_mandir}/man1/*
%changelog
* Wed Jul 15 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.0.9-38
- fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189371)
* Mon Apr 20 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.0.9-37
- fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159316)