rpms/libtiff
7
0
Fork 0
Code Issues Pull Requests Releases Activity

CVE-2014-9655 and CVE-2015-1547 #1190710

Browse Source 
Signed-off-by: Petr Hracek <phracek@redhat.com>
This commit is contained in:
Petr Hracek 2015-05-19 14:40:53 +02:00
parent 0012e06ddb
commit 37199ad8a2
2 changed files with 104 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
libtiff-CVE-2014-9655.patch Normal file
View File

@ -0,0 +1,68 @@
diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
index a85273c..5e0cf92 100644
--- a/libtiff/tif_getimage.c
+++ b/libtiff/tif_getimage.c
@@ -1852,10 +1852,10 @@ DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
(void) y;
fromskew = (fromskew * 10) / 4;
- if ((h & 3) == 0 && (w & 1) == 0) {
+ if ((w & 3) == 0 && (h & 1) == 0) {
for (; h >= 2; h -= 2) {
x = w>>2;
- do {
+ while(x>0) {
int32 Cb = pp[8];
int32 Cr = pp[9];
@@ -1870,7 +1870,8 @@ DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
cp += 4, cp1 += 4;
pp += 10;
- } while (--x);
+ x--;
+ }
cp += incr, cp1 += incr;
pp += fromskew;
}
@@ -2031,7 +2032,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr21tile)
fromskew = (fromskew * 4) / 2;
do {
x = w>>1;
- do {
+ while(x>0) {
int32 Cb = pp[2];
int32 Cr = pp[3];
@@ -2040,7 +2041,8 @@ DECLAREContigPutFunc(putcontig8bitYCbCr21tile)
cp += 2;
pp += 4;
- } while (--x);
+ x--;
+ }
if( (w&1) != 0 )
{
diff --git a/libtiff/tif_next.c b/libtiff/tif_next.c
index 524e127..a6f4577 100644
--- a/libtiff/tif_next.c
+++ b/libtiff/tif_next.c
@@ -71,7 +71,7 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
TIFFErrorExt(tif->tif_clientdata, module, "Fractional scanlines cannot be read");
return (0);
}
- for (row = buf; occ > 0; occ -= scanline, row += scanline) {
+ for (row = buf; cc > 0 && occ > 0; occ -= scanline, row += scanline) {
n = *bp++, cc--;
switch (n) {
case LITERALROW:
@@ -90,6 +90,8 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
* The scanline has a literal span that begins at some
* offset.
*/
+ if( cc < 4 )
+ goto bad;
off = (bp[0] * 256) + bp[1];
n = (bp[2] * 256) + bp[3];
if (cc < 4+n || off+n > scanline)

8
libtiff.spec
View File

@ -1,8 +1,7 @@
Summary: Library of functions for manipulating TIFF format image files
Name: libtiff
Version: 4.0.3
Release: 19%{?dist}
Release: 20%{?dist}
License: libtiff
Group: System Environment/Libraries
URL: http://www.remotesensing.org/libtiff/
@ -22,6 +21,7 @@ Patch9: libtiff-CVE-2013-4232.patch
Patch10: libtiff-CVE-2013-4244.patch
Patch11: libtiff-make-check.patch
Patch12: libtiff-CVE-2013-4243.patch
Patch13: libtiff-CVE-2014-9655.patch
BuildRequires: zlib-devel libjpeg-devel jbigkit-devel
BuildRequires: libtool automake autoconf pkgconfig
@ -85,6 +85,7 @@ image files using the libtiff library.
%patch10 -p1
%patch11 -p1
%patch12 -p1
%patch13 -p1
# Use build system's libtool.m4, not the one in the package.
rm -f libtool.m4
@ -190,6 +191,9 @@ find html -name 'Makefile*' | xargs rm
%{_mandir}/man1/*
%changelog
* Tue May 19 2015 Petr Hracek <phracek@redhat.com> - 4.0.3-20
- CVE-2014-9655 and CVE-2015-1547 #1190710
* Sat May 02 2015 Kalev Lember <kalevlember@gmail.com> - 4.0.3-19
- Rebuilt for GCC 5 C++11 ABI change