Fix CVE-2017-9935, CVE-2017-18013 (#1530441), CVE-2018-8905 (#1559705) and CVE-2018-10963 (#1579061)
This commit is contained in:
Nikola Forró
parent
620adc658c
commit
6bfda150e7
36
libtiff-CVE-2017-18013.patch
Normal file
36
libtiff-CVE-2017-18013.patch
Normal file
@ -0,0 +1,36 @@
|
|||||||
|
From b1997b9c3ac0d6bac5effd7558141986487217a9 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Even Rouault <even.rouault@spatialys.com>
|
||||||
|
Date: Sun, 31 Dec 2017 15:09:41 +0100
|
||||||
|
Subject: [PATCH 2/4] libtiff/tif_print.c: TIFFPrintDirectory(): fix null
|
||||||
|
pointer dereference on corrupted file. Fixes
|
||||||
|
http://bugzilla.maptools.org/show_bug.cgi?id=2770 / CVE-2017-18013
|
||||||
|
|
||||||
|
---
|
||||||
|
libtiff/tif_print.c | 8 ++++----
|
||||||
|
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_print.c b/libtiff/tif_print.c
|
||||||
|
index 10a588e..b9b53a0 100644
|
||||||
|
--- a/libtiff/tif_print.c
|
||||||
|
+++ b/libtiff/tif_print.c
|
||||||
|
@@ -667,13 +667,13 @@ TIFFPrintDirectory(TIFF* tif, FILE* fd, long flags)
|
||||||
|
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
|
||||||
|
fprintf(fd, " %3lu: [%8I64u, %8I64u]\n",
|
||||||
|
(unsigned long) s,
|
||||||
|
- (unsigned __int64) td->td_stripoffset[s],
|
||||||
|
- (unsigned __int64) td->td_stripbytecount[s]);
|
||||||
|
+ td->td_stripoffset ? (unsigned __int64) td->td_stripoffset[s] : 0,
|
||||||
|
+ td->td_stripbytecount ? (unsigned __int64) td->td_stripbytecount[s] : 0);
|
||||||
|
#else
|
||||||
|
fprintf(fd, " %3lu: [%8llu, %8llu]\n",
|
||||||
|
(unsigned long) s,
|
||||||
|
- (unsigned long long) td->td_stripoffset[s],
|
||||||
|
- (unsigned long long) td->td_stripbytecount[s]);
|
||||||
|
+ td->td_stripoffset ? (unsigned long long) td->td_stripoffset[s] : 0,
|
||||||
|
+ td->td_stripbytecount ? (unsigned long long) td->td_stripbytecount[s] : 0);
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.17.0
|
||||||
|
|
||||||
164
libtiff-CVE-2017-9935.patch
Normal file
164
libtiff-CVE-2017-9935.patch
Normal file
@ -0,0 +1,164 @@
|
|||||||
|
From e1cd2d7ab032e7fe80b4c13e07895194c8bac85e Mon Sep 17 00:00:00 2001
|
||||||
|
From: Brian May <brian@linuxpenguins.xyz>
|
||||||
|
Date: Thu, 7 Dec 2017 07:46:47 +1100
|
||||||
|
Subject: [PATCH 1/4] [PATCH] tiff2pdf: Fix CVE-2017-9935
|
||||||
|
|
||||||
|
Fix for http://bugzilla.maptools.org/show_bug.cgi?id=2704
|
||||||
|
|
||||||
|
This vulnerability - at least for the supplied test case - is because we
|
||||||
|
assume that a tiff will only have one transfer function that is the same
|
||||||
|
for all pages. This is not required by the TIFF standards.
|
||||||
|
|
||||||
|
We than read the transfer function for every page. Depending on the
|
||||||
|
transfer function, we allocate either 2 or 4 bytes to the XREF buffer.
|
||||||
|
We allocate this memory after we read in the transfer function for the
|
||||||
|
page.
|
||||||
|
|
||||||
|
For the first exploit - POC1, this file has 3 pages. For the first page
|
||||||
|
we allocate 2 extra extra XREF entries. Then for the next page 2 more
|
||||||
|
entries. Then for the last page the transfer function changes and we
|
||||||
|
allocate 4 more entries.
|
||||||
|
|
||||||
|
When we read the file into memory, we assume we have 4 bytes extra for
|
||||||
|
each and every page (as per the last transfer function we read). Which
|
||||||
|
is not correct, we only have 2 bytes extra for the first 2 pages. As a
|
||||||
|
result, we end up writing past the end of the buffer.
|
||||||
|
|
||||||
|
There are also some related issues that this also fixes. For example,
|
||||||
|
TIFFGetField can return uninitalized pointer values, and the logic to
|
||||||
|
detect a N=3 vs N=1 transfer function seemed rather strange.
|
||||||
|
|
||||||
|
It is also strange that we declare the transfer functions to be of type
|
||||||
|
float, when the standard says they are unsigned 16 bit values. This is
|
||||||
|
fixed in another patch.
|
||||||
|
|
||||||
|
This patch will check to ensure that the N value for every transfer
|
||||||
|
function is the same for every page. If this changes, we abort with an
|
||||||
|
error. In theory, we should perhaps check that the transfer function
|
||||||
|
itself is identical for every page, however we don't do that due to the
|
||||||
|
confusion of the type of the data in the transfer function.
|
||||||
|
---
|
||||||
|
libtiff/tif_dir.c | 3 +++
|
||||||
|
tools/tiff2pdf.c | 69 +++++++++++++++++++++++++++++++----------------
|
||||||
|
2 files changed, 49 insertions(+), 23 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
|
||||||
|
index f00f808..c36a5f3 100644
|
||||||
|
--- a/libtiff/tif_dir.c
|
||||||
|
+++ b/libtiff/tif_dir.c
|
||||||
|
@@ -1067,6 +1067,9 @@ _TIFFVGetField(TIFF* tif, uint32 tag, va_list ap)
|
||||||
|
if (td->td_samplesperpixel - td->td_extrasamples > 1) {
|
||||||
|
*va_arg(ap, uint16**) = td->td_transferfunction[1];
|
||||||
|
*va_arg(ap, uint16**) = td->td_transferfunction[2];
|
||||||
|
+ } else {
|
||||||
|
+ *va_arg(ap, uint16**) = NULL;
|
||||||
|
+ *va_arg(ap, uint16**) = NULL;
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
case TIFFTAG_REFERENCEBLACKWHITE:
|
||||||
|
diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
|
||||||
|
index bdb9126..bd23c9e 100644
|
||||||
|
--- a/tools/tiff2pdf.c
|
||||||
|
+++ b/tools/tiff2pdf.c
|
||||||
|
@@ -239,7 +239,7 @@ typedef struct {
|
||||||
|
float tiff_whitechromaticities[2];
|
||||||
|
float tiff_primarychromaticities[6];
|
||||||
|
float tiff_referenceblackwhite[2];
|
||||||
|
- float* tiff_transferfunction[3];
|
||||||
|
+ uint16* tiff_transferfunction[3];
|
||||||
|
int pdf_image_interpolate; /* 0 (default) : do not interpolate,
|
||||||
|
1 : interpolate */
|
||||||
|
uint16 tiff_transferfunctioncount;
|
||||||
|
@@ -1049,6 +1049,8 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
|
||||||
|
uint16 pagen=0;
|
||||||
|
uint16 paged=0;
|
||||||
|
uint16 xuint16=0;
|
||||||
|
+ uint16 tiff_transferfunctioncount=0;
|
||||||
|
+ uint16* tiff_transferfunction[3];
|
||||||
|
|
||||||
|
directorycount=TIFFNumberOfDirectories(input);
|
||||||
|
if(directorycount > TIFF_DIR_MAX) {
|
||||||
|
@@ -1157,26 +1159,48 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
if (TIFFGetField(input, TIFFTAG_TRANSFERFUNCTION,
|
||||||
|
- &(t2p->tiff_transferfunction[0]),
|
||||||
|
- &(t2p->tiff_transferfunction[1]),
|
||||||
|
- &(t2p->tiff_transferfunction[2]))) {
|
||||||
|
- if((t2p->tiff_transferfunction[1] != (float*) NULL) &&
|
||||||
|
- (t2p->tiff_transferfunction[2] != (float*) NULL) &&
|
||||||
|
- (t2p->tiff_transferfunction[1] !=
|
||||||
|
- t2p->tiff_transferfunction[0])) {
|
||||||
|
- t2p->tiff_transferfunctioncount = 3;
|
||||||
|
- t2p->tiff_pages[i].page_extra += 4;
|
||||||
|
- t2p->pdf_xrefcount += 4;
|
||||||
|
- } else {
|
||||||
|
- t2p->tiff_transferfunctioncount = 1;
|
||||||
|
- t2p->tiff_pages[i].page_extra += 2;
|
||||||
|
- t2p->pdf_xrefcount += 2;
|
||||||
|
- }
|
||||||
|
- if(t2p->pdf_minorversion < 2)
|
||||||
|
- t2p->pdf_minorversion = 2;
|
||||||
|
+ &(tiff_transferfunction[0]),
|
||||||
|
+ &(tiff_transferfunction[1]),
|
||||||
|
+ &(tiff_transferfunction[2]))) {
|
||||||
|
+
|
||||||
|
+ if((tiff_transferfunction[1] != (uint16*) NULL) &&
|
||||||
|
+ (tiff_transferfunction[2] != (uint16*) NULL)
|
||||||
|
+ ) {
|
||||||
|
+ tiff_transferfunctioncount=3;
|
||||||
|
+ } else {
|
||||||
|
+ tiff_transferfunctioncount=1;
|
||||||
|
+ }
|
||||||
|
} else {
|
||||||
|
- t2p->tiff_transferfunctioncount=0;
|
||||||
|
+ tiff_transferfunctioncount=0;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+ if (i > 0){
|
||||||
|
+ if (tiff_transferfunctioncount != t2p->tiff_transferfunctioncount){
|
||||||
|
+ TIFFError(
|
||||||
|
+ TIFF2PDF_MODULE,
|
||||||
|
+ "Different transfer function on page %d",
|
||||||
|
+ i);
|
||||||
|
+ t2p->t2p_error = T2P_ERR_ERROR;
|
||||||
|
+ return;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ t2p->tiff_transferfunctioncount = tiff_transferfunctioncount;
|
||||||
|
+ t2p->tiff_transferfunction[0] = tiff_transferfunction[0];
|
||||||
|
+ t2p->tiff_transferfunction[1] = tiff_transferfunction[1];
|
||||||
|
+ t2p->tiff_transferfunction[2] = tiff_transferfunction[2];
|
||||||
|
+ if(tiff_transferfunctioncount == 3){
|
||||||
|
+ t2p->tiff_pages[i].page_extra += 4;
|
||||||
|
+ t2p->pdf_xrefcount += 4;
|
||||||
|
+ if(t2p->pdf_minorversion < 2)
|
||||||
|
+ t2p->pdf_minorversion = 2;
|
||||||
|
+ } else if (tiff_transferfunctioncount == 1){
|
||||||
|
+ t2p->tiff_pages[i].page_extra += 2;
|
||||||
|
+ t2p->pdf_xrefcount += 2;
|
||||||
|
+ if(t2p->pdf_minorversion < 2)
|
||||||
|
+ t2p->pdf_minorversion = 2;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if( TIFFGetField(
|
||||||
|
input,
|
||||||
|
TIFFTAG_ICCPROFILE,
|
||||||
|
@@ -1837,10 +1861,9 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){
|
||||||
|
&(t2p->tiff_transferfunction[0]),
|
||||||
|
&(t2p->tiff_transferfunction[1]),
|
||||||
|
&(t2p->tiff_transferfunction[2]))) {
|
||||||
|
- if((t2p->tiff_transferfunction[1] != (float*) NULL) &&
|
||||||
|
- (t2p->tiff_transferfunction[2] != (float*) NULL) &&
|
||||||
|
- (t2p->tiff_transferfunction[1] !=
|
||||||
|
- t2p->tiff_transferfunction[0])) {
|
||||||
|
+ if((t2p->tiff_transferfunction[1] != (uint16*) NULL) &&
|
||||||
|
+ (t2p->tiff_transferfunction[2] != (uint16*) NULL)
|
||||||
|
+ ) {
|
||||||
|
t2p->tiff_transferfunctioncount=3;
|
||||||
|
} else {
|
||||||
|
t2p->tiff_transferfunctioncount=1;
|
||||||
|
--
|
||||||
|
2.17.0
|
||||||
|
|
||||||
31
libtiff-CVE-2018-10963.patch
Normal file
31
libtiff-CVE-2018-10963.patch
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
From 98ed6179dec22db48f6e235d8ca9e2708bf4e71a Mon Sep 17 00:00:00 2001
|
||||||
|
From: Even Rouault <even.rouault@spatialys.com>
|
||||||
|
Date: Sat, 12 May 2018 14:24:15 +0200
|
||||||
|
Subject: [PATCH 4/4] TIFFWriteDirectorySec: avoid assertion. Fixes
|
||||||
|
http://bugzilla.maptools.org/show_bug.cgi?id=2795. CVE-2018-10963
|
||||||
|
|
||||||
|
---
|
||||||
|
libtiff/tif_dirwrite.c | 7 +++++--
|
||||||
|
1 file changed, 5 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c
|
||||||
|
index c68d6d2..5d0a669 100644
|
||||||
|
--- a/libtiff/tif_dirwrite.c
|
||||||
|
+++ b/libtiff/tif_dirwrite.c
|
||||||
|
@@ -697,8 +697,11 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
- assert(0); /* we should never get here */
|
||||||
|
- break;
|
||||||
|
+ TIFFErrorExt(tif->tif_clientdata,module,
|
||||||
|
+ "Cannot write tag %d (%s)",
|
||||||
|
+ TIFFFieldTag(o),
|
||||||
|
+ o->field_name ? o->field_name : "unknown");
|
||||||
|
+ goto bad;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.17.0
|
||||||
|
|
||||||
53
libtiff-CVE-2018-8905.patch
Normal file
53
libtiff-CVE-2018-8905.patch
Normal file
@ -0,0 +1,53 @@
|
|||||||
|
From 1c127eb3cb7653bd61b61f9c3cfeb36fd10edab1 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Even Rouault <even.rouault@spatialys.com>
|
||||||
|
Date: Sat, 12 May 2018 15:32:31 +0200
|
||||||
|
Subject: [PATCH 3/4] LZWDecodeCompat(): fix potential index-out-of-bounds
|
||||||
|
write. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2780 /
|
||||||
|
CVE-2018-8905
|
||||||
|
|
||||||
|
The fix consists in using the similar code LZWDecode() to validate we
|
||||||
|
don't write outside of the output buffer.
|
||||||
|
---
|
||||||
|
libtiff/tif_lzw.c | 18 ++++++++++++------
|
||||||
|
1 file changed, 12 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
|
||||||
|
index bc8f9c8..186ea3c 100644
|
||||||
|
--- a/libtiff/tif_lzw.c
|
||||||
|
+++ b/libtiff/tif_lzw.c
|
||||||
|
@@ -604,6 +604,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
|
||||||
|
char *tp;
|
||||||
|
unsigned char *bp;
|
||||||
|
int code, nbits;
|
||||||
|
+ int len;
|
||||||
|
long nextbits, nextdata, nbitsmask;
|
||||||
|
code_t *codep, *free_entp, *maxcodep, *oldcodep;
|
||||||
|
|
||||||
|
@@ -755,13 +756,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
|
||||||
|
} while (--occ);
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
- assert(occ >= codep->length);
|
||||||
|
- op += codep->length;
|
||||||
|
- occ -= codep->length;
|
||||||
|
- tp = op;
|
||||||
|
+ len = codep->length;
|
||||||
|
+ tp = op + len;
|
||||||
|
do {
|
||||||
|
- *--tp = codep->value;
|
||||||
|
- } while( (codep = codep->next) != NULL );
|
||||||
|
+ int t;
|
||||||
|
+ --tp;
|
||||||
|
+ t = codep->value;
|
||||||
|
+ codep = codep->next;
|
||||||
|
+ *tp = (char)t;
|
||||||
|
+ } while (codep && tp > op);
|
||||||
|
+ assert(occ >= len);
|
||||||
|
+ op += len;
|
||||||
|
+ occ -= len;
|
||||||
|
} else {
|
||||||
|
*op++ = (char)code;
|
||||||
|
occ--;
|
||||||
|
--
|
||||||
|
2.17.0
|
||||||
|
|
||||||
14
libtiff.spec
14
libtiff.spec
@ -1,7 +1,7 @@
|
|||||||
Summary: Library of functions for manipulating TIFF format image files
|
Summary: Library of functions for manipulating TIFF format image files
|
||||||
Name: libtiff
|
Name: libtiff
|
||||||
Version: 4.0.9
|
Version: 4.0.9
|
||||||
Release: 8%{?dist}
|
Release: 9%{?dist}
|
||||||
License: libtiff
|
License: libtiff
|
||||||
Group: System Environment/Libraries
|
Group: System Environment/Libraries
|
||||||
URL: http://www.simplesystems.org/libtiff/
|
URL: http://www.simplesystems.org/libtiff/
|
||||||
@ -12,6 +12,10 @@ Patch0: libtiff-am-version.patch
|
|||||||
Patch1: libtiff-make-check.patch
|
Patch1: libtiff-make-check.patch
|
||||||
Patch2: libtiff-CVE-2018-5784.patch
|
Patch2: libtiff-CVE-2018-5784.patch
|
||||||
Patch3: libtiff-CVE-2018-7456.patch
|
Patch3: libtiff-CVE-2018-7456.patch
|
||||||
|
Patch4: libtiff-CVE-2017-9935.patch
|
||||||
|
Patch5: libtiff-CVE-2017-18013.patch
|
||||||
|
Patch6: libtiff-CVE-2018-8905.patch
|
||||||
|
Patch7: libtiff-CVE-2018-10963.patch
|
||||||
|
|
||||||
BuildRequires: gcc, gcc-c++
|
BuildRequires: gcc, gcc-c++
|
||||||
BuildRequires: zlib-devel libjpeg-devel jbigkit-devel
|
BuildRequires: zlib-devel libjpeg-devel jbigkit-devel
|
||||||
@ -67,6 +71,10 @@ image files using the libtiff library.
|
|||||||
%patch1 -p1
|
%patch1 -p1
|
||||||
%patch2 -p1
|
%patch2 -p1
|
||||||
%patch3 -p1
|
%patch3 -p1
|
||||||
|
%patch4 -p1
|
||||||
|
%patch5 -p1
|
||||||
|
%patch6 -p1
|
||||||
|
%patch7 -p1
|
||||||
|
|
||||||
# Use build system's libtool.m4, not the one in the package.
|
# Use build system's libtool.m4, not the one in the package.
|
||||||
rm -f libtool.m4
|
rm -f libtool.m4
|
||||||
@ -170,6 +178,10 @@ find html -name 'Makefile*' | xargs rm
|
|||||||
%{_mandir}/man1/*
|
%{_mandir}/man1/*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed May 30 2018 Nikola Forró <nforro@redhat.com> - 4.0.9-9
|
||||||
|
- Fix CVE-2017-9935, CVE-2017-18013 (#1530441),
|
||||||
|
CVE-2018-8905 (#1559705) and CVE-2018-10963 (#1579061)
|
||||||
|
|
||||||
* Tue Apr 17 2018 Nikola Forró <nforro@redhat.com> - 4.0.9-8
|
* Tue Apr 17 2018 Nikola Forró <nforro@redhat.com> - 4.0.9-8
|
||||||
- Fix CVE-2018-7456 (#1556709)
|
- Fix CVE-2018-7456 (#1556709)
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user