diff --git a/libtiff-CVE-2017-7592.patch b/libtiff-CVE-2017-7592.patch new file mode 100644 index 0000000..d32a1b0 --- /dev/null +++ b/libtiff-CVE-2017-7592.patch @@ -0,0 +1,32 @@ +From ae475079a1cc9064327d0a1f680dd6107db29859 Mon Sep 17 00:00:00 2001 +From: erouault +Date: Wed, 11 Jan 2017 16:38:26 +0000 +Subject: [PATCH 1/8] =?UTF-8?q?*=20libtiff/tif=5Fgetimage.c:=20add=20expli?= + =?UTF-8?q?cit=20uint32=20cast=20in=20putagreytile=20to=20avoid=20Undefine?= + =?UTF-8?q?dBehaviorSanitizer=20warning.=20Patch=20by=20Nicol=C3=A1s=20Pe?= + =?UTF-8?q?=C3=B1a.=20Fixes=20http://bugzilla.maptools.org/show=5Fbug.cgi?= + =?UTF-8?q?=3Fid=3D2658?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +--- + libtiff/tif_getimage.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c +index 0f5e932..f5258b3 100644 +--- a/libtiff/tif_getimage.c ++++ b/libtiff/tif_getimage.c +@@ -1305,7 +1305,7 @@ DECLAREContigPutFunc(putagreytile) + while (h-- > 0) { + for (x = w; x-- > 0;) + { +- *cp++ = BWmap[*pp][0] & (*(pp+1) << 24 | ~A1); ++ *cp++ = BWmap[*pp][0] & ((uint32)*(pp+1) << 24 | ~A1); + pp += samplesperpixel; + } + cp += toskew; +-- +2.7.4 + diff --git a/libtiff-CVE-2017-7593.patch b/libtiff-CVE-2017-7593.patch new file mode 100644 index 0000000..649f763 --- /dev/null +++ b/libtiff-CVE-2017-7593.patch @@ -0,0 +1,84 @@ +From e230043bc9e9bb67ecd3c7378885cbdb3bb89384 Mon Sep 17 00:00:00 2001 +From: erouault +Date: Wed, 11 Jan 2017 19:02:49 +0000 +Subject: [PATCH 2/8] * libtiff/tiffiop.h, tif_unix.c, tif_win32.c: add + _TIFFcalloc() + +* libtiff/tif_read.c: TIFFReadBufferSetup(): use _TIFFcalloc() to zero +initialize tif_rawdata. +Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2651 +--- + libtiff/tif_read.c | 4 +++- + libtiff/tif_unix.c | 8 ++++++++ + libtiff/tif_win32.c | 8 ++++++++ + libtiff/tiffio.h | 1 + + 4 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c +index eb3e3ef..f65bfab 100644 +--- a/libtiff/tif_read.c ++++ b/libtiff/tif_read.c +@@ -976,7 +976,9 @@ TIFFReadBufferSetup(TIFF* tif, void* bp, tmsize_t size) + "Invalid buffer size"); + return (0); + } +- tif->tif_rawdata = (uint8*) _TIFFmalloc(tif->tif_rawdatasize); ++ /* Initialize to zero to avoid uninitialized buffers in case of */ ++ /* short reads (http://bugzilla.maptools.org/show_bug.cgi?id=2651) */ ++ tif->tif_rawdata = (uint8*) _TIFFcalloc(1, tif->tif_rawdatasize); + tif->tif_flags |= TIFF_MYBUFFER; + } + if (tif->tif_rawdata == NULL) { +diff --git a/libtiff/tif_unix.c b/libtiff/tif_unix.c +index 81e9d66..16694df 100644 +--- a/libtiff/tif_unix.c ++++ b/libtiff/tif_unix.c +@@ -316,6 +316,14 @@ _TIFFmalloc(tmsize_t s) + return (malloc((size_t) s)); + } + ++void* _TIFFcalloc(tmsize_t nmemb, tmsize_t siz) ++{ ++ if( nmemb == 0 || siz == 0 ) ++ return ((void *) NULL); ++ ++ return calloc((size_t) nmemb, (size_t)siz); ++} ++ + void + _TIFFfree(void* p) + { +diff --git a/libtiff/tif_win32.c b/libtiff/tif_win32.c +index 24b824f..9dcbc3d 100644 +--- a/libtiff/tif_win32.c ++++ b/libtiff/tif_win32.c +@@ -360,6 +360,14 @@ _TIFFmalloc(tmsize_t s) + return (malloc((size_t) s)); + } + ++void* _TIFFcalloc(tmsize_t nmemb, tmsize_t siz) ++{ ++ if( nmemb == 0 || siz == 0 ) ++ return ((void *) NULL); ++ ++ return calloc((size_t) nmemb, (size_t)siz); ++} ++ + void + _TIFFfree(void* p) + { +diff --git a/libtiff/tiffio.h b/libtiff/tiffio.h +index 6a84d80..9b24fae 100644 +--- a/libtiff/tiffio.h ++++ b/libtiff/tiffio.h +@@ -293,6 +293,7 @@ extern TIFFCodec* TIFFGetConfiguredCODECs(void); + */ + + extern void* _TIFFmalloc(tmsize_t s); ++extern void* _TIFFcalloc(tmsize_t nmemb, tmsize_t siz); + extern void* _TIFFrealloc(void* p, tmsize_t s); + extern void _TIFFmemset(void* p, int v, tmsize_t c); + extern void _TIFFmemcpy(void* d, const void* s, tmsize_t c); +-- +2.7.4 + diff --git a/libtiff-CVE-2017-7594.patch b/libtiff-CVE-2017-7594.patch new file mode 100644 index 0000000..040f6d6 --- /dev/null +++ b/libtiff-CVE-2017-7594.patch @@ -0,0 +1,55 @@ +From 368f11b41c726df5d888124330855e1042db9603 Mon Sep 17 00:00:00 2001 +From: erouault +Date: Thu, 12 Jan 2017 19:23:20 +0000 +Subject: [PATCH 3/8] * libtiff/tif_ojpeg.c: fix leak in + OJPEGReadHeaderInfoSecTablesQTable, OJPEGReadHeaderInfoSecTablesDcTable and + OJPEGReadHeaderInfoSecTablesAcTable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +* libtiff/tif_ojpeg.c: fix leak in OJPEGReadHeaderInfoSecTablesAcTable when read fails. Patch by Nicolás Peña. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2659 +--- + libtiff/tif_ojpeg.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c +index 0e69a46..3421a05 100644 +--- a/libtiff/tif_ojpeg.c ++++ b/libtiff/tif_ojpeg.c +@@ -1790,7 +1790,10 @@ OJPEGReadHeaderInfoSecTablesQTable(TIFF* tif) + TIFFSeekFile(tif,sp->qtable_offset[m],SEEK_SET); + p=(uint32)TIFFReadFile(tif,&ob[sizeof(uint32)+5],64); + if (p!=64) ++ { ++ _TIFFfree(ob); + return(0); ++ } + sp->qtable[m]=ob; + sp->sof_tq[m]=m; + } +@@ -1854,7 +1857,10 @@ OJPEGReadHeaderInfoSecTablesDcTable(TIFF* tif) + rb[sizeof(uint32)+5+n]=o[n]; + p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q); + if (p!=q) ++ { ++ _TIFFfree(rb); + return(0); ++ } + sp->dctable[m]=rb; + sp->sos_tda[m]=(m<<4); + } +@@ -1918,7 +1924,10 @@ OJPEGReadHeaderInfoSecTablesAcTable(TIFF* tif) + rb[sizeof(uint32)+5+n]=o[n]; + p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q); + if (p!=q) ++ { ++ _TIFFfree(rb); + return(0); ++ } + sp->actable[m]=rb; + sp->sos_tda[m]=(sp->sos_tda[m]|m); + } +-- +2.7.4 + diff --git a/libtiff-CVE-2017-7595.patch b/libtiff-CVE-2017-7595.patch new file mode 100644 index 0000000..e6705e0 --- /dev/null +++ b/libtiff-CVE-2017-7595.patch @@ -0,0 +1,32 @@ +From ad5165ff126fc43c60e4d2473c4d8901dc896fec Mon Sep 17 00:00:00 2001 +From: erouault +Date: Wed, 11 Jan 2017 12:15:01 +0000 +Subject: [PATCH 4/8] * libtiff/tif_jpeg.c: avoid integer division by zero in + JPEGSetupEncode() when horizontal or vertical sampling is set to 0. Fixes + http://bugzilla.maptools.org/show_bug.cgi?id=2653 + +--- + libtiff/tif_jpeg.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/libtiff/tif_jpeg.c b/libtiff/tif_jpeg.c +index 70b72d8..1508ce6 100644 +--- a/libtiff/tif_jpeg.c ++++ b/libtiff/tif_jpeg.c +@@ -1626,6 +1626,13 @@ JPEGSetupEncode(TIFF* tif) + case PHOTOMETRIC_YCBCR: + sp->h_sampling = td->td_ycbcrsubsampling[0]; + sp->v_sampling = td->td_ycbcrsubsampling[1]; ++ if( sp->h_sampling == 0 || sp->v_sampling == 0 ) ++ { ++ TIFFErrorExt(tif->tif_clientdata, module, ++ "Invalig horizontal/vertical sampling value"); ++ return (0); ++ } ++ + /* + * A ReferenceBlackWhite field *must* be present since the + * default value is inappropriate for YCbCr. Fill in the +-- +2.7.4 + diff --git a/libtiff-CVE-2017-7596_7597_7599_7600.patch b/libtiff-CVE-2017-7596_7597_7599_7600.patch new file mode 100644 index 0000000..1659e9c --- /dev/null +++ b/libtiff-CVE-2017-7596_7597_7599_7600.patch @@ -0,0 +1,302 @@ +From bf4ca0b5a627bdc00f51d85184beaac6318be355 Mon Sep 17 00:00:00 2001 +From: erouault +Date: Wed, 11 Jan 2017 12:51:59 +0000 +Subject: [PATCH 5/8] * libtiff/tif_dirwrite.c: in + TIFFWriteDirectoryTagCheckedRational, replace assertion by runtime check to + error out if passed value is strictly negative. Fixes + http://bugzilla.maptools.org/show_bug.cgi?id=2535 + +* tools/tiffcrop.c: remove extraneous TIFFClose() in error code path, that +caused double free. +Related to http://bugzilla.maptools.org/show_bug.cgi?id=2535 + +* libtiff/tif_dir.c, tif_dirread.c, tif_dirwrite.c: implement various clampings of double to other data types to avoid undefined behaviour if the output range isn't big enough to hold the input value. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2643 http://bugzilla.maptools.org/show_bug.cgi?id=2642 http://bugzilla.maptools.org/show_bug.cgi?id=2646 http://bugzilla.maptools.org/show_bug.cgi?id=2647 +--- + libtiff/tif_dir.c | 18 +++++++-- + libtiff/tif_dirread.c | 10 ++++- + libtiff/tif_dirwrite.c | 99 ++++++++++++++++++++++++++++++++++++++++++++------ + tools/tiffcrop.c | 1 - + 4 files changed, 110 insertions(+), 18 deletions(-) + +diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c +index ad21655..8806241 100644 +--- a/libtiff/tif_dir.c ++++ b/libtiff/tif_dir.c +@@ -31,6 +31,7 @@ + * (and also some miscellaneous stuff) + */ + #include "tiffiop.h" ++#include + + /* + * These are used in the backwards compatibility code... +@@ -154,6 +155,15 @@ bad: + return (0); + } + ++static float TIFFClampDoubleToFloat( double val ) ++{ ++ if( val > FLT_MAX ) ++ return FLT_MAX; ++ if( val < -FLT_MAX ) ++ return -FLT_MAX; ++ return (float)val; ++} ++ + static int + _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap) + { +@@ -312,13 +322,13 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap) + dblval = va_arg(ap, double); + if( dblval < 0 ) + goto badvaluedouble; +- td->td_xresolution = (float) dblval; ++ td->td_xresolution = TIFFClampDoubleToFloat( dblval ); + break; + case TIFFTAG_YRESOLUTION: + dblval = va_arg(ap, double); + if( dblval < 0 ) + goto badvaluedouble; +- td->td_yresolution = (float) dblval; ++ td->td_yresolution = TIFFClampDoubleToFloat( dblval ); + break; + case TIFFTAG_PLANARCONFIG: + v = (uint16) va_arg(ap, uint16_vap); +@@ -327,10 +337,10 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap) + td->td_planarconfig = (uint16) v; + break; + case TIFFTAG_XPOSITION: +- td->td_xposition = (float) va_arg(ap, double); ++ td->td_xposition = TIFFClampDoubleToFloat( va_arg(ap, double) ); + break; + case TIFFTAG_YPOSITION: +- td->td_yposition = (float) va_arg(ap, double); ++ td->td_yposition = TIFFClampDoubleToFloat( va_arg(ap, double) ); + break; + case TIFFTAG_RESOLUTIONUNIT: + v = (uint16) va_arg(ap, uint16_vap); +diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c +index bfd0105..7d1d194 100644 +--- a/libtiff/tif_dirread.c ++++ b/libtiff/tif_dirread.c +@@ -40,6 +40,7 @@ + */ + + #include "tiffiop.h" ++#include + + #define IGNORE 0 /* tag placeholder used below */ + #define FAILED_FII ((uint32) -1) +@@ -2406,7 +2407,14 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEnt + ma=(double*)origdata; + mb=data; + for (n=0; n FLT_MAX ) ++ val = FLT_MAX; ++ else if( val < -FLT_MAX ) ++ val = -FLT_MAX; ++ *mb++=(float)val; ++ } + } + break; + } +diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c +index d34f6f6..50bc3d5 100644 +--- a/libtiff/tif_dirwrite.c ++++ b/libtiff/tif_dirwrite.c +@@ -30,6 +30,7 @@ + * Directory Write Support Routines. + */ + #include "tiffiop.h" ++#include + + #ifdef HAVE_IEEEFP + #define TIFFCvtNativeToIEEEFloat(tif, n, fp) +@@ -939,6 +940,69 @@ bad: + return(0); + } + ++static float TIFFClampDoubleToFloat( double val ) ++{ ++ if( val > FLT_MAX ) ++ return FLT_MAX; ++ if( val < -FLT_MAX ) ++ return -FLT_MAX; ++ return (float)val; ++} ++ ++static int8 TIFFClampDoubleToInt8( double val ) ++{ ++ if( val > 127 ) ++ return 127; ++ if( val < -128 || val != val ) ++ return -128; ++ return (int8)val; ++} ++ ++static int16 TIFFClampDoubleToInt16( double val ) ++{ ++ if( val > 32767 ) ++ return 32767; ++ if( val < -32768 || val != val ) ++ return -32768; ++ return (int16)val; ++} ++ ++static int32 TIFFClampDoubleToInt32( double val ) ++{ ++ if( val > 0x7FFFFFFF ) ++ return 0x7FFFFFFF; ++ if( val < -0x7FFFFFFF-1 || val != val ) ++ return -0x7FFFFFFF-1; ++ return (int32)val; ++} ++ ++static uint8 TIFFClampDoubleToUInt8( double val ) ++{ ++ if( val < 0 ) ++ return 0; ++ if( val > 255 || val != val ) ++ return 255; ++ return (uint8)val; ++} ++ ++static uint16 TIFFClampDoubleToUInt16( double val ) ++{ ++ if( val < 0 ) ++ return 0; ++ if( val > 65535 || val != val ) ++ return 65535; ++ return (uint16)val; ++} ++ ++static uint32 TIFFClampDoubleToUInt32( double val ) ++{ ++ if( val < 0 ) ++ return 0; ++ if( val > 0xFFFFFFFFU || val != val ) ++ return 0xFFFFFFFFU; ++ return (uint32)val; ++} ++ + static int + TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value) + { +@@ -959,7 +1023,7 @@ TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* di + if (tif->tif_dir.td_bitspersample<=32) + { + for (i = 0; i < count; ++i) +- ((float*)conv)[i] = (float)value[i]; ++ ((float*)conv)[i] = TIFFClampDoubleToFloat(value[i]); + ok = TIFFWriteDirectoryTagFloatArray(tif,ndir,dir,tag,count,(float*)conv); + } + else +@@ -971,19 +1035,19 @@ TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* di + if (tif->tif_dir.td_bitspersample<=8) + { + for (i = 0; i < count; ++i) +- ((int8*)conv)[i] = (int8)value[i]; ++ ((int8*)conv)[i] = TIFFClampDoubleToInt8(value[i]); + ok = TIFFWriteDirectoryTagSbyteArray(tif,ndir,dir,tag,count,(int8*)conv); + } + else if (tif->tif_dir.td_bitspersample<=16) + { + for (i = 0; i < count; ++i) +- ((int16*)conv)[i] = (int16)value[i]; ++ ((int16*)conv)[i] = TIFFClampDoubleToInt16(value[i]); + ok = TIFFWriteDirectoryTagSshortArray(tif,ndir,dir,tag,count,(int16*)conv); + } + else + { + for (i = 0; i < count; ++i) +- ((int32*)conv)[i] = (int32)value[i]; ++ ((int32*)conv)[i] = TIFFClampDoubleToInt32(value[i]); + ok = TIFFWriteDirectoryTagSlongArray(tif,ndir,dir,tag,count,(int32*)conv); + } + break; +@@ -991,19 +1055,19 @@ TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* di + if (tif->tif_dir.td_bitspersample<=8) + { + for (i = 0; i < count; ++i) +- ((uint8*)conv)[i] = (uint8)value[i]; ++ ((uint8*)conv)[i] = TIFFClampDoubleToUInt8(value[i]); + ok = TIFFWriteDirectoryTagByteArray(tif,ndir,dir,tag,count,(uint8*)conv); + } + else if (tif->tif_dir.td_bitspersample<=16) + { + for (i = 0; i < count; ++i) +- ((uint16*)conv)[i] = (uint16)value[i]; ++ ((uint16*)conv)[i] = TIFFClampDoubleToUInt16(value[i]); + ok = TIFFWriteDirectoryTagShortArray(tif,ndir,dir,tag,count,(uint16*)conv); + } + else + { + for (i = 0; i < count; ++i) +- ((uint32*)conv)[i] = (uint32)value[i]; ++ ((uint32*)conv)[i] = TIFFClampDoubleToUInt32(value[i]); + ok = TIFFWriteDirectoryTagLongArray(tif,ndir,dir,tag,count,(uint32*)conv); + } + break; +@@ -2094,15 +2158,25 @@ TIFFWriteDirectoryTagCheckedSlong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* d + static int + TIFFWriteDirectoryTagCheckedRational(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value) + { ++ static const char module[] = "TIFFWriteDirectoryTagCheckedRational"; + uint32 m[2]; +- assert(value>=0.0); + assert(sizeof(uint32)==4); +- if (value<=0.0) ++ if( value < 0 ) ++ { ++ TIFFErrorExt(tif->tif_clientdata,module,"Negative value is illegal"); ++ return 0; ++ } ++ else if( value != value ) ++ { ++ TIFFErrorExt(tif->tif_clientdata,module,"Not-a-number value is illegal"); ++ return 0; ++ } ++ else if (value==0.0) + { + m[0]=0; + m[1]=1; + } +- else if (value==(double)(uint32)value) ++ else if (value <= 0xFFFFFFFFU && value==(double)(uint32)value) + { + m[0]=(uint32)value; + m[1]=1; +@@ -2143,12 +2217,13 @@ TIFFWriteDirectoryTagCheckedRationalArray(TIFF* tif, uint32* ndir, TIFFDirEntry* + } + for (na=value, nb=m, nc=0; nc= 0 && *na <= (float)0xFFFFFFFFU && ++ *na==(float)(uint32)(*na)) + { + nb[0]=(uint32)(*na); + nb[1]=1; +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index ad2c00f..6e7b727 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -7986,7 +7986,6 @@ writeCroppedImage(TIFF *in, TIFF *out, struct image_data *image, + if (!TIFFWriteDirectory(out)) + { + TIFFError("","Failed to write IFD for page number %d", pagenum); +- TIFFClose(out); + return (-1); + } + +-- +2.7.4 + diff --git a/libtiff-CVE-2017-7598.patch b/libtiff-CVE-2017-7598.patch new file mode 100644 index 0000000..b3b0c2a --- /dev/null +++ b/libtiff-CVE-2017-7598.patch @@ -0,0 +1,44 @@ +From c682ee1d269b85c54202c04a9a5afb9737e75416 Mon Sep 17 00:00:00 2001 +From: erouault +Date: Wed, 11 Jan 2017 13:28:01 +0000 +Subject: [PATCH 6/8] * libtiff/tif_dirread.c: avoid division by floating point + 0 in TIFFReadDirEntryCheckedRational() and + TIFFReadDirEntryCheckedSrational(), and return 0 in that case (instead of + infinity as before presumably) Apparently some sanitizers do not like those + divisions by zero. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2644 + +--- + libtiff/tif_dirread.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c +index 7d1d194..32aabe6 100644 +--- a/libtiff/tif_dirread.c ++++ b/libtiff/tif_dirread.c +@@ -2880,7 +2880,10 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFD + m.l = direntry->tdir_offset.toff_long8; + if (tif->tif_flags&TIFF_SWAB) + TIFFSwabArrayOfLong(m.i,2); +- if (m.i[0]==0) ++ /* Not completely sure what we should do when m.i[1]==0, but some */ ++ /* sanitizers do not like division by 0.0: */ ++ /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */ ++ if (m.i[0]==0 || m.i[1]==0) + *value=0.0; + else + *value=(double)m.i[0]/(double)m.i[1]; +@@ -2908,7 +2911,10 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFF + m.l=direntry->tdir_offset.toff_long8; + if (tif->tif_flags&TIFF_SWAB) + TIFFSwabArrayOfLong(m.i,2); +- if ((int32)m.i[0]==0) ++ /* Not completely sure what we should do when m.i[1]==0, but some */ ++ /* sanitizers do not like division by 0.0: */ ++ /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */ ++ if ((int32)m.i[0]==0 || m.i[1]==0) + *value=0.0; + else + *value=(double)((int32)m.i[0])/(double)m.i[1]; +-- +2.7.4 + diff --git a/libtiff-CVE-2017-7601.patch b/libtiff-CVE-2017-7601.patch new file mode 100644 index 0000000..3eaaa8c --- /dev/null +++ b/libtiff-CVE-2017-7601.patch @@ -0,0 +1,32 @@ +From 148b32d6d0d79641b73b75b48ccacda3d640b47d Mon Sep 17 00:00:00 2001 +From: erouault +Date: Wed, 11 Jan 2017 16:13:50 +0000 +Subject: [PATCH 7/8] * libtiff/tif_jpeg.c: validate BitsPerSample in + JPEGSetupEncode() to avoid undefined behaviour caused by invalid shift + exponent. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2648 + +--- + libtiff/tif_jpeg.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/libtiff/tif_jpeg.c b/libtiff/tif_jpeg.c +index 1508ce6..a223eea 100644 +--- a/libtiff/tif_jpeg.c ++++ b/libtiff/tif_jpeg.c +@@ -1632,6 +1632,13 @@ JPEGSetupEncode(TIFF* tif) + "Invalig horizontal/vertical sampling value"); + return (0); + } ++ if( td->td_bitspersample > 16 ) ++ { ++ TIFFErrorExt(tif->tif_clientdata, module, ++ "BitsPerSample %d not allowed for JPEG", ++ td->td_bitspersample); ++ return (0); ++ } + + /* + * A ReferenceBlackWhite field *must* be present since the +-- +2.7.4 + diff --git a/libtiff-CVE-2017-7602.patch b/libtiff-CVE-2017-7602.patch new file mode 100644 index 0000000..0a1804b --- /dev/null +++ b/libtiff-CVE-2017-7602.patch @@ -0,0 +1,53 @@ +From be885a59b044553637289be4f6805e88782e52ef Mon Sep 17 00:00:00 2001 +From: erouault +Date: Wed, 11 Jan 2017 16:33:34 +0000 +Subject: [PATCH 8/8] * libtiff/tif_read.c: avoid potential undefined behaviour + on signed integer addition in TIFFReadRawStrip1() in isMapped() case. Fixes + http://bugzilla.maptools.org/show_bug.cgi?id=2650 + +--- + libtiff/tif_read.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c +index f65bfab..60e5d03 100644 +--- a/libtiff/tif_read.c ++++ b/libtiff/tif_read.c +@@ -420,16 +420,25 @@ TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size, + return ((tmsize_t)(-1)); + } + } else { +- tmsize_t ma,mb; ++ tmsize_t ma; + tmsize_t n; +- ma=(tmsize_t)td->td_stripoffset[strip]; +- mb=ma+size; +- if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||(ma>tif->tif_size)) +- n=0; +- else if ((mbtif->tif_size)) +- n=tif->tif_size-ma; +- else +- n=size; ++ if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)|| ++ ((ma=(tmsize_t)td->td_stripoffset[strip])>tif->tif_size)) ++ { ++ n=0; ++ } ++ else if( ma > TIFF_TMSIZE_T_MAX - size ) ++ { ++ n=0; ++ } ++ else ++ { ++ tmsize_t mb=ma+size; ++ if (mb>tif->tif_size) ++ n=tif->tif_size-ma; ++ else ++ n=size; ++ } + if (n!=size) { + #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) + TIFFErrorExt(tif->tif_clientdata, module, +-- +2.7.4 + diff --git a/libtiff.spec b/libtiff.spec index 9eddcc6..c24b59a 100644 --- a/libtiff.spec +++ b/libtiff.spec @@ -1,7 +1,7 @@ Summary: Library of functions for manipulating TIFF format image files Name: libtiff Version: 4.0.7 -Release: 4%{?dist} +Release: 5%{?dist} License: libtiff Group: System Environment/Libraries URL: http://www.simplesystems.org/libtiff/ @@ -17,6 +17,14 @@ Patch5: libtiff-CVE-2016-10268.patch Patch6: libtiff-CVE-2016-10269.patch Patch7: libtiff-CVE-2016-10270.patch Patch8: libtiff-CVE-2016-10271_10272.patch +Patch9: libtiff-CVE-2017-7592.patch +Patch10: libtiff-CVE-2017-7593.patch +Patch11: libtiff-CVE-2017-7594.patch +Patch12: libtiff-CVE-2017-7595.patch +Patch13: libtiff-CVE-2017-7596_7597_7599_7600.patch +Patch14: libtiff-CVE-2017-7598.patch +Patch15: libtiff-CVE-2017-7601.patch +Patch16: libtiff-CVE-2017-7602.patch BuildRequires: zlib-devel libjpeg-devel jbigkit-devel BuildRequires: libtool automake autoconf pkgconfig @@ -76,6 +84,14 @@ image files using the libtiff library. %patch6 -p1 %patch7 -p1 %patch8 -p1 +%patch9 -p1 +%patch10 -p1 +%patch11 -p1 +%patch12 -p1 +%patch13 -p1 +%patch14 -p1 +%patch15 -p1 +%patch16 -p1 # Use build system's libtool.m4, not the one in the package. rm -f libtool.m4 @@ -181,6 +197,9 @@ find html -name 'Makefile*' | xargs rm %{_mandir}/man1/* %changelog +* Wed Apr 12 2017 Nikola Forró - 4.0.7-5 +- Fix CVE-2017-759{2,3,4,5,6,7,8,9}, CVE-2017-760{0,1,2} (#1441273) + * Wed Apr 05 2017 Nikola Forró - 4.0.7-4 - Fix CVE-2016-1026{6,7,8,9}, CVE-2016-1027{0,1,2} (#1438464)