fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189377)
Resolves: RHEL-189377
This commit is contained in:
Michal Hlavinka
parent
51b078948e
commit
cb52e5ea9d
39
libtiff-4.6.0-cve-2026-12912p1of2.patch
Normal file
39
libtiff-4.6.0-cve-2026-12912p1of2.patch
Normal file
@ -0,0 +1,39 @@
|
||||
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
|
||||
index 8bc1529d7f5e4a20b9e20e637df8e500dd4b0de0..8efd92737bd0954baeec27c7525886cb82fdd39b 100644
|
||||
--- a/libtiff/tif_pixarlog.c
|
||||
+++ b/libtiff/tif_pixarlog.c
|
||||
@@ -876,6 +876,19 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
|
||||
|
||||
llen = sp->stride * td->td_imagewidth;
|
||||
|
||||
+ /* Fix: ABGR with stride=3 expands 3 samples to 4 output bytes per pixel */
|
||||
+ if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3)
|
||||
+ {
|
||||
+ tmsize_t required = (tmsize_t)td->td_imagewidth * 4;
|
||||
+ if (occ < required)
|
||||
+ {
|
||||
+ TIFFErrorExtR(tif, module,
|
||||
+ "Output buffer too small for PixarLog ABGR data");
|
||||
+ memset(op, 0, (size_t)occ);
|
||||
+ return (0);
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
(void)s;
|
||||
assert(sp != NULL);
|
||||
|
||||
@@ -991,7 +1004,13 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
|
||||
case PIXARLOGDATAFMT_8BITABGR:
|
||||
horizontalAccumulate8abgr(up, llen, sp->stride,
|
||||
(unsigned char *)op, sp->ToLinear8);
|
||||
- op += llen * sizeof(unsigned char);
|
||||
+
|
||||
+ /* For stride == 3 (RGB), horizontalAccumulate8abgr expands to 4
|
||||
+ * bytes/pixel (ABGR) */
|
||||
+ if (sp->stride == 3)
|
||||
+ op += (unsigned long)td->td_imagewidth * 4;
|
||||
+ else
|
||||
+ op += (unsigned long)llen * sizeof(unsigned char);
|
||||
break;
|
||||
default:
|
||||
TIFFErrorExtR(tif, module, "Unsupported bits/sample: %" PRIu16,
|
||||
57
libtiff-4.6.0-cve-2026-12912p2of2.patch
Normal file
57
libtiff-4.6.0-cve-2026-12912p2of2.patch
Normal file
@ -0,0 +1,57 @@
|
||||
From f9bda11bf2fc819b971517582666d56f18b1bc3f Mon Sep 17 00:00:00 2001
|
||||
From: waugustus <wangdw.augustus@qq.com>
|
||||
Date: Thu, 7 May 2026 12:48:42 +0800
|
||||
Subject: [PATCH] pixarlog: complete ABGR bounds check for multi-row strip
|
||||
decoding
|
||||
|
||||
---
|
||||
libtiff/tif_pixarlog.c | 26 ++++++++++++++++++++++++++
|
||||
1 file changed, 26 insertions(+)
|
||||
|
||||
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
|
||||
index f35f3fb01..a6f62f18b 100644
|
||||
--- a/libtiff/tif_pixarlog.c
|
||||
+++ b/libtiff/tif_pixarlog.c
|
||||
@@ -880,6 +880,12 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
|
||||
if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3)
|
||||
{
|
||||
tmsize_t required = (tmsize_t)td->td_imagewidth * 4;
|
||||
+ tmsize_t max_rows;
|
||||
+ tmsize_t max_nsamples;
|
||||
+
|
||||
+ /*
|
||||
+ * Ensure at least one expanded output row fits.
|
||||
+ */
|
||||
if (occ < required)
|
||||
{
|
||||
TIFFErrorExtR(tif, module,
|
||||
@@ -887,6 +893,26 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
|
||||
memset(op, 0, (size_t)occ);
|
||||
return (0);
|
||||
}
|
||||
+
|
||||
+ /*
|
||||
+ * PixarLogDecode() may process multiple rows per call
|
||||
+ * (e.g. strip decoding). Limit nsamples so the total
|
||||
+ * output written by the loop below never exceeds occ.
|
||||
+ */
|
||||
+ max_rows = occ / required;
|
||||
+ max_nsamples = max_rows * llen;
|
||||
+
|
||||
+ /*
|
||||
+ * Truncate excess rows to preserve as much decoded data
|
||||
+ * as possible while avoiding output buffer overflow.
|
||||
+ */
|
||||
+ if (nsamples > max_nsamples)
|
||||
+ {
|
||||
+ TIFFWarningExtR(tif, module,
|
||||
+ "PixarLog ABGR decode truncated to avoid "
|
||||
+ "output buffer overflow");
|
||||
+ nsamples = max_nsamples;
|
||||
+ }
|
||||
}
|
||||
|
||||
(void)s;
|
||||
--
|
||||
GitLab
|
||||
|
||||
12
libtiff.spec
12
libtiff.spec
@ -1,7 +1,7 @@
|
||||
Summary: Library of functions for manipulating TIFF format image files
|
||||
Name: libtiff
|
||||
Version: 4.6.0
|
||||
Release: 10%{?dist}
|
||||
Release: 11%{?dist}
|
||||
License: libtiff
|
||||
URL: http://www.simplesystems.org/libtiff/
|
||||
|
||||
@ -27,6 +27,11 @@ Patch5: libtiff-4.6.0-CVE-2023-52355.patch
|
||||
# from upstream, for < 4.7.0, RHEL-185330
|
||||
# https://gitlab.com/libtiff/libtiff/-/commit/1c3ecce8498f634346a7030b1859faca24e126f5
|
||||
Patch6: libtiff-4.6.0-reintroduce-ignore.patch
|
||||
# from upstream, for < 4.7.2, RHEL-189377
|
||||
# https://gitlab.com/libtiff/libtiff/-/merge_requests/873.diff
|
||||
Patch7: libtiff-4.6.0-cve-2026-12912p1of2.patch
|
||||
# https://gitlab.com/libtiff/libtiff/-/commit/f9bda11bf2fc819b971517582666d56f18b1bc3f
|
||||
Patch8: libtiff-4.6.0-cve-2026-12912p2of2.patch
|
||||
|
||||
BuildRequires: gcc, gcc-c++
|
||||
BuildRequires: zlib-devel libjpeg-devel jbigkit-devel libzstd-devel libwebp-devel liblerc-devel
|
||||
@ -84,6 +89,8 @@ image files using the libtiff library.
|
||||
%patch -P 4 -p1 -b .CVE-2026-4775
|
||||
%patch -P 5 -p1 -b .CVE-2023-52355
|
||||
%patch -P 6 -p1 -b .reintroduce-ignore
|
||||
%patch -P 7 -p1 -b .cve-2026-12912p1of2
|
||||
%patch -P 8 -p1 -b .cve-2026-12912p2of2
|
||||
|
||||
# Use build system's libtool.m4, not the one in the package.
|
||||
rm -f libtool.m4
|
||||
@ -182,6 +189,9 @@ LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH make check
|
||||
%{_mandir}/man1/*
|
||||
|
||||
%changelog
|
||||
* Mon Jul 20 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-11
|
||||
- fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189377)
|
||||
|
||||
* Mon Jun 29 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-10
|
||||
- reintroduce ignore option -i as it is required for tests (RHEL-185330)
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user