From cb52e5ea9db13ff37a89ce0afabfe293b7687485 Mon Sep 17 00:00:00 2001 From: Michal Hlavinka Date: Mon, 13 Jul 2026 17:25:59 +0200 Subject: [PATCH] fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189377) Resolves: RHEL-189377 --- libtiff-4.6.0-cve-2026-12912p1of2.patch | 39 +++++++++++++++++ libtiff-4.6.0-cve-2026-12912p2of2.patch | 57 +++++++++++++++++++++++++ libtiff.spec | 12 +++++- 3 files changed, 107 insertions(+), 1 deletion(-) create mode 100644 libtiff-4.6.0-cve-2026-12912p1of2.patch create mode 100644 libtiff-4.6.0-cve-2026-12912p2of2.patch diff --git a/libtiff-4.6.0-cve-2026-12912p1of2.patch b/libtiff-4.6.0-cve-2026-12912p1of2.patch new file mode 100644 index 0000000..e3e1d42 --- /dev/null +++ b/libtiff-4.6.0-cve-2026-12912p1of2.patch @@ -0,0 +1,39 @@ +diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c +index 8bc1529d7f5e4a20b9e20e637df8e500dd4b0de0..8efd92737bd0954baeec27c7525886cb82fdd39b 100644 +--- a/libtiff/tif_pixarlog.c ++++ b/libtiff/tif_pixarlog.c +@@ -876,6 +876,19 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s) + + llen = sp->stride * td->td_imagewidth; + ++ /* Fix: ABGR with stride=3 expands 3 samples to 4 output bytes per pixel */ ++ if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3) ++ { ++ tmsize_t required = (tmsize_t)td->td_imagewidth * 4; ++ if (occ < required) ++ { ++ TIFFErrorExtR(tif, module, ++ "Output buffer too small for PixarLog ABGR data"); ++ memset(op, 0, (size_t)occ); ++ return (0); ++ } ++ } ++ + (void)s; + assert(sp != NULL); + +@@ -991,7 +1004,13 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s) + case PIXARLOGDATAFMT_8BITABGR: + horizontalAccumulate8abgr(up, llen, sp->stride, + (unsigned char *)op, sp->ToLinear8); +- op += llen * sizeof(unsigned char); ++ ++ /* For stride == 3 (RGB), horizontalAccumulate8abgr expands to 4 ++ * bytes/pixel (ABGR) */ ++ if (sp->stride == 3) ++ op += (unsigned long)td->td_imagewidth * 4; ++ else ++ op += (unsigned long)llen * sizeof(unsigned char); + break; + default: + TIFFErrorExtR(tif, module, "Unsupported bits/sample: %" PRIu16, diff --git a/libtiff-4.6.0-cve-2026-12912p2of2.patch b/libtiff-4.6.0-cve-2026-12912p2of2.patch new file mode 100644 index 0000000..59e7622 --- /dev/null +++ b/libtiff-4.6.0-cve-2026-12912p2of2.patch @@ -0,0 +1,57 @@ +From f9bda11bf2fc819b971517582666d56f18b1bc3f Mon Sep 17 00:00:00 2001 +From: waugustus +Date: Thu, 7 May 2026 12:48:42 +0800 +Subject: [PATCH] pixarlog: complete ABGR bounds check for multi-row strip + decoding + +--- + libtiff/tif_pixarlog.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c +index f35f3fb01..a6f62f18b 100644 +--- a/libtiff/tif_pixarlog.c ++++ b/libtiff/tif_pixarlog.c +@@ -880,6 +880,12 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s) + if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3) + { + tmsize_t required = (tmsize_t)td->td_imagewidth * 4; ++ tmsize_t max_rows; ++ tmsize_t max_nsamples; ++ ++ /* ++ * Ensure at least one expanded output row fits. ++ */ + if (occ < required) + { + TIFFErrorExtR(tif, module, +@@ -887,6 +893,26 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s) + memset(op, 0, (size_t)occ); + return (0); + } ++ ++ /* ++ * PixarLogDecode() may process multiple rows per call ++ * (e.g. strip decoding). Limit nsamples so the total ++ * output written by the loop below never exceeds occ. ++ */ ++ max_rows = occ / required; ++ max_nsamples = max_rows * llen; ++ ++ /* ++ * Truncate excess rows to preserve as much decoded data ++ * as possible while avoiding output buffer overflow. ++ */ ++ if (nsamples > max_nsamples) ++ { ++ TIFFWarningExtR(tif, module, ++ "PixarLog ABGR decode truncated to avoid " ++ "output buffer overflow"); ++ nsamples = max_nsamples; ++ } + } + + (void)s; +-- +GitLab + diff --git a/libtiff.spec b/libtiff.spec index 6e666b1..5d047a4 100644 --- a/libtiff.spec +++ b/libtiff.spec @@ -1,7 +1,7 @@ Summary: Library of functions for manipulating TIFF format image files Name: libtiff Version: 4.6.0 -Release: 10%{?dist} +Release: 11%{?dist} License: libtiff URL: http://www.simplesystems.org/libtiff/ @@ -27,6 +27,11 @@ Patch5: libtiff-4.6.0-CVE-2023-52355.patch # from upstream, for < 4.7.0, RHEL-185330 # https://gitlab.com/libtiff/libtiff/-/commit/1c3ecce8498f634346a7030b1859faca24e126f5 Patch6: libtiff-4.6.0-reintroduce-ignore.patch +# from upstream, for < 4.7.2, RHEL-189377 +# https://gitlab.com/libtiff/libtiff/-/merge_requests/873.diff +Patch7: libtiff-4.6.0-cve-2026-12912p1of2.patch +# https://gitlab.com/libtiff/libtiff/-/commit/f9bda11bf2fc819b971517582666d56f18b1bc3f +Patch8: libtiff-4.6.0-cve-2026-12912p2of2.patch BuildRequires: gcc, gcc-c++ BuildRequires: zlib-devel libjpeg-devel jbigkit-devel libzstd-devel libwebp-devel liblerc-devel @@ -84,6 +89,8 @@ image files using the libtiff library. %patch -P 4 -p1 -b .CVE-2026-4775 %patch -P 5 -p1 -b .CVE-2023-52355 %patch -P 6 -p1 -b .reintroduce-ignore +%patch -P 7 -p1 -b .cve-2026-12912p1of2 +%patch -P 8 -p1 -b .cve-2026-12912p2of2 # Use build system's libtool.m4, not the one in the package. rm -f libtool.m4 @@ -182,6 +189,9 @@ LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH make check %{_mandir}/man1/* %changelog +* Mon Jul 20 2026 Michal Hlavinka - 4.6.0-11 +- fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189377) + * Mon Jun 29 2026 Michal Hlavinka - 4.6.0-10 - reintroduce ignore option -i as it is required for tests (RHEL-185330)