rpms/libtiff
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix LZW decoding vulnerabilities (CVE-2008-2327)

Browse Source
This commit is contained in:
Tom Lane 2008-08-26 15:52:30 +00:00
parent 8727f70045
commit ddc956408c
2 changed files with 67 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
libtiff-3.8.2-lzw-bugs.patch Normal file
View File

@ -0,0 +1,58 @@
Fixes for CVE-2008-2327
diff -Naur tiff-3.8.2.orig/libtiff/tif_lzw.c tiff-3.8.2/libtiff/tif_lzw.c
--- tiff-3.8.2.orig/libtiff/tif_lzw.c 2006-03-21 11:42:50.000000000 -0500
+++ tiff-3.8.2/libtiff/tif_lzw.c 2008-08-22 16:26:01.000000000 -0400
@@ -237,6 +237,11 @@
sp->dec_codetab[code].length = 1;
sp->dec_codetab[code].next = NULL;
} while (code--);
+ /*
+ * Zero-out the unused entries
+ */
+ _TIFFmemset(&sp->dec_codetab[CODE_CLEAR], 0,
+ (CODE_FIRST-CODE_CLEAR)*sizeof (code_t));
}
return (1);
}
@@ -408,12 +413,19 @@
break;
if (code == CODE_CLEAR) {
free_entp = sp->dec_codetab + CODE_FIRST;
+ _TIFFmemset(free_entp, 0, (CSIZE-CODE_FIRST)*sizeof (code_t));
nbits = BITS_MIN;
nbitsmask = MAXCODE(BITS_MIN);
maxcodep = sp->dec_codetab + nbitsmask-1;
NextCode(tif, sp, bp, code, GetNextCode);
if (code == CODE_EOI)
break;
+ if (code == CODE_CLEAR) {
+ TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+ "LZWDecode: Corrupted LZW table at scanline %d",
+ tif->tif_row);
+ return (0);
+ }
*op++ = (char)code, occ--;
oldcodep = sp->dec_codetab + code;
continue;
@@ -604,12 +616,19 @@
break;
if (code == CODE_CLEAR) {
free_entp = sp->dec_codetab + CODE_FIRST;
+ _TIFFmemset(free_entp, 0, (CSIZE-CODE_FIRST)*sizeof (code_t));
nbits = BITS_MIN;
nbitsmask = MAXCODE(BITS_MIN);
maxcodep = sp->dec_codetab + nbitsmask;
NextCode(tif, sp, bp, code, GetNextCodeCompat);
if (code == CODE_EOI)
break;
+ if (code == CODE_CLEAR) {
+ TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+ "LZWDecodeCompat: Corrupted LZW table at scanline %d",
+ tif->tif_row);
+ return (0);
+ }
*op++ = code, occ--;
oldcodep = sp->dec_codetab + code;
continue;

10
libtiff.spec
View File

@ -1,7 +1,7 @@
Summary: Library of functions for manipulating TIFF format image files Summary: Library of functions for manipulating TIFF format image files
Name: libtiff Name: libtiff
Version: 3.8.2 Version: 3.8.2
Release: 10%{?dist} Release: 11%{?dist}
License: libtiff License: libtiff
Group: System Environment/Libraries Group: System Environment/Libraries
URL: http://www.libtiff.org/ URL: http://www.libtiff.org/
@ -11,6 +11,7 @@ Patch0: tiffsplit-overflow.patch
Patch1: libtiff-3.8.2-ormandy.patch Patch1: libtiff-3.8.2-ormandy.patch
Patch2: libtiff-3.8.2-CVE-2006-2193.patch Patch2: libtiff-3.8.2-CVE-2006-2193.patch
Patch3: libtiff-3.8.2-mantypo.patch Patch3: libtiff-3.8.2-mantypo.patch
Patch4: libtiff-3.8.2-lzw-bugs.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
BuildRequires: zlib-devel libjpeg-devel BuildRequires: zlib-devel libjpeg-devel
@ -56,8 +57,10 @@ necessary for some boot packages.
%patch1 -p1 -b .ormandy %patch1 -p1 -b .ormandy
%patch2 -p1 -b .CVE-2006-2193 %patch2 -p1 -b .CVE-2006-2193
%patch3 -p1 -b .mantypo %patch3 -p1 -b .mantypo
%patch4 -p1
%build %build
export CFLAGS="%{optflags} -fno-strict-aliasing"
%configure %configure
make %{?_smp_mflags} make %{?_smp_mflags}
@ -154,6 +157,11 @@ rm -rf $RPM_BUILD_ROOT
%{_libdir}/*.a %{_libdir}/*.a
%changelog %changelog
* Tue Aug 26 2008 Tom Lane <tgl@redhat.com> 3.8.2-11
- Fix LZW decoding vulnerabilities (CVE-2008-2327)
Related: #458674
- Use -fno-strict-aliasing per rpmdiff recommendation
* Tue Feb 19 2008 Fedora Release Engineering <rel-eng@fedoraproject.org> - 3.8.2-10 * Tue Feb 19 2008 Fedora Release Engineering <rel-eng@fedoraproject.org> - 3.8.2-10
- Autorebuild for GCC 4.3 - Autorebuild for GCC 4.3