From 9debf535618baef5a906de9f07d937e361ea0bc0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Mu=C5=BEila?= Date: Tue, 14 Mar 2023 19:37:18 +0100 Subject: [PATCH] (CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799) Merge branch 'tiffcrop_R270_fix#492' into 'master' tiffcrop: Amend rotateImage() not to toggle the input (main) image width and... Closes #519, #518, #499, #495, #494, #493 et #492 See merge request libtiff/libtiff!465 (cherry picked from commit afaabc3e50d4e5d80a94143f7e3c997e7e410f68) --- tools/tiffcrop.c | 49 +++++++++++++++++++++++++++--------------------- 1 file changed, 28 insertions(+), 21 deletions(-) diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c index e183e849..c2688883 100644 --- a/tools/tiffcrop.c +++ b/tools/tiffcrop.c @@ -271,7 +271,6 @@ struct region { uint32_t width; /* width in pixels */ uint32_t length; /* length in pixels */ uint32_t buffsize; /* size of buffer needed to hold the cropped region */ - unsigned char *buffptr; /* address of start of the region */ }; /* Cropping parameters from command line and image data @@ -526,7 +525,7 @@ static int rotateContigSamples24bits(uint16_t, uint16_t, uint16_t, uint32_t, static int rotateContigSamples32bits(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, uint32_t, uint8_t *, uint8_t *); static int rotateImage(uint16_t, struct image_data *, uint32_t *, uint32_t *, - unsigned char **, size_t *); + unsigned char **, size_t *, int); static int mirrorImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, unsigned char *); static int invertImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, @@ -5224,7 +5223,6 @@ initCropMasks (struct crop_mask *cps) cps->regionlist[i].width = 0; cps->regionlist[i].length = 0; cps->regionlist[i].buffsize = 0; - cps->regionlist[i].buffptr = NULL; cps->zonelist[i].position = 0; cps->zonelist[i].total = 0; } @@ -6556,8 +6554,12 @@ static int correct_orientation(struct image_data *image, unsigned char **work_b (uint16_t) (image->adjustments & ROTATE_ANY)); return (-1); } - - if (rotateImage(rotation, image, &image->width, &image->length, work_buff_ptr, NULL)) + /* Dummy variable in order not to switch two times the + * image->width,->length within rotateImage(), + * but switch xres, yres there. */ + uint32_t width = image->width; + uint32_t length = image->length; + if (rotateImage(rotation, image, &width, &length, work_buff_ptr, NULL, TRUE)) { TIFFError ("correct_orientation", "Unable to rotate image"); return (-1); @@ -6665,7 +6667,6 @@ extractCompositeRegions(struct image_data *image, struct crop_mask *crop, /* These should not be needed for composite images */ crop->regionlist[i].width = crop_width; crop->regionlist[i].length = crop_length; - crop->regionlist[i].buffptr = crop_buff; src_rowsize = ((img_width * bps * spp) + 7) / 8; dst_rowsize = (((crop_width * bps * count) + 7) / 8); @@ -6904,7 +6905,6 @@ extractSeparateRegion(struct image_data *image, struct crop_mask *crop, crop->regionlist[region].width = crop_width; crop->regionlist[region].length = crop_length; - crop->regionlist[region].buffptr = crop_buff; src = read_buff; dst = crop_buff; @@ -7786,7 +7786,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, * accordingly. */ size_t rot_buf_size = 0; if (rotateImage(crop->rotation, image, &crop->combined_width, - &crop->combined_length, &crop_buff, &rot_buf_size)) + &crop->combined_length, &crop_buff, &rot_buf_size, FALSE)) { TIFFError("processCropSelections", "Failed to rotate composite regions by %"PRIu32" degrees", crop->rotation); @@ -7898,7 +7898,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, * updated accordingly. */ size_t rot_buf_size = 0; if (rotateImage(crop->rotation, image, &crop->regionlist[i].width, - &crop->regionlist[i].length, &crop_buff, &rot_buf_size)) + &crop->regionlist[i].length, &crop_buff, &rot_buf_size, FALSE)) { TIFFError("processCropSelections", "Failed to rotate crop region by %"PRIu16" degrees", crop->rotation); @@ -8029,7 +8029,7 @@ createCroppedImage(struct image_data *image, struct crop_mask *crop, if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */ { if (rotateImage(crop->rotation, image, &crop->combined_width, - &crop->combined_length, crop_buff_ptr, NULL)) + &crop->combined_length, crop_buff_ptr, NULL, TRUE)) { TIFFError("createCroppedImage", "Failed to rotate image or cropped selection by %"PRIu16" degrees", crop->rotation); @@ -8692,7 +8692,8 @@ rotateContigSamples32bits(uint16_t rotation, uint16_t spp, uint16_t bps, uint32_ /* Rotate an image by a multiple of 90 degrees clockwise */ static int rotateImage(uint16_t rotation, struct image_data *image, uint32_t *img_width, - uint32_t * img_length, unsigned char **ibuff_ptr, size_t *rot_buf_size) + uint32_t * img_length, unsigned char **ibuff_ptr, size_t *rot_buf_size, + int rot_image_params) { int shift_width; uint32_t bytes_per_pixel, bytes_per_sample; @@ -8914,11 +8915,14 @@ rotateImage(uint16_t rotation, struct image_data *image, uint32_t *img_width, *img_width = length; *img_length = width; - image->width = length; - image->length = width; - res_temp = image->xres; - image->xres = image->yres; - image->yres = res_temp; + /* Only toggle image parameters if whole input image is rotated. */ + if (rot_image_params) { + image->width = length; + image->length = width; + res_temp = image->xres; + image->xres = image->yres; + image->yres = res_temp; + } break; case 270: if ((bps % 8) == 0) /* byte aligned data */ @@ -8991,11 +8995,14 @@ rotateImage(uint16_t rotation, struct image_data *image, uint32_t *img_width, *img_width = length; *img_length = width; - image->width = length; - image->length = width; - res_temp = image->xres; - image->xres = image->yres; - image->yres = res_temp; + /* Only toggle image parameters if whole input image is rotated. */ + if (rot_image_params) { + image->width = length; + image->length = width; + res_temp = image->xres; + image->xres = image->yres; + image->yres = res_temp; + } break; default: break;