rpms/mingw-libtiff
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3

Browse Source 
Same patches that fixed libtiff in RHEL

Resolves: RHEL-189376
This commit is contained in:
Uri Lublin 2026-08-09 18:34:32 +03:00
parent 046e3d7e65
commit 0f023e9f72
3 changed files with 107 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
libtiff-4.4.0-cve-2026-12912p1of2.patch Normal file
View File

@ -0,0 +1,39 @@
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
index 8bc1529d7f5e4a20b9e20e637df8e500dd4b0de0..8efd92737bd0954baeec27c7525886cb82fdd39b 100644
--- a/libtiff/tif_pixarlog.c
+++ b/libtiff/tif_pixarlog.c
@@ -876,6 +876,19 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
llen = sp->stride * td->td_imagewidth;
+ /* Fix: ABGR with stride=3 expands 3 samples to 4 output bytes per pixel */
+ if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3)
+ {
+ tmsize_t required = (tmsize_t)td->td_imagewidth * 4;
+ if (occ < required)
+ {
+ TIFFErrorExt(tif->tif_clientdata, module,
+ "Output buffer too small for PixarLog ABGR data");
+ memset(op, 0, (size_t)occ);
+ return (0);
+ }
+ }
+
(void) s;
assert(sp != NULL);
@@ -991,7 +1004,13 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
case PIXARLOGDATAFMT_8BITABGR:
horizontalAccumulate8abgr(up, llen, sp->stride,
(unsigned char *)op, sp->ToLinear8);
- op += llen * sizeof(unsigned char);
+
+ /* For stride == 3 (RGB), horizontalAccumulate8abgr expands to 4
+ * bytes/pixel (ABGR) */
+ if (sp->stride == 3)
+ op += (unsigned long)td->td_imagewidth * 4;
+ else
+ op += (unsigned long)llen * sizeof(unsigned char);
break;
default:
TIFFErrorExt(tif->tif_clientdata, module,

57
libtiff-4.4.0-cve-2026-12912p2of2.patch Normal file
View File

@ -0,0 +1,57 @@
From f9bda11bf2fc819b971517582666d56f18b1bc3f Mon Sep 17 00:00:00 2001
From: waugustus <wangdw.augustus@qq.com>
Date: Thu, 7 May 2026 12:48:42 +0800
Subject: [PATCH] pixarlog: complete ABGR bounds check for multi-row strip
decoding
---
libtiff/tif_pixarlog.c | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
index f35f3fb01..a6f62f18b 100644
--- a/libtiff/tif_pixarlog.c
+++ b/libtiff/tif_pixarlog.c
@@ -880,6 +880,12 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3)
{
tmsize_t required = (tmsize_t)td->td_imagewidth * 4;
+ tmsize_t max_rows;
+ tmsize_t max_nsamples;
+
+ /*
+ * Ensure at least one expanded output row fits.
+ */
if (occ < required)
{
TIFFErrorExt(tif->tif_clientdata, module,
@@ -887,6 +893,26 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
memset(op, 0, (size_t)occ);
return (0);
}
+
+ /*
+ * PixarLogDecode() may process multiple rows per call
+ * (e.g. strip decoding). Limit nsamples so the total
+ * output written by the loop below never exceeds occ.
+ */
+ max_rows = occ / required;
+ max_nsamples = max_rows * llen;
+
+ /*
+ * Truncate excess rows to preserve as much decoded data
+ * as possible while avoiding output buffer overflow.
+ */
+ if (nsamples > max_nsamples)
+ {
+ TIFFWarningExt(tif->tif_clientdata, module,
+ "PixarLog ABGR decode truncated to avoid "
+ "output buffer overflow");
+ nsamples = max_nsamples;
+ }
}
(void) s;
--
GitLab

12
mingw-libtiff.spec
View File

@ -3,7 +3,7 @@
Summary: MinGW Windows port of the LibTIFF library
Name: mingw-libtiff
Version: 4.0.9
Release: 4%{?dist}
Release: 5%{?dist}
License: libtiff
Group: System Environment/Libraries
URL: http://www.simplesystems.org/libtiff/
@ -58,6 +58,12 @@ Patch46: RHEL-112533.patch
Patch47: RHEL-120230.patch
Patch48: libtiff-4.4.0-CVE-2026-4775.patch
# from upstream, for < 4.7.2, RHEL-189387
# https://gitlab.com/libtiff/libtiff/-/merge_requests/873
Patch49: libtiff-4.4.0-cve-2026-12912p1of2.patch
# https://gitlab.com/libtiff/libtiff/-/commit/f9bda11bf2fc819b971517582666d56f18b1bc3f
Patch50: libtiff-4.4.0-cve-2026-12912p2of2.patch
BuildArch: noarch
ExclusiveArch: %{ix86} x86_64
@ -200,6 +206,10 @@ find $RPM_BUILD_ROOT -name "*.la" -delete
%changelog
* Sun Aug 09 2026 Uri Lublin <uril@redhat.com> - 4.0.9-5
- fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3
Resolves: RHEL-189376
* Thu Apr 23 2026 Uri Lublin <uril@redhat.com> - 4.0.9-4
- fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile
Resolves: RHEL-159337