<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On 26 October 2016 at 11:26, Yi Zhao <span dir="ltr"><<a href="mailto:yi.zhao@windriver.com" target="_blank">yi.zhao@windriver.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">CVE-2016-3945 libtiff: Multiple integer overflows in the (1)<br>
cvt_by_strip and (2) cvt_by_tile functions in the tiff2rgba tool in<br>
LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote<br>
attackers to cause a denial of service (crash) or execute arbitrary code<br>
via a crafted TIFF image, which triggers an out-of-bounds write.<br>
<br>
External References:<br>
<a href="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3945" rel="noreferrer" target="_blank">https://web.nvd.nist.gov/view/<wbr>vuln/detail?vulnId=CVE-2016-<wbr>3945</a><br>
<a href="http://bugzilla.maptools.org/show_bug.cgi?id=2545" rel="noreferrer" target="_blank">http://bugzilla.maptools.org/<wbr>show_bug.cgi?id=2545</a><br>
<br>
Patch from:<br>
<a href="https://github.com/vadz/libtiff/commit/7c39352ccd9060d311d3dc9a1f1bc00133a160e6" rel="noreferrer" target="_blank">https://github.com/vadz/<wbr>libtiff/commit/<wbr>7c39352ccd9060d311d3dc9a1f1bc0<wbr>0133a160e6</a><br>
<br>
Signed-off-by: Yi Zhao <<a href="mailto:yi.zhao@windriver.com">yi.zhao@windriver.com</a>><br>
---<br>
.../libtiff/files/CVE-2016-<wbr>3945.patch | 118 +++++++++++++++++++++<br>
meta/recipes-multimedia/<wbr>libtiff/<a href="http://tiff_4.0.6.bb" rel="noreferrer" target="_blank">tiff_4.0.6.bb</a> | 1 +<br>
2 files changed, 119 insertions(+)<br>
create mode 100644 meta/recipes-multimedia/<wbr>libtiff/files/CVE-2016-3945.<wbr>patch<br>
<br>
diff --git a/meta/recipes-multimedia/<wbr>libtiff/files/CVE-2016-3945.<wbr>patch b/meta/recipes-multimedia/<wbr>libtiff/files/CVE-2016-3945.<wbr>patch<br>
new file mode 100644<br>
index 0000000..4d965be<br>
--- /dev/null<br>
+++ b/meta/recipes-multimedia/<wbr>libtiff/files/CVE-2016-3945.<wbr>patch<br>
@@ -0,0 +1,118 @@<br>
+From 7c39352ccd9060d311d3dc9a1f1bc0<wbr>0133a160e6 Mon Sep 17 00:00:00 2001<br>
+From: erouault <erouault><br>
+Date: Mon, 15 Aug 2016 20:06:40 +0000<br>
+Subject: [PATCH] * tools/tiff2rgba.c: Fix integer overflow in size of<br>
+ allocated buffer, when -b mode is enabled, that could result in out-of-bounds<br>
+ write. Based initially on patch tiff-CVE-2016-3945.patch from<br>
+ libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with correction for invalid<br>
+ tests that rejected valid files.<br>
+<br>
+CVE: CVE-2016-3945<br>
+Upstream-Status: Backport<br>
+<a href="https://github.com/vadz/libtiff/commit/7c39352ccd9060d311d3dc9a1f1bc00133a160e6" rel="noreferrer" target="_blank">https://github.com/vadz/<wbr>libtiff/commit/<wbr>7c39352ccd9060d311d3dc9a1f1bc0<wbr>0133a160e6</a><br>
</blockquote><div><br></div><div>It would be appropriate to point out that this is not the real upstream, just a nameless github user who maintains a git mirror of the libtiff repository. It's probably a reasonable choice -- the current libtiff situation with no real homepage, no real tarball hosting and a half-hidden cvs server for source control is pretty sad -- but should still be openly mentioned.</div><div><br></div><div>Jussi</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">+<br>
+Signed-off-by: Yi Zhao <<a href="mailto:yi.zhao@windirver.com">yi.zhao@windirver.com</a>><br>
+---<br>
+ ChangeLog | 8 ++++++++<br>
+ tools/tiff2rgba.c | 34 ++++++++++++++++++++++++++++++<wbr>----<br>
+ 2 files changed, 38 insertions(+), 4 deletions(-)<br>
+<br>
+diff --git a/ChangeLog b/ChangeLog<br>
+index 62dc1b5..9c0ab29 100644<br>
+--- a/ChangeLog<br>
++++ b/ChangeLog<br>
+@@ -1,3 +1,11 @@<br>
++2016-08-15 Even Rouault <even.rouault at <a href="http://spatialys.com" rel="noreferrer" target="_blank">spatialys.com</a>><br>
++<br>
++ * tools/tiff2rgba.c: Fix integer overflow in size of allocated<br>
++ buffer, when -b mode is enabled, that could result in out-of-bounds<br>
++ write. Based initially on patch tiff-CVE-2016-3945.patch from<br>
++ libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with correction for<br>
++ invalid tests that rejected valid files.<br>
++<br>
+ 2016-07-11 Even Rouault <even.rouault at <a href="http://spatialys.com" rel="noreferrer" target="_blank">spatialys.com</a>><br>
+<br>
+ * tools/tiffcrop.c: Avoid access outside of stack allocated array<br>
+diff --git a/tools/tiff2rgba.c b/tools/tiff2rgba.c<br>
+index b7a81eb..16e3dc4 100644<br>
+--- a/tools/tiff2rgba.c<br>
++++ b/tools/tiff2rgba.c<br>
+@@ -147,6 +147,7 @@ cvt_by_tile( TIFF *in, TIFF *out )<br>
+ uint32 row, col;<br>
+ uint32 *wrk_line;<br>
+ int ok = 1;<br>
++ uint32 rastersize, wrk_linesize;<br>
+<br>
+ TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);<br>
+ TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);<br>
+@@ -163,7 +164,13 @@ cvt_by_tile( TIFF *in, TIFF *out )<br>
+ /*<br>
+ * Allocate tile buffer<br>
+ */<br>
+- raster = (uint32*)_TIFFmalloc(tile_<wbr>width * tile_height * sizeof (uint32));<br>
++ rastersize = tile_width * tile_height * sizeof (uint32);<br>
++ if (tile_width != (rastersize / tile_height) / sizeof( uint32))<br>
++ {<br>
++ TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");<br>
++ exit(-1);<br>
++ }<br>
++ raster = (uint32*)_TIFFmalloc(<wbr>rastersize);<br>
+ if (raster == 0) {<br>
+ TIFFError(TIFFFileName(in), "No space for raster buffer");<br>
+ return (0);<br>
+@@ -173,7 +180,13 @@ cvt_by_tile( TIFF *in, TIFF *out )<br>
+ * Allocate a scanline buffer for swapping during the vertical<br>
+ * mirroring pass.<br>
+ */<br>
+- wrk_line = (uint32*)_TIFFmalloc(tile_<wbr>width * sizeof (uint32));<br>
++ wrk_linesize = tile_width * sizeof (uint32);<br>
++ if (tile_width != wrk_linesize / sizeof (uint32))<br>
++ {<br>
++ TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");<br>
++ exit(-1);<br>
++ }<br>
++ wrk_line = (uint32*)_TIFFmalloc(wrk_<wbr>linesize);<br>
+ if (!wrk_line) {<br>
+ TIFFError(TIFFFileName(in), "No space for raster scanline buffer");<br>
+ ok = 0;<br>
+@@ -249,6 +262,7 @@ cvt_by_strip( TIFF *in, TIFF *out )<br>
+ uint32 row;<br>
+ uint32 *wrk_line;<br>
+ int ok = 1;<br>
++ uint32 rastersize, wrk_linesize;<br>
+<br>
+ TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);<br>
+ TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);<br>
+@@ -263,7 +277,13 @@ cvt_by_strip( TIFF *in, TIFF *out )<br>
+ /*<br>
+ * Allocate strip buffer<br>
+ */<br>
+- raster = (uint32*)_TIFFmalloc(width * rowsperstrip * sizeof (uint32));<br>
++ rastersize = width * rowsperstrip * sizeof (uint32);<br>
++ if (width != (rastersize / rowsperstrip) / sizeof( uint32))<br>
++ {<br>
++ TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");<br>
++ exit(-1);<br>
++ }<br>
++ raster = (uint32*)_TIFFmalloc(<wbr>rastersize);<br>
+ if (raster == 0) {<br>
+ TIFFError(TIFFFileName(in), "No space for raster buffer");<br>
+ return (0);<br>
+@@ -273,7 +293,13 @@ cvt_by_strip( TIFF *in, TIFF *out )<br>
+ * Allocate a scanline buffer for swapping during the vertical<br>
+ * mirroring pass.<br>
+ */<br>
+- wrk_line = (uint32*)_TIFFmalloc(width * sizeof (uint32));<br>
++ wrk_linesize = width * sizeof (uint32);<br>
++ if (width != wrk_linesize / sizeof (uint32))<br>
++ {<br>
++ TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");<br>
++ exit(-1);<br>
++ }<br>
++ wrk_line = (uint32*)_TIFFmalloc(wrk_<wbr>linesize);<br>
+ if (!wrk_line) {<br>
+ TIFFError(TIFFFileName(in), "No space for raster scanline buffer");<br>
+ ok = 0;<br>
+--<br>
+2.7.4<br>
+<br>
diff --git a/meta/recipes-multimedia/<wbr>libtiff/<a href="http://tiff_4.0.6.bb" rel="noreferrer" target="_blank">tiff_4.0.6.bb</a> b/meta/recipes-multimedia/<wbr>libtiff/<a href="http://tiff_4.0.6.bb" rel="noreferrer" target="_blank">tiff_4.0.6.bb</a><br>
index 8147bc4..b978528 100644<br>
--- a/meta/recipes-multimedia/<wbr>libtiff/<a href="http://tiff_4.0.6.bb" rel="noreferrer" target="_blank">tiff_4.0.6.bb</a><br>
+++ b/meta/recipes-multimedia/<wbr>libtiff/<a href="http://tiff_4.0.6.bb" rel="noreferrer" target="_blank">tiff_4.0.6.bb</a><br>
@@ -10,6 +10,7 @@ SRC_URI = "<a href="http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz" rel="noreferrer" target="_blank">http://download.osgeo.org/<wbr>libtiff/tiff-${PV}.tar.gz</a> \<br>
file://CVE-2016-3186.patch \<br>
file://CVE-2016-5321.patch \<br>
file://CVE-2016-5323.patch \<br>
+ file://CVE-2016-3945.patch \<br>
"<br>
<br>
SRC_URI[md5sum] = "<wbr>d1d2e940dea0b5ad435f21f03d96dd<wbr>72"<br>
<span class="HOEnZb"><font color="#888888">--<br>
2.7.4<br>
<br>
--<br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
</font></span></blockquote></div><br></div></div>