<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi Jussi,<br>
</p>
<br>
<div class="moz-cite-prefix">在 2016年10月26日 17:09, Jussi Kukkonen 写道:<br>
</div>
<blockquote
cite="mid:CAHiDW_FezY8Ee_VObh-n+kf_GCoOWWbwPGpVM6s_7htfv9UhmQ@mail.gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">On 26 October 2016 at 11:26, Yi Zhao
<span dir="ltr"><<a moz-do-not-send="true"
href="mailto:yi.zhao@windriver.com" target="_blank">yi.zhao@windriver.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">CVE-2016-3945
libtiff: Multiple integer overflows in the (1)<br>
cvt_by_strip and (2) cvt_by_tile functions in the
tiff2rgba tool in<br>
LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow
remote<br>
attackers to cause a denial of service (crash) or execute
arbitrary code<br>
via a crafted TIFF image, which triggers an out-of-bounds
write.<br>
<br>
External References:<br>
<a moz-do-not-send="true"
href="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3945"
rel="noreferrer" target="_blank">https://web.nvd.nist.gov/view/<wbr>vuln/detail?vulnId=CVE-2016-<wbr>3945</a><br>
<a moz-do-not-send="true"
href="http://bugzilla.maptools.org/show_bug.cgi?id=2545"
rel="noreferrer" target="_blank">http://bugzilla.maptools.org/<wbr>show_bug.cgi?id=2545</a><br>
<br>
Patch from:<br>
<a moz-do-not-send="true"
href="https://github.com/vadz/libtiff/commit/7c39352ccd9060d311d3dc9a1f1bc00133a160e6"
rel="noreferrer" target="_blank">https://github.com/vadz/<wbr>libtiff/commit/<wbr>7c39352ccd9060d311d3dc9a1f1bc0<wbr>0133a160e6</a><br>
<br>
Signed-off-by: Yi Zhao <<a moz-do-not-send="true"
href="mailto:yi.zhao@windriver.com">yi.zhao@windriver.com</a>><br>
---<br>
.../libtiff/files/CVE-2016-<wbr>3945.patch |
118 +++++++++++++++++++++<br>
meta/recipes-multimedia/<wbr>libtiff/<a
moz-do-not-send="true" href="http://tiff_4.0.6.bb"
rel="noreferrer" target="_blank">tiff_4.0.6.bb</a>
| 1 +<br>
2 files changed, 119 insertions(+)<br>
create mode 100644 meta/recipes-multimedia/<wbr>libtiff/files/CVE-2016-3945.<wbr>patch<br>
<br>
diff --git a/meta/recipes-multimedia/<wbr>libtiff/files/CVE-2016-3945.<wbr>patch
b/meta/recipes-multimedia/<wbr>libtiff/files/CVE-2016-3945.<wbr>patch<br>
new file mode 100644<br>
index 0000000..4d965be<br>
--- /dev/null<br>
+++ b/meta/recipes-multimedia/<wbr>libtiff/files/CVE-2016-3945.<wbr>patch<br>
@@ -0,0 +1,118 @@<br>
+From 7c39352ccd9060d311d3dc9a1f1bc0<wbr>0133a160e6 Mon
Sep 17 00:00:00 2001<br>
+From: erouault <erouault><br>
+Date: Mon, 15 Aug 2016 20:06:40 +0000<br>
+Subject: [PATCH] * tools/tiff2rgba.c: Fix integer
overflow in size of<br>
+ allocated buffer, when -b mode is enabled, that could
result in out-of-bounds<br>
+ write. Based initially on patch tiff-CVE-2016-3945.patch
from<br>
+ libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with
correction for invalid<br>
+ tests that rejected valid files.<br>
+<br>
+CVE: CVE-2016-3945<br>
+Upstream-Status: Backport<br>
+<a moz-do-not-send="true"
href="https://github.com/vadz/libtiff/commit/7c39352ccd9060d311d3dc9a1f1bc00133a160e6"
rel="noreferrer" target="_blank">https://github.com/vadz/<wbr>libtiff/commit/<wbr>7c39352ccd9060d311d3dc9a1f1bc0<wbr>0133a160e6</a><br>
</blockquote>
<div><br>
</div>
<div>It would be appropriate to point out that this is not
the real upstream, just a nameless github user who
maintains a git mirror of the libtiff repository. It's
probably a reasonable choice -- the current libtiff
situation with no real homepage, no real tarball hosting
and a half-hidden cvs server for source control is pretty
sad -- but should still be openly mentioned.</div>
</div>
</div>
</div>
</blockquote>
<br>
Thank you for your suggestion. This github is a mirror for libtiff
cvs repository in <tt>cvs.maptools.org. If the cvs repository is
official, take the patches from it is better.<br>
<br>
Yi<br>
<br>
</tt>
<blockquote
cite="mid:CAHiDW_FezY8Ee_VObh-n+kf_GCoOWWbwPGpVM6s_7htfv9UhmQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div><br>
</div>
<div>Jussi</div>
<div> </div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">+<br>
+Signed-off-by: Yi Zhao <<a moz-do-not-send="true"
href="mailto:yi.zhao@windirver.com">yi.zhao@windirver.com</a>><br>
+---<br>
+ ChangeLog | 8 ++++++++<br>
+ tools/tiff2rgba.c | 34 ++++++++++++++++++++++++++++++<wbr>----<br>
+ 2 files changed, 38 insertions(+), 4 deletions(-)<br>
+<br>
+diff --git a/ChangeLog b/ChangeLog<br>
+index 62dc1b5..9c0ab29 100644<br>
+--- a/ChangeLog<br>
++++ b/ChangeLog<br>
+@@ -1,3 +1,11 @@<br>
++2016-08-15 Even Rouault <even.rouault at <a
moz-do-not-send="true" href="http://spatialys.com"
rel="noreferrer" target="_blank">spatialys.com</a>><br>
++<br>
++ * tools/tiff2rgba.c: Fix integer overflow in size
of allocated<br>
++ buffer, when -b mode is enabled, that could result
in out-of-bounds<br>
++ write. Based initially on patch
tiff-CVE-2016-3945.patch from<br>
++ libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro,
with correction for<br>
++ invalid tests that rejected valid files.<br>
++<br>
+ 2016-07-11 Even Rouault <even.rouault at <a
moz-do-not-send="true" href="http://spatialys.com"
rel="noreferrer" target="_blank">spatialys.com</a>><br>
+<br>
+ * tools/tiffcrop.c: Avoid access outside of stack
allocated array<br>
+diff --git a/tools/tiff2rgba.c b/tools/tiff2rgba.c<br>
+index b7a81eb..16e3dc4 100644<br>
+--- a/tools/tiff2rgba.c<br>
++++ b/tools/tiff2rgba.c<br>
+@@ -147,6 +147,7 @@ cvt_by_tile( TIFF *in, TIFF *out )<br>
+ uint32 row, col;<br>
+ uint32 *wrk_line;<br>
+ int ok = 1;<br>
++ uint32 rastersize, wrk_linesize;<br>
+<br>
+ TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);<br>
+ TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);<br>
+@@ -163,7 +164,13 @@ cvt_by_tile( TIFF *in, TIFF *out )<br>
+ /*<br>
+ * Allocate tile buffer<br>
+ */<br>
+- raster = (uint32*)_TIFFmalloc(tile_<wbr>width *
tile_height * sizeof (uint32));<br>
++ rastersize = tile_width * tile_height * sizeof
(uint32);<br>
++ if (tile_width != (rastersize / tile_height) /
sizeof( uint32))<br>
++ {<br>
++ TIFFError(TIFFFileName(in), "Integer overflow when
calculating raster buffer");<br>
++ exit(-1);<br>
++ }<br>
++ raster = (uint32*)_TIFFmalloc(<wbr>rastersize);<br>
+ if (raster == 0) {<br>
+ TIFFError(TIFFFileName(in), "No space for raster
buffer");<br>
+ return (0);<br>
+@@ -173,7 +180,13 @@ cvt_by_tile( TIFF *in, TIFF *out )<br>
+ * Allocate a scanline buffer for swapping during
the vertical<br>
+ * mirroring pass.<br>
+ */<br>
+- wrk_line = (uint32*)_TIFFmalloc(tile_<wbr>width *
sizeof (uint32));<br>
++ wrk_linesize = tile_width * sizeof (uint32);<br>
++ if (tile_width != wrk_linesize / sizeof (uint32))<br>
++ {<br>
++ TIFFError(TIFFFileName(in), "Integer overflow
when calculating wrk_line buffer");<br>
++ exit(-1);<br>
++ }<br>
++ wrk_line = (uint32*)_TIFFmalloc(wrk_<wbr>linesize);<br>
+ if (!wrk_line) {<br>
+ TIFFError(TIFFFileName(in), "No space for raster
scanline buffer");<br>
+ ok = 0;<br>
+@@ -249,6 +262,7 @@ cvt_by_strip( TIFF *in, TIFF *out )<br>
+ uint32 row;<br>
+ uint32 *wrk_line;<br>
+ int ok = 1;<br>
++ uint32 rastersize, wrk_linesize;<br>
+<br>
+ TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);<br>
+ TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);<br>
+@@ -263,7 +277,13 @@ cvt_by_strip( TIFF *in, TIFF *out )<br>
+ /*<br>
+ * Allocate strip buffer<br>
+ */<br>
+- raster = (uint32*)_TIFFmalloc(width * rowsperstrip *
sizeof (uint32));<br>
++ rastersize = width * rowsperstrip * sizeof (uint32);<br>
++ if (width != (rastersize / rowsperstrip) / sizeof(
uint32))<br>
++ {<br>
++ TIFFError(TIFFFileName(in), "Integer overflow when
calculating raster buffer");<br>
++ exit(-1);<br>
++ }<br>
++ raster = (uint32*)_TIFFmalloc(<wbr>rastersize);<br>
+ if (raster == 0) {<br>
+ TIFFError(TIFFFileName(in), "No space for raster
buffer");<br>
+ return (0);<br>
+@@ -273,7 +293,13 @@ cvt_by_strip( TIFF *in, TIFF *out )<br>
+ * Allocate a scanline buffer for swapping during
the vertical<br>
+ * mirroring pass.<br>
+ */<br>
+- wrk_line = (uint32*)_TIFFmalloc(width * sizeof
(uint32));<br>
++ wrk_linesize = width * sizeof (uint32);<br>
++ if (width != wrk_linesize / sizeof (uint32))<br>
++ {<br>
++ TIFFError(TIFFFileName(in), "Integer overflow
when calculating wrk_line buffer");<br>
++ exit(-1);<br>
++ }<br>
++ wrk_line = (uint32*)_TIFFmalloc(wrk_<wbr>linesize);<br>
+ if (!wrk_line) {<br>
+ TIFFError(TIFFFileName(in), "No space for raster
scanline buffer");<br>
+ ok = 0;<br>
+--<br>
+2.7.4<br>
+<br>
diff --git a/meta/recipes-multimedia/<wbr>libtiff/<a
moz-do-not-send="true" href="http://tiff_4.0.6.bb"
rel="noreferrer" target="_blank">tiff_4.0.6.bb</a>
b/meta/recipes-multimedia/<wbr>libtiff/<a
moz-do-not-send="true" href="http://tiff_4.0.6.bb"
rel="noreferrer" target="_blank">tiff_4.0.6.bb</a><br>
index 8147bc4..b978528 100644<br>
--- a/meta/recipes-multimedia/<wbr>libtiff/<a
moz-do-not-send="true" href="http://tiff_4.0.6.bb"
rel="noreferrer" target="_blank">tiff_4.0.6.bb</a><br>
+++ b/meta/recipes-multimedia/<wbr>libtiff/<a
moz-do-not-send="true" href="http://tiff_4.0.6.bb"
rel="noreferrer" target="_blank">tiff_4.0.6.bb</a><br>
@@ -10,6 +10,7 @@ SRC_URI = "<a moz-do-not-send="true"
href="http://download.osgeo.org/libtiff/tiff-$%7BPV%7D.tar.gz"
rel="noreferrer" target="_blank">http://download.osgeo.org/<wbr>libtiff/tiff-${PV}.tar.gz</a>
\<br>
<a class="moz-txt-link-freetext" href="file://CVE-2016-3186.patch">file://CVE-2016-3186.patch</a> \<br>
<a class="moz-txt-link-freetext" href="file://CVE-2016-5321.patch">file://CVE-2016-5321.patch</a> \<br>
<a class="moz-txt-link-freetext" href="file://CVE-2016-5323.patch">file://CVE-2016-5323.patch</a> \<br>
+ <a class="moz-txt-link-freetext" href="file://CVE-2016-3945.patch">file://CVE-2016-3945.patch</a> \<br>
"<br>
<br>
SRC_URI[md5sum] = "<wbr>d1d2e940dea0b5ad435f21f03d96dd<wbr>72"<br>
<span class="HOEnZb"><font color="#888888">--<br>
2.7.4<br>
<br>
--<br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a moz-do-not-send="true"
href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a moz-do-not-send="true"
href="http://lists.openembedded.org/mailman/listinfo/openembedded-core"
rel="noreferrer" target="_blank">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
</font></span></blockquote>
</div>
<br>
</div>
</div>
</blockquote>
<br>
</body>
</html>