cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update tiff to 4.0.2, includes a fix for CVE-2012-2113,

Browse Source 
LibTIFF "tiff2pdf" Integer Overflow Vulnerability
This commit is contained in:
jasper 2012-06-27 14:27:02 +00:00
parent fa5ee7998b
commit 06cec91f2a
5 changed files with 13 additions and 83 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
graphics/tiff/Makefile
View File

@ -1,10 +1,10 @@
# $OpenBSD: Makefile,v 1.64 2012/04/14 15:09:55 naddy Exp $
# $OpenBSD: Makefile,v 1.65 2012/06/27 14:27:02 jasper Exp $
COMMENT= tools and library routines for working with TIFF images
DISTNAME= tiff-4.0.1
SHARED_LIBS= tiff 39.0 # 5.6
SHARED_LIBS+= tiffxx 40.0 # 5.6
DISTNAME= tiff-4.0.2
SHARED_LIBS= tiff 39.1 # 5.6
SHARED_LIBS+= tiffxx 40.1 # 5.6
CATEGORIES= graphics
MASTER_SITES= http://download.osgeo.org/libtiff/

10
graphics/tiff/distinfo
View File

@ -1,5 +1,5 @@
MD5 (tiff-4.0.1.tar.gz) = +uFJzJ2jXFmNi+iXgm38Yw==
RMD160 (tiff-4.0.1.tar.gz) = q/mKsnftruMCtDLbzs/mgGHdkdw=
SHA1 (tiff-4.0.1.tar.gz) = i684IjHJBRobPrKUWBKJqiFEcXE=
SHA256 (tiff-4.0.1.tar.gz) = mnoDnlFsN0eAOHQPFkKBglC/sUFM9ATMi1aeX51L8vA=
SIZE (tiff-4.0.1.tar.gz) = 1991580
MD5 (tiff-4.0.2.tar.gz) = BKCPoeB+aW6CCgw/MkZaEw==
RMD160 (tiff-4.0.2.tar.gz) = UgxabRfRsMOVfjiJtm6tzgrM9T8=
SHA1 (tiff-4.0.2.tar.gz) = 2Et7M6bPs9Fco4bIwWsFBH+LU1I=
SHA256 (tiff-4.0.2.tar.gz) = qinx9b/j9EPD602sRy694Vrcj/BGS4M3bzXjsv75Ndo=
SIZE (tiff-4.0.2.tar.gz) = 2022814

59
graphics/tiff/patches/patch-libtiff_tif_getimage_c
View File

@ -1,12 +1,10 @@
$OpenBSD: patch-libtiff_tif_getimage_c,v 1.7 2012/04/14 15:09:55 naddy Exp $
$OpenBSD: patch-libtiff_tif_getimage_c,v 1.8 2012/06/27 14:27:02 jasper Exp $
1. sprintf()
This one is slightly problematic. If an application allocates less
room for its error buffer than the recommended 1024, the error message
buffer will still overflow.
2. CVE-2012-1173: integer overflow.
--- libtiff/tif_getimage.c.orig Wed Apr 11 18:42:32 2012
+++ libtiff/tif_getimage.c Wed Apr 11 18:53:00 2012
@@ -80,7 +80,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
@ -220,58 +218,3 @@ buffer will still overflow.
goto fail_return;
}
}
@@ -692,6 +692,7 @@ gtTileSeparate(TIFFRGBAImage* img, uint32* raster, uin
unsigned char* p2;
unsigned char* pa;
tmsize_t tilesize;
+ tmsize_t bufsize;
int32 fromskew, toskew;
int alpha = img->alpha;
uint32 nrow;
@@ -699,12 +700,18 @@ gtTileSeparate(TIFFRGBAImage* img, uint32* raster, uin
int colorchannels;
tilesize = TIFFTileSize(tif);
- buf = (unsigned char*) _TIFFmalloc((alpha?4:3)*tilesize);
+
+ bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,tilesize);
+ if (bufsize == 0) {
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
+ return (0);
+ }
+ buf = (unsigned char*) _TIFFmalloc(bufsize);
if (buf == 0) {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "No space for tile buffer");
return (0);
}
- _TIFFmemset(buf, 0, (alpha?4:3)*tilesize);
+ _TIFFmemset(buf, 0, bufsize);
p0 = buf;
p1 = p0 + tilesize;
p2 = p1 + tilesize;
@@ -917,17 +924,23 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, ui
uint32 rowsperstrip, offset_row;
uint32 imagewidth = img->width;
tmsize_t stripsize;
+ tmsize_t bufsize;
int32 fromskew, toskew;
int alpha = img->alpha;
int ret = 1, flip, colorchannels;
stripsize = TIFFStripSize(tif);
- p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize);
+ bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,stripsize);
+ if (bufsize == 0) {
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
+ return (0);
+ }
+ p0 = buf = (unsigned char *)_TIFFmalloc(bufsize);
if (buf == 0) {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
return (0);
}
- _TIFFmemset(buf, 0, (alpha?4:3)*stripsize);
+ _TIFFmemset(buf, 0, bufsize);
p1 = p0 + stripsize;
p2 = p1 + stripsize;
pa = (alpha?(p2+stripsize):NULL);

15
graphics/tiff/patches/patch-libtiff_tiffiop_h
View File

@ -1,15 +0,0 @@
$OpenBSD: patch-libtiff_tiffiop_h,v 1.4 2012/04/14 15:09:56 naddy Exp $
CVE-2012-1173: integer overflow
--- libtiff/tiffiop.h.orig Wed Apr 11 18:56:30 2012
+++ libtiff/tiffiop.h Wed Apr 11 18:56:58 2012
@@ -250,7 +250,7 @@ struct tiff {
#define TIFFroundup_64(x, y) (TIFFhowmany_64(x,y)*(y))
/* Safe multiply which returns zero if there is an integer overflow */
-#define TIFFSafeMultiply(t,v,m) ((((t)m != (t)0) && (((t)((v*m)/m)) == (t)v)) ? (t)(v*m) : (t)0)
+#define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
#define TIFFmax(A,B) ((A)>(B)?(A):(B))
#define TIFFmin(A,B) ((A)<(B)?(A):(B))

4
graphics/tiff/pkg/PLIST
View File

@ -1,4 +1,4 @@
@comment $OpenBSD: PLIST,v 1.18 2012/04/14 15:09:56 naddy Exp $
@comment $OpenBSD: PLIST,v 1.19 2012/06/27 14:27:02 jasper Exp $
@bin bin/bmp2tiff
@bin bin/fax2ps
@bin bin/fax2tiff
@ -238,3 +238,5 @@ share/doc/tiff/v3.9.0beta.html
share/doc/tiff/v3.9.1.html
share/doc/tiff/v3.9.2.html
share/doc/tiff/v4.0.0.html
share/doc/tiff/v4.0.1.html
share/doc/tiff/v4.0.2.html