openbsd-ports/graphics/tiff/patches/patch-libtiff_tif_lzw_c
jasper 2247677749 Security fix for SA31610
http://secunia.com/advisories/31610
LibTIFF LZW Decoder Buffer Underflow Vulnerability

Patch extracted from Debian's tiff_3.8.2-7+etch1

"looks fine" ajacoutot@
2008-08-27 18:09:36 +00:00

63 lines
2.0 KiB
Plaintext

$OpenBSD: patch-libtiff_tif_lzw_c,v 1.1 2008/08/27 18:09:36 jasper Exp $
Security fix for SA31610
http://secunia.com/advisories/31610
LibTIFF LZW Decoder Buffer Underflow Vulnerability
Patch extracted from Debian's tiff_3.8.2-7+etch1
--- libtiff/tif_lzw.c.orig Wed Aug 27 15:02:14 2008
+++ libtiff/tif_lzw.c Wed Aug 27 15:06:01 2008
@@ -237,6 +237,11 @@ LZWSetupDecode(TIFF* tif)
sp->dec_codetab[code].length = 1;
sp->dec_codetab[code].next = NULL;
} while (code--);
+ /*
+ * Zero-out the unused entries
+ */
+ _TIFFmemset(&sp->dec_codetab[CODE_CLEAR], 0,
+ (CODE_FIRST-CODE_CLEAR)*sizeof (code_t));
}
return (1);
}
@@ -408,12 +413,19 @@ LZWDecode(TIFF* tif, tidata_t op0, tsize_t occ0, tsamp
break;
if (code == CODE_CLEAR) {
free_entp = sp->dec_codetab + CODE_FIRST;
+ _TIFFmemset(free_entp, 0, (CSIZE-CODE_FIRST)*sizeof (code_t));
nbits = BITS_MIN;
nbitsmask = MAXCODE(BITS_MIN);
maxcodep = sp->dec_codetab + nbitsmask-1;
NextCode(tif, sp, bp, code, GetNextCode);
if (code == CODE_EOI)
break;
+ if (code == CODE_CLEAR) {
+ TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+ "LZWDecode: Corrupted LZW table at scanline %d",
+ tif->tif_row);
+ return (0);
+ }
*op++ = (char)code, occ--;
oldcodep = sp->dec_codetab + code;
continue;
@@ -604,12 +616,19 @@ LZWDecodeCompat(TIFF* tif, tidata_t op0, tsize_t occ0,
break;
if (code == CODE_CLEAR) {
free_entp = sp->dec_codetab + CODE_FIRST;
+ _TIFFmemset(free_entp, 0, (CSIZE-CODE_FIRST)*sizeof (code_t));
nbits = BITS_MIN;
nbitsmask = MAXCODE(BITS_MIN);
maxcodep = sp->dec_codetab + nbitsmask;
NextCode(tif, sp, bp, code, GetNextCodeCompat);
if (code == CODE_EOI)
break;
+ if (code == CODE_CLEAR) {
+ TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+ "LZWDecode: Corrupted LZW table at scanline %d",
+ tif->tif_row);
+ return (0);
+ }
*op++ = code, occ--;
oldcodep = sp->dec_codetab + code;
continue;