cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
openbsd-ports/graphics/tiff/patches/patch-libtiff_tif_getimage_c
jasper 06cec91f2a Update tiff to 4.0.2, includes a fix for CVE-2012-2113, 
LibTIFF "tiff2pdf" Integer Overflow Vulnerability
2012-06-27 14:27:02 +00:00

221 lines
8.5 KiB
Plaintext
Raw Blame History

$OpenBSD: patch-libtiff_tif_getimage_c,v 1.8 2012/06/27 14:27:02 jasper Exp $
1. sprintf()
This one is slightly problematic. If an application allocates less
room for its error buffer than the recommended 1024, the error message
buffer will still overflow.
--- libtiff/tif_getimage.c.orig Wed Apr 11 18:42:32 2012
+++ libtiff/tif_getimage.c Wed Apr 11 18:53:00 2012
@@ -80,7 +80,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
int colorchannels;
if (!tif->tif_decodestatus) {
- sprintf(emsg, "Sorry, requested compression method is not configured");
+ snprintf(emsg, 1024, "Sorry, requested compression method is not configured");
return (0);
}
switch (td->td_bitspersample) {
@@ -91,7 +91,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
case 16:
break;
default:
- sprintf(emsg, "Sorry, can not handle images with %d-bit samples",
+ snprintf(emsg, 1024, "Sorry, can not handle images with %d-bit samples",
td->td_bitspersample);
return (0);
}
@@ -105,7 +105,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
photometric = PHOTOMETRIC_RGB;
break;
default:
- sprintf(emsg, "Missing needed %s tag", photoTag);
+ snprintf(emsg, 1024, "Missing needed %s tag", photoTag);
return (0);
}
}
@@ -116,7 +116,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
if (td->td_planarconfig == PLANARCONFIG_CONTIG
&& td->td_samplesperpixel != 1
&& td->td_bitspersample < 8 ) {
- sprintf(emsg,
+ snprintf(emsg, 1024,
"Sorry, can not handle contiguous data with %s=%d, "
"and %s=%d and Bits/Sample=%d",
photoTag, photometric,
@@ -140,7 +140,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
break;
case PHOTOMETRIC_RGB:
if (colorchannels < 3) {
- sprintf(emsg, "Sorry, can not handle RGB image with %s=%d",
+ snprintf(emsg, 1024, "Sorry, can not handle RGB image with %s=%d",
"Color channels", colorchannels);
return (0);
}
@@ -150,13 +150,13 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
uint16 inkset;
TIFFGetFieldDefaulted(tif, TIFFTAG_INKSET, &inkset);
if (inkset != INKSET_CMYK) {
- sprintf(emsg,
+ snprintf(emsg, 1024,
"Sorry, can not handle separated image with %s=%d",
"InkSet", inkset);
return 0;
}
if (td->td_samplesperpixel < 4) {
- sprintf(emsg,
+ snprintf(emsg, 1024,
"Sorry, can not handle separated image with %s=%d",
"Samples/pixel", td->td_samplesperpixel);
return 0;
@@ -165,7 +165,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
}
case PHOTOMETRIC_LOGL:
if (td->td_compression != COMPRESSION_SGILOG) {
- sprintf(emsg, "Sorry, LogL data must have %s=%d",
+ snprintf(emsg, 1024, "Sorry, LogL data must have %s=%d",
"Compression", COMPRESSION_SGILOG);
return (0);
}
@@ -173,12 +173,12 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
case PHOTOMETRIC_LOGLUV:
if (td->td_compression != COMPRESSION_SGILOG &&
td->td_compression != COMPRESSION_SGILOG24) {
- sprintf(emsg, "Sorry, LogLuv data must have %s=%d or %d",
+ snprintf(emsg, 1024, "Sorry, LogLuv data must have %s=%d or %d",
"Compression", COMPRESSION_SGILOG, COMPRESSION_SGILOG24);
return (0);
}
if (td->td_planarconfig != PLANARCONFIG_CONTIG) {
- sprintf(emsg, "Sorry, can not handle LogLuv images with %s=%d",
+ snprintf(emsg, 1024, "Sorry, can not handle LogLuv images with %s=%d",
"Planarconfiguration", td->td_planarconfig);
return (0);
}
@@ -186,7 +186,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
case PHOTOMETRIC_CIELAB:
break;
default:
- sprintf(emsg, "Sorry, can not handle image with %s=%d",
+ snprintf(emsg, 1024, "Sorry, can not handle image with %s=%d",
photoTag, photometric);
return (0);
}
@@ -260,7 +260,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
case 16:
break;
default:
- sprintf(emsg, "Sorry, can not handle images with %d-bit samples",
+ snprintf(emsg, 1024, "Sorry, can not handle images with %d-bit samples",
img->bitspersample);
goto fail_return;
}
@@ -310,7 +310,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
img->photometric = PHOTOMETRIC_RGB;
break;
default:
- sprintf(emsg, "Missing needed %s tag", photoTag);
+ snprintf(emsg, 1024, "Missing needed %s tag", photoTag);
goto fail_return;
}
}
@@ -318,7 +318,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
case PHOTOMETRIC_PALETTE:
if (!TIFFGetField(tif, TIFFTAG_COLORMAP,
&red_orig, &green_orig, &blue_orig)) {
- sprintf(emsg, "Missing required \"Colormap\" tag");
+ snprintf(emsg, 1024, "Missing required \"Colormap\" tag");
goto fail_return;
}
@@ -328,7 +328,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
img->greencmap = (uint16 *) _TIFFmalloc(sizeof(uint16)*n_color);
img->bluecmap = (uint16 *) _TIFFmalloc(sizeof(uint16)*n_color);
if( !img->redcmap || !img->greencmap || !img->bluecmap ) {
- sprintf(emsg, "Out of memory for colormap copy");
+ snprintf(emsg, 1024, "Out of memory for colormap copy");
goto fail_return;
}
@@ -342,7 +342,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
if (planarconfig == PLANARCONFIG_CONTIG
&& img->samplesperpixel != 1
&& img->bitspersample < 8 ) {
- sprintf(emsg,
+ snprintf(emsg, 1024,
"Sorry, can not handle contiguous data with %s=%d, "
"and %s=%d and Bits/Sample=%d",
photoTag, img->photometric,
@@ -379,7 +379,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
break;
case PHOTOMETRIC_RGB:
if (colorchannels < 3) {
- sprintf(emsg, "Sorry, can not handle RGB image with %s=%d",
+ snprintf(emsg, 1024, "Sorry, can not handle RGB image with %s=%d",
"Color channels", colorchannels);
goto fail_return;
}
@@ -389,12 +389,12 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
uint16 inkset;
TIFFGetFieldDefaulted(tif, TIFFTAG_INKSET, &inkset);
if (inkset != INKSET_CMYK) {
- sprintf(emsg, "Sorry, can not handle separated image with %s=%d",
+ snprintf(emsg, 1024, "Sorry, can not handle separated image with %s=%d",
"InkSet", inkset);
goto fail_return;
}
if (img->samplesperpixel < 4) {
- sprintf(emsg, "Sorry, can not handle separated image with %s=%d",
+ snprintf(emsg, 1024, "Sorry, can not handle separated image with %s=%d",
"Samples/pixel", img->samplesperpixel);
goto fail_return;
}
@@ -402,7 +402,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
break;
case PHOTOMETRIC_LOGL:
if (compress != COMPRESSION_SGILOG) {
- sprintf(emsg, "Sorry, LogL data must have %s=%d",
+ snprintf(emsg, 1024, "Sorry, LogL data must have %s=%d",
"Compression", COMPRESSION_SGILOG);
goto fail_return;
}
@@ -412,12 +412,12 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
break;
case PHOTOMETRIC_LOGLUV:
if (compress != COMPRESSION_SGILOG && compress != COMPRESSION_SGILOG24) {
- sprintf(emsg, "Sorry, LogLuv data must have %s=%d or %d",
+ snprintf(emsg, 1024, "Sorry, LogLuv data must have %s=%d or %d",
"Compression", COMPRESSION_SGILOG, COMPRESSION_SGILOG24);
goto fail_return;
}
if (planarconfig != PLANARCONFIG_CONTIG) {
- sprintf(emsg, "Sorry, can not handle LogLuv images with %s=%d",
+ snprintf(emsg, 1024, "Sorry, can not handle LogLuv images with %s=%d",
"Planarconfiguration", planarconfig);
return (0);
}
@@ -428,7 +428,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
case PHOTOMETRIC_CIELAB:
break;
default:
- sprintf(emsg, "Sorry, can not handle image with %s=%d",
+ snprintf(emsg, 1024, "Sorry, can not handle image with %s=%d",
photoTag, img->photometric);
goto fail_return;
}
@@ -446,12 +446,12 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
!(planarconfig == PLANARCONFIG_SEPARATE && img->samplesperpixel > 1);
if (img->isContig) {
if (!PickContigCase(img)) {
- sprintf(emsg, "Sorry, can not handle image");
+ snprintf(emsg, 1024, "Sorry, can not handle image");
goto fail_return;
}
} else {
if (!PickSeparateCase(img)) {
- sprintf(emsg, "Sorry, can not handle image");
+ snprintf(emsg, 1024, "Sorry, can not handle image");
goto fail_return;
}
}
Reference in New Issue View Git Blame Copy Permalink