From patchwork Mon Sep 30 04:47:04 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Armin Kuster X-Patchwork-Id: 174711 Delivered-To: patch@linaro.org Received: by 2002:a92:7e96:0:0:0:0:0 with SMTP id q22csp6648408ill; Sun, 29 Sep 2019 21:49:43 -0700 (PDT) X-Google-Smtp-Source: APXvYqzdQAKXeVdHufMPHfvSLyyRyg0PrcZxhyDUYFJzenWCCktRXM2QPDVTDd3xc718OBzItizv X-Received: by 2002:a17:90a:264a:: with SMTP id l68mr24914128pje.74.1569818983340; Sun, 29 Sep 2019 21:49:43 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1569818983; cv=none; d=google.com; s=arc-20160816; b=dgQ2EpCEjL6dfFxGgcGMSgplhNiiwKCsRRkmcWmvREILdRCPG1vumygq6SMzewUz1R OzowPhLJSHucfL/e1B4LP+Hylzm2eEGyLHOObIXNn0rEWshd9IuAuk1dCM4ihHA0Jl+e zVU0YGUFBindkcluJ072ABQk5j7HIhbu6VuCDpb65S+IBIQ3eT/JQaDfW64mAj3yqssu fDVnINBFlue0ccuh0/9QNsEVF5KZLbMtqKalX0n/5NZwvHOYlDx4RUYyoyJaS3CgLfKJ ViCt7EFxaL9Z3SZu1HyZ6aTyK9ywXBSKkyj44hTsgYEern/Vfc0ZF4V2Xo9Q7jDV4Z6D 4TUg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:sender:content-transfer-encoding:mime-version :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:references:in-reply-to:message-id:date :to:from:dkim-signature:delivered-to; bh=ejbzneT1czepXYgWGrCA/0uN7Wn1JAehgsQFcWkJe5g=; b=ydoogu0QKa3dsqSlB7wCbeqiRT113FAOpJgWcEQJBen0m1Pw+/jjan4ePbHKhEr9wE AwXVEZkvn1IaV8YnobHuuyFQCcB/kObPKAfZLvE0SN1oXcvY3RKeJ9JahNREjk0yADlw LxKIGbggcbisXI9LOVy32b8cJ9KX55dxRsBh3sb3EtDVKKOFk34zs5xPftS8JPKUQKJf +32rckUuEWdOLuU9/wrGXuKwR/FaOQvgsOPKW15Own/f3P6995Y91pNF0zuwa/e3etfC vuY+mGeKNAxHOxCgjtSl38pJxbEYZrDpRfqhyIRjYMVPH4cWSOx9M7qAPzHY+mD8K1XC BUvg== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20161025 header.b=tmDPK8N9; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from mail.openembedded.org (mail.openembedded.org. [140.211.169.62]) by mx.google.com with ESMTP id d8si13303027pgj.367.2019.09.29.21.49.43; Sun, 29 Sep 2019 21:49:43 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) client-ip=140.211.169.62; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20161025 header.b=tmDPK8N9; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from ec2-34-214-78-129.us-west-2.compute.amazonaws.com (localhost [127.0.0.1]) by mail.openembedded.org (Postfix) with ESMTP id D9E987F2DB; Mon, 30 Sep 2019 04:48:45 +0000 (UTC) X-Original-To: openembedded-core@lists.openembedded.org Delivered-To: openembedded-core@lists.openembedded.org Received: from mail-pf1-f180.google.com (mail-pf1-f180.google.com [209.85.210.180]) by mail.openembedded.org (Postfix) with ESMTP id 6645D6D409 for ; Mon, 30 Sep 2019 04:48:02 +0000 (UTC) Received: by mail-pf1-f180.google.com with SMTP id 205so4872793pfw.2 for ; Sun, 29 Sep 2019 21:48:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references; bh=3pIZnIk0lHetOo/VGL1JT/6O03AleRFQfmhuCRz4bmk=; b=tmDPK8N9qCTKiB403TvHpokMMknIN9w6ebG2EQUyl6yTk2xL7CqeDzYzzMUKyzUJcw WGQJWk+bbRKrTyuGcCLMJJ20UIHatV7XNasksdT1d2p0sxciuCr1VYaFMt5GLwUHjZcw PnhQarfu1pAvoh7S0zLJUEwSFpBGyigqZblxAXVHiDwv3/Gk3VeNMCsnLnxdzuNEa7h3 IRtXw5rRQfEh5U7EiVDfGfbPLgoJJ4bwGSFw1ef6DzoAU+IgceYRSXNMo6DTsT+OtUQQ CCKu7oULHtG993ELRujdsW0LckUYhdTeD9PDQIAkjn7i2m3Tt9m3XSAwwWskIIlQdv8Q qq8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=3pIZnIk0lHetOo/VGL1JT/6O03AleRFQfmhuCRz4bmk=; b=I4XCTdRTkw8imePil5IQ24DXHTrvLQ/5TyY8QQ18moH6UTl0Q9rfDKEiVf9woqEInv h+bteKzpLUJhv2886zYXW7Liha1j6zhs4i1pSqBFEK24jhCCIchXOV+b6vGCdX1jZnbX laOkyJFQrFuqxk38sIS/wWRzBzDjbASBaRIvqQVivpY07PFxFt2VhGcIObpFYYVvepia BFX0FXgi4tXNeIzgpr8XndZvHS11u+4aXcY0U7nbAUapygWjjo2v4PnkIeX9Hx045IGX hJWO7t+uCtFMOsnRLbRpnd1j5uEd4RhZBNA/2b8fgbQMnUPgCr/IziYIetXOa26Z6US4 hevA== X-Gm-Message-State: APjAAAUqhg26pEC6bTwFVkH2v4eiF7+4pNo/Y1x6WNitYFWg/SWPqiLE SrUySo9RDa/OFWn5pn7CCaWadZmhZjQ= X-Received: by 2002:a63:d1a:: with SMTP id c26mr22660926pgl.286.1569818883330; Sun, 29 Sep 2019 21:48:03 -0700 (PDT) Received: from akuster-ThinkPad-T460s.hsd1.ca.comcast.net ([2601:202:4180:a5c0:edf9:811d:ad92:85c2]) by smtp.gmail.com with ESMTPSA id h15sm18888493pgn.76.2019.09.29.21.48.02 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 29 Sep 2019 21:48:02 -0700 (PDT) From: Armin Kuster To: openembedded-core@lists.openembedded.org Date: Sun, 29 Sep 2019 21:47:04 -0700 Message-Id: <3c036ee32a8080c12a8c31abed6f0e989c06a306.1569818533.git.akuster808@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: References: Subject: [OE-core] [warrior-next 09/54] tiff: fix CVE-2019-7663 X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: openembedded-core-bounces@lists.openembedded.org Errors-To: openembedded-core-bounces@lists.openembedded.org From: Ross Burton (From OE-Core rev: d06d6910d1ec9374bb15e02809e64e81198731b6) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster --- .../libtiff/tiff/CVE-2019-7663.patch | 77 ++++++++++++++++++++++ meta/recipes-multimedia/libtiff/tiff_4.0.10.bb | 3 +- 2 files changed, 79 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2019-7663.patch -- 2.7.4 -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2019-7663.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2019-7663.patch new file mode 100644 index 0000000..f244fb2 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2019-7663.patch @@ -0,0 +1,77 @@ +CVE: CVE-2019-7663 +Upstream-Status: Backport +Signed-off-by: Ross Burton + +From c6fc6c1fa895024c86285c58efd6424cf8078f32 Mon Sep 17 00:00:00 2001 +From: Thomas Bernard +Date: Mon, 11 Feb 2019 10:05:33 +0100 +Subject: [PATCH 1/2] check that (Tile Width)*(Samples/Pixel) do no overflow + +fixes bug 2833 +--- + tools/tiffcp.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/tools/tiffcp.c b/tools/tiffcp.c +index 2f406e2d..f0ee2c02 100644 +--- a/tools/tiffcp.c ++++ b/tools/tiffcp.c +@@ -1408,7 +1408,7 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer) + int status = 1; + uint32 imagew = TIFFRasterScanlineSize(in); + uint32 tilew = TIFFTileRowSize(in); +- int iskew = imagew - tilew*spp; ++ int iskew; + tsize_t tilesize = TIFFTileSize(in); + tdata_t tilebuf; + uint8* bufp = (uint8*) buf; +@@ -1416,6 +1416,12 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer) + uint32 row; + uint16 bps = 0, bytes_per_sample; + ++ if (spp > (0x7fffffff / tilew)) ++ { ++ TIFFError(TIFFFileName(in), "Error, cannot handle that much samples per tile row (Tile Width * Samples/Pixel)"); ++ return 0; ++ } ++ iskew = imagew - tilew*spp; + tilebuf = _TIFFmalloc(tilesize); + if (tilebuf == 0) + return 0; +-- +2.20.1 + + +From da6454aa80b9bb3154dfab4e8b21637de47531e0 Mon Sep 17 00:00:00 2001 +From: Thomas Bernard +Date: Mon, 11 Feb 2019 21:42:03 +0100 +Subject: [PATCH 2/2] tiffcp.c: use INT_MAX + +--- + tools/tiffcp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/tiffcp.c b/tools/tiffcp.c +index f0ee2c02..8c81aa4f 100644 +--- a/tools/tiffcp.c ++++ b/tools/tiffcp.c +@@ -41,6 +41,7 @@ + #include + #include + #include ++#include + + #include + +@@ -1416,7 +1417,7 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer) + uint32 row; + uint16 bps = 0, bytes_per_sample; + +- if (spp > (0x7fffffff / tilew)) ++ if (spp > (INT_MAX / tilew)) + { + TIFFError(TIFFFileName(in), "Error, cannot handle that much samples per tile row (Tile Width * Samples/Pixel)"); + return 0; +-- +2.20.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb index a82d744..8e3e227 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb @@ -6,7 +6,8 @@ CVE_PRODUCT = "libtiff" SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ file://libtool2.patch \ - file://CVE-2019-6128.patch" + file://CVE-2019-6128.patch \ + file://CVE-2019-7663.patch \ " SRC_URI[md5sum] = "114192d7ebe537912a2b97408832e7fd" SRC_URI[sha256sum] = "2c52d11ccaf767457db0c46795d9c7d1a8d8f76f68b0b800a3dfe45786b996e4"