From patchwork Mon Jul 15 11:04:11 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 168991 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp4244471ilk; Mon, 15 Jul 2019 04:04:25 -0700 (PDT) X-Google-Smtp-Source: APXvYqx+JR9BEMgM4sGCsDLdjpg4t6xDEov2PQSzp/tpwB9o5d0Bd3jno2dqJUi+o3KG90dz3gKY X-Received: by 2002:a17:90a:bb0c:: with SMTP id u12mr29055721pjr.132.1563188665706; Mon, 15 Jul 2019 04:04:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1563188665; cv=none; d=google.com; s=arc-20160816; b=HZprN5ub6NgzC0wvJ7LdcWfddjQCYJJjfjU2rQr1ECgTxzb8uBN6j8i3VmK3vXIFvr Q9zH9ddUUaXgVqve/u3dzmd7Pl6zslscV66LVZ12+Iev6q3cRGBb97EjWBSystT0scRq +Gc1wvhX2UrzP0AGEdsfqffv+MTXXX5OML3aD3cL8V4tIm1bNj7qODr3Ya2Y+FKQPGRi aVGz4Lh5h+Pu9WShoFgaLFkM2USQS/agSOvu3GmlYlEgM9CgubY/grb3T37q8gM4FCc/ 6cbWPH7EW/JO5Y1QL0oFePOXueuFGHXbLfCTbojmN9TDG38cbco2sLPgQ1VReKjaZBq3 /jvw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:sender:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:message-id:date:to:from:dkim-signature:delivered-to; bh=k2qIwQLz6TgNXrm+dd/c2HuG6AT6wNnmL+//jTq2p1U=; b=r2wQomrECbiVFhJJEQSCT3DBhYxyF+LNgdSRMiyXuF1Z81ddSCqHSb9woBvOSwP7rb QS93rTqFD8668JAHOGwyKpDvNpkjWb+wlLTEPexLqyjaPgh/KKOILp2gZ75IqtU2nMDR TbjETnJteOrXCk9ON4ePHrn8cPelwU/lNDd+nf+SpDg1IQU7KOLgI9VvFLN4BI6x+ICE NmlMqBoFDN1j2+l832cDMI6/KKLhCX61woJbzf/tJUHHP80TycJcmXu64LD1Oe0RClrY CZiNPgKmD46LAQk6bt9JWEidlZzM1TZPrnQ+lsneaZPKGLJ47gZ9bzJYFnFbu6PqK8SN BpqQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@intel-com.20150623.gappssmtp.com header.s=20150623 header.b=MfTRwhEn; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from mail.openembedded.org (mail.openembedded.org. [140.211.169.62]) by mx.google.com with ESMTP id f10si9963938pjw.89.2019.07.15.04.04.25; Mon, 15 Jul 2019 04:04:25 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) client-ip=140.211.169.62; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@intel-com.20150623.gappssmtp.com header.s=20150623 header.b=MfTRwhEn; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from ec2-34-214-78-129.us-west-2.compute.amazonaws.com (localhost [127.0.0.1]) by mail.openembedded.org (Postfix) with ESMTP id 916FA7ED76; Mon, 15 Jul 2019 11:04:21 +0000 (UTC) X-Original-To: openembedded-core@lists.openembedded.org Delivered-To: openembedded-core@lists.openembedded.org Received: from mail-wm1-f66.google.com (mail-wm1-f66.google.com [209.85.128.66]) by mail.openembedded.org (Postfix) with ESMTP id 590A17D718 for ; Mon, 15 Jul 2019 11:04:19 +0000 (UTC) Received: by mail-wm1-f66.google.com with SMTP id l2so14736653wmg.0 for ; Mon, 15 Jul 2019 04:04:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel-com.20150623.gappssmtp.com; s=20150623; h=from:to:subject:date:message-id:mime-version :content-transfer-encoding; bh=3+q4JEa0VEAnKdAA68NJs6k8wOKtmqP6L7BnQfch3Ak=; b=MfTRwhEnGvi4gR3nBi0Qf6OaMpyAwfpPFHqGg3V/JeZvwM57GoCRFAm1oGwY2GaGOY EFwcRcPKgxKIyea2DLc42NwO7ukfEZJ/pywzfcJWxG2S6pT3d+e/Wd3Q9bMvG4gwn5oy hWhfPedUX8D53CKn9KKJvbwxQ9rRWN6yo6SPgkrOf95q5zhUol/5lVGP3nHr4UYaec1x YAoLRMqaDl9C7CQUjGh0VkzsChxP3yK6nemeSR3fP7ZfN3kMOn8zDfOgoTch/OgiPmdT vhLeegqjJf+iyJIpeLQq+xHf/M/08x54bZi5ehI7nyJlCN2zJfU5IujseqKJloL92KXD acyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:mime-version :content-transfer-encoding; bh=3+q4JEa0VEAnKdAA68NJs6k8wOKtmqP6L7BnQfch3Ak=; b=B+ZvXqKLfdNC2qLEtvfBVFh72F4Iee7WE+0lMAYIrjUy1enOz2rJ/uttPB5oZejPqx J/Ucv3Q+vIhDPbnb1mpzNleiIBzuk8mmSkYptEfJrLCdE8QpCtjRC0CYJOjHldRdEbY4 rh9D7BSuVslcwmTiWRwsCwsvME5l7Nbu/pkh7sh1nicydOju18h8IDCLX+BEMteO2oUI Giszz3WHngH29RPEscogmIHD92cZrDCJ6tl0KAMkf0dNxBDCTTqO1Apg0i3pONYTfWrp Z8vk+8BGsBQY1OocFOl382cIZn98fOcJuc75+aXAafmOILzEsQET3XFcLC5E1XnGWnMl wQ2Q== X-Gm-Message-State: APjAAAVdB5ADsMDWih6IlSIXdGXdzAuaZoGuwcGujwuyjjd318EKpTHF uD+BqoVd8+6CguSMYfhNP9LIDneOzoQ= X-Received: by 2002:a1c:7e90:: with SMTP id z138mr23443713wmc.128.1563188659784; Mon, 15 Jul 2019 04:04:19 -0700 (PDT) Received: from flashheart.burtonini.com (35.106.2.81.in-addr.arpa. [81.2.106.35]) by smtp.gmail.com with ESMTPSA id n1sm13495486wrx.39.2019.07.15.04.04.17 for (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Mon, 15 Jul 2019 04:04:18 -0700 (PDT) From: Ross Burton To: openembedded-core@lists.openembedded.org Date: Mon, 15 Jul 2019 12:04:11 +0100 Message-Id: <20190715110413.30525-1-ross.burton@intel.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Subject: [OE-core] [PATCH 1/3] tiff: remove redundant patch X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: openembedded-core-bounces@lists.openembedded.org Errors-To: openembedded-core-bounces@lists.openembedded.org The patching to make the new libtool work (from 2008) is no longer needed. Signed-off-by: Ross Burton --- .../libtiff/files/libtool2.patch | 24 ------------------- .../recipes-multimedia/libtiff/tiff_4.0.10.bb | 5 +--- 2 files changed, 1 insertion(+), 28 deletions(-) delete mode 100644 meta/recipes-multimedia/libtiff/files/libtool2.patch -- 2.20.1 -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core diff --git a/meta/recipes-multimedia/libtiff/files/libtool2.patch b/meta/recipes-multimedia/libtiff/files/libtool2.patch deleted file mode 100644 index 96233b46c94..00000000000 --- a/meta/recipes-multimedia/libtiff/files/libtool2.patch +++ /dev/null @@ -1,24 +0,0 @@ -From 5b893206e0a0d529ba2d0caf58cfffc03bccb598 Mon Sep 17 00:00:00 2001 -From: Marcin Juszkiewicz -Date: Sat, 14 Jun 2008 13:42:22 +0000 -Subject: [PATCH] tiff: make it work after libtool upgrade - -Upstream-Status: Inappropriate [configuration] - ---- - configure.ac | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/configure.ac b/configure.ac -index c7b02e2..ae1c964 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -27,7 +27,7 @@ dnl Process this file with autoconf to produce a configure script. - AC_PREREQ(2.64) - AC_INIT([LibTIFF Software],[4.0.10],[tiff@lists.maptools.org],[tiff]) - AC_CONFIG_AUX_DIR(config) --AC_CONFIG_MACRO_DIR(m4) -+dnl AC_CONFIG_MACRO_DIR(m4) - AC_LANG(C) - - dnl Compute the canonical host (run-time) system type variable diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb index 152fa819a5b..7a30690ec17 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb @@ -4,10 +4,7 @@ LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=34da3db46fab7501992f9615d7e158cf" CVE_PRODUCT = "libtiff" -SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ - file://libtool2.patch \ - " - +SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz" SRC_URI[md5sum] = "114192d7ebe537912a2b97408832e7fd" SRC_URI[sha256sum] = "2c52d11ccaf767457db0c46795d9c7d1a8d8f76f68b0b800a3dfe45786b996e4" From patchwork Mon Jul 15 11:04:12 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 168992 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp4245004ilk; Mon, 15 Jul 2019 04:04:51 -0700 (PDT) X-Google-Smtp-Source: APXvYqwBVD6c7OX727CYrsWMPFXc/wUp7HXFKx+14B4ETXc99FhgT1aYAsgCAnKLomdwxVT9bzO1 X-Received: by 2002:a65:64cf:: with SMTP id t15mr25502292pgv.88.1563188691475; Mon, 15 Jul 2019 04:04:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1563188691; cv=none; d=google.com; s=arc-20160816; b=pzkK9amSRU16Xm/2/zuHRYTlEHGBG/nHpbpGgWQJ0LVDNSPITIL03ZAfFmXlOe9KZ+ CucyzH9msbDmz+em+l/vR4nMFyZp4zW4SRO2gjJh5ztbXQfVIHKa4B63Sn+Gx0sf8x4w ft/C8MrK7uj9G8vxylFHRUb7xmjuMWdfF1Bzlx9XoAbfsRqHUevJPcMWlj9fSlBX5nWu LehiyYZ0dhHoRg6vcJMamcRc0bOa7g9KtZHX6+qFGbcG4NdVNztV4qYqKFFeyynFCeZX eCsVr6rkk5T4qMFqnXLspYFgYIYS8ye40duIVWT8FTgA7WeSasGuGsmzl1iecPLQNUOg tYYg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:sender:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:delivered-to; bh=oe8A1okT5Dx9MPbPWI8fpoUQ18cWjuM5ndmoE7+ZJME=; b=I6niWtllGSiwv4+UVGgM1eSCDk6h8iIaTYP2AykWPB7PoOlhkQoB0j0Xf3vniuAa7R pmplYVkm4K4xWDsYxfHYBY0wvzQLBPaGiHxZ0ESKl6uU5P3YFm2T+2R5QjrWHCSPzD/y 59XOcyoWwg4dxErvC3zou4tGRehIc5T23hTDKmH8VQZR8reA5LvXUKTjzYD1SnXQoI3K CWAfY1famjqpVgIiEPqyPeNbFKFuiq6rCWfO2+xdN6FQXa0u3VMntZVYjLDXqYqaZ+zW 1iD9oMHGaHbcB5Sdfhp9IGUUJUf5L1Pd2IcdTKOIz4DNINt/IYKsK+X8Cka2GcInvjFX jlKg== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@intel-com.20150623.gappssmtp.com header.s=20150623 header.b=1BDsyWXk; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from mail.openembedded.org (mail.openembedded.org. [140.211.169.62]) by mx.google.com with ESMTP id bg2si14614916plb.263.2019.07.15.04.04.51; Mon, 15 Jul 2019 04:04:51 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) client-ip=140.211.169.62; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@intel-com.20150623.gappssmtp.com header.s=20150623 header.b=1BDsyWXk; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from ec2-34-214-78-129.us-west-2.compute.amazonaws.com (localhost [127.0.0.1]) by mail.openembedded.org (Postfix) with ESMTP id 7284F7ED7B; Mon, 15 Jul 2019 11:04:48 +0000 (UTC) X-Original-To: openembedded-core@lists.openembedded.org Delivered-To: openembedded-core@lists.openembedded.org Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mail.openembedded.org (Postfix) with ESMTP id 1E4D67D718 for ; Mon, 15 Jul 2019 11:04:20 +0000 (UTC) Received: by mail-wm1-f52.google.com with SMTP id 207so14715767wma.1 for ; Mon, 15 Jul 2019 04:04:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel-com.20150623.gappssmtp.com; s=20150623; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=JzbZ3sYfCjI+zHq+sR8wPGeUEH5E+0Qz6qtn8fxXZp8=; b=1BDsyWXktgVYTbLxWxVhea6cYiSF2PL4N20eVs43TLWg7itRTaTFp0J5o9HSTUpfVn 0HIRyNbLylYLaBbuKm0pkLcLG3wfSap2dQ5UsEneDFJo4IXMi/4c5RJMyZzij4Sx2D86 ULNdjYPlC+XX16vxgxbbXnFHN9dVBNwBI8mYsXFbVBUbIGi0ufYziH7GaFQZnq1PwbeA cQ149cZI1a5uKVCvdpT6mPm+MGjpaO/Urm7oPOphOGM3cQBlfA+BFMmso1OlNfUyIQbJ 19GIXNjtDepZIOm1QoWYy2RhdtjYewsC5qMcoc3j9a0GxP7KNJgzfoPKQMMrHN9KiAQn ysSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=JzbZ3sYfCjI+zHq+sR8wPGeUEH5E+0Qz6qtn8fxXZp8=; b=lMhnaOqxm4KUT54yaSiNQ9k/E6uoVtZIpV4/ShFyFz2QjQYy+TQgw2ZTwsN7zjTKV+ LWTaXvi/AVM9OZT0pk3/+nl1QinAfdgGj42oH48Dou98FF3rY8SdR+q09M2QirP06m3M W60LV1C5H1tObfaMnkC6tH3zA8f2p5maZvMaMsjwURL8xPXqduaAsFiHD9EaLrd8MRBt kbzq7MGfqwNCkkdB7aRlPoniCRgPcxM5M2fh5LJNviFCXI7woYd38hkGWmLIpbt2CV8b 44HAzFtK4IeUITUI/7lrkWJnj43oPGCYob91gZ0YU/5veILZCWWaeHCeqZ7JR39f8GOl 6MbA== X-Gm-Message-State: APjAAAVBDoC4fptX5EYURhpMjpJQARi7SRb4oBx8m9DNq21RaYStJzK5 i043ZIACjp5ETfRIv7dI3o+WWhzRylI= X-Received: by 2002:a1c:f009:: with SMTP id a9mr23482952wmb.32.1563188660681; Mon, 15 Jul 2019 04:04:20 -0700 (PDT) Received: from flashheart.burtonini.com (35.106.2.81.in-addr.arpa. [81.2.106.35]) by smtp.gmail.com with ESMTPSA id n1sm13495486wrx.39.2019.07.15.04.04.19 for (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Mon, 15 Jul 2019 04:04:20 -0700 (PDT) From: Ross Burton To: openembedded-core@lists.openembedded.org Date: Mon, 15 Jul 2019 12:04:12 +0100 Message-Id: <20190715110413.30525-2-ross.burton@intel.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190715110413.30525-1-ross.burton@intel.com> References: <20190715110413.30525-1-ross.burton@intel.com> MIME-Version: 1.0 Subject: [OE-core] [PATCH 2/3] tiff: fix CVE-2019-6128 X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: openembedded-core-bounces@lists.openembedded.org Errors-To: openembedded-core-bounces@lists.openembedded.org Signed-off-by: Ross Burton --- .../libtiff/tiff/CVE-2019-6128.patch | 52 +++++++++++++++++++ .../recipes-multimedia/libtiff/tiff_4.0.10.bb | 3 +- 2 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2019-6128.patch -- 2.20.1 -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2019-6128.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2019-6128.patch new file mode 100644 index 00000000000..6f1fd4d4478 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2019-6128.patch @@ -0,0 +1,52 @@ +CVE: CVE-2019-6128 +Upstream-Status: Backport +Signed-off-by: Ross Burton + +From 0c74a9f49b8d7a36b17b54a7428b3526d20f88a8 Mon Sep 17 00:00:00 2001 +From: Scott Gayou +Date: Wed, 23 Jan 2019 15:03:53 -0500 +Subject: [PATCH] Fix for simple memory leak that was assigned CVE-2019-6128. + +pal2rgb failed to free memory on a few errors. This was reported +here: http://bugzilla.maptools.org/show_bug.cgi?id=2836. +--- + tools/pal2rgb.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c +index 01d8502ec..9492f1cf1 100644 +--- a/tools/pal2rgb.c ++++ b/tools/pal2rgb.c +@@ -118,12 +118,14 @@ main(int argc, char* argv[]) + shortv != PHOTOMETRIC_PALETTE) { + fprintf(stderr, "%s: Expecting a palette image.\n", + argv[optind]); ++ (void) TIFFClose(in); + return (-1); + } + if (!TIFFGetField(in, TIFFTAG_COLORMAP, &rmap, &gmap, &bmap)) { + fprintf(stderr, + "%s: No colormap (not a valid palette image).\n", + argv[optind]); ++ (void) TIFFClose(in); + return (-1); + } + bitspersample = 0; +@@ -131,11 +133,14 @@ main(int argc, char* argv[]) + if (bitspersample != 8) { + fprintf(stderr, "%s: Sorry, can only handle 8-bit images.\n", + argv[optind]); ++ (void) TIFFClose(in); + return (-1); + } + out = TIFFOpen(argv[optind+1], "w"); +- if (out == NULL) ++ if (out == NULL) { ++ (void) TIFFClose(in); + return (-2); ++ } + cpTags(in, out); + TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &imagewidth); + TIFFGetField(in, TIFFTAG_IMAGELENGTH, &imagelength); +-- +2.21.0 diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb index 7a30690ec17..3c055a15dc8 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb @@ -4,7 +4,8 @@ LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=34da3db46fab7501992f9615d7e158cf" CVE_PRODUCT = "libtiff" -SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz" +SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ + file://CVE-2019-6128.patch" SRC_URI[md5sum] = "114192d7ebe537912a2b97408832e7fd" SRC_URI[sha256sum] = "2c52d11ccaf767457db0c46795d9c7d1a8d8f76f68b0b800a3dfe45786b996e4" From patchwork Mon Jul 15 11:04:13 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 168993 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp4245153ilk; Mon, 15 Jul 2019 04:04:57 -0700 (PDT) X-Google-Smtp-Source: APXvYqxwE3YSsqgdz+QWzRlmRUwOQuVG6h4eB7+Lt7rXHoAZr+CA9NXe5gZbqBCP0QtqRCDODKB5 X-Received: by 2002:a17:902:86:: with SMTP id a6mr28078415pla.244.1563188697572; Mon, 15 Jul 2019 04:04:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1563188697; cv=none; d=google.com; s=arc-20160816; b=dZN23AnJ793NMggXHMkPH3u6shd5ZtTc1jo+WdQm8FYbncxvyLawW4lfstlLBqW7X2 SbEeAo8V2Y1ylVflK8Lcn7JXSkl9n++LOISiCg2bKBvMsUpqkssZ1jTd+g03r+6bGUpW a9dZQhV9IL/SjRIDJQJeRaKjCcsOGu2wCeMGZkl1qrB82fWunglSjmH88EQH0rCdpcHi YGX03jQaOhst41/Ga9RVY8Ixw0RTavFwGZmRtOsF6SdZgAAixiu2/u12kQFC/KOsoIAA j/dde7Zrfkpqo1nBCDN0QyZby4LJzSjlsSp0IxJLh8LcGc9hCKvwEq1vr20b/FX19mro C9nQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:sender:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:delivered-to; bh=O0z5JtUw903Zkybg3g9z3qKJNVjc+dGbLR5+P2iXFtU=; b=pPuQkc37BUGvWz2nbrJA1kOavedwx94hyidHojFU8Dvr43O/cYjrb0+sFOxUYCtdRW W/836cDusB89a9hVjYq1bJWryMkG8AkePpAwB68g64Qbow3Jd8TeMO0MP/XlNNIquQRj qGH1Kd+Wv3xPcpSso3CTNg4ZFQDO841DKFu+qGeQNkUEbQkCVzZ0KgxPvgdVOhwguhoG gbQC/aCv/xq9z4uArkSCvy3GBmM/8aAYpDsGMbCVVu6WkaNSv7xl9evCUNfSvaBRDfc1 V3qgddBROBD4DUONsBKkhxYrD5iXIAeaC9Xg8FJg3WQgSnLUpIhXjcFOqCRYEO44XEMa KQ2w== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@intel-com.20150623.gappssmtp.com header.s=20150623 header.b=01TcTW9v; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from mail.openembedded.org (mail.openembedded.org. [140.211.169.62]) by mx.google.com with ESMTP id 32si15063650plb.86.2019.07.15.04.04.57; Mon, 15 Jul 2019 04:04:57 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) client-ip=140.211.169.62; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@intel-com.20150623.gappssmtp.com header.s=20150623 header.b=01TcTW9v; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from ec2-34-214-78-129.us-west-2.compute.amazonaws.com (localhost [127.0.0.1]) by mail.openembedded.org (Postfix) with ESMTP id BC9F67ED96; Mon, 15 Jul 2019 11:04:49 +0000 (UTC) X-Original-To: openembedded-core@lists.openembedded.org Delivered-To: openembedded-core@lists.openembedded.org Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mail.openembedded.org (Postfix) with ESMTP id 495437ED67 for ; Mon, 15 Jul 2019 11:04:21 +0000 (UTC) Received: by mail-wm1-f44.google.com with SMTP id l2so14736748wmg.0 for ; Mon, 15 Jul 2019 04:04:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel-com.20150623.gappssmtp.com; s=20150623; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=lRSGOIsylPFKPYSCPg3bbsmmxkoes/Bl8B1e+F35TiE=; b=01TcTW9vvSff8R7QS3rvLbm04pNvk1njmOP5OZcn+uhObQ5/qXDz5UgznOJQ2sG+S5 AgANaxZk9nRf7WDcU/OIQUl5SD03xA2oOiymH0U/MVmbmwxXe26vP9PHYIv0jDEB0l35 o7PJOcL7QIwki6qGOGDxg/n4P0t7MgRGUwd1ZMaUdtk9DkwxQrmX9P1BMd/R8PPOS0cI ZF9QC9SUTd9vncx7Me00ofKaEdvDf4tC7ObnPWDbkLpSNJksLc4dn3sLI3gxGSlW6SQG HlXpkHLsCCp/UmmaWgvXdTdkDWmHq+8Ik/pFz4LNiTmwcvX7ND+N1n/zpHx+hCEVI/zZ 8Weg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=lRSGOIsylPFKPYSCPg3bbsmmxkoes/Bl8B1e+F35TiE=; b=DhCoA1EejGZ/4qASjxumyo2wo5wkNlwU1KHXff8ro3Scw1J6eyuLx8JKrnMJNNNTkm h/x5T5Z5A5krMLcOkx/7+DglwL+IJCN2fynqFelOjqzjNKnyrC16/HIkdSsFihONN5JN Oz/SBS/zI/M3GIhsK5JkjmueVMZbhpZ5gB0sERClozc3oUL4edAxVfbGvJxDywb6mhgF /x4y5TrNxaNFLSrLV+97+/8WlLh1DrX/NbkQUOSfhyIl1wdn3n4yBF8R9Pv/AdncQG+E 1PM3mNz4QS6w9lqHpAyLWM0blRKpYA6eIUfD19jmB8co6bSCwz2EttszpIliKraZlUjt XE7g== X-Gm-Message-State: APjAAAWC6B3jfs2E1Pr0lqAosP+OE+gTv9g4+fEPN2wrCjAuyDikmutH XVWrJzR6ga6e5+y/o98dRUfu3/eLp5U= X-Received: by 2002:a1c:cf0b:: with SMTP id f11mr25007040wmg.138.1563188661657; Mon, 15 Jul 2019 04:04:21 -0700 (PDT) Received: from flashheart.burtonini.com (35.106.2.81.in-addr.arpa. [81.2.106.35]) by smtp.gmail.com with ESMTPSA id n1sm13495486wrx.39.2019.07.15.04.04.20 for (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Mon, 15 Jul 2019 04:04:21 -0700 (PDT) From: Ross Burton To: openembedded-core@lists.openembedded.org Date: Mon, 15 Jul 2019 12:04:13 +0100 Message-Id: <20190715110413.30525-3-ross.burton@intel.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190715110413.30525-1-ross.burton@intel.com> References: <20190715110413.30525-1-ross.burton@intel.com> MIME-Version: 1.0 Subject: [OE-core] [PATCH 3/3] tiff: fix CVE-2019-7663 X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: openembedded-core-bounces@lists.openembedded.org Errors-To: openembedded-core-bounces@lists.openembedded.org Signed-off-by: Ross Burton --- .../libtiff/tiff/CVE-2019-7663.patch | 77 +++++++++++++++++++ .../recipes-multimedia/libtiff/tiff_4.0.10.bb | 3 +- 2 files changed, 79 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2019-7663.patch -- 2.20.1 -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2019-7663.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2019-7663.patch new file mode 100644 index 00000000000..f244fb2f324 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2019-7663.patch @@ -0,0 +1,77 @@ +CVE: CVE-2019-7663 +Upstream-Status: Backport +Signed-off-by: Ross Burton + +From c6fc6c1fa895024c86285c58efd6424cf8078f32 Mon Sep 17 00:00:00 2001 +From: Thomas Bernard +Date: Mon, 11 Feb 2019 10:05:33 +0100 +Subject: [PATCH 1/2] check that (Tile Width)*(Samples/Pixel) do no overflow + +fixes bug 2833 +--- + tools/tiffcp.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/tools/tiffcp.c b/tools/tiffcp.c +index 2f406e2d..f0ee2c02 100644 +--- a/tools/tiffcp.c ++++ b/tools/tiffcp.c +@@ -1408,7 +1408,7 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer) + int status = 1; + uint32 imagew = TIFFRasterScanlineSize(in); + uint32 tilew = TIFFTileRowSize(in); +- int iskew = imagew - tilew*spp; ++ int iskew; + tsize_t tilesize = TIFFTileSize(in); + tdata_t tilebuf; + uint8* bufp = (uint8*) buf; +@@ -1416,6 +1416,12 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer) + uint32 row; + uint16 bps = 0, bytes_per_sample; + ++ if (spp > (0x7fffffff / tilew)) ++ { ++ TIFFError(TIFFFileName(in), "Error, cannot handle that much samples per tile row (Tile Width * Samples/Pixel)"); ++ return 0; ++ } ++ iskew = imagew - tilew*spp; + tilebuf = _TIFFmalloc(tilesize); + if (tilebuf == 0) + return 0; +-- +2.20.1 + + +From da6454aa80b9bb3154dfab4e8b21637de47531e0 Mon Sep 17 00:00:00 2001 +From: Thomas Bernard +Date: Mon, 11 Feb 2019 21:42:03 +0100 +Subject: [PATCH 2/2] tiffcp.c: use INT_MAX + +--- + tools/tiffcp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/tiffcp.c b/tools/tiffcp.c +index f0ee2c02..8c81aa4f 100644 +--- a/tools/tiffcp.c ++++ b/tools/tiffcp.c +@@ -41,6 +41,7 @@ + #include + #include + #include ++#include + + #include + +@@ -1416,7 +1417,7 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer) + uint32 row; + uint16 bps = 0, bytes_per_sample; + +- if (spp > (0x7fffffff / tilew)) ++ if (spp > (INT_MAX / tilew)) + { + TIFFError(TIFFFileName(in), "Error, cannot handle that much samples per tile row (Tile Width * Samples/Pixel)"); + return 0; +-- +2.20.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb index 3c055a15dc8..999496273c0 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb @@ -5,7 +5,8 @@ LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=34da3db46fab7501992f9615d7e158cf" CVE_PRODUCT = "libtiff" SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ - file://CVE-2019-6128.patch" + file://CVE-2019-6128.patch \ + file://CVE-2019-7663.patch" SRC_URI[md5sum] = "114192d7ebe537912a2b97408832e7fd" SRC_URI[sha256sum] = "2c52d11ccaf767457db0c46795d9c7d1a8d8f76f68b0b800a3dfe45786b996e4"