From patchwork Thu Jul 25 04:03:01 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Anuj Mittal X-Patchwork-Id: 169666 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp11081488ilk; Wed, 24 Jul 2019 21:04:38 -0700 (PDT) X-Google-Smtp-Source: APXvYqz2C5H7YrycXe0vJJJhXA6goW44H4NZFfUPj64ea45fZEBgbXPhQwVhegwgsXIZ3dWwBjrT X-Received: by 2002:a63:30c6:: with SMTP id w189mr81720565pgw.398.1564027478184; Wed, 24 Jul 2019 21:04:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564027478; cv=none; d=google.com; s=arc-20160816; b=gDOKkrZJ8FEFhT052/HPMNS7ttPg7b7KtBBL7LJLz4atO1PDRMI8njdKgz1xmYMMhp 9FwtK8umZY1am0kHc70GT2z3ImCH4a2oPAAjI29mofBJJ9pa0P7pX+gHMnLUctP5kAeD GwP6x1urRqt4r/vvt30WItNy7+uLVeNJThGVqvOZ39wC3xmiGNABF1Fps83r2bKFBWn6 fZUq9mIN6JKozWWUoXC7Q6zVqqVzilFQEkYiw0fA3+41cJlALQoczkqzQFcajj6TB1K6 2/HMpN2kpZI/m95WTfO6O4T5NLF32uQtCnWA+KqfLbxxyK1IT2sGlrDATwJhLe73nisD 4zsw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:sender:content-transfer-encoding:mime-version :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:references:in-reply-to:message-id:date :to:from:delivered-to; bh=rBfinBssqStyIXAFv6vLIyia2emgQcpjXq/PW1XVVjQ=; b=BqN45Sen2RJk+y5COldHNy/1CsFoctnbvyfShQLLw/51IqZlMxWqOk6NGqkQJxkALk 98QBUnzPv5+gzGnB3Chj3uz048dEqL2HTZYYCiXeJvADVi3T3E8X9MpewX7qopQyV+Qz d0wcQvJzjLrMPShYX/vIYJmmgjbl8CGjf3MJx7UzixSVBSPsDdSgDlNvo3+2+qLHq682 lM3OD06UkJ61i6MN8Auiviod21/Q8jRjw+d1j9yL1S00ppj4aEj6AvARlQQuYdjjatBJ chGJb9CmeLI/hKwWi3YRhezD8xtOUlTLjIBm/4wQ6zEvHv+Zbfckc2lM+FL+rn7LZ8Dx y3Ow== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from mail.openembedded.org (mail.openembedded.org. [140.211.169.62]) by mx.google.com with ESMTP id f26si18014634pfd.193.2019.07.24.21.04.37; Wed, 24 Jul 2019 21:04:38 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) client-ip=140.211.169.62; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from ec2-34-214-78-129.us-west-2.compute.amazonaws.com (localhost [127.0.0.1]) by mail.openembedded.org (Postfix) with ESMTP id F05527F1DE; Thu, 25 Jul 2019 04:04:14 +0000 (UTC) X-Original-To: openembedded-core@lists.openembedded.org Delivered-To: openembedded-core@lists.openembedded.org Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mail.openembedded.org (Postfix) with ESMTP id 656847F0EC for ; Thu, 25 Jul 2019 04:03:35 +0000 (UTC) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 24 Jul 2019 21:03:36 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,305,1559545200"; d="scan'208";a="189233232" Received: from andromeda02.png.intel.com ([10.221.183.11]) by fmsmga001.fm.intel.com with ESMTP; 24 Jul 2019 21:03:36 -0700 From: Anuj Mittal To: akuster808@gmail.com, openembedded-core@lists.openembedded.org Date: Thu, 25 Jul 2019 12:03:01 +0800 Message-Id: <1564027386-8107-6-git-send-email-anuj.mittal@intel.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1564027386-8107-1-git-send-email-anuj.mittal@intel.com> References: <1564027386-8107-1-git-send-email-anuj.mittal@intel.com> Subject: [OE-core] [warrior][PATCH 06/11] libid3tag: handle unknown encodings (CVE-2017-11550) X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: openembedded-core-bounces@lists.openembedded.org Errors-To: openembedded-core-bounces@lists.openembedded.org From: Ross Burton (From OE-Core rev: 5090afc1b07e62f70ebcf63a7abb75b8552f0a52) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie --- .../libid3tag/libid3tag/unknown-encoding.patch | 39 ++++++++++++++++++++++ .../libid3tag/libid3tag_0.15.1b.bb | 1 + 2 files changed, 40 insertions(+) create mode 100644 meta/recipes-multimedia/libid3tag/libid3tag/unknown-encoding.patch -- 2.7.4 -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core diff --git a/meta/recipes-multimedia/libid3tag/libid3tag/unknown-encoding.patch b/meta/recipes-multimedia/libid3tag/libid3tag/unknown-encoding.patch new file mode 100644 index 0000000..f0867b5 --- /dev/null +++ b/meta/recipes-multimedia/libid3tag/libid3tag/unknown-encoding.patch @@ -0,0 +1,39 @@ +In case of an unknown/invalid encoding, id3_parse_string() will +return NULL, but the return value wasn't checked resulting +in segfault in id3_ucs4_length(). This is the only place +the return value wasn't checked. + +Patch taken from Debian: +https://sources.debian.org/patches/libid3tag/0.15.1b-14/11_unknown_encoding.dpatch/ + +CVE: CVE-2017-11550 +Upstream-Status: Pending +Signed-off-by: Ross Burton + +diff -urNad libid3tag-0.15.1b~/compat.gperf libid3tag-0.15.1b/compat.gperf +--- libid3tag-0.15.1b~/compat.gperf 2004-01-23 09:41:32.000000000 +0000 ++++ libid3tag-0.15.1b/compat.gperf 2007-01-14 14:36:53.000000000 +0000 +@@ -236,6 +236,10 @@ + + encoding = id3_parse_uint(&data, 1); + string = id3_parse_string(&data, end - data, encoding, 0); ++ if (!string) ++ { ++ continue; ++ } + + if (id3_ucs4_length(string) < 4) { + free(string); +diff -urNad libid3tag-0.15.1b~/parse.c libid3tag-0.15.1b/parse.c +--- libid3tag-0.15.1b~/parse.c 2004-01-23 09:41:32.000000000 +0000 ++++ libid3tag-0.15.1b/parse.c 2007-01-14 14:37:34.000000000 +0000 +@@ -165,6 +165,9 @@ + case ID3_FIELD_TEXTENCODING_UTF_8: + ucs4 = id3_utf8_deserialize(ptr, length); + break; ++ default: ++ /* FIXME: Unknown encoding! Print warning? */ ++ return NULL; + } + + if (ucs4 && !full) { diff --git a/meta/recipes-multimedia/libid3tag/libid3tag_0.15.1b.bb b/meta/recipes-multimedia/libid3tag/libid3tag_0.15.1b.bb index 43edd3f..0312a61 100644 --- a/meta/recipes-multimedia/libid3tag/libid3tag_0.15.1b.bb +++ b/meta/recipes-multimedia/libid3tag/libid3tag_0.15.1b.bb @@ -14,6 +14,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/mad/libid3tag-${PV}.tar.gz \ file://obsolete_automake_macros.patch \ file://0001-Fix-gperf-3.1-incompatibility.patch \ file://10_utf16.patch \ + file://unknown-encoding.patch \ " UPSTREAM_CHECK_URI = "https://sourceforge.net/projects/mad/files/libid3tag/" UPSTREAM_CHECK_REGEX = "/projects/mad/files/libid3tag/(?P.*)/$" From patchwork Thu Jul 25 04:03:02 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Anuj Mittal X-Patchwork-Id: 169667 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp11081625ilk; Wed, 24 Jul 2019 21:04:47 -0700 (PDT) X-Google-Smtp-Source: APXvYqxqmAPubs9lMjqQxdQ3lK9sJmmbryUKMNRw5Qze5N+8nDdw1wC5vRSWS+3SJkQtdQ93WPe9 X-Received: by 2002:a62:1ac9:: with SMTP id a192mr6141293pfa.260.1564027487323; Wed, 24 Jul 2019 21:04:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564027487; cv=none; d=google.com; s=arc-20160816; b=TrIUIKM7J6GbYcu4WC/hxlFuODmOKTandj22pB0XP7Qz1AfLRF1TLTmtJL4qDqMnrI Qw9tIE7dv92MwNsw5WpOhRs/bgtrEtdDJQwuhz649awbLW2QxNFUi61s8XY5apztlBz1 I22KO4gocxfPSlM7KXiPCpJdIMTPEomZdUiNHpN30KbSAnSwXLxT5+EJLiAODJ7xsQFi pRnBNmADPWdoHh7reS1IkXvoYQiTFi5XjXvyajZ9CBn/wxFf3UXnCNXBdQt642C9tiVy rcbRsSsIOoEu09odQQWGdQMp1whRyUBQFxHbugxY/gXudmt6SyIG09/ThAoFi95ccO1d zCaA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:sender:content-transfer-encoding:mime-version :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:references:in-reply-to:message-id:date :to:from:delivered-to; bh=3FkJVwmAPN07KwCv1W1GBhGeRO25EH5zyN67SO0uN/c=; b=kDWyH8IlqOk1+zl5Jno17e/2UQf5o+Ds8RxiNSef+7wjHmIizrJB2qlSw2kYtHqm56 CemhA2vC+iNONCHOogDa52/U3hnDi0Uidsn38jcQuRmgGo+nTUgcdyspz3k2ikF+5qeF lNNpFlCUmGmJcIdmI+FcBMhMtcm7mf46/wj/3n3pGG6fTR7zJcbgZjIXdNPbVkKVwZCf ZMUDJrRQdFC2yEILAMr4ym5iAPhbIWOBwHRkxETej5iSQgnOORYSXBErgOazwyCr3hVb cqJA3p6nAi/xo4c7nti34r3x5YEPR99gQFM1ztII3NbljidrVsYhXjaTRviZr3nejvG4 Rw2g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from mail.openembedded.org (mail.openembedded.org. [140.211.169.62]) by mx.google.com with ESMTP id c4si17012589pfn.71.2019.07.24.21.04.47; Wed, 24 Jul 2019 21:04:47 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) client-ip=140.211.169.62; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from ec2-34-214-78-129.us-west-2.compute.amazonaws.com (localhost [127.0.0.1]) by mail.openembedded.org (Postfix) with ESMTP id 1B9227F1E3; Thu, 25 Jul 2019 04:04:16 +0000 (UTC) X-Original-To: openembedded-core@lists.openembedded.org Delivered-To: openembedded-core@lists.openembedded.org Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mail.openembedded.org (Postfix) with ESMTP id 7EBB07F0EC for ; Thu, 25 Jul 2019 04:03:36 +0000 (UTC) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 24 Jul 2019 21:03:37 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,305,1559545200"; d="scan'208";a="189233233" Received: from andromeda02.png.intel.com ([10.221.183.11]) by fmsmga001.fm.intel.com with ESMTP; 24 Jul 2019 21:03:37 -0700 From: Anuj Mittal To: akuster808@gmail.com, openembedded-core@lists.openembedded.org Date: Thu, 25 Jul 2019 12:03:02 +0800 Message-Id: <1564027386-8107-7-git-send-email-anuj.mittal@intel.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1564027386-8107-1-git-send-email-anuj.mittal@intel.com> References: <1564027386-8107-1-git-send-email-anuj.mittal@intel.com> Subject: [OE-core] [warrior][PATCH 07/11] libid3tag: CVE-2017-11551 is the same as CVE-2004-2779 X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: openembedded-core-bounces@lists.openembedded.org Errors-To: openembedded-core-bounces@lists.openembedded.org From: Ross Burton (From OE-Core rev: 0663e5f8f906803685f018061d51fd6277916e50) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie --- meta/recipes-multimedia/libid3tag/libid3tag/10_utf16.patch | 1 + 1 file changed, 1 insertion(+) -- 2.7.4 -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core diff --git a/meta/recipes-multimedia/libid3tag/libid3tag/10_utf16.patch b/meta/recipes-multimedia/libid3tag/libid3tag/10_utf16.patch index 8d09ce7..10e0890 100644 --- a/meta/recipes-multimedia/libid3tag/libid3tag/10_utf16.patch +++ b/meta/recipes-multimedia/libid3tag/libid3tag/10_utf16.patch @@ -6,6 +6,7 @@ https://sources.debian.org/patches/libid3tag/0.15.1b-13/10_utf16.dpatch Upstream-Status: Pending CVE: CVE-2004-2779 +CVE: CVE-2017-11551 Signed-off-by: Changqing Li From patchwork Thu Jul 25 04:03:03 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Anuj Mittal X-Patchwork-Id: 169668 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp11081768ilk; Wed, 24 Jul 2019 21:04:55 -0700 (PDT) X-Google-Smtp-Source: APXvYqw2nXVk4KgLynfKJEwURuwIGRGvfkO+JDeq/JQ/l3wYRuLqqd4+OWNFG+CrmYRMSpYpKyKq X-Received: by 2002:aa7:9516:: with SMTP id b22mr14483545pfp.106.1564027495372; Wed, 24 Jul 2019 21:04:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564027495; cv=none; d=google.com; s=arc-20160816; b=L0xHKZm6C6iON/XX4NwiZ39bocXa7DHuDM7s2ep1XFIXvxvqNopGzsopANgW6SIWWE mZPys2FX+wSoPYxZK/iIEV5ha2Wd5dxm/9s8j7WGn+rjLvhjCt5RRHkafZmUhwb7Iazx sohZsPcnTbhjsIMhnQg2G9CyXsr5SeDWl09G/TfSRP/9MyDEecXdQmqbu6DelVpMcN3r R1MmPyPMdzhSCvnwIs2s3Rq/ytaMGo3s0VV6L5FvSOVSxMTOrX8PaXydnV1vBTtotHvq b214WbwaH/XBooP3Lqg8mBhdfAi1+I4R5RqYfXRrVAYl9i74T/OcAwR5aDILDEdy8PpO pKQw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:sender:content-transfer-encoding:mime-version :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:references:in-reply-to:message-id:date :to:from:delivered-to; bh=97v5TQvvdXw8HQqdCZPWLGfBHgNM0AApDGjD+6j4lb8=; b=Esv+vWX8M+KCcE+zeFs71LvDF/2qZDo2K+Jrw7rPD4gQYm7NP7YkhMNcOYRQ5cHDib d1k+9nljbvw9Qp56VsoQzH3fVeWdyZ7pctxe1JtJHD8Toku2B4H3y4eMggIF0qLN2pfB 9r2PjOY9/Ve9VjopYQwGWmjVC2+UBg7bbwa9JSiYHYtU51uwqWo8o4g+A2MsPEXO9BBm U4N8klGSK4I9SIxx+2lt703iEsbCUa6ZcqatSsYXw/AI8vxilO4vxDshBOhHWLmRJzWM Zw35KojdNJSGKEwVB9xGX5Gf06vG9mHsLKBmHpOEQU83CBxn3Io0KA+sCj7eoVYTGJWb pzlA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from mail.openembedded.org (mail.openembedded.org. [140.211.169.62]) by mx.google.com with ESMTP id 100si18000544pla.158.2019.07.24.21.04.55; Wed, 24 Jul 2019 21:04:55 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) client-ip=140.211.169.62; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from ec2-34-214-78-129.us-west-2.compute.amazonaws.com (localhost [127.0.0.1]) by mail.openembedded.org (Postfix) with ESMTP id 3D4067F1E8; Thu, 25 Jul 2019 04:04:17 +0000 (UTC) X-Original-To: openembedded-core@lists.openembedded.org Delivered-To: openembedded-core@lists.openembedded.org Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mail.openembedded.org (Postfix) with ESMTP id 9AC6F7F0E9 for ; Thu, 25 Jul 2019 04:03:37 +0000 (UTC) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 24 Jul 2019 21:03:38 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,305,1559545200"; d="scan'208";a="189233234" Received: from andromeda02.png.intel.com ([10.221.183.11]) by fmsmga001.fm.intel.com with ESMTP; 24 Jul 2019 21:03:38 -0700 From: Anuj Mittal To: akuster808@gmail.com, openembedded-core@lists.openembedded.org Date: Thu, 25 Jul 2019 12:03:03 +0800 Message-Id: <1564027386-8107-8-git-send-email-anuj.mittal@intel.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1564027386-8107-1-git-send-email-anuj.mittal@intel.com> References: <1564027386-8107-1-git-send-email-anuj.mittal@intel.com> Subject: [OE-core] [warrior][PATCH 08/11] tiff: fix CVE-2019-6128 X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: openembedded-core-bounces@lists.openembedded.org Errors-To: openembedded-core-bounces@lists.openembedded.org From: Ross Burton (From OE-Core rev: 7293e417dd9bdd04fe0fec177a76c9286234ed46) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie --- .../libtiff/tiff/CVE-2019-6128.patch | 52 ++++++++++++++++++++++ meta/recipes-multimedia/libtiff/tiff_4.0.10.bb | 2 +- 2 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2019-6128.patch -- 2.7.4 -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2019-6128.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2019-6128.patch new file mode 100644 index 0000000..6f1fd4d --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2019-6128.patch @@ -0,0 +1,52 @@ +CVE: CVE-2019-6128 +Upstream-Status: Backport +Signed-off-by: Ross Burton + +From 0c74a9f49b8d7a36b17b54a7428b3526d20f88a8 Mon Sep 17 00:00:00 2001 +From: Scott Gayou +Date: Wed, 23 Jan 2019 15:03:53 -0500 +Subject: [PATCH] Fix for simple memory leak that was assigned CVE-2019-6128. + +pal2rgb failed to free memory on a few errors. This was reported +here: http://bugzilla.maptools.org/show_bug.cgi?id=2836. +--- + tools/pal2rgb.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c +index 01d8502ec..9492f1cf1 100644 +--- a/tools/pal2rgb.c ++++ b/tools/pal2rgb.c +@@ -118,12 +118,14 @@ main(int argc, char* argv[]) + shortv != PHOTOMETRIC_PALETTE) { + fprintf(stderr, "%s: Expecting a palette image.\n", + argv[optind]); ++ (void) TIFFClose(in); + return (-1); + } + if (!TIFFGetField(in, TIFFTAG_COLORMAP, &rmap, &gmap, &bmap)) { + fprintf(stderr, + "%s: No colormap (not a valid palette image).\n", + argv[optind]); ++ (void) TIFFClose(in); + return (-1); + } + bitspersample = 0; +@@ -131,11 +133,14 @@ main(int argc, char* argv[]) + if (bitspersample != 8) { + fprintf(stderr, "%s: Sorry, can only handle 8-bit images.\n", + argv[optind]); ++ (void) TIFFClose(in); + return (-1); + } + out = TIFFOpen(argv[optind+1], "w"); +- if (out == NULL) ++ if (out == NULL) { ++ (void) TIFFClose(in); + return (-2); ++ } + cpTags(in, out); + TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &imagewidth); + TIFFGetField(in, TIFFTAG_IMAGELENGTH, &imagelength); +-- +2.21.0 diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb index 152fa81..a82d744 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb @@ -6,8 +6,8 @@ CVE_PRODUCT = "libtiff" SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ file://libtool2.patch \ + file://CVE-2019-6128.patch" " - SRC_URI[md5sum] = "114192d7ebe537912a2b97408832e7fd" SRC_URI[sha256sum] = "2c52d11ccaf767457db0c46795d9c7d1a8d8f76f68b0b800a3dfe45786b996e4" From patchwork Thu Jul 25 04:03:04 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Anuj Mittal X-Patchwork-Id: 169669 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp11081921ilk; Wed, 24 Jul 2019 21:05:04 -0700 (PDT) X-Google-Smtp-Source: APXvYqywex9bz1qtcQ1ykGj5JLUUM6S9zWuybTDyCOnaPfeiQ8NpdNcwfpBtTVM7Cbb4NimxSHhu X-Received: by 2002:a62:174a:: with SMTP id 71mr15038463pfx.140.1564027504108; Wed, 24 Jul 2019 21:05:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564027504; cv=none; d=google.com; s=arc-20160816; b=Q5lwWthUkisq9+hbqFtmNj8iZcZ9J8/GOS26pypFFyspiCm/LV3vxgogESx8LeT97F HPTz0wyJd1UPgZTqkGAyn0numQubGP3A7wvVV91GkZkBWnMcsLCm/HEAyNNjJnOjYimi c1dgFZOz48Gd0rKDUdNGfQsul8NtFeTCxSTRjCWgthhnfkl7K4hESHW8ddKNKFBlHffq 3kZSNUHOwJt+3AXjbCWgYNKvL7MDI3r1tAneQ0RicRfYOISoNmsI7hkh/1ecO2xo0ejK +0h8iTSa1Te5TxCXUdxu4TcANWCwMNrELTYLYmipysTBeZThwsfQGyzV4bR5Aq9+EM2C hqjg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:sender:content-transfer-encoding:mime-version :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:references:in-reply-to:message-id:date :to:from:delivered-to; bh=bAbqvTsZHxp/a/m/a24aYetyCgc7Ex/jm5fYa1JxflI=; b=Misz0EczD4CUPulNiUjzAQZu3+NMDZy0EM7Td1XbSETTuWyKsTohBu0FWNNPBQzGft iS1SJ2RV/+9y3G0qASss4IYjXDRhT4MuxeXpzpGFnOiXcq9YmAvW7Bulz47uKteFTFyn EAOwWdUoyx76d9SreAisQXf2KMIU4cuq96wosepABO3ZPxwRpoFLOFgH94sngVGLlRZt 3TWC5SbI+5NQIvy5AWQdMXgzekRR8/g9Iz44z6QoiLriD0dysL7qvQBou/AG0f4htxef J/zAceCyfxC8shi2zixDcuVLCYXST/9HF9qIdMCnj1ZecpR5ziFM7/Z/jdXTF/y0CY+j H2QA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from mail.openembedded.org (mail.openembedded.org. [140.211.169.62]) by mx.google.com with ESMTP id u20si14947428plq.421.2019.07.24.21.05.03; Wed, 24 Jul 2019 21:05:04 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) client-ip=140.211.169.62; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from ec2-34-214-78-129.us-west-2.compute.amazonaws.com (localhost [127.0.0.1]) by mail.openembedded.org (Postfix) with ESMTP id 3D93A7F1ED; Thu, 25 Jul 2019 04:04:19 +0000 (UTC) X-Original-To: openembedded-core@lists.openembedded.org Delivered-To: openembedded-core@lists.openembedded.org Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mail.openembedded.org (Postfix) with ESMTP id B63957F18F for ; Thu, 25 Jul 2019 04:03:38 +0000 (UTC) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 24 Jul 2019 21:03:39 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,305,1559545200"; d="scan'208";a="189233235" Received: from andromeda02.png.intel.com ([10.221.183.11]) by fmsmga001.fm.intel.com with ESMTP; 24 Jul 2019 21:03:39 -0700 From: Anuj Mittal To: akuster808@gmail.com, openembedded-core@lists.openembedded.org Date: Thu, 25 Jul 2019 12:03:04 +0800 Message-Id: <1564027386-8107-9-git-send-email-anuj.mittal@intel.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1564027386-8107-1-git-send-email-anuj.mittal@intel.com> References: <1564027386-8107-1-git-send-email-anuj.mittal@intel.com> Subject: [OE-core] [warrior][PATCH 09/11] tiff: fix CVE-2019-7663 X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: openembedded-core-bounces@lists.openembedded.org Errors-To: openembedded-core-bounces@lists.openembedded.org From: Ross Burton (From OE-Core rev: d06d6910d1ec9374bb15e02809e64e81198731b6) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie --- .../libtiff/tiff/CVE-2019-7663.patch | 77 ++++++++++++++++++++++ meta/recipes-multimedia/libtiff/tiff_4.0.10.bb | 3 +- 2 files changed, 79 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2019-7663.patch -- 2.7.4 -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2019-7663.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2019-7663.patch new file mode 100644 index 0000000..f244fb2 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2019-7663.patch @@ -0,0 +1,77 @@ +CVE: CVE-2019-7663 +Upstream-Status: Backport +Signed-off-by: Ross Burton + +From c6fc6c1fa895024c86285c58efd6424cf8078f32 Mon Sep 17 00:00:00 2001 +From: Thomas Bernard +Date: Mon, 11 Feb 2019 10:05:33 +0100 +Subject: [PATCH 1/2] check that (Tile Width)*(Samples/Pixel) do no overflow + +fixes bug 2833 +--- + tools/tiffcp.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/tools/tiffcp.c b/tools/tiffcp.c +index 2f406e2d..f0ee2c02 100644 +--- a/tools/tiffcp.c ++++ b/tools/tiffcp.c +@@ -1408,7 +1408,7 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer) + int status = 1; + uint32 imagew = TIFFRasterScanlineSize(in); + uint32 tilew = TIFFTileRowSize(in); +- int iskew = imagew - tilew*spp; ++ int iskew; + tsize_t tilesize = TIFFTileSize(in); + tdata_t tilebuf; + uint8* bufp = (uint8*) buf; +@@ -1416,6 +1416,12 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer) + uint32 row; + uint16 bps = 0, bytes_per_sample; + ++ if (spp > (0x7fffffff / tilew)) ++ { ++ TIFFError(TIFFFileName(in), "Error, cannot handle that much samples per tile row (Tile Width * Samples/Pixel)"); ++ return 0; ++ } ++ iskew = imagew - tilew*spp; + tilebuf = _TIFFmalloc(tilesize); + if (tilebuf == 0) + return 0; +-- +2.20.1 + + +From da6454aa80b9bb3154dfab4e8b21637de47531e0 Mon Sep 17 00:00:00 2001 +From: Thomas Bernard +Date: Mon, 11 Feb 2019 21:42:03 +0100 +Subject: [PATCH 2/2] tiffcp.c: use INT_MAX + +--- + tools/tiffcp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/tiffcp.c b/tools/tiffcp.c +index f0ee2c02..8c81aa4f 100644 +--- a/tools/tiffcp.c ++++ b/tools/tiffcp.c +@@ -41,6 +41,7 @@ + #include + #include + #include ++#include + + #include + +@@ -1416,7 +1417,7 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer) + uint32 row; + uint16 bps = 0, bytes_per_sample; + +- if (spp > (0x7fffffff / tilew)) ++ if (spp > (INT_MAX / tilew)) + { + TIFFError(TIFFFileName(in), "Error, cannot handle that much samples per tile row (Tile Width * Samples/Pixel)"); + return 0; +-- +2.20.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb index a82d744..8e3e227 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb @@ -6,7 +6,8 @@ CVE_PRODUCT = "libtiff" SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ file://libtool2.patch \ - file://CVE-2019-6128.patch" + file://CVE-2019-6128.patch \ + file://CVE-2019-7663.patch \ " SRC_URI[md5sum] = "114192d7ebe537912a2b97408832e7fd" SRC_URI[sha256sum] = "2c52d11ccaf767457db0c46795d9c7d1a8d8f76f68b0b800a3dfe45786b996e4"