* [bug#31967] [PATCH] gnu: libtiff: Fix CVE-2018-{8905,10963}.
@ 2018-06-25 20:32 Leo Famulari
2018-06-25 20:40 ` Marius Bakke
0 siblings, 1 reply; 3+ messages in thread
From: Leo Famulari @ 2018-06-25 20:32 UTC (permalink / raw)
To: 31967
* gnu/packages/patches/libtiff-CVE-2018-8905.patch,
gnu/packages/patches/libtiff-CVE-2018-10963.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
* gnu/packages/image.scm (libtiff)[replacement]: New field.
(libtiff/fixed): New variable.
---
gnu/local.mk | 2 +
gnu/packages/image.scm | 12 ++++
.../patches/libtiff-CVE-2018-10963.patch | 40 ++++++++++++
.../patches/libtiff-CVE-2018-8905.patch | 61 +++++++++++++++++++
4 files changed, 115 insertions(+)
create mode 100644 gnu/packages/patches/libtiff-CVE-2018-10963.patch
create mode 100644 gnu/packages/patches/libtiff-CVE-2018-8905.patch
diff --git a/gnu/local.mk b/gnu/local.mk
index 9d8947d55..1b39bf4e9 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -883,6 +883,8 @@ dist_patch_DATA = \
%D%/packages/patches/libtheora-config-guess.patch \
%D%/packages/patches/libtiff-CVE-2017-9935.patch \
%D%/packages/patches/libtiff-CVE-2017-18013.patch \
+ %D%/packages/patches/libtiff-CVE-2018-8905.patch \
+ %D%/packages/patches/libtiff-CVE-2018-10963.patch \
%D%/packages/patches/libtool-skip-tests2.patch \
%D%/packages/patches/libusb-0.1-disable-tests.patch \
%D%/packages/patches/libusb-for-axoloti.patch \
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index a2874be1a..5ad6fe948 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -394,6 +394,7 @@ extracting icontainer icon files.")
(define-public libtiff
(package
(name "libtiff")
+ (replacement libtiff/fixed)
(version "4.0.9")
(source
(origin
@@ -426,6 +427,17 @@ collection of tools for doing simple manipulations of TIFF images.")
"See COPYRIGHT in the distribution."))
(home-page "http://www.simplesystems.org/libtiff/")))
+(define libtiff/fixed
+ (package
+ (inherit libtiff)
+ (source
+ (origin
+ (inherit (package-source libtiff))
+ (patches
+ (append (origin-patches (package-source libtiff))
+ (search-patches "libtiff-CVE-2018-8905.patch"
+ "libtiff-CVE-2018-10963.patch")))))))
+
(define-public leptonica
(package
(name "leptonica")
diff --git a/gnu/packages/patches/libtiff-CVE-2018-10963.patch b/gnu/packages/patches/libtiff-CVE-2018-10963.patch
new file mode 100644
index 000000000..d31c12399
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2018-10963.patch
@@ -0,0 +1,40 @@
+Fix CVE-2018-10963:
+
+http://bugzilla.maptools.org/show_bug.cgi?id=2795
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10963
+
+Patch copied from upstream source repository:
+
+https://gitlab.com/libtiff/libtiff/commit/de144fd228e4be8aa484c3caf3d814b6fa88c6d9
+
+From de144fd228e4be8aa484c3caf3d814b6fa88c6d9 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 12 May 2018 14:24:15 +0200
+Subject: [PATCH] TIFFWriteDirectorySec: avoid assertion. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2795. CVE-2018-10963
+
+---
+ libtiff/tif_dirwrite.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c
+index 2430de6d..c15a28db 100644
+--- a/libtiff/tif_dirwrite.c
++++ b/libtiff/tif_dirwrite.c
+@@ -695,8 +695,11 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
+ }
+ break;
+ default:
+- assert(0); /* we should never get here */
+- break;
++ TIFFErrorExt(tif->tif_clientdata,module,
++ "Cannot write tag %d (%s)",
++ TIFFFieldTag(o),
++ o->field_name ? o->field_name : "unknown");
++ goto bad;
+ }
+ }
+ }
+--
+2.17.0
+
diff --git a/gnu/packages/patches/libtiff-CVE-2018-8905.patch b/gnu/packages/patches/libtiff-CVE-2018-8905.patch
new file mode 100644
index 000000000..f49815789
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2018-8905.patch
@@ -0,0 +1,61 @@
+Fix CVE-2018-8095:
+
+http://bugzilla.maptools.org/show_bug.cgi?id=2780
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8905
+
+Patch copied from upstream source repository:
+
+https://gitlab.com/libtiff/libtiff/commit/58a898cb4459055bb488ca815c23b880c242a27d
+
+From 58a898cb4459055bb488ca815c23b880c242a27d Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 12 May 2018 15:32:31 +0200
+Subject: [PATCH] LZWDecodeCompat(): fix potential index-out-of-bounds write.
+ Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2780 / CVE-2018-8905
+
+The fix consists in using the similar code LZWDecode() to validate we
+don't write outside of the output buffer.
+---
+ libtiff/tif_lzw.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
+index 4ccb443c..94d85e38 100644
+--- a/libtiff/tif_lzw.c
++++ b/libtiff/tif_lzw.c
+@@ -602,6 +602,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
+ char *tp;
+ unsigned char *bp;
+ int code, nbits;
++ int len;
+ long nextbits, nextdata, nbitsmask;
+ code_t *codep, *free_entp, *maxcodep, *oldcodep;
+
+@@ -753,13 +754,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
+ } while (--occ);
+ break;
+ }
+- assert(occ >= codep->length);
+- op += codep->length;
+- occ -= codep->length;
+- tp = op;
++ len = codep->length;
++ tp = op + len;
+ do {
+- *--tp = codep->value;
+- } while( (codep = codep->next) != NULL );
++ int t;
++ --tp;
++ t = codep->value;
++ codep = codep->next;
++ *tp = (char)t;
++ } while (codep && tp > op);
++ assert(occ >= len);
++ op += len;
++ occ -= len;
+ } else {
+ *op++ = (char)code;
+ occ--;
+--
+2.17.0
+
--
2.18.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [bug#31967] [PATCH] gnu: libtiff: Fix CVE-2018-{8905,10963}.
2018-06-25 20:32 [bug#31967] [PATCH] gnu: libtiff: Fix CVE-2018-{8905,10963} Leo Famulari
@ 2018-06-25 20:40 ` Marius Bakke
2018-06-26 15:52 ` bug#31967: " Leo Famulari
0 siblings, 1 reply; 3+ messages in thread
From: Marius Bakke @ 2018-06-25 20:40 UTC (permalink / raw)
To: Leo Famulari, 31967
[-- Attachment #1: Type: text/plain, Size: 316 bytes --]
Leo Famulari <leo@famulari.name> writes:
> * gnu/packages/patches/libtiff-CVE-2018-8905.patch,
> gnu/packages/patches/libtiff-CVE-2018-10963.patch: New files.
> * gnu/local.mk (dist_patch_DATA): Add them.
> * gnu/packages/image.scm (libtiff)[replacement]: New field.
> (libtiff/fixed): New variable.
LGTM, thanks!
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* bug#31967: [PATCH] gnu: libtiff: Fix CVE-2018-{8905,10963}.
2018-06-25 20:40 ` Marius Bakke
@ 2018-06-26 15:52 ` Leo Famulari
0 siblings, 0 replies; 3+ messages in thread
From: Leo Famulari @ 2018-06-26 15:52 UTC (permalink / raw)
To: Marius Bakke; +Cc: 31967-done
[-- Attachment #1: Type: text/plain, Size: 468 bytes --]
On Mon, Jun 25, 2018 at 10:40:11PM +0200, Marius Bakke wrote:
> Leo Famulari <leo@famulari.name> writes:
>
> > * gnu/packages/patches/libtiff-CVE-2018-8905.patch,
> > gnu/packages/patches/libtiff-CVE-2018-10963.patch: New files.
> > * gnu/local.mk (dist_patch_DATA): Add them.
> > * gnu/packages/image.scm (libtiff)[replacement]: New field.
> > (libtiff/fixed): New variable.
>
> LGTM, thanks!
Thanks! Pushed as 8dbfaff028d73cc847a9fff03cb17006c5461b11
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-06-26 15:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-06-25 20:32 [bug#31967] [PATCH] gnu: libtiff: Fix CVE-2018-{8905,10963} Leo Famulari
2018-06-25 20:40 ` Marius Bakke
2018-06-26 15:52 ` bug#31967: " Leo Famulari
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).