From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52846) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ekgVu-0002Pc-EO for guix-patches@gnu.org; Sat, 10 Feb 2018 20:33:08 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ekgVq-0001pr-Ch for guix-patches@gnu.org; Sat, 10 Feb 2018 20:33:06 -0500 Received: from debbugs.gnu.org ([208.118.235.43]:57818) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1ekgVq-0001pf-7f for guix-patches@gnu.org; Sat, 10 Feb 2018 20:33:02 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1ekgVq-0003Xc-1X for guix-patches@gnu.org; Sat, 10 Feb 2018 20:33:02 -0500 Subject: [bug#30418] [PATCH] gnu: libtiff: Fix CVE-2017-{9935, 11335, 18013}. Resent-Message-ID: Date: Sun, 11 Feb 2018 02:32:38 +0100 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Marius Bakke Message-ID: <3B1F7BD8-9EAA-4560-A547-3D308C01BF09@fastmail.com> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: 30418@debbugs.gnu.org, leo@famulari.name On February 11, 2018 2:05:18 AM GMT+01:00, Leo Famulari wrote: >* gnu/packages/patches/libtiff-CVE-2017-9935=2Epatch, >gnu/packages/patches/libtiff-CVE-2017-11335=2Epatch, >gnu/packages/patches/libtiff-CVE-2017-18013=2Epatch: New files=2E >* gnu/local=2Emk (dist_patch_DATA): Add them=2E >* gnu/packages/image=2Escm (libtiff)[replacement]: New field=2E >(libtiff/fixed): New variable=2E LGTM, thanks for taking care of this=2E >--- > gnu/local=2Emk | 3 + > gnu/packages/image=2Escm | 13 ++ > gnu/packages/patches/libtiff-CVE-2017-11335=2Epatch | 48 +++++++ > gnu/packages/patches/libtiff-CVE-2017-18013=2Epatch | 45 ++++++ >gnu/packages/patches/libtiff-CVE-2017-9935=2Epatch | 162 >++++++++++++++++++++++ > 5 files changed, 271 insertions(+) > create mode 100644 gnu/packages/patches/libtiff-CVE-2017-11335=2Epatch > create mode 100644 gnu/packages/patches/libtiff-CVE-2017-18013=2Epatch > create mode 100644 gnu/packages/patches/libtiff-CVE-2017-9935=2Epatch > >diff --git a/gnu/local=2Emk b/gnu/local=2Emk >index eb968dede=2E=2E95650cc50 100644 >--- a/gnu/local=2Emk >+++ b/gnu/local=2Emk >@@ -854,7 +854,10 @@ dist_patch_DATA =3D \ > %D%/packages/patches/libtasn1-CVE-2017-10790=2Epatch \ > %D%/packages/patches/libtheora-config-guess=2Epatch \ > %D%/packages/patches/libtiff-CVE-2016-10688=2Epatch \ >+ %D%/packages/patches/libtiff-CVE-2017-9935=2Epatch \ > %D%/packages/patches/libtiff-CVE-2017-9936=2Epatch \ >+ %D%/packages/patches/libtiff-CVE-2017-11335=2Epatch \ >+ %D%/packages/patches/libtiff-CVE-2017-18013=2Epatch \ > %D%/packages/patches/libtiff-tiffgetfield-bugs=2Epatch \ > %D%/packages/patches/libtiff-tiffycbcrtorgb-integer-overflow=2Epatch \ >%D%/packages/patches/libtiff-tiffycbcrtorgbinit-integer-overflow=2Epatch = \ >diff --git a/gnu/packages/image=2Escm b/gnu/packages/image=2Escm >index 548c1df44=2E=2Ea5738f431 100644 >--- a/gnu/packages/image=2Escm >+++ b/gnu/packages/image=2Escm >@@ -390,6 +390,7 @@ extracting icontainer icon files=2E") > (define-public libtiff > (package > (name "libtiff") >+ (replacement libtiff/fixed) > (version "4=2E0=2E8") > (source > (origin >@@ -426,6 +427,18 @@ collection of tools for doing simple manipulations >of TIFF images=2E") > "See COPYRIGHT in the distribution=2E")) > (home-page "http://www=2Esimplesystems=2Eorg/libtiff/"))) >=20 >+(define libtiff/fixed >+ (package >+ (inherit libtiff) >+ (source >+ (origin >+ (inherit (package-source libtiff)) >+ (patches >+ (append (origin-patches (package-source libtiff)) >+ (search-patches "libtiff-CVE-2017-9935=2Epatch" >+ "libtiff-CVE-2017-11335=2Epatch" >+ =20 >"libtiff-CVE-2017-18013=2Epatch"))))))) >+ > (define-public leptonica > (package > (name "leptonica") >diff --git a/gnu/packages/patches/libtiff-CVE-2017-11335=2Epatch >b/gnu/packages/patches/libtiff-CVE-2017-11335=2Epatch >new file mode 100644 >index 000000000=2E=2E504bf3d3e >--- /dev/null >+++ b/gnu/packages/patches/libtiff-CVE-2017-11335=2Epatch >@@ -0,0 +1,48 @@ >+Fix CVE-2017-11335: >+ >+http://bugzilla=2Emaptools=2Eorg/show_bug=2Ecgi?id=3D2715 >+https://cve=2Emitre=2Eorg/cgi-bin/cvename=2Ecgi?name=3DCVE-2017-11335 >+ >+Patch copied from upstream source repository: >+ >+https://gitlab=2Ecom/libtiff/libtiff/commit/979751c407648bd29a6bdf5581ab= 9e3af42c1223 >+ >+From 979751c407648bd29a6bdf5581ab9e3af42c1223 Mon Sep 17 00:00:00 2001 >+From: Even Rouault >+Date: Sat, 15 Jul 2017 11:13:46 +0000 >+Subject: [PATCH] * tools/tiff2pdf=2Ec: prevent heap buffer overflow >write in >+ "Raw" mode on PlanarConfig=3DContig input images=2E Fixes >+ http://bugzilla=2Emaptools=2Eorg/show_bug=2Ecgi?id=3D2715 Reported by t= eam >OWL337 >+ >+--- >+ ChangeLog | 7 +++++++ >+ tools/tiff2pdf=2Ec | 9 +++++++-- >+ 2 files changed, 14 insertions(+), 2 deletions(-) >+ >+diff --git a/tools/tiff2pdf=2Ec b/tools/tiff2pdf=2Ec >+index 8e4e24ef=2E=2Ecaf64ee5 100644 >+--- a/tools/tiff2pdf=2Ec >++++ b/tools/tiff2pdf=2Ec >+@@ -1,4 +1,4 @@ >+-/* $Id: tiff2pdf=2Ec,v 1=2E101 2016-12-20 17:28:17 erouault Exp $ >++/* $Id: tiff2pdf=2Ec,v 1=2E102 2017-07-15 11:13:46 erouault Exp $ >+ * >+ * tiff2pdf - converts a TIFF image to a PDF document >+ * >+@@ -1737,7 +1737,12 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){ >+ return; >+=20 >+ t2p->pdf_transcode =3D T2P_TRANSCODE_ENCODE; >+- if(t2p->pdf_nopassthrough=3D=3D0){ >++ /* It seems that T2P_TRANSCODE_RAW mode doesn't support >separate->contig */ >++ /* conversion=2E At least t2p_read_tiff_size and >t2p_read_tiff_size_tile */ >++ /* do not take into account the number of samples, and thus >*/ >++ /* that can cause heap buffer overflows such as in */ >++ /* http://bugzilla=2Emaptools=2Eorg/show_bug=2Ecgi?id=3D2715 */ >++ if(t2p->pdf_nopassthrough=3D=3D0 && >t2p->tiff_planar!=3DPLANARCONFIG_SEPARATE){ >+ #ifdef CCITT_SUPPORT >+ if(t2p->tiff_compression=3D=3DCOMPRESSION_CCITTFAX4 =20 >+ ){ >+--=20 >+2=2E16=2E1 >+ >diff --git a/gnu/packages/patches/libtiff-CVE-2017-18013=2Epatch >b/gnu/packages/patches/libtiff-CVE-2017-18013=2Epatch >new file mode 100644 >index 000000000=2E=2Eba03c8384 >--- /dev/null >+++ b/gnu/packages/patches/libtiff-CVE-2017-18013=2Epatch >@@ -0,0 +1,45 @@ >+Fix CVE-2017-18013: >+ >+http://bugzilla=2Emaptools=2Eorg/show_bug=2Ecgi?id=3D2770 >+https://cve=2Emitre=2Eorg/cgi-bin/cvename=2Ecgi?name=3DCVE-2017-18013 >+ >+Patch copied from upstream source repository: >+ >+https://gitlab=2Ecom/libtiff/libtiff/commit/c6f41df7b581402dfba3c19a1e3d= f4454c551a01 >+ >+From c6f41df7b581402dfba3c19a1e3df4454c551a01 Mon Sep 17 00:00:00 2001 >+From: Even Rouault >+Date: Sun, 31 Dec 2017 15:09:41 +0100 >+Subject: [PATCH] libtiff/tif_print=2Ec: TIFFPrintDirectory(): fix null >pointer >+ dereference on corrupted file=2E Fixes >+ http://bugzilla=2Emaptools=2Eorg/show_bug=2Ecgi?id=3D2770 >+ >+--- >+ libtiff/tif_print=2Ec | 8 ++++---- >+ 1 file changed, 4 insertions(+), 4 deletions(-) >+ >+diff --git a/libtiff/tif_print=2Ec b/libtiff/tif_print=2Ec >+index 9959d353=2E=2E8deceb2b 100644 >+--- a/libtiff/tif_print=2Ec >++++ b/libtiff/tif_print=2Ec >+@@ -665,13 +665,13 @@ TIFFPrintDirectory(TIFF* tif, FILE* fd, long >flags) >+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) >+ fprintf(fd, " %3lu: [%8I64u, %8I64u]\n", >+ (unsigned long) s, >+- (unsigned __int64) td->td_stripoffset[s], >+- (unsigned __int64) td->td_stripbytecount[s]); >++ td->td_stripoffset ? (unsigned __int64) td->td_stripoffset[s] >: 0, >++ td->td_stripbytecount ? (unsigned __int64) >td->td_stripbytecount[s] : 0); >+ #else >+ fprintf(fd, " %3lu: [%8llu, %8llu]\n", >+ (unsigned long) s, >+- (unsigned long long) td->td_stripoffset[s], >+- (unsigned long long) td->td_stripbytecount[s]); >++ td->td_stripoffset ? (unsigned long long) >td->td_stripoffset[s] : 0, >++ td->td_stripbytecount ? (unsigned long long) >td->td_stripbytecount[s] : 0); >+ #endif >+ } >+ } >+--=20 >+2=2E16=2E1 >+ >diff --git a/gnu/packages/patches/libtiff-CVE-2017-9935=2Epatch >b/gnu/packages/patches/libtiff-CVE-2017-9935=2Epatch >new file mode 100644 >index 000000000=2E=2E5685d81f6 >--- /dev/null >+++ b/gnu/packages/patches/libtiff-CVE-2017-9935=2Epatch >@@ -0,0 +1,162 @@ >+Fix CVE-2017-9935 >+ >+https://cve=2Emitre=2Eorg/cgi-bin/cvename=2Ecgi?name=3DCVE-2017-9935 >+http://bugzilla=2Emaptools=2Eorg/show_bug=2Ecgi?id=3D2704 >+ >+Patch copied from upstream source repository: >+ >+https://gitlab=2Ecom/libtiff/libtiff/commit/3dd8f6a357981a4090f126ab9025= 056c938b6940 >+ >+From 3dd8f6a357981a4090f126ab9025056c938b6940 Mon Sep 17 00:00:00 2001 >+From: Brian May >+Date: Thu, 7 Dec 2017 07:46:47 +1100 >+Subject: [PATCH] tiff2pdf: Fix CVE-2017-9935 >+ >+Fix for http://bugzilla=2Emaptools=2Eorg/show_bug=2Ecgi?id=3D2704 >+ >+This vulnerability - at least for the supplied test case - is because >we >+assume that a tiff will only have one transfer function that is the >same >+for all pages=2E This is not required by the TIFF standards=2E >+ >+We than read the transfer function for every page=2E Depending on the >+transfer function, we allocate either 2 or 4 bytes to the XREF buffer=2E >+We allocate this memory after we read in the transfer function for the >+page=2E >+ >+For the first exploit - POC1, this file has 3 pages=2E For the first >page >+we allocate 2 extra extra XREF entries=2E Then for the next page 2 more >+entries=2E Then for the last page the transfer function changes and we >+allocate 4 more entries=2E >+ >+When we read the file into memory, we assume we have 4 bytes extra for >+each and every page (as per the last transfer function we read)=2E Which >+is not correct, we only have 2 bytes extra for the first 2 pages=2E As a >+result, we end up writing past the end of the buffer=2E >+ >+There are also some related issues that this also fixes=2E For example, >+TIFFGetField can return uninitalized pointer values, and the logic to >+detect a N=3D3 vs N=3D1 transfer function seemed rather strange=2E >+ >+It is also strange that we declare the transfer functions to be of >type >+float, when the standard says they are unsigned 16 bit values=2E This is >+fixed in another patch=2E >+ >+This patch will check to ensure that the N value for every transfer >+function is the same for every page=2E If this changes, we abort with an >+error=2E In theory, we should perhaps check that the transfer function >+itself is identical for every page, however we don't do that due to >the >+confusion of the type of the data in the transfer function=2E >+--- >+ libtiff/tif_dir=2Ec | 3 +++ >+ tools/tiff2pdf=2Ec | 65 >+++++++++++++++++++++++++++++++++++++------------------ >+ 2 files changed, 47 insertions(+), 21 deletions(-) >+ >+diff --git a/libtiff/tif_dir=2Ec b/libtiff/tif_dir=2Ec >+index 2ccaf448=2E=2Ecbf2b693 100644 >+--- a/libtiff/tif_dir=2Ec >++++ b/libtiff/tif_dir=2Ec >+@@ -1065,6 +1065,9 @@ _TIFFVGetField(TIFF* tif, uint32 tag, va_list >ap) >+ if (td->td_samplesperpixel - td->td_extrasamples > 1) { >+ *va_arg(ap, uint16**) =3D td->td_transferfunction[1]; >+ *va_arg(ap, uint16**) =3D td->td_transferfunction[2]; >++ } else { >++ *va_arg(ap, uint16**) =3D NULL; >++ *va_arg(ap, uint16**) =3D NULL; >+ } >+ break; >+ case TIFFTAG_REFERENCEBLACKWHITE: >+diff --git a/tools/tiff2pdf=2Ec b/tools/tiff2pdf=2Ec >+index d1a9b095=2E=2Ec3ec0746 100644 >+--- a/tools/tiff2pdf=2Ec >++++ b/tools/tiff2pdf=2Ec >+@@ -1047,6 +1047,8 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){ >+ uint16 pagen=3D0; >+ uint16 paged=3D0; >+ uint16 xuint16=3D0; >++ uint16 tiff_transferfunctioncount=3D0; >++ float* tiff_transferfunction[3]; >+=20 >+ directorycount=3DTIFFNumberOfDirectories(input); >+ t2p->tiff_pages =3D (T2P_PAGE*) >_TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE))); >+@@ -1147,26 +1149,48 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* >input){ >+ } >+ #endif >+ if (TIFFGetField(input, TIFFTAG_TRANSFERFUNCTION, >+- &(t2p->tiff_transferfunction[0]), >+- &(t2p->tiff_transferfunction[1]), >+- &(t2p->tiff_transferfunction[2]))) { >+- if((t2p->tiff_transferfunction[1] !=3D (float*) NULL) && >+- (t2p->tiff_transferfunction[2] !=3D (float*) >NULL) && >+- (t2p->tiff_transferfunction[1] !=3D >+- t2p->tiff_transferfunction[0])) { >+- t2p->tiff_transferfunctioncount =3D 3; >+- t2p->tiff_pages[i]=2Epage_extra +=3D 4; >+- t2p->pdf_xrefcount +=3D 4; >+- } else { >+- t2p->tiff_transferfunctioncount =3D 1; >+- t2p->tiff_pages[i]=2Epage_extra +=3D 2; >+- t2p->pdf_xrefcount +=3D 2; >+- } >+- if(t2p->pdf_minorversion < 2) >+- t2p->pdf_minorversion =3D 2; >++ &(tiff_transferfunction[0]), >++ &(tiff_transferfunction[1]), >++ &(tiff_transferfunction[2]))) { >++ >++ if((tiff_transferfunction[1] !=3D (float*) >NULL) && >++ (tiff_transferfunction[2] !=3D (float*) >NULL) >++ ) { >++ tiff_transferfunctioncount=3D3; >++ } else { >++ tiff_transferfunctioncount=3D1; >++ } >+ } else { >+- t2p->tiff_transferfunctioncount=3D0; >++ tiff_transferfunctioncount=3D0; >+ } >++ >++ if (i > 0){ >++ if (tiff_transferfunctioncount !=3D >t2p->tiff_transferfunctioncount){ >++ TIFFError( >++ TIFF2PDF_MODULE, >++ "Different transfer function on page %d", >++ i); >++ t2p->t2p_error =3D T2P_ERR_ERROR; >++ return; >++ } >++ } >++ >++ t2p->tiff_transferfunctioncount =3D >tiff_transferfunctioncount; >++ t2p->tiff_transferfunction[0] =3D >tiff_transferfunction[0]; >++ t2p->tiff_transferfunction[1] =3D >tiff_transferfunction[1]; >++ t2p->tiff_transferfunction[2] =3D >tiff_transferfunction[2]; >++ if(tiff_transferfunctioncount =3D=3D 3){ >++ t2p->tiff_pages[i]=2Epage_extra +=3D 4; >++ t2p->pdf_xrefcount +=3D 4; >++ if(t2p->pdf_minorversion < 2) >++ t2p->pdf_minorversion =3D 2; >++ } else if (tiff_transferfunctioncount =3D=3D 1){ >++ t2p->tiff_pages[i]=2Epage_extra +=3D 2; >++ t2p->pdf_xrefcount +=3D 2; >++ if(t2p->pdf_minorversion < 2) >++ t2p->pdf_minorversion =3D 2; >++ } >++ >+ if( TIFFGetField( >+ input,=20 >+ TIFFTAG_ICCPROFILE,=20 >+@@ -1828,9 +1852,8 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){ >+ &(t2p->tiff_transferfunction[1]), >+ &(t2p->tiff_transferfunction[2]))) { >+ if((t2p->tiff_transferfunction[1] !=3D (float*) NULL) && >+- (t2p->tiff_transferfunction[2] !=3D (float*) NULL) >&& >+- (t2p->tiff_transferfunction[1] !=3D >+- t2p->tiff_transferfunction[0])) { >++ (t2p->tiff_transferfunction[2] !=3D (float*) NULL) >++ ) { >+ t2p->tiff_transferfunctioncount=3D3; >+ } else { >+ t2p->tiff_transferfunctioncount=3D1; >+--=20 >+2=2E16=2E1 >+ --=20 Sent from my Android device with K-9 Mail=2E Please excuse my brevity=2E