all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
blob 00bebdf2042c3574c08b8df6efc48128d47dd4f0 1716 bytes (raw)
name: gnu/packages/patches/libtiff-heap-overflow.patch 	 # note: path name is non-authoritative(*)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
 
Fix a heap buffer overflow:

http://bugzilla.maptools.org/show_bug.cgi?id=2587

Patch extracted from upstream CVS repo:

2016-11-10 Even Rouault <even.rouault at spatialys.com>

revision 1.37
date: 2016-11-09 18:00:49 -0500;  author: erouault;  state: Exp;  lines: +10 -1;  commitid: pzKipPxDJO2dxvtz;
* libtiff/tif_strip.c: make TIFFNumberOfStrips() return the td->td_nstrips
value when it is non-zero, instead of recomputing it. This is needed in
TIFF_STRIPCHOP mode where td_nstrips is modified. Fixes a read outsize of
array in tiffsplit (or other utilities using TIFFNumberOfStrips()).
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2587

Index: libtiff/tif_strip.c
===================================================================
RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_strip.c,v
retrieving revision 1.36
retrieving revision 1.37
diff -u -r1.36 -r1.37
--- a/libtiff/tif_strip.c	7 Jun 2015 22:35:40 -0000	1.36
+++ b/libtiff/tif_strip.c	9 Nov 2016 23:00:49 -0000	1.37
@@ -63,6 +63,15 @@
 	TIFFDirectory *td = &tif->tif_dir;
 	uint32 nstrips;
 
+    /* If the value was already computed and store in td_nstrips, then return it,
+       since ChopUpSingleUncompressedStrip might have altered and resized the
+       since the td_stripbytecount and td_stripoffset arrays to the new value
+       after the initial affectation of td_nstrips = TIFFNumberOfStrips() in
+       tif_dirread.c ~line 3612.
+       See http://bugzilla.maptools.org/show_bug.cgi?id=2587 */
+    if( td->td_nstrips )
+        return td->td_nstrips;
+
 	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
 	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)

debug log:

solving 00bebdf ...
found 00bebdf in https://yhetil.org/guix/20161110232827.GA5592@jasmine/

applying [1/1] https://yhetil.org/guix/20161110232827.GA5592@jasmine/
diff --git a/gnu/packages/patches/libtiff-heap-overflow.patch b/gnu/packages/patches/libtiff-heap-overflow.patch
new file mode 100644
index 0000000..00bebdf

1:32: space before tab in indent.
 	TIFFDirectory *td = &tif->tif_dir;
1:33: space before tab in indent.
 	uint32 nstrips;
1:34: trailing whitespace.
 
1:44: space before tab in indent.
 	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
1:45: space before tab in indent.
 	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
Checking patch gnu/packages/patches/libtiff-heap-overflow.patch...
Applied patch gnu/packages/patches/libtiff-heap-overflow.patch cleanly.
warning: squelched 1 whitespace error
warning: 6 lines add whitespace errors.

index at:
100644 00bebdf2042c3574c08b8df6efc48128d47dd4f0	gnu/packages/patches/libtiff-heap-overflow.patch

(*) Git path names are given by the tree(s) the blob belongs to.
    Blobs themselves have no identifier aside from the hash of its contents.^

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.