From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Libtiff buffer overflow fix Date: Thu, 10 Nov 2016 18:28:27 -0500 Message-ID: <20161110232827.GA5592@jasmine> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="yNb1oOkm5a9FJOVX" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:59100) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c4ylm-0004re-TE for guix-devel@gnu.org; Thu, 10 Nov 2016 18:28:36 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c4yli-0001va-JZ for guix-devel@gnu.org; Thu, 10 Nov 2016 18:28:34 -0500 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:41762) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1c4yli-0001tT-Dy for guix-devel@gnu.org; Thu, 10 Nov 2016 18:28:30 -0500 Received: from localhost (c-76-124-102-142.hsd1.pa.comcast.net [76.124.102.142]) by mail.messagingengine.com (Postfix) with ESMTPA id 74A5825085 for ; Thu, 10 Nov 2016 18:28:28 -0500 (EST) Content-Disposition: inline List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org --yNb1oOkm5a9FJOVX Content-Type: multipart/mixed; boundary="8t9RHnE3ZwKMSgU+" Content-Disposition: inline --8t9RHnE3ZwKMSgU+ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline This patch fixes a buffer overflow in libtiff: http://bugzilla.maptools.org/show_bug.cgi?id=2587 http://seclists.org/oss-sec/2016/q4/381 There is no CVE ID assigned yet. --8t9RHnE3ZwKMSgU+ Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="0001-gnu-libtiff-Fix-a-buffer-overflow.patch" Content-Transfer-Encoding: quoted-printable =46rom 5f6d86c83f100ca366a9055dfe30b2e3f0cdf0a9 Mon Sep 17 00:00:00 2001 =46rom: Leo Famulari Date: Thu, 10 Nov 2016 18:23:57 -0500 Subject: [PATCH] gnu: libtiff: Fix a buffer overflow. * gnu/packages/patches/libtiff-heap-overflow.patch: New patch. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/image.scm (libtiff/fixed): Use it. --- gnu/local.mk | 1 + gnu/packages/image.scm | 1 + gnu/packages/patches/libtiff-heap-overflow.patch | 40 ++++++++++++++++++++= ++++ 3 files changed, 42 insertions(+) create mode 100644 gnu/packages/patches/libtiff-heap-overflow.patch diff --git a/gnu/local.mk b/gnu/local.mk index b3a4cd5..6f8ad14 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -654,6 +654,7 @@ dist_patch_DATA =3D \ %D%/packages/patches/libssh-0.6.5-CVE-2016-0739.patch \ %D%/packages/patches/libtar-CVE-2013-4420.patch \ %D%/packages/patches/libtheora-config-guess.patch \ + %D%/packages/patches/libtiff-heap-overflow.patch \ %D%/packages/patches/libtiff-CVE-2015-8665+CVE-2015-8683.patch \ %D%/packages/patches/libtiff-CVE-2016-3623.patch \ %D%/packages/patches/libtiff-CVE-2016-3945.patch \ diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index 601e818..313c265 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -284,6 +284,7 @@ collection of tools for doing simple manipulations of T= IFF images.") (patches (search-patches "libtiff-oob-accesses-in-decode.patch" "libtiff-oob-write-in-nextdecode.patch" + "libtiff-heap-overflow.patch" "libtiff-CVE-2015-8665+CVE-2015-8683.patch" "libtiff-CVE-2016-3623.patch" "libtiff-CVE-2016-3945.patch" diff --git a/gnu/packages/patches/libtiff-heap-overflow.patch b/gnu/package= s/patches/libtiff-heap-overflow.patch new file mode 100644 index 0000000..00bebdf --- /dev/null +++ b/gnu/packages/patches/libtiff-heap-overflow.patch @@ -0,0 +1,40 @@ +Fix a heap buffer overflow: + +http://bugzilla.maptools.org/show_bug.cgi?id=3D2587 + +Patch extracted from upstream CVS repo: + +2016-11-10 Even Rouault + +revision 1.37 +date: 2016-11-09 18:00:49 -0500; author: erouault; state: Exp; lines: += 10 -1; commitid: pzKipPxDJO2dxvtz; +* libtiff/tif_strip.c: make TIFFNumberOfStrips() return the td->td_nstrips +value when it is non-zero, instead of recomputing it. This is needed in +TIFF_STRIPCHOP mode where td_nstrips is modified. Fixes a read outsize of +array in tiffsplit (or other utilities using TIFFNumberOfStrips()). +Fixes http://bugzilla.maptools.org/show_bug.cgi?id=3D2587 + +Index: libtiff/tif_strip.c +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D +RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_strip.c,v +retrieving revision 1.36 +retrieving revision 1.37 +diff -u -r1.36 -r1.37 +--- a/libtiff/tif_strip.c 7 Jun 2015 22:35:40 -0000 1.36 ++++ b/libtiff/tif_strip.c 9 Nov 2016 23:00:49 -0000 1.37 +@@ -63,6 +63,15 @@ + TIFFDirectory *td =3D &tif->tif_dir; + uint32 nstrips; +=20 ++ /* If the value was already computed and store in td_nstrips, then re= turn it, ++ since ChopUpSingleUncompressedStrip might have altered and resized= the ++ since the td_stripbytecount and td_stripoffset arrays to the new v= alue ++ after the initial affectation of td_nstrips =3D TIFFNumberOfStrips= () in ++ tif_dirread.c ~line 3612. ++ See http://bugzilla.maptools.org/show_bug.cgi?id=3D2587 */ ++ if( td->td_nstrips ) ++ return td->td_nstrips; ++ + nstrips =3D (td->td_rowsperstrip =3D=3D (uint32) -1 ? 1 : + TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip)); + if (td->td_planarconfig =3D=3D PLANARCONFIG_SEPARATE) --=20 2.10.2 --8t9RHnE3ZwKMSgU+-- --yNb1oOkm5a9FJOVX Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJYJQKbAAoJECZG+jC6yn8IXowQAJV3owpPTp3pcbSrz/2EzcxJ Em68wkXVQp8OVJnrdRdBr/oWiQwknakY6bX2LylhE0aUOeYxQNP4Iqc4bYYotJTn 1/2R0OH3ZdIJExxK7kf9CwKw6tFdspcpXRecT7JBUoPo6hdlNwFu09ih6ubwUVxx GnFoVPVf9A85xO3VW/ctWZ3/nBveZFkT1N7d52FypzDxpk/CQUfduCNTInSEdDMb oZCg2lVqqTUya0MVl0E7nW66so7WH/e6lHwEVcepM3RPJFk0e2XzH1Y1344dvqSK xAhHUhPxzy4xMCUx/6hKBPpilD9ogoBe7l9ubCdi1boEyxyw0JKcylD0YbvtrwNl g9fiEjh8ZN65B0ekZQQVhYY9PGeLZhtbuNoXtHXj96CDfSHV4kZ1EijG3kuyNYtl ohM0PTh/Qw3fpCsJRJden//Ph6YA4Xf95wQEOy+oqZlYz5kxyGH55v9gQCufq0rm PMDynOS7Pd4hybmxTK7OFoXoiNzz2T8TzPtFNAokEfcXxw94lY34F4WomSsGsfNv wMlsOxjVh5GNYoqQGkAUkQwQI1kwGL2mw3aLQFs8LV+PbKRP8Z+IpN0q2R5/fBaF o918jZY8ReVEM9MKsIbSoNsUc1H+cSagj4Xg0vT5EJ89zrcJz1SAJZqrOZBLTAat 32+gCLM6eNXwUyttVEP0 =FQN5 -----END PGP SIGNATURE----- --yNb1oOkm5a9FJOVX--