From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kei Kebreau Subject: Re: [PATCH 1/1] gnu: libtiff: Fix some buffer overflows. Date: Wed, 16 Nov 2016 13:10:56 -0500 Message-ID: <8760nne1n3.fsf@openmailbox.org> References: Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:55412) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c74fv-0002f9-E7 for guix-devel@gnu.org; Wed, 16 Nov 2016 13:11:13 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c74fp-0005VV-Tp for guix-devel@gnu.org; Wed, 16 Nov 2016 13:11:11 -0500 Received: from smtp14.openmailbox.org ([62.4.1.48]:44384) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1c74fp-0005Un-Ly for guix-devel@gnu.org; Wed, 16 Nov 2016 13:11:05 -0500 In-Reply-To: (Leo Famulari's message of "Tue, 15 Nov 2016 15:28:01 -0500") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Leo Famulari writes: > * gnu/packages/patches/libtiff-uint32-overflow.patch: New file. > * gnu/local.mk (dist_patch_DATA): Add it. > * gnu/packages/image.scm (libtiff/fixed)[source]: Use it. > --- > gnu/local.mk | 1 + > gnu/packages/image.scm | 1 + > gnu/packages/patches/libtiff-uint32-overflow.patch | 102 +++++++++++++++= ++++++ > 3 files changed, 104 insertions(+) > create mode 100644 gnu/packages/patches/libtiff-uint32-overflow.patch > > diff --git a/gnu/local.mk b/gnu/local.mk > index 513bd34..1c27767 100644 > --- a/gnu/local.mk > +++ b/gnu/local.mk > @@ -670,6 +670,7 @@ dist_patch_DATA =3D \ > %D%/packages/patches/libtiff-CVE-2016-9297.patch \ > %D%/packages/patches/libtiff-oob-accesses-in-decode.patch \ > %D%/packages/patches/libtiff-oob-write-in-nextdecode.patch \ > + %D%/packages/patches/libtiff-uint32-overflow.patch \ > %D%/packages/patches/libtool-skip-tests2.patch \ > %D%/packages/patches/libunwind-CVE-2015-3239.patch \ > %D%/packages/patches/libupnp-CVE-2016-6255.patch \ > diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm > index d38344a..7458f4e 100644 > --- a/gnu/packages/image.scm > +++ b/gnu/packages/image.scm > @@ -291,6 +291,7 @@ collection of tools for doing simple manipulations of= TIFF images.") > (patches (search-patches > "libtiff-oob-accesses-in-decode.patch" > "libtiff-oob-write-in-nextdecode.patch" > + "libtiff-uint32-overflow.patch" > "libtiff-CVE-2015-8665+CVE-2015-8683.patch" > "libtiff-CVE-2016-3623.patch" > "libtiff-CVE-2016-3945.patch" > diff --git a/gnu/packages/patches/libtiff-uint32-overflow.patch b/gnu/pac= kages/patches/libtiff-uint32-overflow.patch > new file mode 100644 > index 0000000..b9b1bc2 > --- /dev/null > +++ b/gnu/packages/patches/libtiff-uint32-overflow.patch > @@ -0,0 +1,102 @@ > +Fix some buffer overflows: > + > +http://seclists.org/oss-sec/2016/q4/ > +http://bugzilla.maptools.org/show_bug.cgi?id=3D2592 > + > +2016-11-11 Even Rouault > + > + * tools/tiffcrop.c: fix multiple uint32 overflows in > + writeBufferToSeparateStrips(), writeBufferToContigTiles() and > + writeBufferToSeparateTiles() that could cause heap buffer > +overflows. > + Reported by Henri Salo from Nixu Corporation. > + Fixes http://bugzilla.maptools.org/show_bug.cgi?id=3D2592 > + > + > +/cvs/maptools/cvsroot/libtiff/ChangeLog,v <-- ChangeLog > +new revision: 1.1152; previous revision: 1.1151 > +/cvs/maptools/cvsroot/libtiff/tools/tiffcrop.c,v <-- tools/tiffcrop.c > +new revision: 1.43; previous revision: 1.42 > + > +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > +RCS file: /cvs/maptools/cvsroot/libtiff/tools/tiffcrop.c,v > +retrieving revision 1.42 > +retrieving revision 1.43 > +diff -u -r1.42 -r1.43 > +--- libtiff/tools/tiffcrop.c 14 Oct 2016 19:13:20 -0000 1.42 > ++++ libtiff/tools/tiffcrop.c 11 Nov 2016 19:33:06 -0000 1.43 > +@@ -148,6 +148,8 @@ > + #define PATH_MAX 1024 > + #endif > +=20 > ++#define TIFF_UINT32_MAX 0xFFFFFFFFU > ++ > + #ifndef streq > + #define streq(a,b) (strcmp((a),(b)) =3D=3D 0) > + #endif > +@@ -1164,7 +1166,24 @@ > + (void) TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip= ); > + (void) TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps); > + bytes_per_sample =3D (bps + 7) / 8; > +- rowsize =3D ((bps * spp * width) + 7) / 8; /* source has interleaved = samples */ > ++ if( width =3D=3D 0 || > ++ (uint32)bps * (uint32)spp > TIFF_UINT32_MAX / width || > ++ bps * spp * width > TIFF_UINT32_MAX - 7U ) > ++ { > ++ TIFFError(TIFFFileName(out), > ++ "Error, uint32 overflow when computing (bps * spp * width) = + 7"); > ++ return 1; > ++ } > ++ rowsize =3D ((bps * spp * width) + 7U) / 8; /* source has interleaved= samples */ > ++ if( bytes_per_sample =3D=3D 0 || > ++ rowsperstrip > TIFF_UINT32_MAX / bytes_per_sample || > ++ rowsperstrip * bytes_per_sample > TIFF_UINT32_MAX / (width + 1) ) > ++ { > ++ TIFFError(TIFFFileName(out), > ++ "Error, uint32 overflow when computing rowsperstrip * " > ++ "bytes_per_sample * (width + 1)"); > ++ return 1; > ++ } > + rowstripsize =3D rowsperstrip * bytes_per_sample * (width + 1);=20 > +=20 > + obuf =3D _TIFFmalloc (rowstripsize); > +@@ -1251,11 +1270,19 @@ > + } > + } > +=20 > ++ if( imagewidth =3D=3D 0 || > ++ (uint32)bps * (uint32)spp > TIFF_UINT32_MAX / imagewidth || > ++ bps * spp * imagewidth > TIFF_UINT32_MAX - 7U ) > ++ { > ++ TIFFError(TIFFFileName(out), > ++ "Error, uint32 overflow when computing (imagewidth * bps * = spp) + 7"); > ++ return 1; > ++ } > ++ src_rowsize =3D ((imagewidth * spp * bps) + 7U) / 8; > ++ > + tilebuf =3D _TIFFmalloc(tile_buffsize); > + if (tilebuf =3D=3D 0) > + return 1; > +- > +- src_rowsize =3D ((imagewidth * spp * bps) + 7) / 8; > + for (row =3D 0; row < imagelength; row +=3D tl) > + { > + nrow =3D (row + tl > imagelength) ? imagelength - row : tl; > +@@ -1315,7 +1342,16 @@ > + TIFFGetField(out, TIFFTAG_TILELENGTH, &tl); > + TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw); > + TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps); > +- src_rowsize =3D ((imagewidth * spp * bps) + 7) / 8; > ++ > ++ if( imagewidth =3D=3D 0 || > ++ (uint32)bps * (uint32)spp > TIFF_UINT32_MAX / imagewidth || > ++ bps * spp * imagewidth > TIFF_UINT32_MAX - 7 ) > ++ { > ++ TIFFError(TIFFFileName(out), > ++ "Error, uint32 overflow when computing (imagewidth * bps * = spp) + 7"); > ++ return 1; > ++ } > ++ src_rowsize =3D ((imagewidth * spp * bps) + 7U) / 8; > +=20=20=20=20=20=20=20=20=20=20 > + for (row =3D 0; row < imagelength; row +=3D tl) > + { The Guix linter tells me that ftp.remotesensing.org is not reachable. Is it reachable for you? My connection could just be bad, or the server temporarily down. Otherwise, LGTM. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJYLKEwAAoJEOal7jwZRnoNp7EP/jU3eeO0P8GWiVBxxUe4aOq5 JTU0QTgipkRGlxX1jVdU2tuNIrcdlCgG0Pwn2I0FEQw/T7601E+a3rEUSDHIEKdF TwBwI/enVX70Lbfz+Hni3cKV1m30cv0Lf7bDfOmaBkszsYm1kJFWkRTYc0TZL+w8 7hq4w8aFB9kVXhKELY8BLPYXfdcImGNkYSN92ajN8vbR2GutMI5f4Wb9k96rjvNM d0RBMmw+utwxRU4d9FodcHk5X1Dhjjmiordcg4A9fLTaUrqGH+5EXqCEl8NY7APa ZJ7OUuU6LNh1tYoe4yklD1gtpoDkYNK1u4EIr2QoVQd+32fhSOqIidt81klpBwn5 KGB8btYctRD5vKmZZ57IlBSWEptSBN2Ugu9ztQX0mMX4fyDDp881qVo7KoRQP22m VTLy2R6iNoo6Ga/np23t6dVF2XThtJ0FlRFSL94PAyDxCo1ZozjtGJcqFt3V2+uG dr0+TT/dJTUikJrlsbJk2dFKPBU+1/s0Yb3F7txNM1mZ8Ng8nZgvTucTctNEiN29 V5q+/l74+6PLR0ZuONtmIyMbkPWDV46O5v2ngznedjNUMFE4D+pKkIvAjNjsacGX CueHXK5mfOOtMfYpiuKQPXJY5t04/yeUub7XNWYBhM5WcmKpPo4lDPQNNs/DlJSG RoBDCSEV4HKbrdGkJpnX =hLGO -----END PGP SIGNATURE----- --=-=-=--