* [PATCH 1/2] tiff: Security fix CVE-2016-3658
2016-11-17 8:08 [PATCH 0/2] tiff: 2 CVE fixes Yi Zhao
@ 2016-11-17 8:08 ` Yi Zhao
2016-11-17 8:08 ` [PATCH 2/2] tiff: Security fix CVE-2016-3632 Yi Zhao
1 sibling, 0 replies; 3+ messages in thread
From: Yi Zhao @ 2016-11-17 8:08 UTC (permalink / raw)
To: openembedded-core
CVE-2016-3658 libtiff: The TIFFWriteDirectoryTagLongLong8Array function
in tif_dirwrite.c in the tiffset tool in LibTIFF 4.0.6 and earlier
allows remote attackers to cause a denial of service (out-of-bounds
read) via vectors involving the ma variable.
External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3658
http://www.openwall.com/lists/oss-security/2016/04/08/12
http://bugzilla.maptools.org/show_bug.cgi?id=2546
Patch from:
https://github.com/vadz/libtiff/commit/45c68450bef8ad876f310b495165c513cad8b67d
This git repository is a mirror of libtiff cvs repository at cvs.maptools.org
created and updated using "git cvsimport".
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
.../libtiff/files/CVE-2016-3658.patch | 120 +++++++++++++++++++++
meta/recipes-multimedia/libtiff/tiff_4.0.6.bb | 1 +
2 files changed, 121 insertions(+)
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2016-3658.patch
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2016-3658.patch b/meta/recipes-multimedia/libtiff/files/CVE-2016-3658.patch
new file mode 100644
index 0000000..950c634
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2016-3658.patch
@@ -0,0 +1,120 @@
+From 45c68450bef8ad876f310b495165c513cad8b67d Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Tue, 25 Oct 2016 21:35:15 +0000
+Subject: [PATCH] * libtiff/tif_dir.c: discard values of SMinSampleValue and
+ SMaxSampleValue when they have been read and the value of SamplesPerPixel is
+ changed afterwards (like when reading a OJPEG compressed image with a missing
+ SamplesPerPixel tag, and whose photometric is RGB or YCbCr, forcing
+ SamplesPerPixel being 3). Otherwise when rewriting the directory (for example
+ with tiffset, we will expect 3 values whereas the array had been allocated
+ with just one), thus causing a out of bound read access. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2500 (CVE-2014-8127, duplicate:
+ CVE-2016-3658)
+
+* libtiff/tif_write.c: avoid null pointer dereference on td_stripoffset
+when writing directory, if FIELD_STRIPOFFSETS was artificially set
+for a hack case in OJPEG case.
+Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2500
+(CVE-2014-8127, duplicate: CVE-2016-3658)
+
+CVE: CVE-2016-3658
+Upstream-Status: Backport
+https://github.com/vadz/libtiff/commit/45c68450bef8ad876f310b495165c513cad8b67d
+
+Signed-off-by: Yi Zhao <yi.zhao@windirver.com>
+---
+ ChangeLog | 19 +++++++++++++++++++
+ libtiff/tif_dir.c | 22 ++++++++++++++++++++++
+ libtiff/tif_dirwrite.c | 16 ++++++++++++++--
+ 3 files changed, 55 insertions(+), 2 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index 375fe02..8027964 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,22 @@
++2016-10-25 Even Rouault <even.rouault at spatialys.com>
++
++ * libtiff/tif_dir.c: discard values of SMinSampleValue and
++ SMaxSampleValue when they have been read and the value of
++ SamplesPerPixel is changed afterwards (like when reading a
++ OJPEG compressed image with a missing SamplesPerPixel tag,
++ and whose photometric is RGB or YCbCr, forcing SamplesPerPixel
++ being 3). Otherwise when rewriting the directory (for example
++ with tiffset, we will expect 3 values whereas the array had been
++ allocated with just one), thus causing a out of bound read access.
++ Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2500
++ (CVE-2014-8127, duplicate: CVE-2016-3658)
++
++ * libtiff/tif_write.c: avoid null pointer dereference on td_stripoffset
++ when writing directory, if FIELD_STRIPOFFSETS was artificially set
++ for a hack case in OJPEG case.
++ Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2500
++ (CVE-2014-8127, duplicate: CVE-2016-3658)
++
+ 2016-09-24 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
+
+ * libtiff/tif_getimage.c (TIFFRGBAImageOK): Reject attempts to
+diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
+index 8073480..160c5d4 100644
+--- a/libtiff/tif_dir.c
++++ b/libtiff/tif_dir.c
+@@ -256,6 +256,28 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
+ v = (uint16) va_arg(ap, uint16_vap);
+ if (v == 0)
+ goto badvalue;
++ if( v != td->td_samplesperpixel )
++ {
++ /* See http://bugzilla.maptools.org/show_bug.cgi?id=2500 */
++ if( td->td_sminsamplevalue != NULL )
++ {
++ TIFFWarningExt(tif->tif_clientdata,module,
++ "SamplesPerPixel tag value is changing, "
++ "but SMinSampleValue tag was read with a different value. Cancelling it");
++ TIFFClrFieldBit(tif,FIELD_SMINSAMPLEVALUE);
++ _TIFFfree(td->td_sminsamplevalue);
++ td->td_sminsamplevalue = NULL;
++ }
++ if( td->td_smaxsamplevalue != NULL )
++ {
++ TIFFWarningExt(tif->tif_clientdata,module,
++ "SamplesPerPixel tag value is changing, "
++ "but SMaxSampleValue tag was read with a different value. Cancelling it");
++ TIFFClrFieldBit(tif,FIELD_SMAXSAMPLEVALUE);
++ _TIFFfree(td->td_smaxsamplevalue);
++ td->td_smaxsamplevalue = NULL;
++ }
++ }
+ td->td_samplesperpixel = (uint16) v;
+ break;
+ case TIFFTAG_ROWSPERSTRIP:
+diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c
+index 7e71818..8a3341e 100644
+--- a/libtiff/tif_dirwrite.c
++++ b/libtiff/tif_dirwrite.c
+@@ -542,8 +542,20 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
+ {
+ if (!isTiled(tif))
+ {
+- if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPOFFSETS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripoffset))
+- goto bad;
++ /* td_stripoffset might be NULL in an odd OJPEG case. See
++ * tif_dirread.c around line 3634.
++ * XXX: OJPEG hack.
++ * If a) compression is OJPEG, b) it's not a tiled TIFF,
++ * and c) the number of strips is 1,
++ * then we tolerate the absence of stripoffsets tag,
++ * because, presumably, all required data is in the
++ * JpegInterchangeFormat stream.
++ * We can get here when using tiffset on such a file.
++ * See http://bugzilla.maptools.org/show_bug.cgi?id=2500
++ */
++ if (tif->tif_dir.td_stripoffset != NULL &&
++ !TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPOFFSETS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripoffset))
++ goto bad;
+ }
+ else
+ {
+--
+2.7.4
+
diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
index 796d86e..edd560f 100644
--- a/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
@@ -15,6 +15,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
file://CVE-2016-3991.patch \
file://CVE-2016-3623.patch \
file://CVE-2016-3622.patch \
+ file://CVE-2016-3658.patch \
"
SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72"
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH 2/2] tiff: Security fix CVE-2016-3632
2016-11-17 8:08 [PATCH 0/2] tiff: 2 CVE fixes Yi Zhao
2016-11-17 8:08 ` [PATCH 1/2] tiff: Security fix CVE-2016-3658 Yi Zhao
@ 2016-11-17 8:08 ` Yi Zhao
1 sibling, 0 replies; 3+ messages in thread
From: Yi Zhao @ 2016-11-17 8:08 UTC (permalink / raw)
To: openembedded-core
CVE-2016-3632 libtiff: The _TIFFVGetField function in tif_dirinfo.c in
LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of
service (out-of-bounds write) or execute arbitrary code via a crafted
TIFF image.
External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3632
http://bugzilla.maptools.org/show_bug.cgi?id=2549
https://bugzilla.redhat.com/show_bug.cgi?id=1325095
The patch is from RHEL7.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
.../libtiff/files/CVE-2016-3632.patch | 34 ++++++++++++++++++++++
meta/recipes-multimedia/libtiff/tiff_4.0.6.bb | 1 +
2 files changed, 35 insertions(+)
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2016-3632.patch
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2016-3632.patch b/meta/recipes-multimedia/libtiff/files/CVE-2016-3632.patch
new file mode 100644
index 0000000..a839250
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/files/CVE-2016-3632.patch
@@ -0,0 +1,34 @@
+From d3f9829a37661749b200760ad6525f77cf77d77a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
+Date: Mon, 11 Jul 2016 16:04:34 +0200
+Subject: [PATCH 4/8] Fix CVE-2016-3632
+
+CVE-2016-3632 libtiff: The _TIFFVGetField function in tif_dirinfo.c in
+LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service
+(out-of-bounds write) or execute arbitrary code via a crafted TIFF image.
+
+CVE: CVE-2016-3632
+Upstream-Status: Backport [RedHat RHEL7]
+
+Signed-off-by: Yi Zhao <yi.zhao@windirver.com>
+---
+ tools/thumbnail.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/thumbnail.c b/tools/thumbnail.c
+index fd1cba5..75e7009 100644
+--- a/tools/thumbnail.c
++++ b/tools/thumbnail.c
+@@ -253,7 +253,8 @@ static struct cpTag {
+ { TIFFTAG_WHITEPOINT, 2, TIFF_RATIONAL },
+ { TIFFTAG_PRIMARYCHROMATICITIES, (uint16) -1,TIFF_RATIONAL },
+ { TIFFTAG_HALFTONEHINTS, 2, TIFF_SHORT },
+- { TIFFTAG_BADFAXLINES, 1, TIFF_LONG },
++ // disable BADFAXLINES, CVE-2016-3632
++ //{ TIFFTAG_BADFAXLINES, 1, TIFF_LONG },
+ { TIFFTAG_CLEANFAXDATA, 1, TIFF_SHORT },
+ { TIFFTAG_CONSECUTIVEBADFAXLINES, 1, TIFF_LONG },
+ { TIFFTAG_INKSET, 1, TIFF_SHORT },
+--
+2.7.4
+
diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
index edd560f..9b4aff3 100644
--- a/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.0.6.bb
@@ -16,6 +16,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
file://CVE-2016-3623.patch \
file://CVE-2016-3622.patch \
file://CVE-2016-3658.patch \
+ file://CVE-2016-3632.patch \
"
SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72"
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread