mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-07 16:59:22 +00:00
Code Issues Projects Releases Wiki Activity

tiff: Fix CVE-2025-8961

Browse Source 
Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/0ac97aa7a5bffddd88f7cdbe517264e9db3f5bd5

(From OE-Core rev: 8d956d80f0eae39f9de68c0cd5a361c69b47cda4)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Vijay Anusuri
2025-10-07 13:06:03 +05:30
committed by Steve Sakoman
parent 4ef41425c6
commit 4a1254610c
2 changed files with 75 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-multimedia/libtiff/tiff/CVE-2025-8961.patch
+74
View File
@@ -0,0 +1,74 @@
From 0ac97aa7a5bffddd88f7cdbe517264e9db3f5bd5 Mon Sep 17 00:00:00 2001
From: Lee Howard <faxguy@howardsilvan.com>
Date: Fri, 5 Sep 2025 21:42:35 +0000
Subject: [PATCH] tiffcrop: fix double-free and memory leak exposed by issue
#721
Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/0ac97aa7a5bffddd88f7cdbe517264e9db3f5bd5]
CVE: CVE-2025-8961
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
tools/tiffcrop.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index e16bc2d..c7d2553 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -929,6 +929,7 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf,
TIFFError("readContigTilesIntoBuffer",
"Unable to extract row %"PRIu32" from tile %"PRIu32,
row, TIFFCurrentTile(in));
+ _TIFFfree(tilebuf);
return 1;
}
break;
@@ -943,6 +944,7 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf,
TIFFError("readContigTilesIntoBuffer",
"Unable to extract row %"PRIu32" from tile %"PRIu32,
row, TIFFCurrentTile(in));
+ _TIFFfree(tilebuf);
return 1;
}
break;
@@ -957,6 +959,7 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf,
TIFFError("readContigTilesIntoBuffer",
"Unable to extract row %"PRIu32" from tile %"PRIu32,
row, TIFFCurrentTile(in));
+ _TIFFfree(tilebuf);
return 1;
}
break;
@@ -969,6 +972,7 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf,
TIFFError("readContigTilesIntoBuffer",
"Unable to extract row %"PRIu32" from tile %"PRIu32,
row, TIFFCurrentTile(in));
+ _TIFFfree(tilebuf);
return 1;
}
break;
@@ -983,10 +987,12 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf,
TIFFError("readContigTilesIntoBuffer",
"Unable to extract row %"PRIu32" from tile %"PRIu32,
row, TIFFCurrentTile(in));
+ _TIFFfree(tilebuf);
return 1;
}
break;
default: TIFFError("readContigTilesIntoBuffer", "Unsupported bit depth %"PRIu16, bps);
+ _TIFFfree(tilebuf);
return 1;
}
}
@@ -2535,7 +2541,7 @@ main(int argc, char* argv[])
}
/* If we did not use the read buffer as the crop buffer */
- if (read_buff)
+ if (read_buff && read_buff != crop_buff)
_TIFFfree(read_buff);
if (crop_buff)
--
2.25.1
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb
+1
View File
@@ -63,6 +63,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
file://CVE-2025-8534.patch \
file://CVE-2025-8851.patch \
file://CVE-2025-9900.patch \
file://CVE-2025-8961.patch \
"
SRC_URI[sha256sum] = "0e46e5acb087ce7d1ac53cf4f56a09b221537fc86dfc5daaad1c2e89e1b37ac8"