mirror of
https://git.yoctoproject.org/poky
synced 2026-06-02 13:29:49 +00:00
Mingli Yu
014af27dcb
* libtiff/tif_predict.h, libtiff/tif_predict.c: Replace assertions by runtime checks to avoid assertions in debug mode, or buffer overflows in release mode. Can happen when dealing with unusual tile size like YCbCr with subsampling. External References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9535 Patch from: https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1 https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33 (From OE-Core rev: 61d3feb9cad9f61f6551b43f4f19bfa33cadd275) (From OE-Core rev: d55b4470c20f4a4b73b1e6f148a45d94649dfdb5) (From OE-Core rev: 3f22e42b981319b1aaa15871a90753060817c911) Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
68 lines
1.8 KiB
Diff
68 lines
1.8 KiB
Diff
From 6a984bf7905c6621281588431f384e79d11a2e33 Mon Sep 17 00:00:00 2001
|
|
From: erouault <erouault>
|
|
Date: Fri, 4 Nov 2016 09:19:13 +0000
|
|
Subject: [PATCH 2/2] Fix CVE-2016-9535
|
|
* libtiff/tif_predic.c: fix memory leaks in error code
|
|
paths added in previous commit (fix for MSVR 35105)
|
|
|
|
CVE: CVE-2016-9535
|
|
Upstream-Status: Backport
|
|
https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33
|
|
|
|
Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
|
|
|
|
---
|
|
libtiff/tif_predict.c | 8 ++++++--
|
|
1 files changed, 11 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/libtiff/tif_predict.c b/libtiff/tif_predict.c
|
|
index b829259..3f42f3b 100644
|
|
--- a/libtiff/tif_predict.c
|
|
+++ b/libtiff/tif_predict.c
|
|
@@ -409,7 +409,7 @@ fpAcc(TIFF* tif, uint8* cp0, tmsize_t cc)
|
|
tmsize_t wc = cc / bps;
|
|
tmsize_t count = cc;
|
|
uint8 *cp = (uint8 *) cp0;
|
|
- uint8 *tmp = (uint8 *)_TIFFmalloc(cc);
|
|
+ uint8 *tmp;
|
|
|
|
if(cc%(bps*stride)!=0)
|
|
{
|
|
@@ -418,6 +418,7 @@ fpAcc(TIFF* tif, uint8* cp0, tmsize_t cc)
|
|
return 0;
|
|
}
|
|
|
|
+ tmp = (uint8 *)_TIFFmalloc(cc);
|
|
if (!tmp)
|
|
return 0;
|
|
|
|
@@ -640,7 +641,7 @@ fpDiff(TIFF* tif, uint8* cp0, tmsize_t cc)
|
|
tmsize_t wc = cc / bps;
|
|
tmsize_t count;
|
|
uint8 *cp = (uint8 *) cp0;
|
|
- uint8 *tmp = (uint8 *)_TIFFmalloc(cc);
|
|
+ uint8 *tmp;
|
|
|
|
if((cc%(bps*stride))!=0)
|
|
{
|
|
@@ -648,6 +649,8 @@ fpDiff(TIFF* tif, uint8* cp0, tmsize_t cc)
|
|
"%s", "(cc%(bps*stride))!=0");
|
|
return 0;
|
|
}
|
|
+
|
|
+ tmp = (uint8 *)_TIFFmalloc(cc);
|
|
if (!tmp)
|
|
return 0;
|
|
|
|
@@ -722,6 +725,7 @@ PredictorEncodeTile(TIFF* tif, uint8* bp0, tmsize_t cc0, uint16 s)
|
|
{
|
|
TIFFErrorExt(tif->tif_clientdata, "PredictorEncodeTile",
|
|
"%s", "(cc0%rowsize)!=0");
|
|
+ _TIFFfree( working_copy );
|
|
return 0;
|
|
}
|
|
while (cc > 0) {
|
|
--
|
|
2.9.3
|
|
|