cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* libtiff/tif_pixarlog.c: Fix write buffer overflow in PixarLogEncode

Browse Source 
if more input samples are provided than expected by PixarLogSetupEncode.
Idea based on libtiff-CVE-2016-3990.patch from
libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with different and
simpler check. (bugzilla #2544)


invalid tests that rejected valid files. (bugzilla #2545)
This commit is contained in:
Even Rouault 2016-08-15 20:49:48 +00:00
parent 01bac25a5a
commit a71b62bcff
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ChangeLog
View File

@ -1,10 +1,18 @@
2016-08-15 Even Rouault <even.rouault at spatialys.com>
* libtiff/tif_pixarlog.c: Fix write buffer overflow in PixarLogEncode
if more input samples are provided than expected by PixarLogSetupEncode.
Idea based on libtiff-CVE-2016-3990.patch from
libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with different and
simpler check. (bugzilla #2544)
2016-08-15 Even Rouault <even.rouault at spatialys.com>
* tools/tiff2rgba.c: Fix integer overflow in size of allocated
buffer, when -b mode is enabled, that could result in out-of-bounds
write. Based initially on patch tiff-CVE-2016-3945.patch from
libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with correction for
invalid tests that rejected valid files.
invalid tests that rejected valid files. (bugzilla #2545)
2016-07-11 Even Rouault <even.rouault at spatialys.com>

9
libtiff/tif_pixarlog.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_pixarlog.c,v 1.45 2016-06-28 15:37:33 erouault Exp $ */
/* $Id: tif_pixarlog.c,v 1.46 2016-08-15 20:49:48 erouault Exp $ */
/*
* Copyright (c) 1996-1997 Sam Leffler
@ -1141,6 +1141,13 @@ PixarLogEncode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
}
llen = sp->stride * td->td_imagewidth;
/* Check against the number of elements (of size uint16) of sp->tbuf */
if( n > td->td_rowsperstrip * llen )
{
TIFFErrorExt(tif->tif_clientdata, module,
"Too many input bytes provided");
return 0;
}
for (i = 0, up = sp->tbuf; i < n; i += llen, up += llen) {
switch (sp->user_datafmt) {