You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

136 lines
5.0 KiB

  1. From f3f0cad770593eaef0766e5be896a6a034fc6313 Mon Sep 17 00:00:00 2001
  2. From: erouault <erouault>
  3. Date: Sat, 26 Dec 2015 17:32:03 +0000
  4. Subject: [PATCH] * libtiff/tif_getimage.c: fix out-of-bound reads in
  5. TIFFRGBAImage interface in case of unsupported values of
  6. SamplesPerPixel/ExtraSamples for LogLUV / CIELab. Add explicit call to
  7. TIFFRGBAImageOK() in TIFFRGBAImageBegin(). Fix CVE-2015-8665 reported by
  8. limingxing and CVE-2015-8683 reported by zzf of Alibaba.
  9. ---
  10. ChangeLog | 8 ++++++++
  11. libtiff/tif_getimage.c | 37 +++++++++++++++++++++++--------------
  12. 2 files changed, 31 insertions(+), 14 deletions(-)
  13. diff --git a/ChangeLog b/ChangeLog
  14. index a7d283a..4beb30b 100644
  15. --- a/ChangeLog
  16. +++ b/ChangeLog
  17. @@ -1,3 +1,11 @@
  18. +2015-12-26 Even Rouault <even.rouault at spatialys.com>
  19. +
  20. + * libtiff/tif_getimage.c: fix out-of-bound reads in TIFFRGBAImage
  21. + interface in case of unsupported values of SamplesPerPixel/ExtraSamples
  22. + for LogLUV / CIELab. Add explicit call to TIFFRGBAImageOK() in
  23. + TIFFRGBAImageBegin(). Fix CVE-2015-8665 reported by limingxing and
  24. + CVE-2015-8683 reported by zzf of Alibaba.
  25. +
  26. 2015-09-12 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
  27. * libtiff 4.0.6 released.
  28. diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
  29. index fd0a4f9..fae1e31 100644
  30. --- a/libtiff/tif_getimage.c
  31. +++ b/libtiff/tif_getimage.c
  32. @@ -1,4 +1,4 @@
  33. -/* $Id: tif_getimage.c,v 1.90 2015-06-17 01:34:08 bfriesen Exp $ */
  34. +/* $Id: tif_getimage.c,v 1.94 2015-12-26 17:32:03 erouault Exp $ */
  35. /*
  36. * Copyright (c) 1991-1997 Sam Leffler
  37. @@ -182,20 +182,22 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
  38. "Planarconfiguration", td->td_planarconfig);
  39. return (0);
  40. }
  41. - if( td->td_samplesperpixel != 3 )
  42. + if( td->td_samplesperpixel != 3 || colorchannels != 3 )
  43. {
  44. sprintf(emsg,
  45. - "Sorry, can not handle image with %s=%d",
  46. - "Samples/pixel", td->td_samplesperpixel);
  47. + "Sorry, can not handle image with %s=%d, %s=%d",
  48. + "Samples/pixel", td->td_samplesperpixel,
  49. + "colorchannels", colorchannels);
  50. return 0;
  51. }
  52. break;
  53. case PHOTOMETRIC_CIELAB:
  54. - if( td->td_samplesperpixel != 3 || td->td_bitspersample != 8 )
  55. + if( td->td_samplesperpixel != 3 || colorchannels != 3 || td->td_bitspersample != 8 )
  56. {
  57. sprintf(emsg,
  58. - "Sorry, can not handle image with %s=%d and %s=%d",
  59. + "Sorry, can not handle image with %s=%d, %s=%d and %s=%d",
  60. "Samples/pixel", td->td_samplesperpixel,
  61. + "colorchannels", colorchannels,
  62. "Bits/sample", td->td_bitspersample);
  63. return 0;
  64. }
  65. @@ -255,6 +257,9 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int stop, char emsg[1024])
  66. int colorchannels;
  67. uint16 *red_orig, *green_orig, *blue_orig;
  68. int n_color;
  69. +
  70. + if( !TIFFRGBAImageOK(tif, emsg) )
  71. + return 0;
  72. /* Initialize to normal values */
  73. img->row_offset = 0;
  74. @@ -2508,29 +2513,33 @@ PickContigCase(TIFFRGBAImage* img)
  75. case PHOTOMETRIC_RGB:
  76. switch (img->bitspersample) {
  77. case 8:
  78. - if (img->alpha == EXTRASAMPLE_ASSOCALPHA)
  79. + if (img->alpha == EXTRASAMPLE_ASSOCALPHA &&
  80. + img->samplesperpixel >= 4)
  81. img->put.contig = putRGBAAcontig8bittile;
  82. - else if (img->alpha == EXTRASAMPLE_UNASSALPHA)
  83. + else if (img->alpha == EXTRASAMPLE_UNASSALPHA &&
  84. + img->samplesperpixel >= 4)
  85. {
  86. if (BuildMapUaToAa(img))
  87. img->put.contig = putRGBUAcontig8bittile;
  88. }
  89. - else
  90. + else if( img->samplesperpixel >= 3 )
  91. img->put.contig = putRGBcontig8bittile;
  92. break;
  93. case 16:
  94. - if (img->alpha == EXTRASAMPLE_ASSOCALPHA)
  95. + if (img->alpha == EXTRASAMPLE_ASSOCALPHA &&
  96. + img->samplesperpixel >=4 )
  97. {
  98. if (BuildMapBitdepth16To8(img))
  99. img->put.contig = putRGBAAcontig16bittile;
  100. }
  101. - else if (img->alpha == EXTRASAMPLE_UNASSALPHA)
  102. + else if (img->alpha == EXTRASAMPLE_UNASSALPHA &&
  103. + img->samplesperpixel >=4 )
  104. {
  105. if (BuildMapBitdepth16To8(img) &&
  106. BuildMapUaToAa(img))
  107. img->put.contig = putRGBUAcontig16bittile;
  108. }
  109. - else
  110. + else if( img->samplesperpixel >=3 )
  111. {
  112. if (BuildMapBitdepth16To8(img))
  113. img->put.contig = putRGBcontig16bittile;
  114. @@ -2539,7 +2548,7 @@ PickContigCase(TIFFRGBAImage* img)
  115. }
  116. break;
  117. case PHOTOMETRIC_SEPARATED:
  118. - if (buildMap(img)) {
  119. + if (img->samplesperpixel >=4 && buildMap(img)) {
  120. if (img->bitspersample == 8) {
  121. if (!img->Map)
  122. img->put.contig = putRGBcontig8bitCMYKtile;
  123. @@ -2635,7 +2644,7 @@ PickContigCase(TIFFRGBAImage* img)
  124. }
  125. break;
  126. case PHOTOMETRIC_CIELAB:
  127. - if (buildMap(img)) {
  128. + if (img->samplesperpixel == 3 && buildMap(img)) {
  129. if (img->bitspersample == 8)
  130. img->put.contig = initCIELabConversion(img);
  131. break;