|
|
- From 49723b0eb683cca80142b01a48ba1475fed5188a Mon Sep 17 00:00:00 2001
- From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
- Date: Fri, 23 Mar 2018 15:35:39 +0100
- Subject: [PATCH] Fix for bug 2772
-
- It is possible to craft a TIFF document where the IFD list is circular,
- leading to an infinite loop while traversing the chain. The libtiff
- directory reader has a failsafe that will break out of this loop after
- reading 65535 directory entries, but it will continue processing,
- consuming time and resources to process what is essentially a bogus TIFF
- document.
-
- This change fixes the above behavior by breaking out of processing when
- a TIFF document has >= 65535 directories and terminating with an error.
- ---
- contrib/addtiffo/tif_overview.c | 14 +++++++++++++-
- tools/tiff2pdf.c | 10 ++++++++++
- tools/tiffcrop.c | 13 +++++++++++--
- 3 files changed, 34 insertions(+), 3 deletions(-)
-
- diff --git a/contrib/addtiffo/tif_overview.c b/contrib/addtiffo/tif_overview.c
- index c61ffbb..03b3573 100644
- --- a/contrib/addtiffo/tif_overview.c
- +++ b/contrib/addtiffo/tif_overview.c
- @@ -65,6 +65,8 @@
- # define MAX(a,b) ((a>b) ? a : b)
- #endif
-
- +#define TIFF_DIR_MAX 65534
- +
- void TIFFBuildOverviews( TIFF *, int, int *, int, const char *,
- int (*)(double,void*), void * );
-
- @@ -91,6 +93,7 @@ uint32 TIFF_WriteOverview( TIFF *hTIFF, uint32 nXSize, uint32 nYSize,
- {
- toff_t nBaseDirOffset;
- toff_t nOffset;
- + tdir_t iNumDir;
-
- (void) bUseSubIFDs;
-
- @@ -147,7 +150,16 @@ uint32 TIFF_WriteOverview( TIFF *hTIFF, uint32 nXSize, uint32 nYSize,
- return 0;
-
- TIFFWriteDirectory( hTIFF );
- - TIFFSetDirectory( hTIFF, (tdir_t) (TIFFNumberOfDirectories(hTIFF)-1) );
- + iNumDir = TIFFNumberOfDirectories(hTIFF);
- + if( iNumDir > TIFF_DIR_MAX )
- + {
- + TIFFErrorExt( TIFFClientdata(hTIFF),
- + "TIFF_WriteOverview",
- + "File `%s' has too many directories.\n",
- + TIFFFileName(hTIFF) );
- + exit(-1);
- + }
- + TIFFSetDirectory( hTIFF, (tdir_t) (iNumDir - 1) );
-
- nOffset = TIFFCurrentDirOffset( hTIFF );
-
- diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
- index 454befb..bdb9126 100644
- --- a/tools/tiff2pdf.c
- +++ b/tools/tiff2pdf.c
- @@ -68,6 +68,8 @@ extern int getopt(int, char**, char*);
-
- #define PS_UNIT_SIZE 72.0F
-
- +#define TIFF_DIR_MAX 65534
- +
- /* This type is of PDF color spaces. */
- typedef enum {
- T2P_CS_BILEVEL = 0x01, /* Bilevel, black and white */
- @@ -1049,6 +1051,14 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
- uint16 xuint16=0;
-
- directorycount=TIFFNumberOfDirectories(input);
- + if(directorycount > TIFF_DIR_MAX) {
- + TIFFError(
- + TIFF2PDF_MODULE,
- + "TIFF contains too many directories, %s",
- + TIFFFileName(input));
- + t2p->t2p_error = T2P_ERR_ERROR;
- + return;
- + }
- t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE)));
- if(t2p->tiff_pages==NULL){
- TIFFError(
- diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
- index c69177e..c60cb38 100644
- --- a/tools/tiffcrop.c
- +++ b/tools/tiffcrop.c
- @@ -217,6 +217,8 @@ extern int getopt(int argc, char * const argv[], const char *optstring);
- #define DUMP_TEXT 1
- #define DUMP_RAW 2
-
- +#define TIFF_DIR_MAX 65534
- +
- /* Offsets into buffer for margins and fixed width and length segments */
- struct offset {
- uint32 tmargin;
- @@ -2233,7 +2235,7 @@ main(int argc, char* argv[])
- pageNum = -1;
- else
- total_images = 0;
- - /* read multiple input files and write to output file(s) */
- + /* Read multiple input files and write to output file(s) */
- while (optind < argc - 1)
- {
- in = TIFFOpen (argv[optind], "r");
- @@ -2241,7 +2243,14 @@ main(int argc, char* argv[])
- return (-3);
-
- /* If only one input file is specified, we can use directory count */
- - total_images = TIFFNumberOfDirectories(in);
- + total_images = TIFFNumberOfDirectories(in);
- + if (total_images > TIFF_DIR_MAX)
- + {
- + TIFFError (TIFFFileName(in), "File contains too many directories");
- + if (out != NULL)
- + (void) TIFFClose(out);
- + return (1);
- + }
- if (image_count == 0)
- {
- dirnum = 0;
- --
- 2.13.6
-
|
