Signed-off-by: Jiri Slachta <jiri@slachta.eu>lilik-openwrt-22.03
@ -1,37 +0,0 @@ | |||||
From 802d3cbf3043be5dce5317e140ccb1c17a6a2d39 Mon Sep 17 00:00:00 2001 | |||||
From: Thomas Bernard <miniupnp@free.fr> | |||||
Date: Tue, 29 Jan 2019 11:21:47 +0100 | |||||
Subject: [PATCH] TIFFWriteDirectoryTagTransferfunction() : fix NULL | |||||
dereferencing | |||||
http://bugzilla.maptools.org/show_bug.cgi?id=2833 | |||||
we must check the pointer is not NULL before memcmp() the memory | |||||
--- | |||||
libtiff/tif_dirwrite.c | 6 ++++-- | |||||
1 file changed, 4 insertions(+), 2 deletions(-) | |||||
diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c | |||||
index c15a28db..ef30c869 100644 | |||||
--- a/libtiff/tif_dirwrite.c | |||||
+++ b/libtiff/tif_dirwrite.c | |||||
@@ -1893,12 +1893,14 @@ TIFFWriteDirectoryTagTransferfunction(TIFF* tif, uint32* ndir, TIFFDirEntry* dir | |||||
n=3; | |||||
if (n==3) | |||||
{ | |||||
- if (!_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16))) | |||||
+ if (tif->tif_dir.td_transferfunction[2] == NULL || | |||||
+ !_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16))) | |||||
n=2; | |||||
} | |||||
if (n==2) | |||||
{ | |||||
- if (!_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[1],m*sizeof(uint16))) | |||||
+ if (tif->tif_dir.td_transferfunction[1] == NULL || | |||||
+ !_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[1],m*sizeof(uint16))) | |||||
n=1; | |||||
} | |||||
if (n==0) | |||||
-- | |||||
2.18.1 | |||||
@ -1,49 +0,0 @@ | |||||
From 0c74a9f49b8d7a36b17b54a7428b3526d20f88a8 Mon Sep 17 00:00:00 2001 | |||||
From: Scott Gayou <github.scott@gmail.com> | |||||
Date: Wed, 23 Jan 2019 15:03:53 -0500 | |||||
Subject: [PATCH] Fix for simple memory leak that was assigned CVE-2019-6128. | |||||
pal2rgb failed to free memory on a few errors. This was reported | |||||
here: http://bugzilla.maptools.org/show_bug.cgi?id=2836. | |||||
--- | |||||
tools/pal2rgb.c | 7 ++++++- | |||||
1 file changed, 6 insertions(+), 1 deletion(-) | |||||
diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c | |||||
index 01d8502e..9492f1cf 100644 | |||||
--- a/tools/pal2rgb.c | |||||
+++ b/tools/pal2rgb.c | |||||
@@ -118,12 +118,14 @@ main(int argc, char* argv[]) | |||||
shortv != PHOTOMETRIC_PALETTE) { | |||||
fprintf(stderr, "%s: Expecting a palette image.\n", | |||||
argv[optind]); | |||||
+ (void) TIFFClose(in); | |||||
return (-1); | |||||
} | |||||
if (!TIFFGetField(in, TIFFTAG_COLORMAP, &rmap, &gmap, &bmap)) { | |||||
fprintf(stderr, | |||||
"%s: No colormap (not a valid palette image).\n", | |||||
argv[optind]); | |||||
+ (void) TIFFClose(in); | |||||
return (-1); | |||||
} | |||||
bitspersample = 0; | |||||
@@ -131,11 +133,14 @@ main(int argc, char* argv[]) | |||||
if (bitspersample != 8) { | |||||
fprintf(stderr, "%s: Sorry, can only handle 8-bit images.\n", | |||||
argv[optind]); | |||||
+ (void) TIFFClose(in); | |||||
return (-1); | |||||
} | |||||
out = TIFFOpen(argv[optind+1], "w"); | |||||
- if (out == NULL) | |||||
+ if (out == NULL) { | |||||
+ (void) TIFFClose(in); | |||||
return (-2); | |||||
+ } | |||||
cpTags(in, out); | |||||
TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &imagewidth); | |||||
TIFFGetField(in, TIFFTAG_IMAGELENGTH, &imagelength); | |||||
-- | |||||
2.18.1 | |||||