← Back to branch summary

~ubuntu-branches/ubuntu/hardy/tiff/hardy-updates

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2010-1411.patch

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2012-04-02 12:15:45 UTC
  • Revision ID: package-import@ubuntu.com-20120402121545-4v7622mmp6box103
Tags: 3.8.2-7ubuntu3.10
* SECURITY UPDATE: denial of service and possible code execution via
  tiffdump
  - debian/patches/z_CVE-2010-4665.patch: prevent integer overflow in
    tools/tiffdump.c.
  - CVE-2010-4665
* SECURITY UPDATE: arbitrary code execution via size overflow
  - debian/patches/z_CVE-2012-1173.patch: use TIFFSafeMultiply in
    libtiff/tif_getimage.c, fix TIFFSafeMultiply in libtiff/tiffiop.h.
  - CVE-2012-1173
* debian/patches/CVE-2010-1411.patch: updated to use actual upstream fix
  and to get TIFFSafeMultiply macro.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2010-1411.patch
1
 
Description: fix integer overflow in use of TIFFroundup (CVE-2010-1411)
2
 
Author: Tomas Hoger <thoger@redhat.com>
 
1
Description: fix integer overflows, introduce TIFFSafeMultiply
 
2
Origin: backported from libtiff 3.9.4
3
3
 
4
 
Index: tiff-3.8.2/libtiff/tif_fax3.c
5
 
===================================================================
6
 
--- tiff-3.8.2.orig/libtiff/tif_fax3.c  2010-06-10 18:09:58.779641597 -0700
7
 
+++ tiff-3.8.2/libtiff/tif_fax3.c       2010-06-10 18:11:50.949640612 -0700
8
 
@@ -491,7 +491,16 @@
 
4
diff -Naur tiff-3.8.2.ori/libtiff/tif_fax3.c tiff-3.8.2/libtiff/tif_fax3.c
 
5
--- tiff-3.8.2.ori/libtiff/tif_fax3.c   2012-04-02 11:57:19.010090410 -0400
 
6
+++ tiff-3.8.2/libtiff/tif_fax3.c       2012-04-02 12:01:32.918087990 -0400
 
7
@@ -491,10 +491,27 @@
9
8
            td->td_compression == COMPRESSION_CCITTFAX4
10
9
        );
11
10
 
12
11
-       nruns = needsRefLine ? 2*TIFFroundup(rowpixels,32) : rowpixels;
 
12
+       /*
 
13
+         Assure that allocation computations do not overflow.
 
14
+  
 
15
+         TIFFroundup and TIFFSafeMultiply return zero on integer overflow
 
16
+       */
 
17
+       dsp->runs=(uint32*) NULL;
 
18
+       nruns = TIFFroundup(rowpixels,32);
13
19
+       if (needsRefLine) {
14
 
+               /* integer overflow check */
15
 
+               if ((uint32)rowpixels > 0xffffffff - 32 || TIFFroundup(rowpixels,32) > 0xffffffff / 2)
16
 
+                       return (0);
17
 
+               nruns = 2*TIFFroundup(rowpixels,32);
18
 
+       } else
19
 
+               nruns = rowpixels;
20
 
+       /* integer overflow check */
21
 
+       if (nruns > (0xffffffff - 3) / 2)
 
20
+               nruns = TIFFSafeMultiply(uint32,nruns,2);
 
21
+       }
 
22
+       if ((nruns == 0) || (TIFFSafeMultiply(uint32,nruns,2) == 0)) {
 
23
+               TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
 
24
+                            "Row pixels integer overflow (rowpixels %u)",
 
25
+                            rowpixels);
22
26
+               return (0);
23
 
 
24
 
        dsp->runs = (uint32*) _TIFFCheckMalloc(tif, 2*nruns+3, sizeof (uint32),
25
 
                                          "for Group 3/4 run arrays");
 
27
+       }
 
28
+       dsp->runs = (uint32*) _TIFFCheckMalloc(tif,
 
29
+                                              TIFFSafeMultiply(uint32,nruns,2),
 
30
+                                              sizeof (uint32),
 
31
+                                              "for Group 3/4 run arrays");
 
32
 
 
33
-       dsp->runs = (uint32*) _TIFFCheckMalloc(tif, 2*nruns+3, sizeof (uint32),
 
34
-                                         "for Group 3/4 run arrays");
 
35
        if (dsp->runs == NULL)
 
36
                return (0);
 
37
        dsp->curruns = dsp->runs;
 
38
diff -Naur tiff-3.8.2.ori/libtiff/tiffiop.h tiff-3.8.2/libtiff/tiffiop.h
 
39
--- tiff-3.8.2.ori/libtiff/tiffiop.h    2006-03-21 11:42:50.000000000 -0500
 
40
+++ tiff-3.8.2/libtiff/tiffiop.h        2012-04-02 11:58:04.838089974 -0400
 
41
@@ -222,10 +222,15 @@
 
42
 #endif
 
43
 
 
44
 /* NB: the uint32 casts are to silence certain ANSI-C compilers */
 
45
-#define TIFFhowmany(x, y) ((((uint32)(x))+(((uint32)(y))-1))/((uint32)(y)))
 
46
+#define TIFFhowmany(x, y) (((uint32)x < (0xffffffff - (uint32)(y-1))) ?        \
 
47
+                          ((((uint32)(x))+(((uint32)(y))-1))/((uint32)(y))) : \
 
48
+                          0U)
 
49
 #define TIFFhowmany8(x) (((x)&0x07)?((uint32)(x)>>3)+1:(uint32)(x)>>3)
 
50
 #define        TIFFroundup(x, y) (TIFFhowmany(x,y)*(y))
 
51
 
 
52
+/* Safe multiply which returns zero if there is an integer overflow */
 
53
+#define TIFFSafeMultiply(t,v,m) ((((t)m != (t)0) && (((t)((v*m)/m)) == (t)v)) ? (t)(v*m) : (t)0)
 
54
+
 
55
 #define TIFFmax(A,B) ((A)>(B)?(A):(B))
 
56
 #define TIFFmin(A,B) ((A)<(B)?(A):(B))
 
57