← Back to branch summary

~ubuntu-branches/ubuntu/natty/tiff/natty

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2010-2065.patch

  • Committer: Bazaar Package Importer
  • Author(s): Jay Berkenbilt
  • Date: 2010-06-18 21:28:11 UTC
  • mfrom: (10.1.1 sid)
  • Revision ID: james.westby@ubuntu.com-20100618212811-3t5mffcr8gpfpuel
Tags: 3.9.4-1
New upstream release

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2010-2065.patch
1
 
Description: fix TIFFroundup integer overflow (CVE-2010-2065).
2
 
Author: Bob Friesenhahn <bfriesen@GraphicsMagick.org> and Kees Cook <kees@ubuntu.com>
3
 
 
4
 
Index: tiff-3.9.2/libtiff/tif_ojpeg.c
5
 
===================================================================
6
 
--- tiff-3.9.2.orig/libtiff/tif_ojpeg.c 2010-06-10 12:56:15.218390746 -0700
7
 
+++ tiff-3.9.2/libtiff/tif_ojpeg.c      2010-06-10 12:57:08.268390489 -0700
8
 
@@ -1909,6 +1909,10 @@
9
 
                                        sp->in_buffer_source=osibsEof;
10
 
                                else
11
 
                                {
12
 
+                                       if (sp->tif->tif_dir.td_stripoffset == 0) {
13
 
+                                               TIFFErrorExt(sp->tif->tif_clientdata,sp->tif->tif_name,"Strip offsets are missing");
14
 
+                                               return(0);
15
 
+                                       }
16
 
                                        sp->in_buffer_file_pos=sp->tif->tif_dir.td_stripoffset[sp->in_buffer_next_strile];  
17
 
                                        if (sp->in_buffer_file_pos!=0)
18
 
                                        {
19
 
Index: tiff-3.9.2/libtiff/tif_read.c
20
 
===================================================================
21
 
--- tiff-3.9.2.orig/libtiff/tif_read.c  2010-06-10 12:56:24.098391246 -0700
22
 
+++ tiff-3.9.2/libtiff/tif_read.c       2010-06-10 12:57:13.248390618 -0700
23
 
@@ -609,7 +609,7 @@
24
 
                tif->tif_rawdata = (tidata_t) _TIFFmalloc(tif->tif_rawdatasize);
25
 
                tif->tif_flags |= TIFF_MYBUFFER;
26
 
        }
27
 
-       if (tif->tif_rawdata == NULL) {
28
 
+       if ((tif->tif_rawdata == NULL) || (tif->tif_rawdatasize == 0)) {
29
 
                TIFFErrorExt(tif->tif_clientdata, module,
30
 
                    "%s: No space for data buffer at scanline %ld",
31
 
                    tif->tif_name, (long) tif->tif_row);