← Back to branch summary

~ubuntu-branches/ubuntu/precise/tiff/precise-security

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2014-81xx-9.patch

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2015-03-30 08:11:18 UTC
  • Revision ID: package-import@ubuntu.com-20150330081118-bvaoaii1act27voq
Tags: 3.9.5-2ubuntu1.7
* SECURITY UPDATE: Fix multiple security issues
  - debian/patches/CVE-2014-81xx-1.patch to CVE-2014-81xx-11.patch
  - debian/patches/CVE-2014-8128-5.patch
  - debian/patches/CVE-2014-9655-1.patch to CVE-2014-9655-3.patch
  - debian/patches/read_overrun.patch
  - debian/patches/CVE-2014-8130.patch
  - CVE-2014-8127 (partially)
  - CVE-2014-8128
  - CVE-2014-8129
  - CVE-2014-8130
  - CVE-2014-9330
  - CVE-2014-9655

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2014-81xx-9.patch
 
1
Backport of:
 
2
 
 
3
From 77837423c3a125a3b39ddae246ff904f437cf845 Mon Sep 17 00:00:00 2001
 
4
From: bfriesen <bfriesen>
 
5
Date: Mon, 22 Dec 2014 02:52:38 +0000
 
6
Subject: [PATCH] * tools/tiffdump.c: Guard against arithmetic overflow when
 
7
 calculating allocation buffer sizes.
 
8
 
 
9
---
 
10
 ChangeLog        |  5 +++++
 
11
 tools/tiffdump.c | 21 ++++++++++++++++++---
 
12
 2 files changed, 23 insertions(+), 3 deletions(-)
 
13
 
 
14
Index: tiff-3.9.5/tools/tiffdump.c
 
15
===================================================================
 
16
--- tiff-3.9.5.orig/tools/tiffdump.c    2015-03-30 07:47:36.009335099 -0400
 
17
+++ tiff-3.9.5/tools/tiffdump.c 2015-03-30 07:49:47.910486251 -0400
 
18
@@ -34,6 +34,8 @@
 
19
 # include <unistd.h>
 
20
 #endif
 
21
 
 
22
+#include "tiffiop.h"
 
23
+
 
24
 #ifdef HAVE_FCNTL_H
 
25
 # include <fcntl.h>
 
26
 #endif
 
27
@@ -285,7 +287,7 @@
 
28
        }
 
29
        if (swabflag)
 
30
                TIFFSwabShort(&dircount);
 
31
-       dir = (TIFFDirEntry *)_TIFFmalloc(dircount * sizeof (TIFFDirEntry));
 
32
+       dir = (TIFFDirEntry *)_TIFFmalloc(TIFFSafeMultiply(tsize_t,dircount,sizeof (TIFFDirEntry)));
 
33
        if (dir == NULL) {
 
34
                Fatal("No space for TIFF directory");
 
35
                goto done;