← Back to branch summary

~ubuntu-branches/ubuntu/vivid/tiff/vivid-proposed

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2013-1960.patch

  • Committer: Package Import Robot
  • Author(s): Michael Gilbert
  • Date: 2013-06-17 01:27:17 UTC
  • Revision ID: package-import@ubuntu.com-20130617012717-s4yksbuv0ri97x5g
Tags: 4.0.2-6+nmu1
http://bugs.debian.org/706675
http://bugs.debian.org/706674
* Non-maintainer upload by the Security Team.
* Fix cve-2013-1960: heap-based buffer overlow in tiff2pdf
  (closes: #706675).
* Fix cve-2013-1961: stack-based buffer overflow in tiff2pdf
  (closes: #706674). 

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2013-1960.patch
 
1
--- tiff-4.0.2.orig/tools/tiff2pdf.c
 
2
+++ tiff-4.0.2/tools/tiff2pdf.c
 
3
@@ -3340,33 +3340,56 @@ int t2p_process_jpeg_strip(
 
4
        uint32 height){
 
5
 
 
6
        tsize_t i=0;
 
7
-       uint16 ri =0;
 
8
-       uint16 v_samp=1;
 
9
-       uint16 h_samp=1;
 
10
-       int j=0;
 
11
-       
 
12
-       i++;
 
13
-       
 
14
-       while(i<(*striplength)){
 
15
+
 
16
+       while (i < *striplength) {
 
17
+               tsize_t datalen;
 
18
+               uint16 ri;
 
19
+               uint16 v_samp;
 
20
+               uint16 h_samp;
 
21
+               int j;
 
22
+               int ncomp;
 
23
+
 
24
+               /* marker header: one or more FFs */
 
25
+               if (strip[i] != 0xff)
 
26
+                       return(0);
 
27
+               i++;
 
28
+               while (i < *striplength && strip[i] == 0xff)
 
29
+                       i++;
 
30
+               if (i >= *striplength)
 
31
+                       return(0);
 
32
+               /* SOI is the only pre-SOS marker without a length word */
 
33
+               if (strip[i] == 0xd8)
 
34
+                       datalen = 0;
 
35
+               else {
 
36
+                       if ((*striplength - i) <= 2)
 
37
+                               return(0);
 
38
+                       datalen = (strip[i+1] << 8) | strip[i+2];
 
39
+                       if (datalen < 2 || datalen >= (*striplength - i))
 
40
+                               return(0);
 
41
+               }
 
42
                switch( strip[i] ){
 
43
-                       case 0xd8:
 
44
-                               /* SOI - start of image */
 
45
+                       case 0xd8:      /* SOI - start of image */
 
46
                                _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), 2);
 
47
                                *bufferoffset+=2;
 
48
-                               i+=2;
 
49
                                break;
 
50
-                       case 0xc0:
 
51
-                       case 0xc1:
 
52
-                       case 0xc3:
 
53
-                       case 0xc9:
 
54
-                       case 0xca:
 
55
+                       case 0xc0:      /* SOF0 */
 
56
+                       case 0xc1:      /* SOF1 */
 
57
+                       case 0xc3:      /* SOF3 */
 
58
+                       case 0xc9:      /* SOF9 */
 
59
+                       case 0xca:      /* SOF10 */
 
60
                                if(no==0){
 
61
-                                       _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
 
62
-                                       for(j=0;j<buffer[*bufferoffset+9];j++){
 
63
-                                               if( (buffer[*bufferoffset+11+(2*j)]>>4) > h_samp) 
 
64
-                                                       h_samp = (buffer[*bufferoffset+11+(2*j)]>>4);
 
65
-                                               if( (buffer[*bufferoffset+11+(2*j)] & 0x0f) > v_samp) 
 
66
-                                                       v_samp = (buffer[*bufferoffset+11+(2*j)] & 0x0f);
 
67
+                                       _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
 
68
+                                       ncomp = buffer[*bufferoffset+9];
 
69
+                                       if (ncomp < 1 || ncomp > 4)
 
70
+                                               return(0);
 
71
+                                       v_samp=1;
 
72
+                                       h_samp=1;
 
73
+                                       for(j=0;j<ncomp;j++){
 
74
+                                               uint16 samp = buffer[*bufferoffset+11+(3*j)];
 
75
+                                               if( (samp>>4) > h_samp) 
 
76
+                                                       h_samp = (samp>>4);
 
77
+                                               if( (samp & 0x0f) > v_samp) 
 
78
+                                                       v_samp = (samp & 0x0f);
 
79
                                        }
 
80
                                        v_samp*=8;
 
81
                                        h_samp*=8;
 
82
@@ -3380,45 +3403,43 @@ int t2p_process_jpeg_strip(
 
83
                                           (unsigned char) ((height>>8) & 0xff);
 
84
                                        buffer[*bufferoffset+6]=
 
85
                                             (unsigned char) (height & 0xff);
 
86
-                                       *bufferoffset+=strip[i+2]+2;
 
87
-                                       i+=strip[i+2]+2;
 
88
-
 
89
+                                       *bufferoffset+=datalen+2;
 
90
+                                       /* insert a DRI marker */
 
91
                                        buffer[(*bufferoffset)++]=0xff;
 
92
                                        buffer[(*bufferoffset)++]=0xdd;
 
93
                                        buffer[(*bufferoffset)++]=0x00;
 
94
                                        buffer[(*bufferoffset)++]=0x04;
 
95
                                        buffer[(*bufferoffset)++]=(ri >> 8) & 0xff;
 
96
                                        buffer[(*bufferoffset)++]= ri & 0xff;
 
97
-                               } else {
 
98
-                                       i+=strip[i+2]+2;
 
99
                                }
 
100
                                break;
 
101
-                       case 0xc4:
 
102
-                       case 0xdb:
 
103
-                               _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
 
104
-                               *bufferoffset+=strip[i+2]+2;
 
105
-                               i+=strip[i+2]+2;
 
106
+                       case 0xc4: /* DHT */
 
107
+                       case 0xdb: /* DQT */
 
108
+                               _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
 
109
+                               *bufferoffset+=datalen+2;
 
110
                                break;
 
111
-                       case 0xda:
 
112
+                       case 0xda: /* SOS */
 
113
                                if(no==0){
 
114
-                                       _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
 
115
-                                       *bufferoffset+=strip[i+2]+2;
 
116
-                                       i+=strip[i+2]+2;
 
117
+                                       _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
 
118
+                                       *bufferoffset+=datalen+2;
 
119
                                } else {
 
120
                                        buffer[(*bufferoffset)++]=0xff;
 
121
                                        buffer[(*bufferoffset)++]=
 
122
                                             (unsigned char)(0xd0 | ((no-1)%8));
 
123
-                                       i+=strip[i+2]+2;
 
124
                                }
 
125
-                               _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), (*striplength)-i-1);
 
126
-                               *bufferoffset+=(*striplength)-i-1;
 
127
+                               i += datalen + 1;
 
128
+                               /* copy remainder of strip */
 
129
+                               _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i]), *striplength - i);
 
130
+                               *bufferoffset+= *striplength - i;
 
131
                                return(1);
 
132
                        default:
 
133
-                               i+=strip[i+2]+2;
 
134
+                               /* ignore any other marker */
 
135
+                               break;
 
136
                }
 
137
+               i += datalen + 1;
 
138
        }
 
139
-       
 
140
 
 
141
+       /* failed to find SOS marker */
 
142
        return(0);
 
143
 }
 
144
 #endif