diff options
Diffstat (limited to 'meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch')
| -rw-r--r-- | meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch | 46 |
1 files changed, 0 insertions, 46 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch b/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch deleted file mode 100644 index 9b9962ed35..0000000000 --- a/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 9171da596c88e6a2dadcab4a3a89dddd6e1b4655 Mon Sep 17 00:00:00 2001 -From: Nathan Baker <elitebadger@gmail.com> -Date: Thu, 25 Jan 2018 21:28:15 +0000 -Subject: [PATCH] Add workaround to pal2rgb buffer overflow. - -CVE: CVE-2017-17095 - -Upstream-Status: Backport (unchanged) [gitlab.com/libtiff/libtiff/commit/9171da5...] - -Signed-off-by: Joe Slater <joe.slater@windriver.com. - ---- - tools/pal2rgb.c | 17 +++++++++++++++-- - 1 file changed, 15 insertions(+), 2 deletions(-) - -diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c -index 0423598..01fcf94 100644 ---- a/tools/pal2rgb.c -+++ b/tools/pal2rgb.c -@@ -182,8 +182,21 @@ main(int argc, char* argv[]) - { unsigned char *ibuf, *obuf; - register unsigned char* pp; - register uint32 x; -- ibuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(in)); -- obuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(out)); -+ tmsize_t tss_in = TIFFScanlineSize(in); -+ tmsize_t tss_out = TIFFScanlineSize(out); -+ if (tss_out / tss_in < 3) { -+ /* -+ * BUG 2750: The following code does not know about chroma -+ * subsampling of JPEG data. It assumes that the output buffer is 3x -+ * the length of the input buffer due to exploding the palette into -+ * RGB tuples. If this assumption is incorrect, it could lead to a -+ * buffer overflow. Go ahead and fail now to prevent that. -+ */ -+ fprintf(stderr, "Could not determine correct image size for output. Exiting.\n"); -+ return -1; -+ } -+ ibuf = (unsigned char*)_TIFFmalloc(tss_in); -+ obuf = (unsigned char*)_TIFFmalloc(tss_out); - switch (config) { - case PLANARCONFIG_CONTIG: - for (row = 0; row < imagelength; row++) { --- -1.7.9.5 - |