diff options
| author |   Natasha Bailey <nat.bailey@windriver.com> | 2023-05-30 15:16:06 -0700 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2023-06-01 08:04:14 +0100 |
| commit | 7da5abf23232f61bf8009b4b8e97632768867e07 (patch) | |
| tree | 69c2c032e3b9eef5cd3da41b55ac22bd908f80e0 /meta/recipes-multimedia/libtiff | |
| parent | 5eb6c747f8b25cd16125307a51470463c02dffd3 (diff) | |
| download | openembedded-core-7da5abf23232f61bf8009b4b8e97632768867e07.tar.gz | |
tiff: backport a fix for CVE-2023-2731
This patch fixes an issue in libtiff's LZWDecode function which could cause a null pointer dereference.
Signed-off-by: Natasha Bailey <nat.bailey@windriver.com>
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-multimedia/libtiff')
| -rw-r--r-- | meta/recipes-multimedia/libtiff/files/CVE-2023-2731.patch | 39 | ||||
| -rw-r--r-- | meta/recipes-multimedia/libtiff/tiff_4.5.0.bb | 4 |
2 files changed, 42 insertions, 1 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2023-2731.patch b/meta/recipes-multimedia/libtiff/files/CVE-2023-2731.patch new file mode 100644 index 0000000000..7db0a35f72 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/files/CVE-2023-2731.patch @@ -0,0 +1,39 @@ +From 9be22b639ea69e102d3847dca4c53ef025e9527b Mon Sep 17 00:00:00 2001 +From: Even Rouault <even.rouault@spatialys.com> +Date: Sat, 29 Apr 2023 12:20:46 +0200 +Subject: [PATCH] LZWDecode(): avoid crash when trying to read again from a + strip whith a missing end-of-information marker (fixes #548) + +CVE: CVE-2023-2731 +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/9be22b639ea69e102d3847dca4c53ef025e9527b] + +--- + libtiff/tif_lzw.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c +index ba75a07e..d631fa10 100644 +--- a/libtiff/tif_lzw.c ++++ b/libtiff/tif_lzw.c +@@ -423,6 +423,10 @@ static int LZWDecode(TIFF *tif, uint8_t *op0, tmsize_t occ0, uint16_t s) + + if (sp->read_error) + { ++ TIFFErrorExtR(tif, module, ++ "LZWDecode: Scanline %" PRIu32 " cannot be read due to " ++ "previous error", ++ tif->tif_row); + return 0; + } + +@@ -742,6 +746,7 @@ after_loop: + return (1); + + no_eoi: ++ sp->read_error = 1; + TIFFErrorExtR(tif, module, + "LZWDecode: Strip %" PRIu32 " not terminated with EOI code", + tif->tif_curstrip); +-- +2.34.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff_4.5.0.bb b/meta/recipes-multimedia/libtiff/tiff_4.5.0.bb index f8a2482a84..ca4a3eff91 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.5.0.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.5.0.bb @@ -9,7 +9,9 @@ LIC_FILES_CHKSUM = "file://LICENSE.md;md5=a3e32d664d6db1386b4689c8121531c3" CVE_PRODUCT = "libtiff" SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ - file://CVE-2022-48281.patch" + file://CVE-2022-48281.patch \ + file://CVE-2023-2731.patch \ +" SRC_URI[sha256sum] = "c7a1d9296649233979fa3eacffef3fa024d73d05d589cb622727b5b08c423464" |