diff options
| -rw-r--r-- | meta/recipes-multimedia/libtiff/files/CVE-2016-10267.patch | 70 | ||||
| -rw-r--r-- | meta/recipes-multimedia/libtiff/tiff_4.0.7.bb | 1 |
2 files changed, 71 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2016-10267.patch b/meta/recipes-multimedia/libtiff/files/CVE-2016-10267.patch new file mode 100644 index 0000000000..f4c57917d8 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/files/CVE-2016-10267.patch @@ -0,0 +1,70 @@ +From f8203c7ab1dbd7b5c59158576bec7da90191f42f Mon Sep 17 00:00:00 2001 +From: erouault <erouault> +Date: Sat, 3 Dec 2016 11:15:18 +0000 +Subject: [PATCH] * libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case + of failure in OJPEGPreDecode(). This will avoid a divide by zero, and + potential other issues. Reported by Agostino Sarubbo. Fixes + http://bugzilla.maptools.org/show_bug.cgi?id=2611 + +Upstream-Status: Backport + +CVE: CVE-2016-10267 +Signed-off-by: Rajkumar Veer <rveer@mvista.com> +--- + ChangeLog | 7 +++++++ + libtiff/tif_ojpeg.c | 8 ++++++++ + 2 files changed, 15 insertions(+) + +diff --git a/ChangeLog b/ChangeLog +index 7339c1a..66fbcdc 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -1,3 +1,10 @@ ++2016-12-03 Even Rouault <even.rouault at spatialys.com> ++ ++ * libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of failure in ++ OJPEGPreDecode(). This will avoid a divide by zero, and potential other issues. ++ Reported by Agostino Sarubbo. ++ Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2611 ++ + 2016-12-02 Even Rouault <even.rouault at spatialys.com> + + * libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow in +diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c +index 1ccc3f9..f19e8fd 100644 +--- a/libtiff/tif_ojpeg.c ++++ b/libtiff/tif_ojpeg.c +@@ -244,6 +244,7 @@ typedef enum { + + typedef struct { + TIFF* tif; ++ int decoder_ok; + #ifndef LIBJPEG_ENCAP_EXTERNAL + JMP_BUF exit_jmpbuf; + #endif +@@ -722,6 +723,7 @@ OJPEGPreDecode(TIFF* tif, uint16 s) + } + sp->write_curstrile++; + } ++ sp->decoder_ok = 1; + return(1); + } + +@@ -784,8 +786,14 @@ OJPEGPreDecodeSkipScanlines(TIFF* tif) + static int + OJPEGDecode(TIFF* tif, uint8* buf, tmsize_t cc, uint16 s) + { ++ static const char module[]="OJPEGDecode"; + OJPEGState* sp=(OJPEGState*)tif->tif_data; + (void)s; ++ if( !sp->decoder_ok ) ++ { ++ TIFFErrorExt(tif->tif_clientdata,module,"Cannot decode: decoder not correctly initialized"); ++ return 0; ++ } + if (sp->libjpeg_jpeg_query_style==0) + { + if (OJPEGDecodeRaw(tif,buf,cc)==0) +-- +1.9.1 + diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.7.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.7.bb index cb7c4949cd..d60c7fed13 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.0.7.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.0.7.bb @@ -15,6 +15,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ file://CVE-2016-10093.patch \ file://CVE-2016-10268.patch \ file://CVE-2016-10266.patch \ + file://CVE-2016-10267.patch \ " SRC_URI[md5sum] = "77ae928d2c6b7fb46a21c3a29325157b" |