From 7af2f595a595533356ddef42e542825faab3382a Mon Sep 17 00:00:00 2001 From: Rajkumar Veer Date: Fri, 3 Nov 2017 22:27:08 -0700 Subject: tiff: Security fix for CVE-2017-7595 Signed-off-by: Rajkumar Veer Signed-off-by: Armin Kuster --- .../libtiff/files/CVE-2017-7595.patch | 48 ++++++++++++++++++++++ meta/recipes-multimedia/libtiff/tiff_4.0.7.bb | 1 + 2 files changed, 49 insertions(+) create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2017-7595.patch diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2017-7595.patch b/meta/recipes-multimedia/libtiff/files/CVE-2017-7595.patch new file mode 100644 index 0000000000..851a37fc74 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/files/CVE-2017-7595.patch @@ -0,0 +1,48 @@ +commit 618d490090bfd10e613ac574ecff31a293904b44 +Author: erouault +Date: Wed Jan 11 12:15:01 2017 +0000 + + * libtiff/tif_jpeg.c: avoid integer division by zero + in JPEGSetupEncode() when horizontal or vertical sampling is set to 0. + Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2653 + +Upstream-Status: Backport + +CVE: CVE-2017-7595 +Signed-off-by: Rajkumar Veer + +Index: tiff-4.0.7/ChangeLog +=================================================================== +--- tiff-4.0.7.orig/ChangeLog 2017-04-24 17:31:40.013832807 +0530 ++++ tiff-4.0.7/ChangeLog 2017-04-24 18:03:34.769782616 +0530 +@@ -8,6 +8,12 @@ + + 2017-01-11 Even Rouault + ++ * libtiff/tif_jpeg.c: avoid integer division by zero in ++ JPEGSetupEncode() when horizontal or vertical sampling is set to 0. ++ Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2653 ++ ++2017-01-11 Even Rouault ++ + * libtiff/tif_getimage.c: add explicit uint32 cast in putagreytile to + avoid UndefinedBehaviorSanitizer warning. + Patch by Nicolas Pena. +Index: tiff-4.0.7/libtiff/tif_jpeg.c +=================================================================== +--- tiff-4.0.7.orig/libtiff/tif_jpeg.c 2016-01-24 21:09:51.781641625 +0530 ++++ tiff-4.0.7/libtiff/tif_jpeg.c 2017-04-24 18:05:59.777778815 +0530 +@@ -1626,6 +1626,13 @@ + case PHOTOMETRIC_YCBCR: + sp->h_sampling = td->td_ycbcrsubsampling[0]; + sp->v_sampling = td->td_ycbcrsubsampling[1]; ++ if( sp->h_sampling == 0 || sp->v_sampling == 0 ) ++ { ++ TIFFErrorExt(tif->tif_clientdata, module, ++ "Invalig horizontal/vertical sampling value"); ++ return (0); ++ } ++ + /* + * A ReferenceBlackWhite field *must* be present since the + * default value is inappropriate for YCbCr. Fill in the diff --git a/meta/recipes-multimedia/libtiff/tiff_4.0.7.bb b/meta/recipes-multimedia/libtiff/tiff_4.0.7.bb index 12ab9360a7..6881c2456f 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.0.7.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.0.7.bb @@ -21,6 +21,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ file://CVE-2017-7592.patch \ file://CVE-2017-7594-p1.patch \ file://CVE-2017-7594-p2.patch \ + file://CVE-2017-7595.patch \ " SRC_URI[md5sum] = "77ae928d2c6b7fb46a21c3a29325157b" -- cgit 1.2.3-korg