From 6c4480d2980dc61f3fcd4f43a499e69764133f1a Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>

Date: Wed, 11 Jan 2017 12:50:33 +0100

Subject: [PATCH 1/5] Fix CVE-2016-9533, CVE-2016-9534, CVE-2016-9536,

CVE-2016-9537

---

libtiff/tif_pixarlog.c | 55 +++++++++++++++++++++-----------------------------

libtiff/tif_write.c | 7 +++++++

tools/thumbnail.c | 7 ++++++-

tools/tiff2pdf.c | 22 ++++++++++++++++++--

tools/tiffcrop.c | 31 ++++++++++++++++++++++++----

5 files changed, 83 insertions(+), 39 deletions(-)

diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c

index c961529..6128f2f 100644

--- a/libtiff/tif_pixarlog.c

+++ b/libtiff/tif_pixarlog.c

@@ -981,17 +981,14 @@ horizontalDifferenceF(float *ip, int n, int stride, uint16 *wp, uint16 *FromLT2)

a1 = (int32) CLAMP(ip[3]); wp[3] = (a1-a2) & mask; a2 = a1;

}

} else {

- ip += n - 1; /* point to last one */

- wp += n - 1; /* point to last one */

- n -= stride;

- while (n > 0) {

- REPEAT(stride, wp[0] = (uint16) CLAMP(ip[0]);

- wp[stride] -= wp[0];

- wp[stride] &= mask;

- wp--; ip--)

- n -= stride;

- }

- REPEAT(stride, wp[0] = (uint16) CLAMP(ip[0]); wp--; ip--)

+ REPEAT(stride, wp[0] = (uint16) CLAMP(ip[0]); wp++; ip++)

+ n -= stride;

+ while (n > 0) {

+ REPEAT(stride,

+ wp[0] = (uint16)(((int32)CLAMP(ip[0])-(int32)CLAMP(ip[-stride])) & mask);

+ wp++; ip++)

+ n -= stride;

+ }

}

}

}

@@ -1034,17 +1031,14 @@ horizontalDifference16(unsigned short *ip, int n, int stride,

a1 = CLAMP(ip[3]); wp[3] = (a1-a2) & mask; a2 = a1;

}

} else {

- ip += n - 1; /* point to last one */

- wp += n - 1; /* point to last one */

+ REPEAT(stride, wp[0] = CLAMP(ip[0]); wp++; ip++)

n -= stride;

while (n > 0) {

- REPEAT(stride, wp[0] = CLAMP(ip[0]);

- wp[stride] -= wp[0];

- wp[stride] &= mask;

- wp--; ip--)

- n -= stride;

- }

- REPEAT(stride, wp[0] = CLAMP(ip[0]); wp--; ip--)

+ REPEAT(stride,

+ wp[0] = (uint16)((CLAMP(ip[0])-CLAMP(ip[-stride])) & mask);

+ wp++; ip++)

+ n -= stride;

+ }

}

}

}

@@ -1087,18 +1081,15 @@ horizontalDifference8(unsigned char *ip, int n, int stride,

ip += 4;

}

} else {

- wp += n + stride - 1; /* point to last one */

- ip += n + stride - 1; /* point to last one */

- n -= stride;

- while (n > 0) {

- REPEAT(stride, wp[0] = CLAMP(ip[0]);

- wp[stride] -= wp[0];

- wp[stride] &= mask;

- wp--; ip--)

- n -= stride;

- }

- REPEAT(stride, wp[0] = CLAMP(ip[0]); wp--; ip--)

- }

+ REPEAT(stride, wp[0] = CLAMP(ip[0]); wp++; ip++)

+ n -= stride;

+ while (n > 0) {

+ REPEAT(stride,

+ wp[0] = (uint16)((CLAMP(ip[0])-CLAMP(ip[-stride])) & mask);

+ wp++; ip++)

+ n -= stride;

+ }

+ }

}

}

diff --git a/libtiff/tif_write.c b/libtiff/tif_write.c

index 8792123..ce671af 100644

--- a/libtiff/tif_write.c

+++ b/libtiff/tif_write.c

@@ -742,7 +742,14 @@ TIFFFlushData1(TIFF* tif)

if (!TIFFAppendToStrip(tif,

isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip,

tif->tif_rawdata, tif->tif_rawcc))

+ {

+ /* We update those variables even in case of error since there's */

+ /* code that doesn't really check the return code of this */

+ /* function */

+ tif->tif_rawcc = 0;

+ tif->tif_rawcp = tif->tif_rawdata;

return (0);

+ }

tif->tif_rawcc = 0;

tif->tif_rawcp = tif->tif_rawdata;

}

diff --git a/tools/thumbnail.c b/tools/thumbnail.c

index e14d290..9a9c439 100644

--- a/tools/thumbnail.c

+++ b/tools/thumbnail.c

@@ -587,12 +587,17 @@ generateThumbnail(TIFF* in, TIFF* out)

rowsize = TIFFScanlineSize(in);

rastersize = sh * rowsize;

fprintf(stderr, "rastersize=%u\n", (unsigned int)rastersize);

- raster = (unsigned char*)_TIFFmalloc(rastersize + 3);

+ /* +3 : add a few guard bytes since setrow() can read a bit */

+ /* outside buffer */

+ raster = (unsigned char*)_TIFFmalloc(rastersize+3);

if (!raster) {

TIFFError(TIFFFileName(in),

"Can't allocate space for raster buffer.");

return 0;

}

+ raster[rastersize] = 0;

+ raster[rastersize+1] = 0;

+ raster[rastersize+2] = 0;

rp = raster;

for (s = 0; s < ns; s++) {

(void) TIFFReadEncodedStrip(in, s, rp, -1);

diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c

index 2a64ec3..fbca305 100644

--- a/tools/tiff2pdf.c

+++ b/tools/tiff2pdf.c

@@ -285,7 +285,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P*, TIFF*, TIFF*, ttile_t);

int t2p_process_ojpeg_tables(T2P*, TIFF*);

#endif

#ifdef JPEG_SUPPORT

-int t2p_process_jpeg_strip(unsigned char*, tsize_t*, unsigned char*, tsize_t*, tstrip_t, uint32);

+int t2p_process_jpeg_strip(unsigned char*, tsize_t*, unsigned char*, tsize_t, tsize_t*, tstrip_t, uint32);

#endif

void t2p_tile_collapse_left(tdata_t, tsize_t, uint32, uint32, uint32);

void t2p_write_advance_directory(T2P*, TIFF*);

@@ -2348,7 +2348,8 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){

if(!t2p_process_jpeg_strip(

stripbuffer,

&striplength,

- buffer,

+ buffer,

+ t2p->tiff_datasize,

&bufferoffset,

i,

t2p->tiff_length)){

@@ -3378,6 +3379,7 @@ int t2p_process_jpeg_strip(

unsigned char* strip,

tsize_t* striplength,

unsigned char* buffer,

+ tsize_t buffersize,

tsize_t* bufferoffset,

tstrip_t no,

uint32 height){

@@ -3412,6 +3414,8 @@ int t2p_process_jpeg_strip(

}

switch( strip[i] ){

case 0xd8: /* SOI - start of image */

+ if( *bufferoffset + 2 > buffersize )

+ return(0);

_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), 2);

*bufferoffset+=2;

break;

@@ -3421,12 +3425,18 @@ int t2p_process_jpeg_strip(

case 0xc9: /* SOF9 */

case 0xca: /* SOF10 */

if(no==0){

+ if( *bufferoffset + datalen + 2 + 6 > buffersize )

+ return(0);

_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);

+ if( *bufferoffset + 9 >= buffersize )

+ return(0);

ncomp = buffer[*bufferoffset+9];

if (ncomp < 1 || ncomp > 4)

return(0);

v_samp=1;

h_samp=1;

+ if( *bufferoffset + 11 + 3*(ncomp-1) >= buffersize )

+ return(0);

for(j=0;j<ncomp;j++){

uint16 samp = buffer[*bufferoffset+11+(3*j)];

if( (samp>>4) > h_samp)

@@ -3458,20 +3468,28 @@ int t2p_process_jpeg_strip(

break;

case 0xc4: /* DHT */

case 0xdb: /* DQT */

+ if( *bufferoffset + datalen + 2 > buffersize )

+ return(0);

_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);

*bufferoffset+=datalen+2;

break;

case 0xda: /* SOS */

if(no==0){

+ if( *bufferoffset + datalen + 2 > buffersize )

+ return(0);

_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);

*bufferoffset+=datalen+2;

} else {

+ if( *bufferoffset + 2 > buffersize )

+ return(0);

buffer[(*bufferoffset)++]=0xff;

buffer[(*bufferoffset)++]=

(unsigned char)(0xd0 | ((no-1)%8));

}

i += datalen + 1;

/* copy remainder of strip */

+ if( *bufferoffset + *striplength - i > buffersize )

+ return(0);

_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i]), *striplength - i);

*bufferoffset+= *striplength - i;

return(1);

diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c

index f04e2eb..02c53cd 100644

--- a/tools/tiffcrop.c

+++ b/tools/tiffcrop.c

@@ -5744,7 +5744,8 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c

{

uint32 i;

float xres = 0.0, yres = 0.0;

- uint16 nstrips = 0, ntiles = 0, planar = 0;

+ uint32 nstrips = 0, ntiles = 0;

+ uint16 planar = 0;

uint16 bps = 0, spp = 0, res_unit = 0;

uint16 orientation = 0;

uint16 input_compression = 0, input_photometric = 0;

@@ -6049,17 +6050,31 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c

}

read_buff = *read_ptr;

+ /* +3 : add a few guard bytes since reverseSamples16bits() can read a bit */

+ /* outside buffer */

if (!read_buff)

- read_buff = (unsigned char *)_TIFFmalloc(buffsize);

+ {

+ if( buffsize > 0xFFFFFFFFU - 3 )

+ {

+ TIFFError("loadImage", "Unable to allocate/reallocate read buffer");

+ return (-1);

+ }

+ read_buff = (unsigned char *)_TIFFmalloc(buffsize+3);

+ }

else

{

if (prev_readsize < buffsize)

+ {

+ if( buffsize > 0xFFFFFFFFU - 3 )

{

- new_buff = _TIFFrealloc(read_buff, buffsize);

+ TIFFError("loadImage", "Unable to allocate/reallocate read buffer");

+ return (-1);

+ }

+ new_buff = _TIFFrealloc(read_buff, buffsize+3);

if (!new_buff)

{

free (read_buff);

- read_buff = (unsigned char *)_TIFFmalloc(buffsize);

+ read_buff = (unsigned char *)_TIFFmalloc(buffsize+3);

}

else

read_buff = new_buff;

@@ -6071,6 +6086,9 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c

TIFFError("loadImage", "Unable to allocate/reallocate read buffer");

return (-1);

}

+ read_buff[buffsize] = 0;

+ read_buff[buffsize+1] = 0;

+ read_buff[buffsize+2] = 0;

prev_readsize = buffsize;

*read_ptr = read_buff;

@@ -8877,6 +8895,11 @@ reverseSamplesBytes (uint16 spp, uint16 bps, uint32 width,

}

bytes_per_pixel = ((bps * spp) + 7) / 8;

+ if( bytes_per_pixel > sizeof(swapbuff) )

+ {

+ TIFFError("reverseSamplesBytes","bytes_per_pixel too large");

+ return (1);

+ }

switch (bps / 8)

{

case 8: /* Use memcpy for multiple bytes per sample data */

--

2.7.4