diff options
| author | Daniel Sabogal <dsabogalcc@gmail.com> | 2017-05-01 00:07:25 -0400 |
|---|---|---|
| committer | Leonardo Arena <rnalrd@alpinelinux.org> | 2017-05-03 10:02:58 +0000 |
| commit | fa18ed2287bf127951d71bdf233db44b1e923739 (patch) | |
| tree | b74dde74b2d7b2f8a20b693a8743e0e6abc19f0f /main/tiff/CVE-2016-10268.patch | |
| parent | 5b598aecd1e0174b9debbf49c0eea825b7a50c98 (diff) | |
| download | aports-fa18ed2287bf127951d71bdf233db44b1e923739.tar.bz2 aports-fa18ed2287bf127951d71bdf233db44b1e923739.tar.xz | |
main/tiff: security fixes
Diffstat (limited to 'main/tiff/CVE-2016-10268.patch')
| -rw-r--r-- | main/tiff/CVE-2016-10268.patch | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/main/tiff/CVE-2016-10268.patch b/main/tiff/CVE-2016-10268.patch new file mode 100644 index 0000000000..ce5f9be7a2 --- /dev/null +++ b/main/tiff/CVE-2016-10268.patch @@ -0,0 +1,43 @@ +From 5397a417e61258c69209904e652a1f409ec3b9df Mon Sep 17 00:00:00 2001 +From: erouault <erouault> +Date: Fri, 2 Dec 2016 22:13:32 +0000 +Subject: [PATCH] * tools/tiffcp.c: avoid uint32 underflow in cpDecodedStrips + that can cause various issues, such as buffer overflows in the library. + Reported by Agostino Sarubbo. Fixes + http://bugzilla.maptools.org/show_bug.cgi?id=2598 + +--- + ChangeLog | 7 +++++++ + tools/tiffcp.c | 2 +- + 2 files changed, 8 insertions(+), 1 deletion(-) + +diff --git a/ChangeLog b/ChangeLog +index 668b66a..0f154d6 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -1,5 +1,12 @@ + 2016-12-02 Even Rouault <even.rouault at spatialys.com> + ++ * tools/tiffcp.c: avoid uint32 underflow in cpDecodedStrips that ++ can cause various issues, such as buffer overflows in the library. ++ Reported by Agostino Sarubbo. ++ Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2598 ++ ++2016-12-02 Even Rouault <even.rouault at spatialys.com> ++ + * libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow in + TIFFReadEncodedStrip() that caused an integer division by zero. + Reported by Agostino Sarubbo. +diff --git a/tools/tiffcp.c b/tools/tiffcp.c +index a99c906..f294ed1 100644 +--- a/tools/tiffcp.c ++++ b/tools/tiffcp.c +@@ -985,7 +985,7 @@ DECLAREcpFunc(cpDecodedStrips) + tstrip_t s, ns = TIFFNumberOfStrips(in); + uint32 row = 0; + _TIFFmemset(buf, 0, stripsize); +- for (s = 0; s < ns; s++) { ++ for (s = 0; s < ns && row < imagelength; s++) { + tsize_t cc = (row + rowsperstrip > imagelength) ? + TIFFVStripSize(in, imagelength - row) : stripsize; + if (TIFFReadEncodedStrip(in, s, buf, cc) < 0 |