bakabtw/packages
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[package] tiff: update to 4.0.1 and include CVE-2012-1173 patch

Browse Source 
git-svn-id: svn://svn.openwrt.org/openwrt/packages@31367 3c298f89-4303-0410-b956-a3cf2f4a3e73
This commit is contained in:
florian 2012-04-20 13:26:16 +00:00
parent 6039cccf10
commit 703f1eefb6
2 changed files with 72 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libs/tiff/Makefile
View File

@ -1,5 +1,5 @@
#
# Copyright (C) 2006-2009 OpenWrt.org
# Copyright (C) 2006-2012 OpenWrt.org
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
@ -9,12 +9,12 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=tiff
PKG_VERSION:=3.9.2
PKG_VERSION:=4.0.1
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=http://download.osgeo.org/libtiff
PKG_MD5SUM:=93e56e421679c591de7552db13384cb8
PKG_MD5SUM:=fae149cc9da35c598d8be897826dfc63
PKG_FIXUP:=libtool-ucxx
PKG_REMOVE_FILES:=autogen.sh aclocal.m4

69
libs/tiff/patches/001-CVE-2012-1173.patch Normal file
View File

@ -0,0 +1,69 @@
diff -urN tiff-4.0.1/libtiff/tif_getimage.c tiff-4.0.1.new/libtiff/tif_getimage.c
--- tiff-4.0.1/libtiff/tif_getimage.c 2011-02-25 04:34:02.000000000 +0100
+++ tiff-4.0.1.new/libtiff/tif_getimage.c 2012-04-20 13:27:50.109802168 +0200
@@ -692,6 +692,7 @@
unsigned char* p2;
unsigned char* pa;
tmsize_t tilesize;
+ tmsize_t bufsize;
int32 fromskew, toskew;
int alpha = img->alpha;
uint32 nrow;
@@ -699,12 +700,17 @@
int colorchannels;
tilesize = TIFFTileSize(tif);
- buf = (unsigned char*) _TIFFmalloc((alpha?4:3)*tilesize);
+ bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,tilesize);
+ if (bufsize == 0) {
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
+ return (0);
+ }
+ buf = (unsigned char*) _TIFFmalloc(bufsize);
if (buf == 0) {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "No space for tile buffer");
return (0);
}
- _TIFFmemset(buf, 0, (alpha?4:3)*tilesize);
+ _TIFFmemset(buf, 0, bufsize);
p0 = buf;
p1 = p0 + tilesize;
p2 = p1 + tilesize;
@@ -917,17 +923,23 @@
uint32 rowsperstrip, offset_row;
uint32 imagewidth = img->width;
tmsize_t stripsize;
+ tmsize_t bufsize;
int32 fromskew, toskew;
int alpha = img->alpha;
int ret = 1, flip, colorchannels;
stripsize = TIFFStripSize(tif);
- p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize);
+ bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,stripsize);
+ if (bufsize == 0) {
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
+ return (0);
+ }
+ p0 = buf = (unsigned char *)_TIFFmalloc(bufsize);
if (buf == 0) {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
return (0);
}
- _TIFFmemset(buf, 0, (alpha?4:3)*stripsize);
+ _TIFFmemset(buf, 0, bufsize);
p1 = p0 + stripsize;
p2 = p1 + stripsize;
pa = (alpha?(p2+stripsize):NULL);
diff -urN tiff-4.0.1/libtiff/tiffiop.h tiff-4.0.1.new/libtiff/tiffiop.h
--- tiff-4.0.1/libtiff/tiffiop.h 2011-02-19 17:26:09.000000000 +0100
+++ tiff-4.0.1.new/libtiff/tiffiop.h 2012-04-20 13:27:50.109802168 +0200
@@ -250,7 +250,7 @@
#define TIFFroundup_64(x, y) (TIFFhowmany_64(x,y)*(y))
/* Safe multiply which returns zero if there is an integer overflow */
-#define TIFFSafeMultiply(t,v,m) ((((t)m != (t)0) && (((t)((v*m)/m)) == (t)v)) ? (t)(v*m) : (t)0)
+#define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
#define TIFFmax(A,B) ((A)>(B)?(A):(B))
#define TIFFmin(A,B) ((A)<(B)?(A):(B))