tiff: Fix remaining CVEs

[feed/packages.git] / libs / tiff / patches / 024-CVE-2018-8905.patch

diff --git a/libs/tiff/patches/024-CVE-2018-8905.patch b/libs/tiff/patches/024-CVE-2018-8905.patch
new file mode 100644 (file)
index 0000000..be6bee4
--- /dev/null
+++ b/libs/tiff/patches/024-CVE-2018-8905.patch
@@ -0,0 +1,53 @@
+From 1c127eb3cb7653bd61b61f9c3cfeb36fd10edab1 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 12 May 2018 15:32:31 +0200
+Subject: [PATCH 3/4] LZWDecodeCompat(): fix potential index-out-of-bounds
+ write. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2780 /
+ CVE-2018-8905
+
+The fix consists in using the similar code LZWDecode() to validate we
+don't write outside of the output buffer.
+---
+ libtiff/tif_lzw.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
+index bc8f9c8..186ea3c 100644
+--- a/libtiff/tif_lzw.c
++++ b/libtiff/tif_lzw.c
+@@ -604,6 +604,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
+       char *tp;
+       unsigned char *bp;
+       int code, nbits;
++      int len;
+       long nextbits, nextdata, nbitsmask;
+       code_t *codep, *free_entp, *maxcodep, *oldcodep;
+ 
+@@ -755,13 +756,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
+                               }  while (--occ);
+                               break;
+                       }
+-                      assert(occ >= codep->length);
+-                      op += codep->length;
+-                      occ -= codep->length;
+-                      tp = op;
++                      len = codep->length;
++                      tp = op + len;
+                       do {
+-                              *--tp = codep->value;
+-                      } while( (codep = codep->next) != NULL );
++                              int t;
++                              --tp;
++                              t = codep->value;
++                              codep = codep->next;
++                              *tp = (char)t;
++                      } while (codep && tp > op);
++                      assert(occ >= len);
++                      op += len;
++                      occ -= len;
+               } else {
+                       *op++ = (char)code;
+                       occ--;
+-- 
+2.17.0
+