Attachment #165108 for bug #205923

View | Details | Raw Unified | Return to bug 205923
Collapse All | Expand All

Lines 3-8 Link Here

(-)Makefile (+1 lines)
3		3
4	PORTNAME= tiff	4	PORTNAME= tiff
5	PORTVERSION= 4.0.6	5	PORTVERSION= 4.0.6
		6	PORTREVISION= 1
6	CATEGORIES= graphics	7	CATEGORIES= graphics
7	MASTER_SITES= ftp://ftp.remotesensing.org/pub/libtiff/ \	8	MASTER_SITES= ftp://ftp.remotesensing.org/pub/libtiff/ \
8	http://download.osgeo.org/libtiff/	9	http://download.osgeo.org/libtiff/




revision 1.94
date: 2015-12-26 17:32:03 +0000;  author: erouault;  state: Exp;  lines: +23 -14;  commitid: ohB9uRxvIWq9YtOy;
* libtiff/tif_getimage.c: fix out-of-bound reads in TIFFRGBAImage
interface in case of unsupported values of SamplesPerPixel/ExtraSamples
for LogLUV / CIELab. Add explicit call to TIFFRGBAImageOK() in
TIFFRGBAImageBegin(). Fix CVE-2015-8665 reported by limingxing and
CVE-2015-8683 reported by zzf of Alibaba.

Index: libtiff/tif_getimage.c
===================================================================
RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_getimage.c,v
retrieving revision 1.93
retrieving revision 1.94
diff -u -r1.93 -r1.94
--- libtiff/tif_getimage.c	22 Nov 2015 15:31:03 -0000	1.93
+++ libtiff/tif_getimage.c	26 Dec 2015 17:32:03 -0000	1.94
@@ -1,4 +1,4 @@
-/* $Id: tif_getimage.c,v 1.93 2015-11-22 15:31:03 erouault Exp $ */
+/* $Id: tif_getimage.c,v 1.94 2015-12-26 17:32:03 erouault Exp $ */
 
 /*
  * Copyright (c) 1991-1997 Sam Leffler
@@ -182,20 +182,22 @@
 				    "Planarconfiguration", td->td_planarconfig);
 				return (0);
 			}
-			if( td->td_samplesperpixel != 3 )
+			if( td->td_samplesperpixel != 3 || colorchannels != 3 )
             {
                 sprintf(emsg,
-                        "Sorry, can not handle image with %s=%d",
-                        "Samples/pixel", td->td_samplesperpixel);
+                        "Sorry, can not handle image with %s=%d, %s=%d",
+                        "Samples/pixel", td->td_samplesperpixel,
+                        "colorchannels", colorchannels);
                 return 0;
             }
 			break;
 		case PHOTOMETRIC_CIELAB:
-            if( td->td_samplesperpixel != 3 || td->td_bitspersample != 8 )
+            if( td->td_samplesperpixel != 3 || colorchannels != 3 || td->td_bitspersample != 8 )
             {
                 sprintf(emsg,
-                        "Sorry, can not handle image with %s=%d and %s=%d",
+                        "Sorry, can not handle image with %s=%d, %s=%d and %s=%d",
                         "Samples/pixel", td->td_samplesperpixel,
+                        "colorchannels", colorchannels,
                         "Bits/sample", td->td_bitspersample);
                 return 0;
             }
@@ -255,6 +257,9 @@
 	int colorchannels;
 	uint16 *red_orig, *green_orig, *blue_orig;
 	int n_color;
+	
+	if( !TIFFRGBAImageOK(tif, emsg) )
+		return 0;
 
 	/* Initialize to normal values */
 	img->row_offset = 0;
@@ -2509,29 +2514,33 @@
 		case PHOTOMETRIC_RGB:
 			switch (img->bitspersample) {
 				case 8:
-					if (img->alpha == EXTRASAMPLE_ASSOCALPHA)
+					if (img->alpha == EXTRASAMPLE_ASSOCALPHA &&
+						img->samplesperpixel >= 4)
 						img->put.contig = putRGBAAcontig8bittile;
-					else if (img->alpha == EXTRASAMPLE_UNASSALPHA)
+					else if (img->alpha == EXTRASAMPLE_UNASSALPHA &&
+							 img->samplesperpixel >= 4)
 					{
 						if (BuildMapUaToAa(img))
 							img->put.contig = putRGBUAcontig8bittile;
 					}
-					else
+					else if( img->samplesperpixel >= 3 )
 						img->put.contig = putRGBcontig8bittile;
 					break;
 				case 16:
-					if (img->alpha == EXTRASAMPLE_ASSOCALPHA)
+					if (img->alpha == EXTRASAMPLE_ASSOCALPHA &&
+						img->samplesperpixel >=4 )
 					{
 						if (BuildMapBitdepth16To8(img))
 							img->put.contig = putRGBAAcontig16bittile;
 					}
-					else if (img->alpha == EXTRASAMPLE_UNASSALPHA)
+					else if (img->alpha == EXTRASAMPLE_UNASSALPHA &&
+							 img->samplesperpixel >=4 )
 					{
 						if (BuildMapBitdepth16To8(img) &&
 						    BuildMapUaToAa(img))
 							img->put.contig = putRGBUAcontig16bittile;
 					}
-					else
+					else if( img->samplesperpixel >=3 )
 					{
 						if (BuildMapBitdepth16To8(img))
 							img->put.contig = putRGBcontig16bittile;
@@ -2540,7 +2549,7 @@
 			}
 			break;
 		case PHOTOMETRIC_SEPARATED:
-			if (buildMap(img)) {
+			if (img->samplesperpixel >=4 && buildMap(img)) {
 				if (img->bitspersample == 8) {
 					if (!img->Map)
 						img->put.contig = putRGBcontig8bitCMYKtile;
@@ -2636,7 +2645,7 @@
 			}
 			break;
 		case PHOTOMETRIC_CIELAB:
-			if (buildMap(img)) {
+			if (img->samplesperpixel == 3 && buildMap(img)) {
 				if (img->bitspersample == 8)
 					img->put.contig = initCIELabConversion(img);
 				break;




revision 1.41
date: 2015-12-27 16:25:11 +0000;  author: erouault;  state: Exp;  lines: +45 -12;  commitid: gXczlJDfVlBdzBOy;
* libtiff/tif_luv.c: fix potential out-of-bound writes in decode
functions in non debug builds by replacing assert()s by regular if
checks (bugzilla #2522).
Fix potential out-of-bound reads in case of short input data.

Index: libtiff/tif_luv.c
===================================================================
RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_luv.c,v
retrieving revision 1.40
retrieving revision 1.41
diff -u -r1.40 -r1.41
--- libtiff/tif_luv.c	21 Jun 2015 01:09:09 -0000	1.40
+++ libtiff/tif_luv.c	27 Dec 2015 16:25:11 -0000	1.41
@@ -1,4 +1,4 @@
-/* $Id: tif_luv.c,v 1.40 2015-06-21 01:09:09 bfriesen Exp $ */
+/* $Id: tif_luv.c,v 1.41 2015-12-27 16:25:11 erouault Exp $ */
 
 /*
  * Copyright (c) 1997 Greg Ward Larson
@@ -202,7 +202,11 @@
 	if (sp->user_datafmt == SGILOGDATAFMT_16BIT)
 		tp = (int16*) op;
 	else {
-		assert(sp->tbuflen >= npixels);
+		if(sp->tbuflen < npixels) {
+			TIFFErrorExt(tif->tif_clientdata, module,
+						 "Translation buffer too short");
+			return (0);
+		}
 		tp = (int16*) sp->tbuf;
 	}
 	_TIFFmemset((void*) tp, 0, npixels*sizeof (tp[0]));
@@ -211,9 +215,11 @@
 	cc = tif->tif_rawcc;
 	/* get each byte string */
 	for (shft = 2*8; (shft -= 8) >= 0; ) {
-		for (i = 0; i < npixels && cc > 0; )
+		for (i = 0; i < npixels && cc > 0; ) {
 			if (*bp >= 128) {		/* run */
-				rc = *bp++ + (2-128);   /* TODO: potential input buffer overrun when decoding corrupt or truncated data */
+				if( cc < 2 )
+					break;
+				rc = *bp++ + (2-128);
 				b = (int16)(*bp++ << shft);
 				cc -= 2;
 				while (rc-- && i < npixels)
@@ -223,6 +229,7 @@
 				while (--cc && rc-- && i < npixels)
 					tp[i++] |= (int16)*bp++ << shft;
 			}
+		}
 		if (i != npixels) {
 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
 			TIFFErrorExt(tif->tif_clientdata, module,
@@ -268,13 +275,17 @@
 	if (sp->user_datafmt == SGILOGDATAFMT_RAW)
 		tp = (uint32 *)op;
 	else {
-		assert(sp->tbuflen >= npixels);
+		if(sp->tbuflen < npixels) {
+			TIFFErrorExt(tif->tif_clientdata, module,
+						 "Translation buffer too short");
+			return (0);
+		}
 		tp = (uint32 *) sp->tbuf;
 	}
 	/* copy to array of uint32 */
 	bp = (unsigned char*) tif->tif_rawcp;
 	cc = tif->tif_rawcc;
-	for (i = 0; i < npixels && cc > 0; i++) {
+	for (i = 0; i < npixels && cc >= 3; i++) {
 		tp[i] = bp[0] << 16 | bp[1] << 8 | bp[2];
 		bp += 3;
 		cc -= 3;
@@ -325,7 +336,11 @@
 	if (sp->user_datafmt == SGILOGDATAFMT_RAW)
 		tp = (uint32*) op;
 	else {
-		assert(sp->tbuflen >= npixels);
+		if(sp->tbuflen < npixels) {
+			TIFFErrorExt(tif->tif_clientdata, module,
+						 "Translation buffer too short");
+			return (0);
+		}
 		tp = (uint32*) sp->tbuf;
 	}
 	_TIFFmemset((void*) tp, 0, npixels*sizeof (tp[0]));
@@ -334,11 +349,13 @@
 	cc = tif->tif_rawcc;
 	/* get each byte string */
 	for (shft = 4*8; (shft -= 8) >= 0; ) {
-		for (i = 0; i < npixels && cc > 0; )
+		for (i = 0; i < npixels && cc > 0; ) {
 			if (*bp >= 128) {		/* run */
+				if( cc < 2 )
+					break;
 				rc = *bp++ + (2-128);
 				b = (uint32)*bp++ << shft;
-				cc -= 2;                /* TODO: potential input buffer overrun when decoding corrupt or truncated data */
+				cc -= 2;
 				while (rc-- && i < npixels)
 					tp[i++] |= b;
 			} else {			/* non-run */
@@ -346,6 +363,7 @@
 				while (--cc && rc-- && i < npixels)
 					tp[i++] |= (uint32)*bp++ << shft;
 			}
+		}
 		if (i != npixels) {
 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
 			TIFFErrorExt(tif->tif_clientdata, module,
@@ -413,6 +431,7 @@
 static int
 LogL16Encode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 {
+	static const char module[] = "LogL16Encode";
 	LogLuvState* sp = EncoderState(tif);
 	int shft;
 	tmsize_t i;
@@ -433,7 +452,11 @@
 		tp = (int16*) bp;
 	else {
 		tp = (int16*) sp->tbuf;
-		assert(sp->tbuflen >= npixels);
+		if(sp->tbuflen < npixels) {
+			TIFFErrorExt(tif->tif_clientdata, module,
+						 "Translation buffer too short");
+			return (0);
+		}
 		(*sp->tfunc)(sp, bp, npixels);
 	}
 	/* compress each byte string */
@@ -506,6 +529,7 @@
 static int
 LogLuvEncode24(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 {
+	static const char module[] = "LogLuvEncode24";
 	LogLuvState* sp = EncoderState(tif);
 	tmsize_t i;
 	tmsize_t npixels;
@@ -521,7 +545,11 @@
 		tp = (uint32*) bp;
 	else {
 		tp = (uint32*) sp->tbuf;
-		assert(sp->tbuflen >= npixels);
+		if(sp->tbuflen < npixels) {
+			TIFFErrorExt(tif->tif_clientdata, module,
+						 "Translation buffer too short");
+			return (0);
+		}
 		(*sp->tfunc)(sp, bp, npixels);
 	}
 	/* write out encoded pixels */
@@ -553,6 +581,7 @@
 static int
 LogLuvEncode32(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 {
+	static const char module[] = "LogLuvEncode32";
 	LogLuvState* sp = EncoderState(tif);
 	int shft;
 	tmsize_t i;
@@ -574,7 +603,11 @@
 		tp = (uint32*) bp;
 	else {
 		tp = (uint32*) sp->tbuf;
-		assert(sp->tbuflen >= npixels);
+		if(sp->tbuflen < npixels) {
+			TIFFErrorExt(tif->tif_clientdata, module,
+						 "Translation buffer too short");
+			return (0);
+		}
 		(*sp->tfunc)(sp, bp, npixels);
 	}
 	/* compress each byte string */




revision 1.17
date: 2015-12-27 16:55:20 +0000;  author: erouault;  state: Exp;  lines: +9 -3;  commitid: 4yLOaM0uFVPyJBOy;
* libtiff/tif_next.c: fix potential out-of-bound write in NeXTDecode()
triggered by http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif
(bugzilla #2508)

Index: libtiff/tif_next.c
===================================================================
RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_next.c,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -r1.16 -r1.17
--- libtiff/tif_next.c	29 Dec 2014 12:09:11 -0000	1.16
+++ libtiff/tif_next.c	27 Dec 2015 16:55:20 -0000	1.17
@@ -1,4 +1,4 @@
-/* $Id: tif_next.c,v 1.16 2014-12-29 12:09:11 erouault Exp $ */
+/* $Id: tif_next.c,v 1.17 2015-12-27 16:55:20 erouault Exp $ */
 
 /*
  * Copyright (c) 1988-1997 Sam Leffler
@@ -37,7 +37,7 @@
 	case 0:	op[0]  = (unsigned char) ((v) << 6); break;	\
 	case 1:	op[0] |= (v) << 4; break;	\
 	case 2:	op[0] |= (v) << 2; break;	\
-	case 3:	*op++ |= (v);	   break;	\
+	case 3:	*op++ |= (v);	   op_offset++; break;	\
 	}					\
 }
 
@@ -106,6 +106,7 @@
 			uint32 imagewidth = tif->tif_dir.td_imagewidth;
             if( isTiled(tif) )
                 imagewidth = tif->tif_dir.td_tilewidth;
+            tmsize_t op_offset = 0;
 
 			/*
 			 * The scanline is composed of a sequence of constant
@@ -122,10 +123,15 @@
 				 * bounds, potentially resulting in a security
 				 * issue.
 				 */
-				while (n-- > 0 && npixels < imagewidth)
+				while (n-- > 0 && npixels < imagewidth && op_offset < scanline)
 					SETPIXEL(op, grey);
 				if (npixels >= imagewidth)
 					break;
+                if (op_offset >= scanline ) {
+                    TIFFErrorExt(tif->tif_clientdata, module, "Invalid data for scanline %ld",
+                        (long) tif->tif_row);
+                    return (0);
+                }
 				if (cc == 0)
 					goto bad;
 				n = *bp++, cc--;

Return to bug 205923

Line 0 Link Here

(-)files/patch-CVE-2015-8665_8683 (+118 lines)
		1	revision 1.94
		2	date: 2015-12-26 17:32:03 +0000; author: erouault; state: Exp; lines: +23 -14; commitid: ohB9uRxvIWq9YtOy;
		3	* libtiff/tif_getimage.c: fix out-of-bound reads in TIFFRGBAImage
		4	interface in case of unsupported values of SamplesPerPixel/ExtraSamples
		5	for LogLUV / CIELab. Add explicit call to TIFFRGBAImageOK() in
		6	TIFFRGBAImageBegin(). Fix CVE-2015-8665 reported by limingxing and
		7	CVE-2015-8683 reported by zzf of Alibaba.
		8
		9	Index: libtiff/tif_getimage.c
		10	===================================================================
		11	RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_getimage.c,v
		12	retrieving revision 1.93
		13	retrieving revision 1.94
		14	diff -u -r1.93 -r1.94
		15	--- libtiff/tif_getimage.c 22 Nov 2015 15:31:03 -0000 1.93
		16	+++ libtiff/tif_getimage.c 26 Dec 2015 17:32:03 -0000 1.94
		17	@@ -1,4 +1,4 @@
		18	-/* $Id: tif_getimage.c,v 1.93 2015-11-22 15:31:03 erouault Exp $ */
		19	+/* $Id: tif_getimage.c,v 1.94 2015-12-26 17:32:03 erouault Exp $ */
		20
		21	/*
		22	* Copyright (c) 1991-1997 Sam Leffler
		23	@@ -182,20 +182,22 @@
		24	"Planarconfiguration", td->td_planarconfig);
		25	return (0);
		26	}
		27	- if( td->td_samplesperpixel != 3 )
		28	+ if( td->td_samplesperpixel != 3 \|\| colorchannels != 3 )
		29	{
		30	sprintf(emsg,
		31	- "Sorry, can not handle image with %s=%d",
		32	- "Samples/pixel", td->td_samplesperpixel);
		33	+ "Sorry, can not handle image with %s=%d, %s=%d",
		34	+ "Samples/pixel", td->td_samplesperpixel,
		35	+ "colorchannels", colorchannels);
		36	return 0;
		37	}
		38	break;
		39	case PHOTOMETRIC_CIELAB:
		40	- if( td->td_samplesperpixel != 3 \|\| td->td_bitspersample != 8 )
		41	+ if( td->td_samplesperpixel != 3 \|\| colorchannels != 3 \|\| td->td_bitspersample != 8 )
		42	{
		43	sprintf(emsg,
		44	- "Sorry, can not handle image with %s=%d and %s=%d",
		45	+ "Sorry, can not handle image with %s=%d, %s=%d and %s=%d",
		46	"Samples/pixel", td->td_samplesperpixel,
		47	+ "colorchannels", colorchannels,
		48	"Bits/sample", td->td_bitspersample);
		49	return 0;
		50	}
		51	@@ -255,6 +257,9 @@
		52	int colorchannels;
		53	uint16 red_orig, green_orig, *blue_orig;
		54	int n_color;
		55	+
		56	+ if( !TIFFRGBAImageOK(tif, emsg) )
		57	+ return 0;
		58
		59	/* Initialize to normal values */
		60	img->row_offset = 0;
		61	@@ -2509,29 +2514,33 @@
		62	case PHOTOMETRIC_RGB:
		63	switch (img->bitspersample) {
		64	case 8:
65	- if (img->alpha == EXTRASAMPLE_ASSOCALPHA)
66	+ if (img->alpha == EXTRASAMPLE_ASSOCALPHA &&
67	+ img->samplesperpixel >= 4)
68	img->put.contig = putRGBAAcontig8bittile;
69	- else if (img->alpha == EXTRASAMPLE_UNASSALPHA)
70	+ else if (img->alpha == EXTRASAMPLE_UNASSALPHA &&
71	+ img->samplesperpixel >= 4)
72	{
73	if (BuildMapUaToAa(img))
74	img->put.contig = putRGBUAcontig8bittile;
75	}
76	- else
77	+ else if( img->samplesperpixel >= 3 )
78	img->put.contig = putRGBcontig8bittile;
79	break;
80	case 16:
81	- if (img->alpha == EXTRASAMPLE_ASSOCALPHA)
82	+ if (img->alpha == EXTRASAMPLE_ASSOCALPHA &&
83	+ img->samplesperpixel >=4 )
84	{
85	if (BuildMapBitdepth16To8(img))
86	img->put.contig = putRGBAAcontig16bittile;
87	}
88	- else if (img->alpha == EXTRASAMPLE_UNASSALPHA)
89	+ else if (img->alpha == EXTRASAMPLE_UNASSALPHA &&
90	+ img->samplesperpixel >=4 )
91	{
92	if (BuildMapBitdepth16To8(img) &&
93	BuildMapUaToAa(img))
94	img->put.contig = putRGBUAcontig16bittile;
95	}
96	- else
97	+ else if( img->samplesperpixel >=3 )
98	{
99	if (BuildMapBitdepth16To8(img))
100	img->put.contig = putRGBcontig16bittile;
101	@@ -2540,7 +2549,7 @@
102	}
103	break;
104	case PHOTOMETRIC_SEPARATED:
105	- if (buildMap(img)) {
106	+ if (img->samplesperpixel >=4 && buildMap(img)) {
107	if (img->bitspersample == 8) {
108	if (!img->Map)
109	img->put.contig = putRGBcontig8bitCMYKtile;
110	@@ -2636,7 +2645,7 @@
111	}
112	break;
113	case PHOTOMETRIC_CIELAB:
114	- if (buildMap(img)) {
115	+ if (img->samplesperpixel == 3 && buildMap(img)) {
116	if (img->bitspersample == 8)
117	img->put.contig = initCIELabConversion(img);
118	break;

Line 0 Link Here

(-)files/patch-libtiff_tif__luv.c (+176 lines)
		1	revision 1.41
		2	date: 2015-12-27 16:25:11 +0000; author: erouault; state: Exp; lines: +45 -12; commitid: gXczlJDfVlBdzBOy;
		3	* libtiff/tif_luv.c: fix potential out-of-bound writes in decode
		4	functions in non debug builds by replacing assert()s by regular if
		5	checks (bugzilla #2522).
		6	Fix potential out-of-bound reads in case of short input data.
		7
		8	Index: libtiff/tif_luv.c
		9	===================================================================
		10	RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_luv.c,v
		11	retrieving revision 1.40
		12	retrieving revision 1.41
		13	diff -u -r1.40 -r1.41
		14	--- libtiff/tif_luv.c 21 Jun 2015 01:09:09 -0000 1.40
		15	+++ libtiff/tif_luv.c 27 Dec 2015 16:25:11 -0000 1.41
		16	@@ -1,4 +1,4 @@
		17	-/* $Id: tif_luv.c,v 1.40 2015-06-21 01:09:09 bfriesen Exp $ */
		18	+/* $Id: tif_luv.c,v 1.41 2015-12-27 16:25:11 erouault Exp $ */
		19
		20	/*
		21	* Copyright (c) 1997 Greg Ward Larson
		22	@@ -202,7 +202,11 @@
		23	if (sp->user_datafmt == SGILOGDATAFMT_16BIT)
		24	tp = (int16*) op;
		25	else {
		26	- assert(sp->tbuflen >= npixels);
		27	+ if(sp->tbuflen < npixels) {
		28	+ TIFFErrorExt(tif->tif_clientdata, module,
		29	+ "Translation buffer too short");
		30	+ return (0);
		31	+ }
		32	tp = (int16*) sp->tbuf;
		33	}
		34	_TIFFmemset((void) tp, 0, npixelssizeof (tp[0]));
		35	@@ -211,9 +215,11 @@
		36	cc = tif->tif_rawcc;
		37	/* get each byte string */
		38	for (shft = 2*8; (shft -= 8) >= 0; ) {
		39	- for (i = 0; i < npixels && cc > 0; )
		40	+ for (i = 0; i < npixels && cc > 0; ) {
		41	if (bp >= 128) { / run */
		42	- rc = bp++ + (2-128); / TODO: potential input buffer overrun when decoding corrupt or truncated data */
		43	+ if( cc < 2 )
		44	+ break;
		45	+ rc = *bp++ + (2-128);
		46	b = (int16)(*bp++ << shft);
		47	cc -= 2;
		48	while (rc-- && i < npixels)
		49	@@ -223,6 +229,7 @@
		50	while (--cc && rc-- && i < npixels)
		51	tp[i++] \|= (int16)*bp++ << shft;
		52	}
		53	+ }
		54	if (i != npixels) {
		55	#if defined(__WIN32__) && (defined(_MSC_VER) \|\| defined(__MINGW32__))
		56	TIFFErrorExt(tif->tif_clientdata, module,
		57	@@ -268,13 +275,17 @@
		58	if (sp->user_datafmt == SGILOGDATAFMT_RAW)
		59	tp = (uint32 *)op;
		60	else {
		61	- assert(sp->tbuflen >= npixels);
		62	+ if(sp->tbuflen < npixels) {
		63	+ TIFFErrorExt(tif->tif_clientdata, module,
		64	+ "Translation buffer too short");
65	+ return (0);
66	+ }
67	tp = (uint32 *) sp->tbuf;
68	}
69	/* copy to array of uint32 */
70	bp = (unsigned char*) tif->tif_rawcp;
71	cc = tif->tif_rawcc;
72	- for (i = 0; i < npixels && cc > 0; i++) {
73	+ for (i = 0; i < npixels && cc >= 3; i++) {
74	tp[i] = bp[0] << 16 \| bp[1] << 8 \| bp[2];
75	bp += 3;
76	cc -= 3;
77	@@ -325,7 +336,11 @@
78	if (sp->user_datafmt == SGILOGDATAFMT_RAW)
79	tp = (uint32*) op;
80	else {
81	- assert(sp->tbuflen >= npixels);
82	+ if(sp->tbuflen < npixels) {
83	+ TIFFErrorExt(tif->tif_clientdata, module,
84	+ "Translation buffer too short");
85	+ return (0);
86	+ }
87	tp = (uint32*) sp->tbuf;
88	}
89	_TIFFmemset((void) tp, 0, npixelssizeof (tp[0]));
90	@@ -334,11 +349,13 @@
91	cc = tif->tif_rawcc;
92	/* get each byte string */
93	for (shft = 4*8; (shft -= 8) >= 0; ) {
94	- for (i = 0; i < npixels && cc > 0; )
95	+ for (i = 0; i < npixels && cc > 0; ) {
96	if (bp >= 128) { / run */
97	+ if( cc < 2 )
98	+ break;
99	rc = *bp++ + (2-128);
100	b = (uint32)*bp++ << shft;
101	- cc -= 2; /* TODO: potential input buffer overrun when decoding corrupt or truncated data */
102	+ cc -= 2;
103	while (rc-- && i < npixels)
104	tp[i++] \|= b;
105	} else { /* non-run */
106	@@ -346,6 +363,7 @@
107	while (--cc && rc-- && i < npixels)
108	tp[i++] \|= (uint32)*bp++ << shft;
109	}
110	+ }
111	if (i != npixels) {
112	#if defined(__WIN32__) && (defined(_MSC_VER) \|\| defined(__MINGW32__))
113	TIFFErrorExt(tif->tif_clientdata, module,
114	@@ -413,6 +431,7 @@
115	static int
116	LogL16Encode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
117	{
118	+ static const char module[] = "LogL16Encode";
119	LogLuvState* sp = EncoderState(tif);
120	int shft;
121	tmsize_t i;
122	@@ -433,7 +452,11 @@
123	tp = (int16*) bp;
124	else {
125	tp = (int16*) sp->tbuf;
126	- assert(sp->tbuflen >= npixels);
127	+ if(sp->tbuflen < npixels) {
128	+ TIFFErrorExt(tif->tif_clientdata, module,
129	+ "Translation buffer too short");
130	+ return (0);
131	+ }
132	(*sp->tfunc)(sp, bp, npixels);
133	}
134	/* compress each byte string */
135	@@ -506,6 +529,7 @@
136	static int
137	LogLuvEncode24(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
138	{
139	+ static const char module[] = "LogLuvEncode24";
140	LogLuvState* sp = EncoderState(tif);
141	tmsize_t i;
142	tmsize_t npixels;
143	@@ -521,7 +545,11 @@
144	tp = (uint32*) bp;
145	else {
146	tp = (uint32*) sp->tbuf;
147	- assert(sp->tbuflen >= npixels);
148	+ if(sp->tbuflen < npixels) {
149	+ TIFFErrorExt(tif->tif_clientdata, module,
150	+ "Translation buffer too short");
151	+ return (0);
152	+ }
153	(*sp->tfunc)(sp, bp, npixels);
154	}
155	/* write out encoded pixels */
156	@@ -553,6 +581,7 @@
157	static int
158	LogLuvEncode32(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
159	{
160	+ static const char module[] = "LogLuvEncode32";
161	LogLuvState* sp = EncoderState(tif);
162	int shft;
163	tmsize_t i;
164	@@ -574,7 +603,11 @@
165	tp = (uint32*) bp;
166	else {
167	tp = (uint32*) sp->tbuf;
168	- assert(sp->tbuflen >= npixels);
169	+ if(sp->tbuflen < npixels) {
170	+ TIFFErrorExt(tif->tif_clientdata, module,
171	+ "Translation buffer too short");
172	+ return (0);
173	+ }
174	(*sp->tfunc)(sp, bp, npixels);
175	}
176	/* compress each byte string */

Line 0 Link Here

(-)files/patch-libtiff_tif__next.c (+54 lines)
	1	revision 1.17
	2	date: 2015-12-27 16:55:20 +0000; author: erouault; state: Exp; lines: +9 -3; commitid: 4yLOaM0uFVPyJBOy;
	3	* libtiff/tif_next.c: fix potential out-of-bound write in NeXTDecode()
	4	triggered by http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif
	5	(bugzilla #2508)
	6
	7	Index: libtiff/tif_next.c
	8	===================================================================
	9	RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_next.c,v
	10	retrieving revision 1.16
	11	retrieving revision 1.17
	12	diff -u -r1.16 -r1.17
	13	--- libtiff/tif_next.c 29 Dec 2014 12:09:11 -0000 1.16
	14	+++ libtiff/tif_next.c 27 Dec 2015 16:55:20 -0000 1.17
	15	@@ -1,4 +1,4 @@
	16	-/* $Id: tif_next.c,v 1.16 2014-12-29 12:09:11 erouault Exp $ */
	17	+/* $Id: tif_next.c,v 1.17 2015-12-27 16:55:20 erouault Exp $ */
	18
	19	/*
	20	* Copyright (c) 1988-1997 Sam Leffler
	21	@@ -37,7 +37,7 @@
	22	case 0: op[0] = (unsigned char) ((v) << 6); break; \
	23	case 1: op[0] \|= (v) << 4; break; \
	24	case 2: op[0] \|= (v) << 2; break; \
	25	- case 3: *op++ \|= (v); break; \
	26	+ case 3: *op++ \|= (v); op_offset++; break; \
	27	} \
	28	}
	29
	30	@@ -106,6 +106,7 @@
	31	uint32 imagewidth = tif->tif_dir.td_imagewidth;
	32	if( isTiled(tif) )
	33	imagewidth = tif->tif_dir.td_tilewidth;
	34	+ tmsize_t op_offset = 0;
	35
	36	/*
	37	* The scanline is composed of a sequence of constant
	38	@@ -122,10 +123,15 @@
	39	* bounds, potentially resulting in a security
	40	* issue.
	41	*/
	42	- while (n-- > 0 && npixels < imagewidth)
	43	+ while (n-- > 0 && npixels < imagewidth && op_offset < scanline)
	44	SETPIXEL(op, grey);
	45	if (npixels >= imagewidth)
	46	break;
	47	+ if (op_offset >= scanline ) {
	48	+ TIFFErrorExt(tif->tif_clientdata, module, "Invalid data for scanline %ld",
	49	+ (long) tif->tif_row);
	50	+ return (0);
	51	+ }
	52	if (cc == 0)
	53	goto bad;
	54	n = *bp++, cc--;