gnu: libtiff: Fix CVE-2018-{8905,10963}.
* gnu/packages/patches/libtiff-CVE-2018-8905.patch, gnu/packages/patches/libtiff-CVE-2018-10963.patch: New files. * gnu/local.mk (dist_patch_DATA): Add them. * gnu/packages/image.scm (libtiff)[replacement]: New field. (libtiff/fixed): New variable.
This commit is contained in:
parent
671dd8d6e6
commit
8dbfaff028
|
@ -887,6 +887,8 @@ dist_patch_DATA = \
|
|||
%D%/packages/patches/libtheora-config-guess.patch \
|
||||
%D%/packages/patches/libtiff-CVE-2017-9935.patch \
|
||||
%D%/packages/patches/libtiff-CVE-2017-18013.patch \
|
||||
%D%/packages/patches/libtiff-CVE-2018-8905.patch \
|
||||
%D%/packages/patches/libtiff-CVE-2018-10963.patch \
|
||||
%D%/packages/patches/libtool-skip-tests2.patch \
|
||||
%D%/packages/patches/libusb-0.1-disable-tests.patch \
|
||||
%D%/packages/patches/libusb-for-axoloti.patch \
|
||||
|
|
|
@ -394,6 +394,7 @@ extracting icontainer icon files.")
|
|||
(define-public libtiff
|
||||
(package
|
||||
(name "libtiff")
|
||||
(replacement libtiff/fixed)
|
||||
(version "4.0.9")
|
||||
(source
|
||||
(origin
|
||||
|
@ -426,6 +427,17 @@ collection of tools for doing simple manipulations of TIFF images.")
|
|||
"See COPYRIGHT in the distribution."))
|
||||
(home-page "http://www.simplesystems.org/libtiff/")))
|
||||
|
||||
(define libtiff/fixed
|
||||
(package
|
||||
(inherit libtiff)
|
||||
(source
|
||||
(origin
|
||||
(inherit (package-source libtiff))
|
||||
(patches
|
||||
(append (origin-patches (package-source libtiff))
|
||||
(search-patches "libtiff-CVE-2018-8905.patch"
|
||||
"libtiff-CVE-2018-10963.patch")))))))
|
||||
|
||||
(define-public leptonica
|
||||
(package
|
||||
(name "leptonica")
|
||||
|
|
|
@ -0,0 +1,40 @@
|
|||
Fix CVE-2018-10963:
|
||||
|
||||
http://bugzilla.maptools.org/show_bug.cgi?id=2795
|
||||
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10963
|
||||
|
||||
Patch copied from upstream source repository:
|
||||
|
||||
https://gitlab.com/libtiff/libtiff/commit/de144fd228e4be8aa484c3caf3d814b6fa88c6d9
|
||||
|
||||
From de144fd228e4be8aa484c3caf3d814b6fa88c6d9 Mon Sep 17 00:00:00 2001
|
||||
From: Even Rouault <even.rouault@spatialys.com>
|
||||
Date: Sat, 12 May 2018 14:24:15 +0200
|
||||
Subject: [PATCH] TIFFWriteDirectorySec: avoid assertion. Fixes
|
||||
http://bugzilla.maptools.org/show_bug.cgi?id=2795. CVE-2018-10963
|
||||
|
||||
---
|
||||
libtiff/tif_dirwrite.c | 7 +++++--
|
||||
1 file changed, 5 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c
|
||||
index 2430de6d..c15a28db 100644
|
||||
--- a/libtiff/tif_dirwrite.c
|
||||
+++ b/libtiff/tif_dirwrite.c
|
||||
@@ -695,8 +695,11 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
|
||||
}
|
||||
break;
|
||||
default:
|
||||
- assert(0); /* we should never get here */
|
||||
- break;
|
||||
+ TIFFErrorExt(tif->tif_clientdata,module,
|
||||
+ "Cannot write tag %d (%s)",
|
||||
+ TIFFFieldTag(o),
|
||||
+ o->field_name ? o->field_name : "unknown");
|
||||
+ goto bad;
|
||||
}
|
||||
}
|
||||
}
|
||||
--
|
||||
2.17.0
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
Fix CVE-2018-8095:
|
||||
|
||||
http://bugzilla.maptools.org/show_bug.cgi?id=2780
|
||||
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8905
|
||||
|
||||
Patch copied from upstream source repository:
|
||||
|
||||
https://gitlab.com/libtiff/libtiff/commit/58a898cb4459055bb488ca815c23b880c242a27d
|
||||
|
||||
From 58a898cb4459055bb488ca815c23b880c242a27d Mon Sep 17 00:00:00 2001
|
||||
From: Even Rouault <even.rouault@spatialys.com>
|
||||
Date: Sat, 12 May 2018 15:32:31 +0200
|
||||
Subject: [PATCH] LZWDecodeCompat(): fix potential index-out-of-bounds write.
|
||||
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2780 / CVE-2018-8905
|
||||
|
||||
The fix consists in using the similar code LZWDecode() to validate we
|
||||
don't write outside of the output buffer.
|
||||
---
|
||||
libtiff/tif_lzw.c | 18 ++++++++++++------
|
||||
1 file changed, 12 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
|
||||
index 4ccb443c..94d85e38 100644
|
||||
--- a/libtiff/tif_lzw.c
|
||||
+++ b/libtiff/tif_lzw.c
|
||||
@@ -602,6 +602,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
|
||||
char *tp;
|
||||
unsigned char *bp;
|
||||
int code, nbits;
|
||||
+ int len;
|
||||
long nextbits, nextdata, nbitsmask;
|
||||
code_t *codep, *free_entp, *maxcodep, *oldcodep;
|
||||
|
||||
@@ -753,13 +754,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
|
||||
} while (--occ);
|
||||
break;
|
||||
}
|
||||
- assert(occ >= codep->length);
|
||||
- op += codep->length;
|
||||
- occ -= codep->length;
|
||||
- tp = op;
|
||||
+ len = codep->length;
|
||||
+ tp = op + len;
|
||||
do {
|
||||
- *--tp = codep->value;
|
||||
- } while( (codep = codep->next) != NULL );
|
||||
+ int t;
|
||||
+ --tp;
|
||||
+ t = codep->value;
|
||||
+ codep = codep->next;
|
||||
+ *tp = (char)t;
|
||||
+ } while (codep && tp > op);
|
||||
+ assert(occ >= len);
|
||||
+ op += len;
|
||||
+ occ -= len;
|
||||
} else {
|
||||
*op++ = (char)code;
|
||||
occ--;
|
||||
--
|
||||
2.17.0
|
||||
|
Loading…
Reference in New Issue