gnu/packages/patches/libtiff-invalid-read.patch

   1 Fix invalid read in t2p_writeproc():
   2
   3 http://bugzilla.maptools.org/show_bug.cgi?id=2639
   4
   5 2016-12-20 Even Rouault <even.rouault at spatialys.com>
   6
   7         * tools/tiff2pdf.c: avoid potential invalid memory read in
   8         t2p_writeproc.
   9         Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2639
  10
  11
  12 /cvs/maptools/cvsroot/libtiff/ChangeLog,v  <--  ChangeLog
  13 new revision: 1.1198; previous revision: 1.1197
  14 /cvs/maptools/cvsroot/libtiff/tools/tiff2pdf.c,v  <--  tools/tiff2pdf.c
  15 new revision: 1.100; previous revision: 1.99
  16
  17 Index: libtiff/tools/tiff2pdf.c
  18 ===================================================================
  19 RCS file: /cvs/maptools/cvsroot/libtiff/tools/tiff2pdf.c,v
  20 retrieving revision 1.99
  21 retrieving revision 1.100
  22 diff -u -r1.99 -r1.100
  23 --- libtiff/tools/tiff2pdf.c    20 Dec 2016 17:13:26 -0000      1.99
  24 +++ libtiff/tools/tiff2pdf.c    20 Dec 2016 17:24:35 -0000      1.100
  25 @@ -2896,6 +2896,7 @@
  26                         }
  27                         if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) {
  28                                 if (count >= 4) {
  29 +                                        int retTIFFReadRawTile;
  30                      /* Ignore EOI marker of JpegTables */
  31                                         _TIFFmemcpy(buffer, jpt, count - 2);
  32                                         bufferoffset += count - 2;
  33 @@ -2903,22 +2904,23 @@
  34                                         table_end[0] = buffer[bufferoffset-2];
  35                                         table_end[1] = buffer[bufferoffset-1];
  36                                         xuint32 = bufferoffset;
  37 -                    bufferoffset -= 2;
  38 -                                       bufferoffset += TIFFReadRawTile(
  39 +                                        bufferoffset -= 2;
  40 +                                        retTIFFReadRawTile= TIFFReadRawTile(
  41                                                 input,
  42                                                 tile,
  43                                                 (tdata_t) &(((unsigned char*)buffer)[bufferoffset]),
  44                                                 -1);
  45 +                                        if( retTIFFReadRawTile < 0 )
  46 +                                        {
  47 +                                            _TIFFfree(buffer);
  48 +                                            t2p->t2p_error = T2P_ERR_ERROR;
  49 +                                            return(0);
  50 +                                        }
  51 +                                       bufferoffset += retTIFFReadRawTile;
  52                      /* Overwrite SOI marker of image scan with previously */
  53                      /* saved end of JpegTables */
  54                                         buffer[xuint32-2]=table_end[0];
  55                                         buffer[xuint32-1]=table_end[1];
  56 -                               } else {
  57 -                                       bufferoffset += TIFFReadRawTile(
  58 -                                               input,
  59 -                                               tile,
  60 -                                               (tdata_t) &(((unsigned char*)buffer)[bufferoffset]),
  61 -                                               -1);
  62                                 }
  63                         }
  64                         t2pWriteFile(output, (tdata_t) buffer, bufferoffset);