1 |
commit: b5f874c2b8cbbdb0eb013c1543ef3aaddbe67903 |
2 |
Author: Michael Vetter <jubalh <AT> iodoru <DOT> org> |
3 |
AuthorDate: Tue Feb 20 14:18:53 2018 +0000 |
4 |
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org> |
5 |
CommitDate: Tue Feb 20 14:29:48 2018 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b5f874c2 |
7 |
|
8 |
media-libs/tiff: Fix CVE-2018-5784 |
9 |
|
10 |
Patch is upstream commit: |
11 |
https://gitlab.com/libtiff/libtiff/commit/473851d211cf8805a161820337ca74cc9615d6ef |
12 |
|
13 |
Bug: https://bugs.gentoo.org/645730 |
14 |
|
15 |
Package-Manager: Portage-2.3.19, Repoman-2.3.6 |
16 |
Closes: https://github.com/gentoo/gentoo/pull/7237 |
17 |
|
18 |
.../tiff/files/tiff-4.0.9-CVE-2018-5784.patch | 128 +++++++++++++++++++++ |
19 |
media-libs/tiff/tiff-4.0.9-r3.ebuild | 84 ++++++++++++++ |
20 |
2 files changed, 212 insertions(+) |
21 |
|
22 |
diff --git a/media-libs/tiff/files/tiff-4.0.9-CVE-2018-5784.patch b/media-libs/tiff/files/tiff-4.0.9-CVE-2018-5784.patch |
23 |
new file mode 100644 |
24 |
index 00000000000..56d0f4b0687 |
25 |
--- /dev/null |
26 |
+++ b/media-libs/tiff/files/tiff-4.0.9-CVE-2018-5784.patch |
27 |
@@ -0,0 +1,128 @@ |
28 |
+From 473851d211cf8805a161820337ca74cc9615d6ef Mon Sep 17 00:00:00 2001 |
29 |
+From: Nathan Baker <nathanb@×××××××××××××.com> |
30 |
+Date: Tue, 6 Feb 2018 10:13:57 -0500 |
31 |
+Subject: [PATCH] Fix for bug 2772 |
32 |
+ |
33 |
+It is possible to craft a TIFF document where the IFD list is circular, |
34 |
+leading to an infinite loop while traversing the chain. The libtiff |
35 |
+directory reader has a failsafe that will break out of this loop after |
36 |
+reading 65535 directory entries, but it will continue processing, |
37 |
+consuming time and resources to process what is essentially a bogus TIFF |
38 |
+document. |
39 |
+ |
40 |
+This change fixes the above behavior by breaking out of processing when |
41 |
+a TIFF document has >= 65535 directories and terminating with an error. |
42 |
+--- |
43 |
+ contrib/addtiffo/tif_overview.c | 14 +++++++++++++- |
44 |
+ tools/tiff2pdf.c | 10 ++++++++++ |
45 |
+ tools/tiffcrop.c | 13 +++++++++++-- |
46 |
+ 3 files changed, 34 insertions(+), 3 deletions(-) |
47 |
+ |
48 |
+diff --git a/contrib/addtiffo/tif_overview.c b/contrib/addtiffo/tif_overview.c |
49 |
+index c61ffbb..03b3573 100644 |
50 |
+--- a/contrib/addtiffo/tif_overview.c |
51 |
++++ b/contrib/addtiffo/tif_overview.c |
52 |
+@@ -65,6 +65,8 @@ |
53 |
+ # define MAX(a,b) ((a>b) ? a : b) |
54 |
+ #endif |
55 |
+ |
56 |
++#define TIFF_DIR_MAX 65534 |
57 |
++ |
58 |
+ void TIFFBuildOverviews( TIFF *, int, int *, int, const char *, |
59 |
+ int (*)(double,void*), void * ); |
60 |
+ |
61 |
+@@ -91,6 +93,7 @@ uint32 TIFF_WriteOverview( TIFF *hTIFF, uint32 nXSize, uint32 nYSize, |
62 |
+ { |
63 |
+ toff_t nBaseDirOffset; |
64 |
+ toff_t nOffset; |
65 |
++ tdir_t iNumDir; |
66 |
+ |
67 |
+ (void) bUseSubIFDs; |
68 |
+ |
69 |
+@@ -147,7 +150,16 @@ uint32 TIFF_WriteOverview( TIFF *hTIFF, uint32 nXSize, uint32 nYSize, |
70 |
+ return 0; |
71 |
+ |
72 |
+ TIFFWriteDirectory( hTIFF ); |
73 |
+- TIFFSetDirectory( hTIFF, (tdir_t) (TIFFNumberOfDirectories(hTIFF)-1) ); |
74 |
++ iNumDir = TIFFNumberOfDirectories(hTIFF); |
75 |
++ if( iNumDir > TIFF_DIR_MAX ) |
76 |
++ { |
77 |
++ TIFFErrorExt( TIFFClientdata(hTIFF), |
78 |
++ "TIFF_WriteOverview", |
79 |
++ "File `%s' has too many directories.\n", |
80 |
++ TIFFFileName(hTIFF) ); |
81 |
++ exit(-1); |
82 |
++ } |
83 |
++ TIFFSetDirectory( hTIFF, (tdir_t) (iNumDir - 1) ); |
84 |
+ |
85 |
+ nOffset = TIFFCurrentDirOffset( hTIFF ); |
86 |
+ |
87 |
+diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c |
88 |
+index 984ef65..832a247 100644 |
89 |
+--- a/tools/tiff2pdf.c |
90 |
++++ b/tools/tiff2pdf.c |
91 |
+@@ -68,6 +68,8 @@ extern int getopt(int, char**, char*); |
92 |
+ |
93 |
+ #define PS_UNIT_SIZE 72.0F |
94 |
+ |
95 |
++#define TIFF_DIR_MAX 65534 |
96 |
++ |
97 |
+ /* This type is of PDF color spaces. */ |
98 |
+ typedef enum { |
99 |
+ T2P_CS_BILEVEL = 0x01, /* Bilevel, black and white */ |
100 |
+@@ -1051,6 +1053,14 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){ |
101 |
+ uint16* tiff_transferfunction[3]; |
102 |
+ |
103 |
+ directorycount=TIFFNumberOfDirectories(input); |
104 |
++ if(directorycount > TIFF_DIR_MAX) { |
105 |
++ TIFFError( |
106 |
++ TIFF2PDF_MODULE, |
107 |
++ "TIFF contains too many directories, %s", |
108 |
++ TIFFFileName(input)); |
109 |
++ t2p->t2p_error = T2P_ERR_ERROR; |
110 |
++ return; |
111 |
++ } |
112 |
+ t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE))); |
113 |
+ if(t2p->tiff_pages==NULL){ |
114 |
+ TIFFError( |
115 |
+diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c |
116 |
+index 91a38f6..e466dae 100644 |
117 |
+--- a/tools/tiffcrop.c |
118 |
++++ b/tools/tiffcrop.c |
119 |
+@@ -215,6 +215,8 @@ extern int getopt(int argc, char * const argv[], const char *optstring); |
120 |
+ #define DUMP_TEXT 1 |
121 |
+ #define DUMP_RAW 2 |
122 |
+ |
123 |
++#define TIFF_DIR_MAX 65534 |
124 |
++ |
125 |
+ /* Offsets into buffer for margins and fixed width and length segments */ |
126 |
+ struct offset { |
127 |
+ uint32 tmargin; |
128 |
+@@ -2232,7 +2234,7 @@ main(int argc, char* argv[]) |
129 |
+ pageNum = -1; |
130 |
+ else |
131 |
+ total_images = 0; |
132 |
+- /* read multiple input files and write to output file(s) */ |
133 |
++ /* Read multiple input files and write to output file(s) */ |
134 |
+ while (optind < argc - 1) |
135 |
+ { |
136 |
+ in = TIFFOpen (argv[optind], "r"); |
137 |
+@@ -2240,7 +2242,14 @@ main(int argc, char* argv[]) |
138 |
+ return (-3); |
139 |
+ |
140 |
+ /* If only one input file is specified, we can use directory count */ |
141 |
+- total_images = TIFFNumberOfDirectories(in); |
142 |
++ total_images = TIFFNumberOfDirectories(in); |
143 |
++ if (total_images > TIFF_DIR_MAX) |
144 |
++ { |
145 |
++ TIFFError (TIFFFileName(in), "File contains too many directories"); |
146 |
++ if (out != NULL) |
147 |
++ (void) TIFFClose(out); |
148 |
++ return (1); |
149 |
++ } |
150 |
+ if (image_count == 0) |
151 |
+ { |
152 |
+ dirnum = 0; |
153 |
+-- |
154 |
+libgit2 0.26.0 |
155 |
+ |
156 |
|
157 |
diff --git a/media-libs/tiff/tiff-4.0.9-r3.ebuild b/media-libs/tiff/tiff-4.0.9-r3.ebuild |
158 |
new file mode 100644 |
159 |
index 00000000000..b8364e2b3cf |
160 |
--- /dev/null |
161 |
+++ b/media-libs/tiff/tiff-4.0.9-r3.ebuild |
162 |
@@ -0,0 +1,84 @@ |
163 |
+# Copyright 1999-2018 Gentoo Foundation |
164 |
+# Distributed under the terms of the GNU General Public License v2 |
165 |
+ |
166 |
+EAPI=6 |
167 |
+ |
168 |
+inherit autotools libtool ltprune multilib-minimal |
169 |
+ |
170 |
+DESCRIPTION="Tag Image File Format (TIFF) library" |
171 |
+HOMEPAGE="http://libtiff.maptools.org" |
172 |
+SRC_URI="http://download.osgeo.org/libtiff/${P}.tar.gz |
173 |
+ ftp://ftp.remotesensing.org/pub/libtiff/${P}.tar.gz" |
174 |
+ |
175 |
+LICENSE="libtiff" |
176 |
+SLOT="0" |
177 |
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~x64-solaris ~x86-solaris" |
178 |
+IUSE="+cxx jbig jpeg lzma static-libs test zlib" |
179 |
+ |
180 |
+RDEPEND="jpeg? ( >=virtual/jpeg-0-r2:0=[${MULTILIB_USEDEP}] ) |
181 |
+ jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] ) |
182 |
+ lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] ) |
183 |
+ zlib? ( >=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}] ) |
184 |
+ abi_x86_32? ( |
185 |
+ !<=app-emulation/emul-linux-x86-baselibs-20130224-r9 |
186 |
+ !app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)] |
187 |
+ )" |
188 |
+DEPEND="${RDEPEND}" |
189 |
+ |
190 |
+REQUIRED_USE="test? ( jpeg )" #483132 |
191 |
+ |
192 |
+PATCHES=( |
193 |
+ "${FILESDIR}"/${PN}-4.0.7-pdfium-0006-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch |
194 |
+ "${FILESDIR}"/${PN}-4.0.7-pdfium-0008-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch |
195 |
+ "${FILESDIR}"/${P}-CVE-2017-9935.patch #624696 |
196 |
+ "${FILESDIR}"/${P}-CVE-2017-9935-fix-incorrect-type.patch #624696 |
197 |
+ "${FILESDIR}"/${P}-CVE-2018-5784.patch #645730 |
198 |
+) |
199 |
+ |
200 |
+MULTILIB_WRAPPED_HEADERS=( |
201 |
+ /usr/include/tiffconf.h |
202 |
+) |
203 |
+ |
204 |
+src_prepare() { |
205 |
+ default |
206 |
+ |
207 |
+ # tiffcp-thumbnail.sh fails as thumbnail binary doesn't get built anymore since tiff-4.0.7 |
208 |
+ sed '/tiffcp-thumbnail\.sh/d' -i test/Makefile.am || die |
209 |
+ |
210 |
+ eautoreconf |
211 |
+} |
212 |
+ |
213 |
+multilib_src_configure() { |
214 |
+ local myeconfargs=( |
215 |
+ --without-x |
216 |
+ $(use_enable cxx) |
217 |
+ $(use_enable jbig) |
218 |
+ $(use_enable jpeg) |
219 |
+ $(use_enable lzma) |
220 |
+ $(use_enable static-libs static) |
221 |
+ $(use_enable zlib) |
222 |
+ ) |
223 |
+ ECONF_SOURCE="${S}" econf "${myeconfargs[@]}" |
224 |
+ |
225 |
+ # remove useless subdirs |
226 |
+ if ! multilib_is_native_abi ; then |
227 |
+ sed -i \ |
228 |
+ -e 's/ tools//' \ |
229 |
+ -e 's/ contrib//' \ |
230 |
+ -e 's/ man//' \ |
231 |
+ -e 's/ html//' \ |
232 |
+ Makefile || die |
233 |
+ fi |
234 |
+} |
235 |
+ |
236 |
+multilib_src_test() { |
237 |
+ if ! multilib_is_native_abi ; then |
238 |
+ emake -C tools |
239 |
+ fi |
240 |
+ emake check |
241 |
+} |
242 |
+ |
243 |
+multilib_src_install_all() { |
244 |
+ prune_libtool_files --all |
245 |
+ rm -f "${ED%/}"/usr/share/doc/${PF}/{COPYRIGHT,README*,RELEASE-DATE,TODO,VERSION} |
246 |
+} |