Subject: [alpine-aports] [PATCH v3.4] main/tiff: security fixes

From: Sergey Lukin <[email-masked]>
Date: Fri, 16 Dec 2016 13:20:07 +0000

CVE-2015-8668, CVE-2016-3945, CVE-2016-3990
---
 main/tiff/APKBUILD            | 31 ++++++++++----
 main/tiff/CVE-2015-8668.patch | 40 ++++++++++++++++++
 main/tiff/CVE-2016-3945.patch | 95 +++++++++++++++++++++++++++++++++++++++++++
 main/tiff/CVE-2016-3990.patch | 35 ++++++++++++++++
 4 files changed, 192 insertions(+), 9 deletions(-)
 create mode 100644 main/tiff/CVE-2015-8668.patch
 create mode 100644 main/tiff/CVE-2016-3945.patch
 create mode 100644 main/tiff/CVE-2016-3990.patch

diff --git a/main/tiff/APKBUILD b/main/tiff/APKBUILD
index bf84f4d..85256eb 100644
--- a/main/tiff/APKBUILD
+++ b/main/tiff/APKBUILD
@@ -1,8 +1,9 @@
 # Contributor: Leonardo Arena <[email-masked]>
 # Maintainer: Michael Mason <[email-masked]>
+# Contributor: Sergey Lukin <[email-masked]>
 pkgname=tiff
 pkgver=4.0.6
-pkgrel=3
+pkgrel=4
 pkgdesc="Provides support for the Tag Image File Format or TIFF"
 url="http://www.libtiff.org/"
 arch="all"
@@ -11,17 +12,20 @@ depends=
 depends_dev="zlib-dev libjpeg-turbo-dev"
 makedepends="libtool autoconf automake $depends_dev"
 subpackages="$pkgname-doc $pkgname-dev $pkgname-tools"
-source="ftp://ftp.remotesensing.org/pub/libtiff/$pkgname-$pkgver.tar.gz
+source="http://download.osgeo.org/libtiff/$pkgname-$pkgver.tar.gz
 	CVE-2015-8665.patch
+	CVE-2015-8668.patch
 	CVE-2015-8781-8782-8783.patch
 	CVE-2015-8784.patch
+	CVE-2016-3945.patch
+	CVE-2016-3990.patch
 	"
 
-_builddir="$srcdir"/$pkgname-$pkgver
+builddir="$srcdir"/$pkgname-$pkgver
 
 prepare() {
 	local _failed=
-	cd "$_builddir"
+	cd "$builddir"
 	update_config_sub || return 1
 	for i in $source; do
 		case $i in
@@ -31,7 +35,7 @@ prepare() {
 }
 
 build() {
-	cd "$_builddir"
+	cd "$builddir"
 
 	./configure \
 		--build=$CBUILD \
@@ -46,7 +50,7 @@ build() {
 }
 
 package() {
-	cd "$_builddir"
+	cd "$builddir"
 	make DESTDIR="$pkgdir" install
 }
 
@@ -58,13 +62,22 @@ tools() {
 
 md5sums="d1d2e940dea0b5ad435f21f03d96dd72  tiff-4.0.6.tar.gz
 1ed2295ff179a6b64803d33f0f865740  CVE-2015-8665.patch
+afb8f33be03452530ec08e17adfb2b4e  CVE-2015-8668.patch
 96d2a934914a548d244e0a055f370334  CVE-2015-8781-8782-8783.patch
-8b3e84314fc2c0eeabd8d2c410f85727  CVE-2015-8784.patch"
+8b3e84314fc2c0eeabd8d2c410f85727  CVE-2015-8784.patch
+2d6bc5b89e7283b87c615a905d2e3336  CVE-2016-3945.patch
+f1732576a00613b89d580b186d34b4b8  CVE-2016-3990.patch"
 sha256sums="4d57a50907b510e3049a4bba0d7888930fdfc16ce49f1bf693e5b6247370d68c  tiff-4.0.6.tar.gz
 1e4158f2a85e4c597b2a6d290c54d4ee815c8930f80824363945506bda3fc798  CVE-2015-8665.patch
+4a758a18324c0cf905230b84797760b9104e5fcce4667691ab330a77bd7fbef3  CVE-2015-8668.patch
 f7c953c51f4f14b8627aad9bfe5b183b5d56e62e96e24d80a233e0b849c0c743  CVE-2015-8781-8782-8783.patch
-504332761f3e72d8424fd59d4e2c75dd280f61efbbd4e60f6bc0e1f91ed9e972  CVE-2015-8784.patch"
+504332761f3e72d8424fd59d4e2c75dd280f61efbbd4e60f6bc0e1f91ed9e972  CVE-2015-8784.patch
+654501fa6d69de7e79a1407baddd0bae35fb5deb2a32e919ca75b791ead4f568  CVE-2016-3945.patch
+c9c98ae4b2ccef568bffb8fc538df2977a733900ead6587ca1e6b8395115bc44  CVE-2016-3990.patch"
 sha512sums="2c8dbaaaab9f82a7722bfe8cb6fcfcf67472beb692f1b7dafaf322759e7016dad1bc58457c0f03db50aa5bd088fef2b37358fcbc1524e20e9e14a9620373fdf8  tiff-4.0.6.tar.gz
 4507d3852d57922574897d53f366d80d71d0d83850aa3c3993b956fabce26165f315838c17430d1abd41f160c40a4e3d8e6b31ff150e81059669ccfe29f90126  CVE-2015-8665.patch
+0bb232dc6e49d768007217f16d89e030ffd431a543314159017a9a44d5fb301e3ada918b9bcc6571f642cc39945d4b16eb125e8e5b42bf3430ec1985a73bd9b3  CVE-2015-8668.patch
 4ca7823f666df8f29eba0f62a14f71e440eef20fcc8d3a1a77cf65a07e1e737bdcfb49641ee5b62ce28877ef428106996254989d2100615dc7cf2be7aa903002  CVE-2015-8781-8782-8783.patch
-46c917d435bca839bc2bcdb170e1a9724e07da9ba9cdf1230168f1cef7b1e62c4af19ebe4892d9d56f29fcf2820b8f55e81539eca70120893b2f0894efcc370f  CVE-2015-8784.patch"
+46c917d435bca839bc2bcdb170e1a9724e07da9ba9cdf1230168f1cef7b1e62c4af19ebe4892d9d56f29fcf2820b8f55e81539eca70120893b2f0894efcc370f  CVE-2015-8784.patch
+3f2c74eebd0675000c881d33eaf85fb293729c2342a4994694a32f9b216205fa6c7698d13a8a3fe8dfdcbbfdb4bfb9932b169a0519811666d1fb651162711258  CVE-2016-3945.patch
+b1b9b80718be88d667376e70930fc6d4b15b9d093af98b1bb8da1398245bfb72fe1a756dd6ede3c0473d6a9ca664d59b06df008208c751aff440581fe4e9b80e  CVE-2016-3990.patch"
diff --git a/main/tiff/CVE-2015-8668.patch b/main/tiff/CVE-2015-8668.patch
new file mode 100644
index 0000000..a70f824
--- /dev/null
+++ b/main/tiff/CVE-2015-8668.patch
@@ -0,0 +1,40 @@
+diff --git a/tools/bmp2tiff.c b/tools/bmp2tiff.c
+index 376f4e6..c747c13 100644
+--- a/tools/bmp2tiff.c
++++ b/tools/bmp2tiff.c
+@@ -614,18 +614,27 @@ main(int argc, char* argv[])
+ 			    || info_hdr.iCompression == BMPC_RLE4 ) {
+ 			uint32		i, j, k, runlength;
+ 			uint32		compr_size, uncompr_size;
++			uint32      bits = 0;
+ 			unsigned char   *comprbuf;
+ 			unsigned char   *uncomprbuf;
+ 
+ 			compr_size = file_hdr.iSize - file_hdr.iOffBits;
+-			uncompr_size = width * length;
+-            /* Detect int overflow */
+-            if( uncompr_size / width != length ) {
+-                TIFFError(infilename,
+-                    "Invalid dimensions of BMP file" );
+-                close(fd);
+-                return -1;
+-            }
++
++			bits = info_hdr.iBitCount;
++
++			if (bits > 8) // bit depth is > 8bit, adjust size
++			{
++				uncompr_size = width * length * (bits / 8);
++				/* Detect int overflow */
++				if (uncompr_size / width / (bits / 8) != length) {
++					TIFFError(infilename,
++							   "Invalid dimensions of BMP file");
++					close(fd);
++					return -1;
++				}
++			}
++			else
++				uncompr_size = width * length;
+                         if ( (compr_size == 0) ||
+                              (compr_size > ((uint32) ~0) >> 1) ||
+                              (uncompr_size == 0) ||
diff --git a/main/tiff/CVE-2016-3945.patch b/main/tiff/CVE-2016-3945.patch
new file mode 100644
index 0000000..75493bb
--- /dev/null
+++ b/main/tiff/CVE-2016-3945.patch
@@ -0,0 +1,95 @@
+From 7c39352ccd9060d311d3dc9a1f1bc00133a160e6 Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Mon, 15 Aug 2016 20:06:40 +0000
+Subject: [PATCH] * tools/tiff2rgba.c: Fix integer overflow in size of
+ allocated buffer, when -b mode is enabled, that could result in out-of-bounds
+ write. Based initially on patch tiff-CVE-2016-3945.patch from
+ libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with correction for invalid
+ tests that rejected valid files.
+
+CVE: CVE-2016-3945
+Upstream-Status: Backport
+https://github.com/vadz/libtiff/commit/7c39352ccd9060d311d3dc9a1f1bc00133a160e6
+
+Signed-off-by: Yi Zhao <[email-masked]>
+---
+diff --git a/tools/tiff2rgba.c b/tools/tiff2rgba.c
+index b7a81eb..16e3dc4 100644
+--- a/tools/tiff2rgba.c
++++ b/tools/tiff2rgba.c
+@@ -147,6 +147,7 @@ cvt_by_tile( TIFF *in, TIFF *out )
+     uint32  row, col;
+     uint32  *wrk_line;
+     int	    ok = 1;
++    uint32  rastersize, wrk_linesize;
+ 
+     TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);
+     TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);
+@@ -163,7 +164,13 @@ cvt_by_tile( TIFF *in, TIFF *out )
+     /*
+      * Allocate tile buffer
+      */
+-    raster = (uint32*)_TIFFmalloc(tile_width * tile_height * sizeof (uint32));
++    rastersize = tile_width * tile_height * sizeof (uint32);
++    if (tile_width != (rastersize / tile_height) / sizeof( uint32))
++    {
++	TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");
++	exit(-1);
++    }
++    raster = (uint32*)_TIFFmalloc(rastersize);
+     if (raster == 0) {
+         TIFFError(TIFFFileName(in), "No space for raster buffer");
+         return (0);
+@@ -173,7 +180,13 @@ cvt_by_tile( TIFF *in, TIFF *out )
+      * Allocate a scanline buffer for swapping during the vertical
+      * mirroring pass.
+      */
+-    wrk_line = (uint32*)_TIFFmalloc(tile_width * sizeof (uint32));
++    wrk_linesize = tile_width * sizeof (uint32);
++    if (tile_width != wrk_linesize / sizeof (uint32))
++    {
++        TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");
++	exit(-1);
++    }
++    wrk_line = (uint32*)_TIFFmalloc(wrk_linesize);
+     if (!wrk_line) {
+         TIFFError(TIFFFileName(in), "No space for raster scanline buffer");
+         ok = 0;
+@@ -249,6 +262,7 @@ cvt_by_strip( TIFF *in, TIFF *out )
+     uint32  row;
+     uint32  *wrk_line;
+     int	    ok = 1;
++    uint32  rastersize, wrk_linesize;
+ 
+     TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);
+     TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);
+@@ -263,7 +277,13 @@ cvt_by_strip( TIFF *in, TIFF *out )
+     /*
+      * Allocate strip buffer
+      */
+-    raster = (uint32*)_TIFFmalloc(width * rowsperstrip * sizeof (uint32));
++    rastersize = width * rowsperstrip * sizeof (uint32);
++    if (width != (rastersize / rowsperstrip) / sizeof( uint32))
++    {
++	TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");
++	exit(-1);
++    }
++    raster = (uint32*)_TIFFmalloc(rastersize);
+     if (raster == 0) {
+         TIFFError(TIFFFileName(in), "No space for raster buffer");
+         return (0);
+@@ -273,7 +293,13 @@ cvt_by_strip( TIFF *in, TIFF *out )
+      * Allocate a scanline buffer for swapping during the vertical
+      * mirroring pass.
+      */
+-    wrk_line = (uint32*)_TIFFmalloc(width * sizeof (uint32));
++    wrk_linesize = width * sizeof (uint32);
++    if (width != wrk_linesize / sizeof (uint32))
++    {
++        TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");
++	exit(-1);
++    }
++    wrk_line = (uint32*)_TIFFmalloc(wrk_linesize);
+     if (!wrk_line) {
+         TIFFError(TIFFFileName(in), "No space for raster scanline buffer");
+         ok = 0;
diff --git a/main/tiff/CVE-2016-3990.patch b/main/tiff/CVE-2016-3990.patch
new file mode 100644
index 0000000..f5bbff6
--- /dev/null
+++ b/main/tiff/CVE-2016-3990.patch
@@ -0,0 +1,35 @@
+From 6a4dbb07ccf92836bb4adac7be4575672d0ac5f1 Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Mon, 15 Aug 2016 20:49:48 +0000
+Subject: [PATCH] * libtiff/tif_pixarlog.c: Fix write buffer overflow in
+ PixarLogEncode if more input samples are provided than expected by
+ PixarLogSetupEncode. Idea based on libtiff-CVE-2016-3990.patch from
+ libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with different and
+ simpler check. (bugzilla #2544)
+
+invalid tests that rejected valid files. (bugzilla #2545)
+
+CVE: CVE-2016-3990
+Upstream-Status: Backport
+https://github.com/vadz/libtiff/commit/6a4dbb07ccf92836bb4adac7be4575672d0ac5f1
+
+Signed-off-by: Yi Zhao <[email-masked]>
+---
+diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
+index e78f788..28329d1 100644
+--- a/libtiff/tif_pixarlog.c
++++ b/libtiff/tif_pixarlog.c
+@@ -1141,6 +1141,13 @@ PixarLogEncode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
+ 	}
+ 
+ 	llen = sp->stride * td->td_imagewidth;
++    /* Check against the number of elements (of size uint16) of sp->tbuf */
++    if( n > td->td_rowsperstrip * llen )
++    {
++        TIFFErrorExt(tif->tif_clientdata, module,
++                     "Too many input bytes provided");
++        return 0;
++    }
+ 
+ 	for (i = 0, up = sp->tbuf; i < n; i += llen, up += llen) {
+ 		switch (sp->user_datafmt)  {
-- 
2.8.3

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---