summaryrefslogtreecommitdiff
path: root/source/l/libtiff
diff options
context:
space:
mode:
authorPatrick J Volkerding <volkerdi@slackware.com>2011-04-25 13:37:00 +0000
committerEric Hameleers <alien@slackware.com>2018-05-31 22:45:18 +0200
commit75a4a592e5ccda30715f93563d741b83e0dcf39e (patch)
tree502f745607e77a2c4386ad38d818ddcafe81489c /source/l/libtiff
parentb76270bf9e6dd375e495fec92140a79a79415d27 (diff)
downloadcurrent-75a4a592e5ccda30715f93563d741b83e0dcf39e.tar.gz
Slackware 13.37slackware-13.37
Mon Apr 25 13:37:00 UTC 2011 Slackware 13.37 x86_64 stable is released! Thanks to everyone who pitched in on this release: the Slackware team, the folks producing upstream code, and linuxquestions.org for providing a great forum for collaboration and testing. The ISOs are off to be replicated, a 6 CD-ROM 32-bit set and a dual-sided 32-bit/64-bit x86/x86_64 DVD. Please consider supporting the Slackware project by picking up a copy from store.slackware.com. We're taking pre-orders now, and offer a discount if you sign up for a subscription. As always, thanks to the Slackware community for testing, suggestions, and feedback. :-) Have fun!
Diffstat (limited to 'source/l/libtiff')
-rw-r--r--source/l/libtiff/libtiff-CVE-2011-0192.patch27
-rw-r--r--source/l/libtiff/libtiff-CVE-2011-1167.patch53
-rwxr-xr-xsource/l/libtiff/libtiff.SlackBuild7
3 files changed, 85 insertions, 2 deletions
diff --git a/source/l/libtiff/libtiff-CVE-2011-0192.patch b/source/l/libtiff/libtiff-CVE-2011-0192.patch
new file mode 100644
index 00000000..892f70e0
--- /dev/null
+++ b/source/l/libtiff/libtiff-CVE-2011-0192.patch
@@ -0,0 +1,27 @@
+Protect against a fax VL(n) codeword commanding a move left. Without
+this, a malicious input file can generate an indefinitely large series
+of runs without a0 ever reaching the right margin, thus overrunning
+our buffer of run lengths. Per CVE-2011-0192. This is a modified
+version of a patch proposed by Drew Yao of Apple Product Security.
+It adds an unexpected() report, and disallows the equality case except
+for the first run of a line, since emitting a run without increasing a0
+still allows buffer overrun. (We have to allow it for the first run to
+cover the case of encoding a zero-length run at start of line using VL.)
+
+
+diff -Naur tiff-3.9.4.orig/libtiff/tif_fax3.h tiff-3.9.4/libtiff/tif_fax3.h
+--- tiff-3.9.4.orig/libtiff/tif_fax3.h 2010-06-08 14:50:42.000000000 -0400
++++ tiff-3.9.4/libtiff/tif_fax3.h 2011-03-10 12:11:20.850839162 -0500
+@@ -478,6 +478,12 @@
+ break; \
+ case S_VL: \
+ CHECK_b1; \
++ if (b1 <= (int) (a0 + TabEnt->Param)) { \
++ if (b1 < (int) (a0 + TabEnt->Param) || pa != thisrun) { \
++ unexpected("VL", a0); \
++ goto eol2d; \
++ } \
++ } \
+ SETVALUE(b1 - a0 - TabEnt->Param); \
+ b1 -= *--pb; \
+ break; \
diff --git a/source/l/libtiff/libtiff-CVE-2011-1167.patch b/source/l/libtiff/libtiff-CVE-2011-1167.patch
new file mode 100644
index 00000000..d3fcf6f6
--- /dev/null
+++ b/source/l/libtiff/libtiff-CVE-2011-1167.patch
@@ -0,0 +1,53 @@
+Upstream patch for CVE-2011-1167, heap-based buffer overflow in thunder
+decoder (ZDI-CAN-1004).
+
+
+diff -Naur tiff-3.9.4.orig/libtiff/tif_thunder.c tiff-3.9.4/libtiff/tif_thunder.c
+--- tiff-3.9.4.orig/libtiff/tif_thunder.c 2010-06-08 14:50:43.000000000 -0400
++++ tiff-3.9.4/libtiff/tif_thunder.c 2011-03-18 12:17:13.635796403 -0400
+@@ -55,12 +55,32 @@
+ static const int twobitdeltas[4] = { 0, 1, 0, -1 };
+ static const int threebitdeltas[8] = { 0, 1, 2, 3, 0, -3, -2, -1 };
+
+-#define SETPIXEL(op, v) { \
+- lastpixel = (v) & 0xf; \
+- if (npixels++ & 1) \
+- *op++ |= lastpixel; \
+- else \
++#define SETPIXEL(op, v) { \
++ lastpixel = (v) & 0xf; \
++ if ( npixels < maxpixels ) \
++ { \
++ if (npixels++ & 1) \
++ *op++ |= lastpixel; \
++ else \
+ op[0] = (tidataval_t) (lastpixel << 4); \
++ } \
++}
++
++static int
++ThunderSetupDecode(TIFF* tif)
++{
++ static const char module[] = "ThunderSetupDecode";
++
++ if( tif->tif_dir.td_bitspersample != 4 )
++ {
++ TIFFErrorExt(tif->tif_clientdata, module,
++ "Wrong bitspersample value (%d), Thunder decoder only supports 4bits per sample.",
++ (int) tif->tif_dir.td_bitspersample );
++ return 0;
++ }
++
++
++ return (1);
+ }
+
+ static int
+@@ -151,6 +171,7 @@
+ (void) scheme;
+ tif->tif_decoderow = ThunderDecodeRow;
+ tif->tif_decodestrip = ThunderDecodeRow;
++ tif->tif_setupdecode = ThunderSetupDecode;
+ return (1);
+ }
+ #endif /* THUNDER_SUPPORT */
diff --git a/source/l/libtiff/libtiff.SlackBuild b/source/l/libtiff/libtiff.SlackBuild
index d2e2556e..33e871f3 100755
--- a/source/l/libtiff/libtiff.SlackBuild
+++ b/source/l/libtiff/libtiff.SlackBuild
@@ -1,6 +1,6 @@
#!/bin/sh
-# Copyright 2005-2010 Patrick J. Volkerding, Sebeka, Minnesota, USA
+# Copyright 2005-2011 Patrick J. Volkerding, Sebeka, Minnesota, USA
# All rights reserved.
#
# Redistribution and use of this script, with or without modification, is
@@ -21,7 +21,7 @@
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
VERSION=${VERSION:-$(echo tiff-*.tar.?z* | rev | cut -f 3- -d . | cut -f 1 -d - | rev)}
-BUILD=1
+BUILD=2
# Automatically determine the architecture we're building on:
if [ -z "$ARCH" ]; then
@@ -63,6 +63,9 @@ rm -rf tiff-$VERSION
tar xvf $CWD/tiff-$VERSION.tar.?z* || exit 1
cd tiff-$VERSION
+zcat $CWD/libtiff-CVE-2011-0192.patch.gz | patch -p1 --verbose || exit 1
+zcat $CWD/libtiff-CVE-2011-1167.patch.gz | patch -p1 --verbose || exit 1
+
chown -R root:root .
find . \
\( -perm 777 -o -perm 775 -o -perm 711 -o -perm 555 -o -perm 511 \) \