summaryrefslogtreecommitdiff
path: root/media-libs/tiff/files/tiff-3.9.7-CVE-2012-5581.patch
diff options
context:
space:
mode:
Diffstat (limited to 'media-libs/tiff/files/tiff-3.9.7-CVE-2012-5581.patch')
-rw-r--r--media-libs/tiff/files/tiff-3.9.7-CVE-2012-5581.patch245
1 files changed, 0 insertions, 245 deletions
diff --git a/media-libs/tiff/files/tiff-3.9.7-CVE-2012-5581.patch b/media-libs/tiff/files/tiff-3.9.7-CVE-2012-5581.patch
deleted file mode 100644
index a6bdca137029..000000000000
--- a/media-libs/tiff/files/tiff-3.9.7-CVE-2012-5581.patch
+++ /dev/null
@@ -1,245 +0,0 @@
-Fix unsafe handling of DotRange and related tags. Back-port of upstream
-patch for CVE-2012-5581. (Note: I have not pushed this into upstream CVS
-for the 3.9 branch, because I'm not entirely convinced that it won't create
-application compatibility issues --- tgl)
-
-
-diff -Naur tiff-3.9.7.orig/libtiff/tif_dir.c tiff-3.9.7/libtiff/tif_dir.c
---- tiff-3.9.7.orig/libtiff/tif_dir.c 2012-09-22 10:48:09.000000000 -0400
-+++ tiff-3.9.7/libtiff/tif_dir.c 2012-12-13 13:39:20.448864070 -0500
-@@ -494,32 +494,28 @@
- goto end;
- }
-
-- if ((fip->field_passcount
-+ if (fip->field_tag == TIFFTAG_DOTRANGE
-+ && strcmp(fip->field_name,"DotRange") == 0) {
-+ /* TODO: This is an evil exception and should not have been
-+ handled this way ... likely best if we move it into
-+ the directory structure with an explicit field in
-+ libtiff 4.1 and assign it a FIELD_ value */
-+ uint16 v[2];
-+ v[0] = (uint16)va_arg(ap, int);
-+ v[1] = (uint16)va_arg(ap, int);
-+ _TIFFmemcpy(tv->value, v, 4);
-+ }
-+ else if (fip->field_passcount
- || fip->field_writecount == TIFF_VARIABLE
- || fip->field_writecount == TIFF_VARIABLE2
- || fip->field_writecount == TIFF_SPP
-- || tv->count > 1)
-- && fip->field_tag != TIFFTAG_PAGENUMBER
-- && fip->field_tag != TIFFTAG_HALFTONEHINTS
-- && fip->field_tag != TIFFTAG_YCBCRSUBSAMPLING
-- && fip->field_tag != TIFFTAG_DOTRANGE
-- && fip->field_tag != TIFFTAG_WHITELEVEL) {
-+ || tv->count > 1) {
- _TIFFmemcpy(tv->value, va_arg(ap, void *),
- tv->count * tv_size);
- } else {
-- /*
-- * XXX: The following loop required to handle
-- * TIFFTAG_PAGENUMBER, TIFFTAG_HALFTONEHINTS,
-- * TIFFTAG_YCBCRSUBSAMPLING and TIFFTAG_DOTRANGE tags.
-- * These tags are actually arrays and should be passed as
-- * array pointers to TIFFSetField() function, but actually
-- * passed as a list of separate values. This behaviour
-- * must be changed in the future!
-- */
-- int i;
- char *val = (char *)tv->value;
-
-- for (i = 0; i < tv->count; i++, val += tv_size) {
-+ assert( tv->count == 1 );
- switch (fip->field_type) {
- case TIFF_BYTE:
- case TIFF_UNDEFINED:
-@@ -578,7 +574,6 @@
- status = 0;
- break;
- }
-- }
- }
- }
- }
-@@ -869,24 +864,27 @@
- *va_arg(ap, uint16*) = (uint16)tv->count;
- *va_arg(ap, void **) = tv->value;
- ret_val = 1;
-- } else {
-- if ((fip->field_type == TIFF_ASCII
-+ } else if (fip->field_tag == TIFFTAG_DOTRANGE
-+ && strcmp(fip->field_name,"DotRange") == 0) {
-+ /* TODO: This is an evil exception and should not have been
-+ handled this way ... likely best if we move it into
-+ the directory structure with an explicit field in
-+ libtiff 4.1 and assign it a FIELD_ value */
-+ *va_arg(ap, uint16*) = ((uint16 *)tv->value)[0];
-+ *va_arg(ap, uint16*) = ((uint16 *)tv->value)[1];
-+ ret_val = 1;
-+ } else {
-+ if (fip->field_type == TIFF_ASCII
- || fip->field_readcount == TIFF_VARIABLE
- || fip->field_readcount == TIFF_VARIABLE2
- || fip->field_readcount == TIFF_SPP
-- || tv->count > 1)
-- && fip->field_tag != TIFFTAG_PAGENUMBER
-- && fip->field_tag != TIFFTAG_HALFTONEHINTS
-- && fip->field_tag != TIFFTAG_YCBCRSUBSAMPLING
-- && fip->field_tag != TIFFTAG_DOTRANGE) {
-+ || tv->count > 1) {
- *va_arg(ap, void **) = tv->value;
- ret_val = 1;
- } else {
-- int j;
- char *val = (char *)tv->value;
-
-- for (j = 0; j < tv->count;
-- j++, val += _TIFFDataSize(tv->info->field_type)) {
-+ assert( tv->count == 1 );
- switch (fip->field_type) {
- case TIFF_BYTE:
- case TIFF_UNDEFINED:
-@@ -936,7 +934,6 @@
- ret_val = 0;
- break;
- }
-- }
- }
- }
- break;
-diff -Naur tiff-3.9.7.orig/libtiff/tif_print.c tiff-3.9.7/libtiff/tif_print.c
---- tiff-3.9.7.orig/libtiff/tif_print.c 2010-07-08 12:17:59.000000000 -0400
-+++ tiff-3.9.7/libtiff/tif_print.c 2012-12-13 13:42:12.773478278 -0500
-@@ -112,16 +112,22 @@
- }
-
- static int
--_TIFFPrettyPrintField(TIFF* tif, FILE* fd, ttag_t tag,
-+_TIFFPrettyPrintField(TIFF* tif, const TIFFFieldInfo *fip, FILE* fd, ttag_t tag,
- uint32 value_count, void *raw_data)
- {
- TIFFDirectory *td = &tif->tif_dir;
-
-+ /* do not try to pretty print auto-defined fields */
-+ if (strncmp(fip->field_name,"Tag ", 4) == 0) {
-+ return 0;
-+ }
-+
- switch (tag)
- {
- case TIFFTAG_INKSET:
-- fprintf(fd, " Ink Set: ");
-- switch (*((uint16*)raw_data)) {
-+ if (value_count == 2 && fip->field_type == TIFF_SHORT) {
-+ fprintf(fd, " Ink Set: ");
-+ switch (*((uint16*)raw_data)) {
- case INKSET_CMYK:
- fprintf(fd, "CMYK\n");
- break;
-@@ -130,11 +136,18 @@
- *((uint16*)raw_data),
- *((uint16*)raw_data));
- break;
-+ }
-+ return 1;
- }
-- return 1;
-+ return 0;
-+
- case TIFFTAG_WHITEPOINT:
-- fprintf(fd, " White Point: %g-%g\n",
-- ((float *)raw_data)[0], ((float *)raw_data)[1]); return 1;
-+ if (value_count == 2 && fip->field_type == TIFF_RATIONAL) {
-+ fprintf(fd, " White Point: %g-%g\n",
-+ ((float *)raw_data)[0], ((float *)raw_data)[1]); return 1;
-+ }
-+ return 0;
-+
- case TIFFTAG_REFERENCEBLACKWHITE:
- {
- uint16 i;
-@@ -174,10 +187,13 @@
- (unsigned long) value_count);
- return 1;
- case TIFFTAG_STONITS:
-- fprintf(fd,
-- " Sample to Nits conversion factor: %.4e\n",
-- *((double*)raw_data));
-- return 1;
-+ if (value_count == 1 && fip->field_type == TIFF_DOUBLE) {
-+ fprintf(fd,
-+ " Sample to Nits conversion factor: %.4e\n",
-+ *((double*)raw_data));
-+ return 1;
-+ }
-+ return 0;
- }
-
- return 0;
-@@ -524,44 +540,28 @@
- value_count = td->td_samplesperpixel;
- else
- value_count = fip->field_readcount;
-- if ((fip->field_type == TIFF_ASCII
-+ if (fip->field_tag == TIFFTAG_DOTRANGE
-+ && strcmp(fip->field_name,"DotRange") == 0) {
-+ /* TODO: This is an evil exception and should not have been
-+ handled this way ... likely best if we move it into
-+ the directory structure with an explicit field in
-+ libtiff 4.1 and assign it a FIELD_ value */
-+ static uint16 dotrange[2];
-+ raw_data = dotrange;
-+ TIFFGetField(tif, tag, dotrange+0, dotrange+1);
-+ } else if (fip->field_type == TIFF_ASCII
- || fip->field_readcount == TIFF_VARIABLE
- || fip->field_readcount == TIFF_VARIABLE2
- || fip->field_readcount == TIFF_SPP
-- || value_count > 1)
-- && fip->field_tag != TIFFTAG_PAGENUMBER
-- && fip->field_tag != TIFFTAG_HALFTONEHINTS
-- && fip->field_tag != TIFFTAG_YCBCRSUBSAMPLING
-- && fip->field_tag != TIFFTAG_DOTRANGE) {
-+ || value_count > 1) {
- if(TIFFGetField(tif, tag, &raw_data) != 1)
- continue;
-- } else if (fip->field_tag != TIFFTAG_PAGENUMBER
-- && fip->field_tag != TIFFTAG_HALFTONEHINTS
-- && fip->field_tag != TIFFTAG_YCBCRSUBSAMPLING
-- && fip->field_tag != TIFFTAG_DOTRANGE) {
-- raw_data = _TIFFmalloc(
-- _TIFFDataSize(fip->field_type)
-- * value_count);
-- mem_alloc = 1;
-- if(TIFFGetField(tif, tag, raw_data) != 1) {
-- _TIFFfree(raw_data);
-- continue;
-- }
- } else {
-- /*
-- * XXX: Should be fixed and removed, see the
-- * notes related to TIFFTAG_PAGENUMBER,
-- * TIFFTAG_HALFTONEHINTS,
-- * TIFFTAG_YCBCRSUBSAMPLING and
-- * TIFFTAG_DOTRANGE tags in tif_dir.c. */
-- char *tmp;
- raw_data = _TIFFmalloc(
- _TIFFDataSize(fip->field_type)
- * value_count);
-- tmp = raw_data;
- mem_alloc = 1;
-- if(TIFFGetField(tif, tag, tmp,
-- tmp + _TIFFDataSize(fip->field_type)) != 1) {
-+ if(TIFFGetField(tif, tag, raw_data) != 1) {
- _TIFFfree(raw_data);
- continue;
- }
-@@ -574,7 +574,7 @@
- * _TIFFPrettyPrintField() fall down and print it as any other
- * tag.
- */
-- if (_TIFFPrettyPrintField(tif, fd, tag, value_count, raw_data)) {
-+ if (_TIFFPrettyPrintField(tif, fip, fd, tag, value_count, raw_data)) {
- if(mem_alloc)
- _TIFFfree(raw_data);
- continue;
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-03 15:13:53 +0000