Skip to content

Commit 5b1646c

Browse files
SumynwaSumynwa
authored
libtiff: Add patch to resolve CVE-2023-6277 (#10048)
1 parent 45be18f commit 5b1646c

2 files changed

Lines changed: 175 additions & 1 deletion

File tree

‎SPECS/libtiff/CVE-2023-6277.patch‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
From 5320c9d89c054fa805d037d84c57da874470b01a Mon Sep 17 00:00:00 2001
2+
From: Su Laus <sulau@freenet.de>
3+
Date: Tue, 31 Oct 2023 15:43:29 +0000
4+
Subject: [PATCH] Prevent some out-of-memory attacks
5+
6+
Some small fuzzer files fake large amounts of data and provoke out-of-memory situations. For non-compressed data content / tags, out-of-memory can be prevented by comparing with the file size.
7+
8+
At image reading, data size of some tags / data structures (StripByteCounts, StripOffsets, StripArray, TIFF directory) is compared with file size to prevent provoked out-of-memory attacks.
9+
10+
See issue https://gitlab.com/libtiff/libtiff/-/issues/614#note_1602683857
11+
---
12+
libtiff/tif_dirread.c | 92 ++++++++++++++++++++++++++++++++++++++++++-
13+
1 file changed, 90 insertions(+), 2 deletions(-)
14+
15+
diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
16+
index 2c49dc6a..58a42760 100644
17+
--- a/libtiff/tif_dirread.c
18+
+++ b/libtiff/tif_dirread.c
19+
@@ -1308,6 +1308,21 @@ TIFFReadDirEntryArrayWithLimit(TIFF *tif, TIFFDirEntry *direntry,
20+
datasize = (*count) * typesize;
21+
assert((tmsize_t)datasize > 0);
22+
23+
+ /* Before allocating a huge amount of memory for corrupted files, check if
24+
+ * size of requested memory is not greater than file size.
25+
+ */
26+
+ uint64_t filesize = TIFFGetFileSize(tif);
27+
+ if (datasize > filesize)
28+
+ {
29+
+ TIFFWarningExtR(tif, "ReadDirEntryArray",
30+
+ "Requested memory size for tag %d (0x%x) %" PRIu32
31+
+ " is greather than filesize %" PRIu64
32+
+ ". Memory not allocated, tag not read",
33+
+ direntry->tdir_tag, direntry->tdir_tag, datasize,
34+
+ filesize);
35+
+ return (TIFFReadDirEntryErrAlloc);
36+
+ }
37+
+
38+
if (isMapped(tif) && datasize > (uint64_t)tif->tif_size)
39+
return TIFFReadDirEntryErrIo;
40+
41+
@@ -5266,6 +5281,20 @@ static int EstimateStripByteCounts(TIFF *tif, TIFFDirEntry *dir,
42+
if (!_TIFFFillStrilesInternal(tif, 0))
43+
return -1;
44+
45+
+ /* Before allocating a huge amount of memory for corrupted files, check if
46+
+ * size of requested memory is not greater than file size. */
47+
+ uint64_t filesize = TIFFGetFileSize(tif);
48+
+ uint64_t allocsize = (uint64_t)td->td_nstrips * sizeof(uint64_t);
49+
+ if (allocsize > filesize)
50+
+ {
51+
+ TIFFWarningExtR(tif, module,
52+
+ "Requested memory size for StripByteCounts of %" PRIu64
53+
+ " is greather than filesize %" PRIu64
54+
+ ". Memory not allocated",
55+
+ allocsize, filesize);
56+
+ return -1;
57+
+ }
58+
+
59+
if (td->td_stripbytecount_p)
60+
_TIFFfreeExt(tif, td->td_stripbytecount_p);
61+
td->td_stripbytecount_p = (uint64_t *)_TIFFCheckMalloc(
62+
@@ -5276,9 +5305,7 @@ static int EstimateStripByteCounts(TIFF *tif, TIFFDirEntry *dir,
63+
if (td->td_compression != COMPRESSION_NONE)
64+
{
65+
uint64_t space;
66+
- uint64_t filesize;
67+
uint16_t n;
68+
- filesize = TIFFGetFileSize(tif);
69+
if (!(tif->tif_flags & TIFF_BIGTIFF))
70+
space = sizeof(TIFFHeaderClassic) + 2 + dircount * 12 + 4;
71+
else
72+
@@ -5807,6 +5834,20 @@ static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff,
73+
dircount16 = (uint16_t)dircount64;
74+
dirsize = 20;
75+
}
76+
+ /* Before allocating a huge amount of memory for corrupted files, check
77+
+ * if size of requested memory is not greater than file size. */
78+
+ uint64_t filesize = TIFFGetFileSize(tif);
79+
+ uint64_t allocsize = (uint64_t)dircount16 * dirsize;
80+
+ if (allocsize > filesize)
81+
+ {
82+
+ TIFFWarningExtR(
83+
+ tif, module,
84+
+ "Requested memory size for TIFF directory of %" PRIu64
85+
+ " is greather than filesize %" PRIu64
86+
+ ". Memory not allocated, TIFF directory not read",
87+
+ allocsize, filesize);
88+
+ return 0;
89+
+ }
90+
origdir = _TIFFCheckMalloc(tif, dircount16, dirsize,
91+
"to read TIFF directory");
92+
if (origdir == NULL)
93+
@@ -5921,6 +5962,20 @@ static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff,
94+
"directories not supported");
95+
return 0;
96+
}
97+
+ /* Before allocating a huge amount of memory for corrupted files, check
98+
+ * if size of requested memory is not greater than file size. */
99+
+ uint64_t filesize = TIFFGetFileSize(tif);
100+
+ uint64_t allocsize = (uint64_t)dircount16 * dirsize;
101+
+ if (allocsize > filesize)
102+
+ {
103+
+ TIFFWarningExtR(
104+
+ tif, module,
105+
+ "Requested memory size for TIFF directory of %" PRIu64
106+
+ " is greather than filesize %" PRIu64
107+
+ ". Memory not allocated, TIFF directory not read",
108+
+ allocsize, filesize);
109+
+ return 0;
110+
+ }
111+
origdir = _TIFFCheckMalloc(tif, dircount16, dirsize,
112+
"to read TIFF directory");
113+
if (origdir == NULL)
114+
@@ -5968,6 +6023,8 @@ static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff,
115+
}
116+
}
117+
}
118+
+ /* No check against filesize needed here because "dir" should have same size
119+
+ * than "origdir" checked above. */
120+
dir = (TIFFDirEntry *)_TIFFCheckMalloc(
121+
tif, dircount16, sizeof(TIFFDirEntry), "to read TIFF directory");
122+
if (dir == 0)
123+
@@ -7164,6 +7221,20 @@ static int TIFFFetchStripThing(TIFF *tif, TIFFDirEntry *dir, uint32_t nstrips,
124+
return (0);
125+
}
126+
127+
+ /* Before allocating a huge amount of memory for corrupted files, check
128+
+ * if size of requested memory is not greater than file size. */
129+
+ uint64_t filesize = TIFFGetFileSize(tif);
130+
+ uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t);
131+
+ if (allocsize > filesize)
132+
+ {
133+
+ TIFFWarningExtR(tif, module,
134+
+ "Requested memory size for StripArray of %" PRIu64
135+
+ " is greather than filesize %" PRIu64
136+
+ ". Memory not allocated",
137+
+ allocsize, filesize);
138+
+ _TIFFfreeExt(tif, data);
139+
+ return (0);
140+
+ }
141+
resizeddata = (uint64_t *)_TIFFCheckMalloc(
142+
tif, nstrips, sizeof(uint64_t), "for strip array");
143+
if (resizeddata == 0)
144+
@@ -7263,6 +7334,23 @@ static void allocChoppedUpStripArrays(TIFF *tif, uint32_t nstrips,
145+
}
146+
bytecount = last_offset + last_bytecount - offset;
147+
148+
+ /* Before allocating a huge amount of memory for corrupted files, check if
149+
+ * size of StripByteCount and StripOffset tags is not greater than
150+
+ * file size.
151+
+ */
152+
+ uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t) * 2;
153+
+ uint64_t filesize = TIFFGetFileSize(tif);
154+
+ if (allocsize > filesize)
155+
+ {
156+
+ TIFFWarningExtR(tif, "allocChoppedUpStripArrays",
157+
+ "Requested memory size for StripByteCount and "
158+
+ "StripOffsets %" PRIu64
159+
+ " is greather than filesize %" PRIu64
160+
+ ". Memory not allocated",
161+
+ allocsize, filesize);
162+
+ return;
163+
+ }
164+
+
165+
newcounts =
166+
(uint64_t *)_TIFFCheckMalloc(tif, nstrips, sizeof(uint64_t),
167+
"for chopped \"StripByteCounts\" array");
168+
--
169+
GitLab
170+

‎SPECS/libtiff/libtiff.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
Summary: TIFF libraries and associated utilities.
22
Name: libtiff
33
Version: 4.6.0
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: libtiff
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
88
Group: System Environment/Libraries
99
URL: https://gitlab.com/libtiff/libtiff
1010
Source0: https://gitlab.com/libtiff/libtiff/-/archive/v%{version}/libtiff-v%{version}.tar.gz
1111
Patch0: CVE-2023-52356.patch
12+
Patch1: CVE-2023-6277.patch
1213
BuildRequires: autoconf
1314
BuildRequires: automake
1415
BuildRequires: libjpeg-turbo-devel
@@ -61,6 +62,9 @@ make %{?_smp_mflags} -k check
6162
%{_docdir}/*
6263

6364
%changelog
65+
* Wed Aug 07 2024 Sumedh Sharma <sumsharma@microsoft.com> - 4.6.0-3
66+
- Add patch to resolve CVE-2023-6277
67+
6468
* Thu Mar 7 2024 Xiaohong Deng <xiaohongdeng@microsoft.com> - 4.6.0-2
6569
- Add patches for CVE-2023-52356
6670

0 commit comments

Comments
 (0)