diff options
| -rw-r--r-- | ChangeLog | 11 | ||||
| -rw-r--r-- | libtiff/tif_getimage.c | 40 | ||||
| -rw-r--r-- | libtiff/tif_predict.c | 13 |
3 files changed, 42 insertions, 22 deletions
@@ -1,3 +1,12 @@ +2016-09-24 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> + + * libtiff/tif_getimage.c (TIFFRGBAImageOK): Reject attempts to + read floating point images. + + * libtiff/tif_predict.c (PredictorSetup): Enforce bits-per-sample + requirements of floating point predictor (3). Fixes CVE-2016-3622 + "Divide By Zero in the tiff2rgba tool." + 2016-09-23 Even Rouault <even.rouault at spatialys.com> * tools/tiffcrop.c: fix various out-of-bounds write vulnerabilities @@ -17,7 +26,7 @@ completely sure if that could happen in practice outside of the odd behaviour of t2p_seekproc() of tiff2pdf). The report points that a better fix could be to check the return value of TIFFFlushData1() in - places where it isn't done currently, but it seems this patch is enough. + places where it isn't done currently, but it seems this patch is enough. Reported as MSVR 35095. Discovered by Axel Souchet & Vishal Chauhan & Suha Can from the MSRC Vulnerabilities & Mitigations team. diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c index 503a2284..b4e58f94 100644 --- a/libtiff/tif_getimage.c +++ b/libtiff/tif_getimage.c @@ -1,4 +1,4 @@ -/* $Id: tif_getimage.c,v 1.96 2016-09-04 21:32:56 erouault Exp $ */ +/* $Id: tif_getimage.c,v 1.97 2016-09-24 23:11:55 bfriesen Exp $ */ /* * Copyright (c) 1991-1997 Sam Leffler @@ -95,6 +95,10 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024]) td->td_bitspersample); return (0); } + if (td->td_sampleformat == SAMPLEFORMAT_IEEEFP) { + sprintf(emsg, "Sorry, can not handle images with IEEE floating-point samples"); + return (0); + } colorchannels = td->td_samplesperpixel - td->td_extrasamples; if (!TIFFGetField(tif, TIFFTAG_PHOTOMETRIC, &photometric)) { switch (colorchannels) { @@ -182,27 +186,25 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024]) "Planarconfiguration", td->td_planarconfig); return (0); } - if( td->td_samplesperpixel != 3 || colorchannels != 3 ) - { - sprintf(emsg, - "Sorry, can not handle image with %s=%d, %s=%d", - "Samples/pixel", td->td_samplesperpixel, - "colorchannels", colorchannels); - return 0; - } + if ( td->td_samplesperpixel != 3 || colorchannels != 3 ) { + sprintf(emsg, + "Sorry, can not handle image with %s=%d, %s=%d", + "Samples/pixel", td->td_samplesperpixel, + "colorchannels", colorchannels); + return 0; + } break; case PHOTOMETRIC_CIELAB: - if( td->td_samplesperpixel != 3 || colorchannels != 3 || td->td_bitspersample != 8 ) - { - sprintf(emsg, - "Sorry, can not handle image with %s=%d, %s=%d and %s=%d", - "Samples/pixel", td->td_samplesperpixel, - "colorchannels", colorchannels, - "Bits/sample", td->td_bitspersample); - return 0; - } + if ( td->td_samplesperpixel != 3 || colorchannels != 3 || td->td_bitspersample != 8 ) { + sprintf(emsg, + "Sorry, can not handle image with %s=%d, %s=%d and %s=%d", + "Samples/pixel", td->td_samplesperpixel, + "colorchannels", colorchannels, + "Bits/sample", td->td_bitspersample); + return 0; + } break; - default: + default: sprintf(emsg, "Sorry, can not handle image with %s=%d", photoTag, photometric); return (0); diff --git a/libtiff/tif_predict.c b/libtiff/tif_predict.c index 556b1c49..72571f42 100644 --- a/libtiff/tif_predict.c +++ b/libtiff/tif_predict.c @@ -1,4 +1,4 @@ -/* $Id: tif_predict.c,v 1.37 2016-01-23 21:20:34 erouault Exp $ */ +/* $Id: tif_predict.c,v 1.38 2016-09-24 23:11:55 bfriesen Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -80,6 +80,15 @@ PredictorSetup(TIFF* tif) td->td_sampleformat); return 0; } + if (td->td_bitspersample != 16 + && td->td_bitspersample != 24 + && td->td_bitspersample != 32 + && td->td_bitspersample != 64) { /* Should 64 be allowed? */ + TIFFErrorExt(tif->tif_clientdata, module, + "Floating point \"Predictor\" not supported with %d-bit samples", + td->td_bitspersample); + return 0; + } break; default: TIFFErrorExt(tif->tif_clientdata, module, @@ -174,7 +183,7 @@ PredictorSetupDecode(TIFF* tif) } /* * Allocate buffer to keep the decoded bytes before - * rearranging in the ight order + * rearranging in the right order */ } |