head 1.2; access; symbols pkgsrc-2022Q1:1.1.0.2 pkgsrc-2022Q1-base:1.1; locks; strict; comment @# @; 1.2 date 2022.05.29.12.24.16; author gdt; state dead; branches; next 1.1; commitid KI7OGkMHkcxrPWFD; 1.1 date 2022.03.25.09.32.49; author nia; state Exp; branches; next ; commitid fUb1w31yeh4VZzxD; desc @@ 1.2 log @graphics/tiff: Update to 4.4.0 Upstream does not provide NEWS. Skimming over 1300 lines of ChangeLog, this release contains mostly bufixes, speed improvemnents, and other minor improvements. This commit drops 5 patches for CVEs. These patches all appear to have been taken from the upstream repo. One CVE remains: https://nvd.nist.gov/vuln/detail/CVE-2018-10126 http://bugzilla.maptools.org/show_bug.cgi?id=2786 https://gitlab.com/libtiff/libtiff/-/issues/128 @ text @$NetBSD: patch-CVE-2022-0907,v 1.1 2022/03/25 09:32:49 nia Exp $ [PATCH] add checks for return value of limitMalloc (CVE-2022-0907) https://gitlab.com/libtiff/libtiff/-/merge_requests/314.patch [PATCH] tiffcrop: fix issue #380 and #382 heap buffer overflow in extractImageSection (CVE-2022-0891) https://gitlab.com/libtiff/libtiff/-/commit/46dc8fcd4d38c3b6f35ab28e532aee80e6f609d6.patch --- tools/tiffcrop.c.orig 2021-03-07 18:09:46.000000000 +0000 +++ tools/tiffcrop.c @@@@ -105,8 +105,8 @@@@ * of messages to monitor progress without enabling dump logs. */ -static char tiffcrop_version_id[] = "2.4"; -static char tiffcrop_rev_date[] = "12-13-2010"; +static char tiffcrop_version_id[] = "2.4.1"; +static char tiffcrop_rev_date[] = "03-03-2010"; #include "tif_config.h" #include "libport.h" @@@@ -6710,10 +6710,10 @@@@ extractImageSection(struct image_data *i #ifdef DEVELMODE uint32_t img_length; #endif - uint32_t j, shift1, shift2, trailing_bits; + uint32_t j, shift1, trailing_bits; uint32_t row, first_row, last_row, first_col, last_col; uint32_t src_offset, dst_offset, row_offset, col_offset; - uint32_t offset1, offset2, full_bytes; + uint32_t offset1, full_bytes; uint32_t sect_width; #ifdef DEVELMODE uint32_t sect_length; @@@@ -6723,7 +6723,6 @@@@ extractImageSection(struct image_data *i #ifdef DEVELMODE int k; unsigned char bitset; - static char *bitarray = NULL; #endif img_width = image->width; @@@@ -6741,17 +6740,12 @@@@ extractImageSection(struct image_data *i dst_offset = 0; #ifdef DEVELMODE - if (bitarray == NULL) - { - if ((bitarray = (char *)malloc(img_width)) == NULL) - { - TIFFError ("", "DEBUG: Unable to allocate debugging bitarray"); - return (-1); - } - } + char bitarray[39]; #endif - /* rows, columns, width, length are expressed in pixels */ + /* rows, columns, width, length are expressed in pixels + * first_row, last_row, .. are index into image array starting at 0 to width-1, + * last_col shall be also extracted. */ first_row = section->y1; last_row = section->y2; first_col = section->x1; @@@@ -6761,9 +6755,14 @@@@ extractImageSection(struct image_data *i #ifdef DEVELMODE sect_length = last_row - first_row + 1; #endif - img_rowsize = ((img_width * bps + 7) / 8) * spp; - full_bytes = (sect_width * spp * bps) / 8; /* number of COMPLETE bytes per row in section */ - trailing_bits = (sect_width * bps) % 8; + /* The read function loadImage() used copy separate plane data into a buffer as interleaved + * samples rather than separate planes so the same logic works to extract regions + * regardless of the way the data are organized in the input file. + * Furthermore, bytes and bits are arranged in buffer according to COMPRESSION=1 and FILLORDER=1 + */ + img_rowsize = (((img_width * spp * bps) + 7) / 8); /* row size in full bytes of source image */ + full_bytes = (sect_width * spp * bps) / 8; /* number of COMPLETE bytes per row in section */ + trailing_bits = (sect_width * spp * bps) % 8; /* trailing bits within the last byte of destination buffer */ #ifdef DEVELMODE TIFFError ("", "First row: %"PRIu32", last row: %"PRIu32", First col: %"PRIu32", last col: %"PRIu32"\n", @@@@ -6776,10 +6775,9 @@@@ extractImageSection(struct image_data *i if ((bps % 8) == 0) { - col_offset = first_col * spp * bps / 8; + col_offset = (first_col * spp * bps) / 8; for (row = first_row; row <= last_row; row++) { - /* row_offset = row * img_width * spp * bps / 8; */ row_offset = row * img_rowsize; src_offset = row_offset + col_offset; @@@@ -6792,14 +6790,12 @@@@ extractImageSection(struct image_data *i } else { /* bps != 8 */ - shift1 = spp * ((first_col * bps) % 8); - shift2 = spp * ((last_col * bps) % 8); + shift1 = ((first_col * spp * bps) % 8); /* shift1 = bits to skip in the first byte of source buffer*/ for (row = first_row; row <= last_row; row++) { /* pull out the first byte */ row_offset = row * img_rowsize; - offset1 = row_offset + (first_col * bps / 8); - offset2 = row_offset + (last_col * bps / 8); + offset1 = row_offset + ((first_col * spp * bps) / 8); /* offset1 = offset into source of byte with first bits to be extracted */ #ifdef DEVELMODE for (j = 0, k = 7; j < 8; j++, k--) @@@@ -6811,12 +6807,12 @@@@ extractImageSection(struct image_data *i sprintf(&bitarray[9], " "); for (j = 10, k = 7; j < 18; j++, k--) { - bitset = *(src_buff + offset2) & (((unsigned char)1 << k)) ? 1 : 0; + bitset = *(src_buff + offset1 + full_bytes) & (((unsigned char)1 << k)) ? 1 : 0; sprintf(&bitarray[j], (bitset) ? "1" : "0"); } bitarray[18] = '\0'; - TIFFError ("", "Row: %3d Offset1: %"PRIu32", Shift1: %"PRIu32", Offset2: %"PRIu32", Shift2: %"PRIu32"\n", - row, offset1, shift1, offset2, shift2); + TIFFError ("", "Row: %3d Offset1: %"PRIu32", Shift1: %"PRIu32", Offset2: %"PRIu32", Trailing_bits: %"PRIu32"\n", + row, offset1, shift1, offset1+full_bytes, trailing_bits); #endif bytebuff1 = bytebuff2 = 0; @@@@ -6840,11 +6836,12 @@@@ extractImageSection(struct image_data *i if (trailing_bits != 0) { - bytebuff2 = src_buff[offset2] & ((unsigned char)255 << (7 - shift2)); + /* Only copy higher bits of samples and mask lower bits of not wanted column samples to zero */ + bytebuff2 = src_buff[offset1 + full_bytes] & ((unsigned char)255 << (8 - trailing_bits)); sect_buff[dst_offset] = bytebuff2; #ifdef DEVELMODE TIFFError ("", " Trailing bits src offset: %8"PRIu32", Dst offset: %8"PRIu32"\n", - offset2, dst_offset); + offset1 + full_bytes, dst_offset); for (j = 30, k = 7; j < 38; j++, k--) { bitset = *(sect_buff + dst_offset) & (((unsigned char)1 << k)) ? 1 : 0; @@@@ -6863,8 +6860,10 @@@@ extractImageSection(struct image_data *i #endif for (j = 0; j <= full_bytes; j++) { - bytebuff1 = src_buff[offset1 + j] & ((unsigned char)255 >> shift1); - bytebuff2 = src_buff[offset1 + j + 1] & ((unsigned char)255 << (7 - shift1)); + /* Skip the first shift1 bits and shift the source up by shift1 bits before save to destination.*/ + /* Attention: src_buff size needs to be some bytes larger than image size, because could read behind image here. */ + bytebuff1 = src_buff[offset1 + j] & ((unsigned char)255 >> shift1); + bytebuff2 = src_buff[offset1 + j + 1] & ((unsigned char)255 << (8 - shift1)); sect_buff[dst_offset + j] = (bytebuff1 << shift1) | (bytebuff2 >> (8 - shift1)); } #ifdef DEVELMODE @@@@ -6880,36 +6879,17 @@@@ extractImageSection(struct image_data *i #endif dst_offset += full_bytes; + /* Copy the trailing_bits for the last byte in the destination buffer. + Could come from one ore two bytes of the source buffer. */ if (trailing_bits != 0) { #ifdef DEVELMODE - TIFFError ("", " Trailing bits src offset: %8"PRIu32", Dst offset: %8"PRIu32"\n", offset1 + full_bytes, dst_offset); -#endif - if (shift2 > shift1) - { - bytebuff1 = src_buff[offset1 + full_bytes] & ((unsigned char)255 << (7 - shift2)); - bytebuff2 = bytebuff1 & ((unsigned char)255 << shift1); - sect_buff[dst_offset] = bytebuff2; -#ifdef DEVELMODE - TIFFError ("", " Shift2 > Shift1\n"); + TIFFError("", " Trailing bits %4"PRIu32" src offset: %8"PRIu32", Dst offset: %8"PRIu32"\n", trailing_bits, offset1 + full_bytes, dst_offset); #endif + /* More than necessary bits are already copied into last destination buffer, + * only masking of last byte in destination buffer is necessary.*/ + sect_buff[dst_offset] &= ((uint8_t)0xFF << (8 - trailing_bits)); } - else - { - if (shift2 < shift1) - { - bytebuff2 = ((unsigned char)255 << (shift1 - shift2 - 1)); - sect_buff[dst_offset] &= bytebuff2; -#ifdef DEVELMODE - TIFFError ("", " Shift2 < Shift1\n"); -#endif - } -#ifdef DEVELMODE - else - TIFFError ("", " Shift2 == Shift1\n"); -#endif - } - } #ifdef DEVELMODE sprintf(&bitarray[28], " "); sprintf(&bitarray[29], " "); @@@@ -7062,7 +7042,7 @@@@ writeImageSections(TIFF *in, TIFF *out, width = sections[i].x2 - sections[i].x1 + 1; length = sections[i].y2 - sections[i].y1 + 1; sectsize = (uint32_t) - ceil((width * image->bps + 7) / (double)8) * image->spp * length; + ceil((width * image->bps * image->spp + 7) / (double)8) * length; /* allocate a buffer if we don't have one already */ if (createImageSection(sectsize, sect_buff_ptr)) { @@@@ -7377,7 +7357,11 @@@@ createImageSection(uint32_t sectsize, un if (!sect_buff) { sect_buff = (unsigned char *)limitMalloc(sectsize); - *sect_buff_ptr = sect_buff; + if (!sect_buff) + { + TIFFError("createImageSection", "Unable to allocate/reallocate section buffer"); + return (-1); + } _TIFFmemset(sect_buff, 0, sectsize); } else @@@@ -7393,15 +7377,15 @@@@ createImageSection(uint32_t sectsize, un else sect_buff = new_buff; + if (!sect_buff) + { + TIFFError("createImageSection", "Unable to allocate/reallocate section buffer"); + return (-1); + } _TIFFmemset(sect_buff, 0, sectsize); } } - if (!sect_buff) - { - TIFFError("createImageSection", "Unable to allocate/reallocate section buffer"); - return (-1); - } prev_sectsize = sectsize; *sect_buff_ptr = sect_buff; @@@@ -7668,7 +7652,11 @@@@ createCroppedImage(struct image_data *im if (!crop_buff) { crop_buff = (unsigned char *)limitMalloc(cropsize); - *crop_buff_ptr = crop_buff; + if (!crop_buff) + { + TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer"); + return (-1); + } _TIFFmemset(crop_buff, 0, cropsize); prev_cropsize = cropsize; } @@@@ -7684,15 +7672,15 @@@@ createCroppedImage(struct image_data *im } else crop_buff = new_buff; + if (!crop_buff) + { + TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer"); + return (-1); + } _TIFFmemset(crop_buff, 0, cropsize); } } - if (!crop_buff) - { - TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer"); - return (-1); - } *crop_buff_ptr = crop_buff; if (crop->crop_mode & CROP_INVERT) @@@@ -9251,3 +9239,4 @@@@ invertImage(uint16_t photometric, uint16 * fill-column: 78 * End: */ + @ 1.1 log @tiff: apply fixes for CVE-2022-0561 CVE-2022-0907 CVE-2022-0891 CVE-2022-0907 CVE-2022-0909 bump PKGREVISION again... @ text @d1 1 a1 1 $NetBSD$ @