From f94a29a822f5528d2334592760fbb7938f15eb55 Mon Sep 17 00:00:00 2001 From: erouault <erouault> Date: Sat, 26 Dec 2015 17:32:03 +0000 Subject: [PATCH] * libtiff/tif_getimage.c: fix out-of-bound reads in TIFFRGBAImage interface in case of unsupported values of SamplesPerPixel/ExtraSamples for LogLUV / CIELab. Add explicit call to TIFFRGBAImageOK() in TIFFRGBAImageBegin(). Fix CVE-2015-8665 reported by limingxing and CVE-2015-8683 reported by zzf of Alibaba. --- ChangeLog | 8 ++++++++ libtiff/tif_getimage.c | 35 ++++++++++++++++++++++------------- 2 files changed, 30 insertions(+), 13 deletions(-) Index: tiff-4.0.3/libtiff/tif_getimage.c =================================================================== --- tiff-4.0.3.orig/libtiff/tif_getimage.c 2016-03-23 10:13:42.728371661 -0400 +++ tiff-4.0.3/libtiff/tif_getimage.c 2016-03-23 10:13:42.724371614 -0400 @@ -182,20 +182,22 @@ "Planarconfiguration", td->td_planarconfig); return (0); } - if( td->td_samplesperpixel != 3 ) + if( td->td_samplesperpixel != 3 || colorchannels != 3 ) { sprintf(emsg, - "Sorry, can not handle image with %s=%d", - "Samples/pixel", td->td_samplesperpixel); + "Sorry, can not handle image with %s=%d, %s=%d", + "Samples/pixel", td->td_samplesperpixel, + "colorchannels", colorchannels); return 0; } break; case PHOTOMETRIC_CIELAB: - if( td->td_samplesperpixel != 3 || td->td_bitspersample != 8 ) + if( td->td_samplesperpixel != 3 || colorchannels != 3 || td->td_bitspersample != 8 ) { sprintf(emsg, - "Sorry, can not handle image with %s=%d and %s=%d", + "Sorry, can not handle image with %s=%d, %s=%d and %s=%d", "Samples/pixel", td->td_samplesperpixel, + "colorchannels", colorchannels, "Bits/sample", td->td_bitspersample); return 0; } @@ -255,6 +257,9 @@ int colorchannels; uint16 *red_orig, *green_orig, *blue_orig; int n_color; + + if( !TIFFRGBAImageOK(tif, emsg) ) + return 0; /* Initialize to normal values */ img->row_offset = 0; @@ -2470,29 +2475,33 @@ case PHOTOMETRIC_RGB: switch (img->bitspersample) { case 8: - if (img->alpha == EXTRASAMPLE_ASSOCALPHA) + if (img->alpha == EXTRASAMPLE_ASSOCALPHA && + img->samplesperpixel >= 4) img->put.contig = putRGBAAcontig8bittile; - else if (img->alpha == EXTRASAMPLE_UNASSALPHA) + else if (img->alpha == EXTRASAMPLE_UNASSALPHA && + img->samplesperpixel >= 4) { if (BuildMapUaToAa(img)) img->put.contig = putRGBUAcontig8bittile; } - else + else if( img->samplesperpixel >= 3 ) img->put.contig = putRGBcontig8bittile; break; case 16: - if (img->alpha == EXTRASAMPLE_ASSOCALPHA) + if (img->alpha == EXTRASAMPLE_ASSOCALPHA && + img->samplesperpixel >=4 ) { if (BuildMapBitdepth16To8(img)) img->put.contig = putRGBAAcontig16bittile; } - else if (img->alpha == EXTRASAMPLE_UNASSALPHA) + else if (img->alpha == EXTRASAMPLE_UNASSALPHA && + img->samplesperpixel >=4 ) { if (BuildMapBitdepth16To8(img) && BuildMapUaToAa(img)) img->put.contig = putRGBUAcontig16bittile; } - else + else if( img->samplesperpixel >=3 ) { if (BuildMapBitdepth16To8(img)) img->put.contig = putRGBcontig16bittile; @@ -2501,7 +2510,7 @@ } break; case PHOTOMETRIC_SEPARATED: - if (buildMap(img)) { + if (img->samplesperpixel >=4 && buildMap(img)) { if (img->bitspersample == 8) { if (!img->Map) img->put.contig = putRGBcontig8bitCMYKtile; @@ -2597,7 +2606,7 @@ } break; case PHOTOMETRIC_CIELAB: - if (buildMap(img)) { + if (img->samplesperpixel == 3 && buildMap(img)) { if (img->bitspersample == 8) img->put.contig = initCIELabConversion(img); break;