|
 |
cbcfe72 |
From 24f099951c3a86f04a29adc7b0dda474a3c44722 Mon Sep 17 00:00:00 2001
|
|
|
cbcfe72 |
From: Nils Philippsen <nils@redhat.com>
|
|
|
cbcfe72 |
Date: Wed, 25 Sep 2013 15:04:43 +0200
|
|
|
cbcfe72 |
Subject: [PATCH] CVE-2013-1438: fix various security issues
|
|
|
cbcfe72 |
|
|
|
cbcfe72 |
This fixes division by zero, infinite loop, and null pointer dereference
|
|
|
cbcfe72 |
bugs. Ported from Alex Tutubalin's fix in LibRaw (commit
|
|
|
cbcfe72 |
9ae25d8c3a6bfb40c582538193264f74c9b93bc0).
|
|
|
cbcfe72 |
---
|
|
|
cbcfe72 |
dcraw.c | 33 ++++++++++++++++++++++++---------
|
|
|
cbcfe72 |
1 file changed, 24 insertions(+), 9 deletions(-)
|
|
|
cbcfe72 |
|
|
|
cbcfe72 |
diff --git a/dcraw.c b/dcraw.c
|
|
|
cbcfe72 |
index 96e3d1f..dcf284c 100644
|
|
|
cbcfe72 |
--- a/dcraw.c
|
|
|
cbcfe72 |
+++ b/dcraw.c
|
|
|
cbcfe72 |
@@ -828,6 +828,9 @@ int CLASS ljpeg_diff (ushort *huff)
|
|
|
cbcfe72 |
{
|
|
|
cbcfe72 |
int len, diff;
|
|
|
cbcfe72 |
|
|
|
cbcfe72 |
+ if (!huff)
|
|
|
cbcfe72 |
+ longjmp(failure, 2);
|
|
|
cbcfe72 |
+
|
|
|
cbcfe72 |
len = gethuff(huff);
|
|
|
cbcfe72 |
if (len == 16 && (!dng_version || dng_version >= 0x1010000))
|
|
|
cbcfe72 |
return -32768;
|
|
|
cbcfe72 |
@@ -883,6 +886,8 @@ void CLASS lossless_jpeg_load_raw()
|
|
|
cbcfe72 |
ushort *rp;
|
|
|
cbcfe72 |
|
|
|
cbcfe72 |
if (!ljpeg_start (&jh, 0)) return;
|
|
|
cbcfe72 |
+ if (jh.wide < 1 || jh.high < 1 || jh.clrs < 1 || jh.bits < 1)
|
|
|
cbcfe72 |
+ longjmp (failure, 2);
|
|
|
cbcfe72 |
jwide = jh.wide * jh.clrs;
|
|
|
cbcfe72 |
|
|
|
cbcfe72 |
for (jrow=0; jrow < jh.high; jrow++) {
|
|
|
cbcfe72 |
@@ -902,6 +907,8 @@ void CLASS lossless_jpeg_load_raw()
|
|
|
cbcfe72 |
}
|
|
|
cbcfe72 |
if (raw_width == 3984 && (col -= 2) < 0)
|
|
|
cbcfe72 |
col += (row--,raw_width);
|
|
|
cbcfe72 |
+ if (row > raw_height)
|
|
|
cbcfe72 |
+ longjmp (failure, 3);
|
|
|
cbcfe72 |
if ((unsigned) row < raw_height) RAW(row,col) = val;
|
|
|
cbcfe72 |
if (++col >= raw_width)
|
|
|
cbcfe72 |
col = (row++,0);
|
|
|
cbcfe72 |
@@ -5444,6 +5451,7 @@ int CLASS parse_tiff_ifd (int base)
|
|
|
cbcfe72 |
data_offset = get4()+base;
|
|
|
cbcfe72 |
ifd++; break;
|
|
|
cbcfe72 |
}
|
|
|
cbcfe72 |
+ if(len > 1000) len=1000; /* 1000 SubIFDs is enough */
|
|
|
cbcfe72 |
while (len--) {
|
|
|
cbcfe72 |
i = ftell(ifp);
|
|
|
cbcfe72 |
fseek (ifp, get4()+base, SEEK_SET);
|
|
|
cbcfe72 |
@@ -5662,7 +5670,7 @@ guess_cfa_pc:
|
|
|
cbcfe72 |
break;
|
|
|
cbcfe72 |
case 50715: /* BlackLevelDeltaH */
|
|
|
cbcfe72 |
case 50716: /* BlackLevelDeltaV */
|
|
|
cbcfe72 |
- for (num=i=0; i < len; i++)
|
|
|
cbcfe72 |
+ for (num=i=0; i < len && i < 65536; i++)
|
|
|
cbcfe72 |
num += getreal(type);
|
|
|
cbcfe72 |
black += num/len + 0.5;
|
|
|
cbcfe72 |
break;
|
|
|
cbcfe72 |
@@ -5787,9 +5795,13 @@ void CLASS apply_tiff()
|
|
|
cbcfe72 |
if (thumb_offset) {
|
|
|
cbcfe72 |
fseek (ifp, thumb_offset, SEEK_SET);
|
|
|
cbcfe72 |
if (ljpeg_start (&jh, 1)) {
|
|
|
cbcfe72 |
- thumb_misc = jh.bits;
|
|
|
cbcfe72 |
- thumb_width = jh.wide;
|
|
|
cbcfe72 |
- thumb_height = jh.high;
|
|
|
cbcfe72 |
+ if ((unsigned)jh.bits < 17 && (unsigned)jh.wide < 0x10000 &&
|
|
|
cbcfe72 |
+ (unsigned)jh.high < 0x10000)
|
|
|
cbcfe72 |
+ {
|
|
|
cbcfe72 |
+ thumb_misc = jh.bits;
|
|
|
cbcfe72 |
+ thumb_width = jh.wide;
|
|
|
cbcfe72 |
+ thumb_height = jh.high;
|
|
|
cbcfe72 |
+ }
|
|
|
cbcfe72 |
}
|
|
|
cbcfe72 |
}
|
|
|
cbcfe72 |
for (i=0; i < tiff_nifds; i++) {
|
|
|
cbcfe72 |
@@ -5797,8 +5809,9 @@ void CLASS apply_tiff()
|
|
|
cbcfe72 |
max_samp = tiff_ifd[i].samples;
|
|
|
cbcfe72 |
if (max_samp > 3) max_samp = 3;
|
|
|
cbcfe72 |
if ((tiff_ifd[i].comp != 6 || tiff_ifd[i].samples != 3) &&
|
|
|
cbcfe72 |
- (tiff_ifd[i].width | tiff_ifd[i].height) < 0x10000 &&
|
|
|
cbcfe72 |
- tiff_ifd[i].width*tiff_ifd[i].height > raw_width*raw_height) {
|
|
|
cbcfe72 |
+ (tiff_ifd[i].width | tiff_ifd[i].height) < 0x10000 &&
|
|
|
cbcfe72 |
+ (unsigned)tiff_ifd[i].bps < 33 && (unsigned)tiff_ifd[i].samples < 13 &&
|
|
|
cbcfe72 |
+ tiff_ifd[i].width*tiff_ifd[i].height > raw_width*raw_height) {
|
|
|
cbcfe72 |
raw_width = tiff_ifd[i].width;
|
|
|
cbcfe72 |
raw_height = tiff_ifd[i].height;
|
|
|
cbcfe72 |
tiff_bps = tiff_ifd[i].bps;
|
|
|
cbcfe72 |
@@ -5884,9 +5897,11 @@ void CLASS apply_tiff()
|
|
|
cbcfe72 |
is_raw = 0;
|
|
|
cbcfe72 |
for (i=0; i < tiff_nifds; i++)
|
|
|
cbcfe72 |
if (i != raw && tiff_ifd[i].samples == max_samp &&
|
|
|
cbcfe72 |
- tiff_ifd[i].width * tiff_ifd[i].height / (SQR(tiff_ifd[i].bps)+1) >
|
|
|
cbcfe72 |
- thumb_width * thumb_height / (SQR(thumb_misc)+1)
|
|
|
cbcfe72 |
- && tiff_ifd[i].comp != 34892) {
|
|
|
cbcfe72 |
+ tiff_ifd[i].bps > 0 && tiff_ifd[i].bps < 33 &&
|
|
|
cbcfe72 |
+ ((unsigned)(tiff_ifd[i].width | tiff_ifd[i].height)) < 0x10000 &&
|
|
|
cbcfe72 |
+ tiff_ifd[i].width * tiff_ifd[i].height / (SQR(tiff_ifd[i].bps)+1) >
|
|
|
cbcfe72 |
+ thumb_width * thumb_height / (SQR(thumb_misc)+1)
|
|
|
cbcfe72 |
+ && tiff_ifd[i].comp != 34892) {
|
|
|
cbcfe72 |
thumb_width = tiff_ifd[i].width;
|
|
|
cbcfe72 |
thumb_height = tiff_ifd[i].height;
|
|
|
cbcfe72 |
thumb_offset = tiff_ifd[i].offset;
|
|
|
cbcfe72 |
--
|
|
|
cbcfe72 |
1.8.4.2
|
|
|
cbcfe72 |
|