File libraw-CVE-2017-6887,6886.patch of Package libraw

Overview Repositories Revisions Requests Users Attributes Meta

File libraw-CVE-2017-6887,6886.patch of Package libraw (Revision 47a285459c94dbe23a948abfb3a5bc09)

Currently displaying revision 47a285459c94dbe23a948abfb3a5bc09 , Show latest

From d7c3d2cb460be10a3ea7b32e9443a83c243b2251 Mon Sep 17 00:00:00 2001
From: Alex Tutubalin <lexa@lexa.ru>
Date: Sat, 4 Mar 2017 21:27:39 +0300
Subject: [PATCH] Secunia SA75000 advisory: several buffer overruns

---
 dcraw/dcraw.c             | 12 ++++++++++--
 internal/dcraw_common.cpp | 12 ++++++++++--
 2 files changed, 20 insertions(+), 4 deletions(-)

Index: LibRaw-0.15.4/dcraw/dcraw.c
===================================================================
--- LibRaw-0.15.4.orig/dcraw/dcraw.c	2017-05-23 11:25:12.276579000 +0200
+++ LibRaw-0.15.4/dcraw/dcraw.c	2017-05-23 11:25:12.288579204 +0200
@@ -5451,7 +5451,12 @@ int CLASS parse_tiff_ifd (int base)
 	if (!strcmp(model,"DSLR-A100") && tiff_ifd[ifd].width == 3872) {
 	  load_raw = &CLASS sony_arw_load_raw;
 	  data_offset = get4()+base;
-	  ifd++;  break;
+	  ifd++;  
+#ifdef LIBRAW_LIBRARY_BUILD
+          if (ifd >= sizeof tiff_ifd / sizeof tiff_ifd[0])
+            throw LIBRAW_EXCEPTION_IO_CORRUPT;
+#endif  
+          break; 
 	}
 	while (len--) {
 	  i = ftell(ifp);
@@ -5603,6 +5608,8 @@ int CLASS parse_tiff_ifd (int base)
 	break;
       case 50454:			/* Sinar tag */
       case 50455:
+        if (len < 1 || len > 2560000)
+          break;
 	if (!(cbuf = (char *) malloc(len))) break;
 	fread (cbuf, 1, len, ifp);
 	for (cp = cbuf-1; cp && cp < cbuf+len; cp = strchr(cp,'\n'))
Index: LibRaw-0.15.4/internal/dcraw_common.cpp
===================================================================
--- LibRaw-0.15.4.orig/internal/dcraw_common.cpp	2017-05-23 11:25:12.268578862 +0200
+++ LibRaw-0.15.4/internal/dcraw_common.cpp	2017-05-23 11:25:12.288579204 +0200
@@ -5170,7 +5170,12 @@ int CLASS parse_tiff_ifd (int base)
 	if (!strcmp(model,"DSLR-A100") && tiff_ifd[ifd].t_width == 3872) {
 	  load_raw = &CLASS sony_arw_load_raw;
 	  data_offset = get4()+base;
-	  ifd++;  break;
+	  ifd++;
+#ifdef LIBRAW_LIBRARY_BUILD
+          if (ifd >= sizeof tiff_ifd / sizeof tiff_ifd[0])
+            throw LIBRAW_EXCEPTION_IO_CORRUPT;
+#endif  
+          break;
 	}
         if(len > 1000) len=1000; /* 1000 SubIFDs is enough */
 	while (len--) {
@@ -5324,6 +5329,8 @@ int CLASS parse_tiff_ifd (int base)
 	break;
       case 50454:			/* Sinar tag */
       case 50455:
+        if (len < 1 || len > 2560000)  
+          break;
 	if (!(cbuf = (char *) malloc(len))) break;
 	fread (cbuf, 1, len, ifp);
 	for (cp = cbuf-1; cp && cp < cbuf+len; cp = strchr(cp,'\n'))

Places

File libraw-CVE-2017-6887,6886.patch of Package libraw (Revision 47a285459c94dbe23a948abfb3a5bc09)

Places