mirror of
https://git.FreeBSD.org/ports.git
synced 2025-01-28 10:08:24 +00:00
f025b838e6
- fix missign macro in manpages - add regression test Security: CVE-2006-2193 Security: CVE-2006-2327 Security: CVE-2006-2656 Security: CVE-2006-3459 Security: CVE-2006-3460 Security: CVE-2006-3461 Security: CVE-2006-3462 Security: CVE-2006-3463 Security: CVE-2006-3464 Security: CVE-2006-3465 Security: CVE-2008-2327 PR: 127434 Submitted by: <bf2006a@yahoo.com> Obtained From: Gentoo,Debian Approved by: portmgr (marcus)
44 lines
1.5 KiB
C
44 lines
1.5 KiB
C
CVE-2006-3464,3465
|
|
===================================================================
|
|
--- libtiff/tif_read.c.orig 2008-08-17 13:03:48.990994211 -0400
|
|
+++ libtiff/tif_read.c 2008-08-17 13:03:52.898026507 -0400
|
|
@@ -31,6 +31,8 @@
|
|
#include "tiffiop.h"
|
|
#include <stdio.h>
|
|
|
|
+#include <limits.h>
|
|
+
|
|
int TIFFFillStrip(TIFF*, tstrip_t);
|
|
int TIFFFillTile(TIFF*, ttile_t);
|
|
static int TIFFStartStrip(TIFF*, tstrip_t);
|
|
@@ -272,7 +274,13 @@
|
|
if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata)
|
|
_TIFFfree(tif->tif_rawdata);
|
|
tif->tif_flags &= ~TIFF_MYBUFFER;
|
|
- if ( td->td_stripoffset[strip] + bytecount > tif->tif_size) {
|
|
+ /*
|
|
+ * This sanity check could potentially overflow, causing an OOB read.
|
|
+ * verify that offset + bytecount is > offset.
|
|
+ * -- taviso@google.com 14 Jun 2006
|
|
+ */
|
|
+ if ( td->td_stripoffset[strip] + bytecount > tif->tif_size ||
|
|
+ bytecount > (UINT_MAX - td->td_stripoffset[strip])) {
|
|
/*
|
|
* This error message might seem strange, but it's
|
|
* what would happen if a read were done instead.
|
|
@@ -470,7 +478,13 @@
|
|
if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata)
|
|
_TIFFfree(tif->tif_rawdata);
|
|
tif->tif_flags &= ~TIFF_MYBUFFER;
|
|
- if ( td->td_stripoffset[tile] + bytecount > tif->tif_size) {
|
|
+ /*
|
|
+ * We must check this calculation doesnt overflow, potentially
|
|
+ * causing an OOB read.
|
|
+ * -- taviso@google.com 15 Jun 2006
|
|
+ */
|
|
+ if (td->td_stripoffset[tile] + bytecount > tif->tif_size ||
|
|
+ bytecount > (UINT_MAX - td->td_stripoffset[tile])) {
|
|
tif->tif_curtile = NOTILE;
|
|
return (0);
|
|
}
|