Complete Yocto mirror with license table for TQMa6UL (2038-compliance)
- 264 license table entries with exact download URLs (224/264 resolved) - Complete sources/ directory with all BitBake recipes - Build configuration: tqma6ul-multi-mba6ulx, spaetzle (musl) - Full traceability for Softwarefreigabeantrag - GCC 13.4.0, Linux 6.6.102, U-Boot 2023.04, musl 1.2.4 - License distribution: GPL-2.0 (24), MIT (23), GPL-2.0+ (18), BSD-3 (16)
This commit is contained in:
@@ -0,0 +1,49 @@
|
||||
From 51558511bdbbcffdce534db21dbaf5d54b31638a Mon Sep 17 00:00:00 2001
|
||||
From: Even Rouault <even.rouault@spatialys.com>
|
||||
Date: Thu, 1 Feb 2024 11:38:14 +0000
|
||||
Subject: [PATCH] TIFFReadRGBAStrip/TIFFReadRGBATile: add more validation of
|
||||
col/row (fixes #622)
|
||||
|
||||
CVE: CVE-2023-52356
|
||||
Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/51558511bdbbcffdce534db21dbaf5d54b31638a]
|
||||
|
||||
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
|
||||
---
|
||||
libtiff/tif_getimage.c | 15 +++++++++++++++
|
||||
1 file changed, 15 insertions(+)
|
||||
|
||||
diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
|
||||
index 41f7dfd..9cd6eee 100644
|
||||
--- a/libtiff/tif_getimage.c
|
||||
+++ b/libtiff/tif_getimage.c
|
||||
@@ -3224,6 +3224,13 @@ int TIFFReadRGBAStripExt(TIFF *tif, uint32_t row, uint32_t *raster,
|
||||
if (TIFFRGBAImageOK(tif, emsg) &&
|
||||
TIFFRGBAImageBegin(&img, tif, stop_on_error, emsg))
|
||||
{
|
||||
+ if (row >= img.height)
|
||||
+ {
|
||||
+ TIFFErrorExtR(tif, TIFFFileName(tif),
|
||||
+ "Invalid row passed to TIFFReadRGBAStrip().");
|
||||
+ TIFFRGBAImageEnd(&img);
|
||||
+ return (0);
|
||||
+ }
|
||||
|
||||
img.row_offset = row;
|
||||
img.col_offset = 0;
|
||||
@@ -3301,6 +3308,14 @@ int TIFFReadRGBATileExt(TIFF *tif, uint32_t col, uint32_t row, uint32_t *raster,
|
||||
return (0);
|
||||
}
|
||||
|
||||
+ if (col >= img.width || row >= img.height)
|
||||
+ {
|
||||
+ TIFFErrorExtR(tif, TIFFFileName(tif),
|
||||
+ "Invalid row/col passed to TIFFReadRGBATile().");
|
||||
+ TIFFRGBAImageEnd(&img);
|
||||
+ return (0);
|
||||
+ }
|
||||
+
|
||||
/*
|
||||
* The TIFFRGBAImageGet() function doesn't allow us to get off the
|
||||
* edge of the image, even to fill an otherwise valid tile. So we
|
||||
--
|
||||
2.40.0
|
||||
Reference in New Issue
Block a user