1From 82a7fbb1fa7228499ffeb3a57a1d106a9626d57c Mon Sep 17 00:00:00 2001
2From: Su Laus <sulau@freenet.de>
3Date: Sun, 5 Feb 2023 15:53:15 +0000
4Subject: [PATCH] tiffcrop: added check for assumption on composite images
5 (fixes #496)
6
7tiffcrop: For composite images with more than one region, the combined_length or combined_width always needs to be equal, respectively. Otherwise, even the first section/region copy action might cause buffer overrun. This is now checked before the first copy action.
8
9Closes #496, #497, #498, #500, #501.
10
11Upstream-Status: Backport [import from fedora https://src.fedoraproject.org/rpms/libtiff/c/91856895aadf3cce6353f40c2feef9bf0b486440 ]
12CVE: CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
13Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
14---
15 tools/tiffcrop.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++--
16 1 file changed, 66 insertions(+), 2 deletions(-)
17
18diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
19index 84e26ac6..480b927c 100644
20--- a/tools/tiffcrop.c
21+++ b/tools/tiffcrop.c
22@@ -5329,18 +5329,39 @@
23
24       crop->regionlist[i].buffsize = buffsize;
25       crop->bufftotal += buffsize;
26+            /* For composite images with more than one region, the
27+             * combined_length or combined_width always needs to be equal,
28+             * respectively.
29+             * Otherwise, even the first section/region copy
30+             * action might cause buffer overrun. */
31       if (crop->img_mode == COMPOSITE_IMAGES)
32         {
33         switch (crop->edge_ref)
34           {
35           case EDGE_LEFT:
36           case EDGE_RIGHT:
37+                        if (i > 0 && zlength != crop->combined_length)
38+                        {
39+                            TIFFError(
40+                                "computeInputPixelOffsets",
41+                                "Only equal length regions can be combined for "
42+                                "-E left or right");
43+                            return (-1);
44+                        }
45                crop->combined_length = zlength;
46                crop->combined_width += zwidth;
47                break;
48           case EDGE_BOTTOM:
49           case EDGE_TOP:  /* width from left, length from top */
50           default:
51+                        if (i > 0 && zwidth != crop->combined_width)
52+                        {
53+                            TIFFError("computeInputPixelOffsets",
54+                                      "Only equal width regions can be "
55+                                      "combined for -E "
56+                                      "top or bottom");
57+                            return (-1);
58+                        }
59                crop->combined_width = zwidth;
60                crop->combined_length += zlength;
61 	       break;
62@@ -6546,6 +6567,46 @@
63   crop->combined_width = 0;
64   crop->combined_length = 0;
65
66+    /* If there is more than one region, check beforehand whether all the width
67+     * and length values of the regions are the same, respectively. */
68+    switch (crop->edge_ref)
69+    {
70+        default:
71+        case EDGE_TOP:
72+        case EDGE_BOTTOM:
73+            for (i = 1; i < crop->selections; i++)
74+            {
75+                uint32_t crop_width0 =
76+                    crop->regionlist[i - 1].x2 - crop->regionlist[i - 1].x1 + 1;
77+                uint32_t crop_width1 =
78+                    crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1;
79+                if (crop_width0 != crop_width1)
80+                {
81+                    TIFFError("extractCompositeRegions",
82+                              "Only equal width regions can be combined for -E "
83+                              "top or bottom");
84+                    return (1);
85+                }
86+            }
87+            break;
88+        case EDGE_LEFT:
89+        case EDGE_RIGHT:
90+            for (i = 1; i < crop->selections; i++)
91+            {
92+                uint32_t crop_length0 =
93+                    crop->regionlist[i - 1].y2 - crop->regionlist[i - 1].y1 + 1;
94+                uint32_t crop_length1 =
95+                    crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1;
96+                if (crop_length0 != crop_length1)
97+                {
98+                    TIFFError("extractCompositeRegions",
99+                              "Only equal length regions can be combined for "
100+                              "-E left or right");
101+                    return (1);
102+                }
103+            }
104+    }
105+
106   for (i = 0; i < crop->selections; i++)
107     {
108     /* rows, columns, width, length are expressed in pixels */
109@@ -6570,7 +6631,8 @@
110       default:
111       case EDGE_TOP:
112       case EDGE_BOTTOM:
113-	   if ((i > 0) && (crop_width != crop->regionlist[i - 1].width))
114+                if ((crop->selections > i + 1) &&
115+                    (crop_width != crop->regionlist[i + 1].width))
116              {
117 	     TIFFError ("extractCompositeRegions",
118                           "Only equal width regions can be combined for -E top or bottom");
119@@ -6651,7 +6713,8 @@
120 	   break;
121       case EDGE_LEFT:  /* splice the pieces of each row together, side by side */
122       case EDGE_RIGHT:
123-	   if ((i > 0) && (crop_length != crop->regionlist[i - 1].length))
124+                if ((crop->selections > i + 1) &&
125+                    (crop_length != crop->regionlist[i + 1].length))
126              {
127 	     TIFFError ("extractCompositeRegions",
128                           "Only equal length regions can be combined for -E left or right");
129