1From 9b2645d830b4ad004824cf28d81f3b974faf0037 Mon Sep 17 00:00:00 2001 2From: Su Laus <sulau@freenet.de> 3Date: Tue, 8 Mar 2022 17:02:44 +0000 4Subject: [PATCH] tiffcrop: fix issue #380 and #382 heap buffer overflow in 5 6CVE: CVE-2022-0891 7CVE: CVE-2022-1056 8Upstream-Status: Backport 9Signed-off-by: Ross Burton <ross.burton@arm.com> 10 11 extractImageSection 12 13--- 14 tools/tiffcrop.c | 92 +++++++++++++++++++----------------------------- 15 1 file changed, 36 insertions(+), 56 deletions(-) 16 17diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c 18index b85c2ce..302a7e9 100644 19--- a/tools/tiffcrop.c 20+++ b/tools/tiffcrop.c 21@@ -105,8 +105,8 @@ 22 * of messages to monitor progress without enabling dump logs. 23 */ 24 25-static char tiffcrop_version_id[] = "2.4"; 26-static char tiffcrop_rev_date[] = "12-13-2010"; 27+static char tiffcrop_version_id[] = "2.4.1"; 28+static char tiffcrop_rev_date[] = "03-03-2010"; 29 30 #include "tif_config.h" 31 #include "libport.h" 32@@ -6710,10 +6710,10 @@ extractImageSection(struct image_data *image, struct pageseg *section, 33 #ifdef DEVELMODE 34 uint32_t img_length; 35 #endif 36- uint32_t j, shift1, shift2, trailing_bits; 37+ uint32_t j, shift1, trailing_bits; 38 uint32_t row, first_row, last_row, first_col, last_col; 39 uint32_t src_offset, dst_offset, row_offset, col_offset; 40- uint32_t offset1, offset2, full_bytes; 41+ uint32_t offset1, full_bytes; 42 uint32_t sect_width; 43 #ifdef DEVELMODE 44 uint32_t sect_length; 45@@ -6723,7 +6723,6 @@ extractImageSection(struct image_data *image, struct pageseg *section, 46 #ifdef DEVELMODE 47 int k; 48 unsigned char bitset; 49- static char *bitarray = NULL; 50 #endif 51 52 img_width = image->width; 53@@ -6741,17 +6740,12 @@ extractImageSection(struct image_data *image, struct pageseg *section, 54 dst_offset = 0; 55 56 #ifdef DEVELMODE 57- if (bitarray == NULL) 58- { 59- if ((bitarray = (char *)malloc(img_width)) == NULL) 60- { 61- TIFFError ("", "DEBUG: Unable to allocate debugging bitarray"); 62- return (-1); 63- } 64- } 65+ char bitarray[39]; 66 #endif 67 68- /* rows, columns, width, length are expressed in pixels */ 69+ /* rows, columns, width, length are expressed in pixels 70+ * first_row, last_row, .. are index into image array starting at 0 to width-1, 71+ * last_col shall be also extracted. */ 72 first_row = section->y1; 73 last_row = section->y2; 74 first_col = section->x1; 75@@ -6761,9 +6755,14 @@ extractImageSection(struct image_data *image, struct pageseg *section, 76 #ifdef DEVELMODE 77 sect_length = last_row - first_row + 1; 78 #endif 79- img_rowsize = ((img_width * bps + 7) / 8) * spp; 80- full_bytes = (sect_width * spp * bps) / 8; /* number of COMPLETE bytes per row in section */ 81- trailing_bits = (sect_width * bps) % 8; 82+ /* The read function loadImage() used copy separate plane data into a buffer as interleaved 83+ * samples rather than separate planes so the same logic works to extract regions 84+ * regardless of the way the data are organized in the input file. 85+ * Furthermore, bytes and bits are arranged in buffer according to COMPRESSION=1 and FILLORDER=1 86+ */ 87+ img_rowsize = (((img_width * spp * bps) + 7) / 8); /* row size in full bytes of source image */ 88+ full_bytes = (sect_width * spp * bps) / 8; /* number of COMPLETE bytes per row in section */ 89+ trailing_bits = (sect_width * spp * bps) % 8; /* trailing bits within the last byte of destination buffer */ 90 91 #ifdef DEVELMODE 92 TIFFError ("", "First row: %"PRIu32", last row: %"PRIu32", First col: %"PRIu32", last col: %"PRIu32"\n", 93@@ -6776,10 +6775,9 @@ extractImageSection(struct image_data *image, struct pageseg *section, 94 95 if ((bps % 8) == 0) 96 { 97- col_offset = first_col * spp * bps / 8; 98+ col_offset = (first_col * spp * bps) / 8; 99 for (row = first_row; row <= last_row; row++) 100 { 101- /* row_offset = row * img_width * spp * bps / 8; */ 102 row_offset = row * img_rowsize; 103 src_offset = row_offset + col_offset; 104 105@@ -6792,14 +6790,12 @@ extractImageSection(struct image_data *image, struct pageseg *section, 106 } 107 else 108 { /* bps != 8 */ 109- shift1 = spp * ((first_col * bps) % 8); 110- shift2 = spp * ((last_col * bps) % 8); 111+ shift1 = ((first_col * spp * bps) % 8); /* shift1 = bits to skip in the first byte of source buffer*/ 112 for (row = first_row; row <= last_row; row++) 113 { 114 /* pull out the first byte */ 115 row_offset = row * img_rowsize; 116- offset1 = row_offset + (first_col * bps / 8); 117- offset2 = row_offset + (last_col * bps / 8); 118+ offset1 = row_offset + ((first_col * spp * bps) / 8); /* offset1 = offset into source of byte with first bits to be extracted */ 119 120 #ifdef DEVELMODE 121 for (j = 0, k = 7; j < 8; j++, k--) 122@@ -6811,12 +6807,12 @@ extractImageSection(struct image_data *image, struct pageseg *section, 123 sprintf(&bitarray[9], " "); 124 for (j = 10, k = 7; j < 18; j++, k--) 125 { 126- bitset = *(src_buff + offset2) & (((unsigned char)1 << k)) ? 1 : 0; 127+ bitset = *(src_buff + offset1 + full_bytes) & (((unsigned char)1 << k)) ? 1 : 0; 128 sprintf(&bitarray[j], (bitset) ? "1" : "0"); 129 } 130 bitarray[18] = '\0'; 131- TIFFError ("", "Row: %3d Offset1: %"PRIu32", Shift1: %"PRIu32", Offset2: %"PRIu32", Shift2: %"PRIu32"\n", 132- row, offset1, shift1, offset2, shift2); 133+ TIFFError ("", "Row: %3d Offset1: %"PRIu32", Shift1: %"PRIu32", Offset2: %"PRIu32", Trailing_bits: %"PRIu32"\n", 134+ row, offset1, shift1, offset1+full_bytes, trailing_bits); 135 #endif 136 137 bytebuff1 = bytebuff2 = 0; 138@@ -6840,11 +6836,12 @@ extractImageSection(struct image_data *image, struct pageseg *section, 139 140 if (trailing_bits != 0) 141 { 142- bytebuff2 = src_buff[offset2] & ((unsigned char)255 << (7 - shift2)); 143+ /* Only copy higher bits of samples and mask lower bits of not wanted column samples to zero */ 144+ bytebuff2 = src_buff[offset1 + full_bytes] & ((unsigned char)255 << (8 - trailing_bits)); 145 sect_buff[dst_offset] = bytebuff2; 146 #ifdef DEVELMODE 147 TIFFError ("", " Trailing bits src offset: %8"PRIu32", Dst offset: %8"PRIu32"\n", 148- offset2, dst_offset); 149+ offset1 + full_bytes, dst_offset); 150 for (j = 30, k = 7; j < 38; j++, k--) 151 { 152 bitset = *(sect_buff + dst_offset) & (((unsigned char)1 << k)) ? 1 : 0; 153@@ -6863,8 +6860,10 @@ extractImageSection(struct image_data *image, struct pageseg *section, 154 #endif 155 for (j = 0; j <= full_bytes; j++) 156 { 157- bytebuff1 = src_buff[offset1 + j] & ((unsigned char)255 >> shift1); 158- bytebuff2 = src_buff[offset1 + j + 1] & ((unsigned char)255 << (7 - shift1)); 159+ /* Skip the first shift1 bits and shift the source up by shift1 bits before save to destination.*/ 160+ /* Attention: src_buff size needs to be some bytes larger than image size, because could read behind image here. */ 161+ bytebuff1 = src_buff[offset1 + j] & ((unsigned char)255 >> shift1); 162+ bytebuff2 = src_buff[offset1 + j + 1] & ((unsigned char)255 << (8 - shift1)); 163 sect_buff[dst_offset + j] = (bytebuff1 << shift1) | (bytebuff2 >> (8 - shift1)); 164 } 165 #ifdef DEVELMODE 166@@ -6880,36 +6879,17 @@ extractImageSection(struct image_data *image, struct pageseg *section, 167 #endif 168 dst_offset += full_bytes; 169 170+ /* Copy the trailing_bits for the last byte in the destination buffer. 171+ Could come from one ore two bytes of the source buffer. */ 172 if (trailing_bits != 0) 173 { 174 #ifdef DEVELMODE 175- TIFFError ("", " Trailing bits src offset: %8"PRIu32", Dst offset: %8"PRIu32"\n", offset1 + full_bytes, dst_offset); 176-#endif 177- if (shift2 > shift1) 178- { 179- bytebuff1 = src_buff[offset1 + full_bytes] & ((unsigned char)255 << (7 - shift2)); 180- bytebuff2 = bytebuff1 & ((unsigned char)255 << shift1); 181- sect_buff[dst_offset] = bytebuff2; 182-#ifdef DEVELMODE 183- TIFFError ("", " Shift2 > Shift1\n"); 184+ TIFFError("", " Trailing bits %4"PRIu32" src offset: %8"PRIu32", Dst offset: %8"PRIu32"\n", trailing_bits, offset1 + full_bytes, dst_offset); 185 #endif 186+ /* More than necessary bits are already copied into last destination buffer, 187+ * only masking of last byte in destination buffer is necessary.*/ 188+ sect_buff[dst_offset] &= ((uint8_t)0xFF << (8 - trailing_bits)); 189 } 190- else 191- { 192- if (shift2 < shift1) 193- { 194- bytebuff2 = ((unsigned char)255 << (shift1 - shift2 - 1)); 195- sect_buff[dst_offset] &= bytebuff2; 196-#ifdef DEVELMODE 197- TIFFError ("", " Shift2 < Shift1\n"); 198-#endif 199- } 200-#ifdef DEVELMODE 201- else 202- TIFFError ("", " Shift2 == Shift1\n"); 203-#endif 204- } 205- } 206 #ifdef DEVELMODE 207 sprintf(&bitarray[28], " "); 208 sprintf(&bitarray[29], " "); 209@@ -7062,7 +7042,7 @@ writeImageSections(TIFF *in, TIFF *out, struct image_data *image, 210 width = sections[i].x2 - sections[i].x1 + 1; 211 length = sections[i].y2 - sections[i].y1 + 1; 212 sectsize = (uint32_t) 213- ceil((width * image->bps + 7) / (double)8) * image->spp * length; 214+ ceil((width * image->bps * image->spp + 7) / (double)8) * length; 215 /* allocate a buffer if we don't have one already */ 216 if (createImageSection(sectsize, sect_buff_ptr)) 217 { 218