1*4882a593SmuzhiyunFrom b4cf40182c865db554c6e67034afa6ea12c5554d Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Su_Laus <sulau@freenet.de> 3*4882a593SmuzhiyunDate: Sun, 6 Feb 2022 10:53:45 +0100 4*4882a593SmuzhiyunSubject: [PATCH] tiffcrop.c: Fix issue #352 heap-buffer-overflow by correcting 5*4882a593Smuzhiyun 6*4882a593Smuzhiyun uint32_t underflow. 7*4882a593Smuzhiyun 8*4882a593SmuzhiyunCVE: CVE-2022-2869 9*4882a593Smuzhiyun 10*4882a593SmuzhiyunUpstream-Status: Backport 11*4882a593Smuzhiyun[https://gitlab.com/libtiff/libtiff/-/commit/bcf28bb7f630f24fa47701a9907013f3548092cd?merge_request_iid=294] 12*4882a593Smuzhiyun 13*4882a593SmuzhiyunSigned-off-by: Teoh Jay Shen <jay.shen.teoh@intel.com> 14*4882a593Smuzhiyun 15*4882a593Smuzhiyun--- 16*4882a593Smuzhiyun tools/tiffcrop.c | 34 +++++++++++++++++++--------------- 17*4882a593Smuzhiyun 1 file changed, 19 insertions(+), 15 deletions(-) 18*4882a593Smuzhiyun 19*4882a593Smuzhiyundiff --git a/tools/tiffcrop.c b/tools/tiffcrop.c 20*4882a593Smuzhiyunindex b9b13d8..4a4ace8 100644 21*4882a593Smuzhiyun--- a/tools/tiffcrop.c 22*4882a593Smuzhiyun+++ b/tools/tiffcrop.c 23*4882a593Smuzhiyun@@ -5194,26 +5194,30 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image, 24*4882a593Smuzhiyun y1 = _TIFFClampDoubleToUInt32(crop->corners[i].Y1); 25*4882a593Smuzhiyun y2 = _TIFFClampDoubleToUInt32(crop->corners[i].Y2); 26*4882a593Smuzhiyun } 27*4882a593Smuzhiyun- if (x1 < 1) 28*4882a593Smuzhiyun- crop->regionlist[i].x1 = 0; 29*4882a593Smuzhiyun- else 30*4882a593Smuzhiyun+ /* region needs to be within image sizes 0.. width-1; 0..length-1 31*4882a593Smuzhiyun+ * - be aware x,y are already casted to (uint32_t) and avoid (0 - 1) 32*4882a593Smuzhiyun+ */ 33*4882a593Smuzhiyun+ if (x1 > image->width - 1) 34*4882a593Smuzhiyun+ crop->regionlist[i].x1 = image->width - 1; 35*4882a593Smuzhiyun+ else if (x1 > 0) 36*4882a593Smuzhiyun crop->regionlist[i].x1 = (uint32_t) (x1 - 1); 37*4882a593Smuzhiyun 38*4882a593Smuzhiyun- if (x2 > image->width - 1) 39*4882a593Smuzhiyun- crop->regionlist[i].x2 = image->width - 1; 40*4882a593Smuzhiyun- else 41*4882a593Smuzhiyun- crop->regionlist[i].x2 = (uint32_t) (x2 - 1); 42*4882a593Smuzhiyun+ if (x2 > image->width - 1) 43*4882a593Smuzhiyun+ crop->regionlist[i].x2 = image->width - 1; 44*4882a593Smuzhiyun+ else if (x2 > 0) 45*4882a593Smuzhiyun+ crop->regionlist[i].x2 = (uint32_t)(x2 - 1); 46*4882a593Smuzhiyun+ 47*4882a593Smuzhiyun zwidth = crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1; 48*4882a593Smuzhiyun 49*4882a593Smuzhiyun- if (y1 < 1) 50*4882a593Smuzhiyun- crop->regionlist[i].y1 = 0; 51*4882a593Smuzhiyun- else 52*4882a593Smuzhiyun- crop->regionlist[i].y1 = (uint32_t) (y1 - 1); 53*4882a593Smuzhiyun+ if (y1 > image->length - 1) 54*4882a593Smuzhiyun+ crop->regionlist[i].y1 = image->length - 1; 55*4882a593Smuzhiyun+ else if (y1 > 0) 56*4882a593Smuzhiyun+ crop->regionlist[i].y1 = (uint32_t)(y1 - 1); 57*4882a593Smuzhiyun 58*4882a593Smuzhiyun if (y2 > image->length - 1) 59*4882a593Smuzhiyun crop->regionlist[i].y2 = image->length - 1; 60*4882a593Smuzhiyun- else 61*4882a593Smuzhiyun- crop->regionlist[i].y2 = (uint32_t) (y2 - 1); 62*4882a593Smuzhiyun+ else if (y2 > 0) 63*4882a593Smuzhiyun+ crop->regionlist[i].y2 = (uint32_t)(y2 - 1); 64*4882a593Smuzhiyun 65*4882a593Smuzhiyun zlength = crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1; 66*4882a593Smuzhiyun 67*4882a593Smuzhiyun@@ -5376,7 +5380,7 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image, 68*4882a593Smuzhiyun crop_width = endx - startx + 1; 69*4882a593Smuzhiyun crop_length = endy - starty + 1; 70*4882a593Smuzhiyun 71*4882a593Smuzhiyun- if (crop_width <= 0) 72*4882a593Smuzhiyun+ if (endx + 1 <= startx) 73*4882a593Smuzhiyun { 74*4882a593Smuzhiyun TIFFError("computeInputPixelOffsets", 75*4882a593Smuzhiyun "Invalid left/right margins and /or image crop width requested"); 76*4882a593Smuzhiyun@@ -5385,7 +5389,7 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image, 77*4882a593Smuzhiyun if (crop_width > image->width) 78*4882a593Smuzhiyun crop_width = image->width; 79*4882a593Smuzhiyun 80*4882a593Smuzhiyun- if (crop_length <= 0) 81*4882a593Smuzhiyun+ if (endy + 1 <= starty) 82*4882a593Smuzhiyun { 83*4882a593Smuzhiyun TIFFError("computeInputPixelOffsets", 84*4882a593Smuzhiyun "Invalid top/bottom margins and /or image crop length requested"); 85