1From 05ef5e05a0b8d18ab075e09b1ea349acc0035e67 Mon Sep 17 00:00:00 2001 2From: Su_Laus <sulau@freenet.de> 3Date: Mon, 15 Aug 2022 22:11:03 +0200 4Subject: [PATCH] tiffcrop: disable incompatibility of -S 5 6CVE: CVE-2022-2953 7Upstream-Status: Backport 8Signed-off-by: Ross Burton <ross.burton@arm.com> 9Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com> 10 11According to Richard Nolde 12https://gitlab.com/libtiff/libtiff/-/issues/401#note_877637400 the 13tiffcrop option "-S" is also mutually exclusive to the other crop 14options (-X|-Y), -Z and -z. 15 16MIME-Version: 1.0 17Content-Type: text/plain; charset=UTF-8 18Content-Transfer-Encoding: 8bit 19 20This is now checked and ends tiffcrop if those arguments are not mutually exclusive. 21 22This MR will fix the following tiffcrop issues: #349, #414, #422, #423, #424 23 24--- 25 tools/tiffcrop.c | 25 +++++++++++++------------ 26 1 file changed, 13 insertions(+), 12 deletions(-) 27 28diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c 29index b596f9e..8af85c9 100644 30--- a/tools/tiffcrop.c 31+++ b/tools/tiffcrop.c 32@@ -173,12 +173,12 @@ static char tiffcrop_rev_date[] = "02-09-2022"; 33 #define ROTATECW_270 32 34 #define ROTATE_ANY (ROTATECW_90 | ROTATECW_180 | ROTATECW_270) 35 36-#define CROP_NONE 0 37-#define CROP_MARGINS 1 38-#define CROP_WIDTH 2 39-#define CROP_LENGTH 4 40-#define CROP_ZONES 8 41-#define CROP_REGIONS 16 42+#define CROP_NONE 0 /* "-S" -> Page_MODE_ROWSCOLS and page->rows/->cols != 0 */ 43+#define CROP_MARGINS 1 /* "-m" */ 44+#define CROP_WIDTH 2 /* "-X" */ 45+#define CROP_LENGTH 4 /* "-Y" */ 46+#define CROP_ZONES 8 /* "-Z" */ 47+#define CROP_REGIONS 16 /* "-z" */ 48 #define CROP_ROTATE 32 49 #define CROP_MIRROR 64 50 #define CROP_INVERT 128 51@@ -316,7 +316,7 @@ struct crop_mask { 52 #define PAGE_MODE_RESOLUTION 1 53 #define PAGE_MODE_PAPERSIZE 2 54 #define PAGE_MODE_MARGINS 4 55-#define PAGE_MODE_ROWSCOLS 8 56+#define PAGE_MODE_ROWSCOLS 8 /* for -S option */ 57 58 #define INVERT_DATA_ONLY 10 59 #define INVERT_DATA_AND_TAG 11 60@@ -781,7 +781,7 @@ static const char usage_info[] = 61 " The four debug/dump options are independent, though it makes little sense to\n" 62 " specify a dump file without specifying a detail level.\n" 63 "\n" 64-"Note: The (-X|-Y), -Z and -z options are mutually exclusive.\n" 65+"Note: The (-X|-Y), -Z, -z and -S options are mutually exclusive.\n" 66 " In no case should the options be applied to a given selection successively.\n" 67 "\n" 68 ; 69@@ -2133,13 +2133,14 @@ void process_command_opts (int argc, char *argv[], char *mp, char *mode, uint32 70 /*NOTREACHED*/ 71 } 72 } 73- /*-- Check for not allowed combinations (e.g. -X, -Y and -Z and -z are mutually exclusive) --*/ 74- char XY, Z, R; 75+ /*-- Check for not allowed combinations (e.g. -X, -Y and -Z, -z and -S are mutually exclusive) --*/ 76+ char XY, Z, R, S; 77 XY = ((crop_data->crop_mode & CROP_WIDTH) || (crop_data->crop_mode & CROP_LENGTH)); 78 Z = (crop_data->crop_mode & CROP_ZONES); 79 R = (crop_data->crop_mode & CROP_REGIONS); 80- if ((XY && Z) || (XY && R) || (Z && R)) { 81- TIFFError("tiffcrop input error", "The crop options(-X|-Y), -Z and -z are mutually exclusive.->Exit"); 82+ S = (page->mode & PAGE_MODE_ROWSCOLS); 83+ if ((XY && Z) || (XY && R) || (XY && S) || (Z && R) || (Z && S) || (R && S)) { 84+ TIFFError("tiffcrop input error", "The crop options(-X|-Y), -Z, -z and -S are mutually exclusive.->Exit"); 85 exit(EXIT_FAILURE); 86 } 87 } /* end process_command_opts */ 88