libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter
clamping to avoid
int32 overflow in TIFFYCbCrtoRGB().
Fixes OSS-Fuzz #1844.
Credit to OSS Fuzz
libtiff/tif_getimage.c: initYCbCrConversion(): stricter validation for
refBlackWhite coefficients values. To avoid invalid
float->int32 conversion
(when refBlackWhite[0] == 2147483648.f)
Fixes OSS-Fuzz #1907.
Credit to OSS Fuzz
libtiff/tif_dirinfo.c, tif_dirread.c: add _TIFFCheckFieldIsValidForCodec(),
and use it in TIFFReadDirectory() so as to
ignore fields whose tag is a
codec-specified tag but this codec is not enabled. This avoids TIFFGetField()
to behave differently depending on whether the codec is enabled or not, and
thus can avoid stack based buffer overflows in a number of TIFF utilities
such as tiffsplit, tiffcmp, thumbnail,
etc.
Patch derived from 0063-Handle-properly-CODEC-specific-tags.patch
(MapTools bugzilla
#2580) by Raphaël Hertzog.
Fixes:
MapTools bugzilla
#2580,
MapTools bugzilla
#2693,
MapTools bugzilla
#2625 (CVE-2016-10095),
MapTools bugzilla
#2564 (CVE-2015-7554),
MapTools bugzilla
#2561 (CVE-2016-5318),
MapTools bugzilla
#2499 (CVE-2014-8128),
MapTools bugzilla
#2441,
MapTools bugzilla
#2433.
libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is defined, do not do
the #ifdef
TIFFSwabXXX checks. Make it easier for GDAL to
rename the symbols
of its internal libtiff copy.
libtiff/tif_dirread.c: fix regression of libtiff 4.0.8
in
ChopUpSingleUncompressedStrip() regarding update of
newly single-strip
uncompressed files whose bytecount is 0. Before the change of 2016-12-03,
the condition bytecount==0 used to trigger an early exit/disabling
of
strip chop. Re-introduce that in update mode. Otherwise this cause
later incorrect setting for the value of StripByteCounts/StripOffsets.
(GDAL trac #6924).
libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the number of items
read in StripOffsets/StripByteCounts tags to the number
of strips to avoid
excessive memory allocation.
Fixes OSS-Fuzz #2215.
Credit to OSS Fuzz
libtiff/tif_getimage.c: avoid many (harmless) unsigned
int overflows.
libtiff/tif_fax3.c: avoid unsigned int overflow in Fax3Encode2DRow(). Could
potentially be a bug with huge rows.
libtiff/tif_jpeg.c: avoid (harmless) unsigned
int overflow on tiled images.
libtiff/tif_dirread.c: avoid unsigned int overflow in EstimateStripByteCounts()
and BYTECOUNTLOOKSBAD when file is too short.
libtiff/tif_predict.c: decorate legitimate functions
where unsigned int
overflow occur with TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
libtiff/tif_dirread.c: avoid unsigned int overflow in EstimateStripByteCounts()
libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW macro to
disable CLang warnings raised by -fsanitize=undefined,unsigned-integer-
overflow
libtiff/tif_jpeg.c: add anti-denial of service measure
to avoid excessive
CPU consumption on progressive JPEGs with a huge number of scans.
See http://www.libjpeg-
turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf.
Note
Only affects libtiff since 2014-12-29 where support of non-baseline JPEG
was added.
libtiff/tif_jpeg.c: error out at decoding time if
anticipated libjpeg
memory allocation is above 100 MB. libjpeg in case of multiple scans,
which is allowed even in baseline JPEG, if components are spread over several
scans and not interleavedin a single one, needs to allocate memory (or
backing store) for the whole strip/tile.
See http://www.libjpeg-
turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf.
This limitation may be overridden by setting the
LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment
variable, or recompiling
libtiff with a custom value of TIFF_LIBJPEG_LARGEST_MEM_ALLOC
macro.
libtiff/tif_jbig.c: fix memory leak in error code path
of JBIGDecode().
Fixes MapTools bugzilla
#2706.
Reported by team OWL337
libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that a
double value can fit in a float before casting. Patch by Nicolas RUFF
libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
libtiff/tif_read.c: make TIFFReadScanline() works in
CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with
multiple scans.
Also make configurable through a LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER
environment variable the maximum number of scans allowed. Defaults to
100.
libtiff/tif_read.c: TIFFFillTile():
add limitation to the number
of bytes read in case td_stripbytecount[strip] is bigger than
reasonable, so as to avoid excessive memory allocation (similarly to
what was done for TIFFFileStrip() on 2017-05-10)
libtiff/tif_getimage.c: use _TIFFReadEncodedStripAndAllocBuffer().
Fixes MapTools bugzilla
#2708 and
OSS-Fuzz #2433.
Credit to OSS Fuzz
libtiff/tif_read.c, tiffiop.h: add a _TIFFReadEncodedStripAndAllocBuffer()
function, variant of TIFFReadEncodedStrip() that
allocates the
decoded buffer only after a first successful TIFFFillStrip(). This
avoids
excessive memory allocation on corrupted files.
libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
functions associated with LONG8/SLONG8 data type, replace assertion that
the file is BigTIFF, by a non-fatal error.
Fixes MapTools bugzilla
#2712
Reported by team OWL337
libtiff/tif_read.c: TIFFStartTile():
set tif_rawcc to
tif_rawdataloaded when it is set. Similarly to TIFFStartStrip().
This issue was revealed by the change of 2017-06-30 in TIFFFileTile(),
limiting the number of bytes read. But it could probably have been hit
too in CHUNKY_STRIP_READ_SUPPORT mode previously ?
Fixes OSS-Fuzz #2454
Credit to OSS Fuzz
libtiff/tif_error.c, tif_warning.c: correctly use va_list when both
an old-style and new-style warning/error handlers are installed.
Patch by Paavo Helde (sent on the mailing list)
libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
Fixes OSS-Fuzz #2470
Credit to OSS Fuzz.
libtiff/tif_read.c, tiffiop.h: add a _TIFFReadEncodedTileAndAllocBuffer()
and _TIFFReadTileAndAllocBuffer() variants of TIFFReadEncodedTile() and
TIFFReadTile() that allocates the decoded buffer
only after a first
successful TIFFFillTile(). This avoids excessive memory
allocation
on corrupted files.
libtiff/tif_pixarlog.c: avoid excessive memory
allocation on decoding
when RowsPerStrip tag is not defined (and thus td_rowsperstrip == UINT_MAX)
Fixes OSS-Fuzz #2554
Credit to OSS Fuzz
libtiff/tif_lzw.c: fix 4.0.8 regression in the
decoding of old-style LZW
compressed files.
libtiff/tif_lzw.c: fix potential out-of-buffer read on
1-byte LZW
strips. Crashing issue only on memory mapped files, where the strip
offset is the last byte of the file, and the file size is a multiple
of one page size on the CPU architecture (typically 4096). Credit
to myself :-)
libtiff/tif_dir.c: avoid potential null pointer
dereference in
_TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
instance.
Fixes MapTools bugzilla
#2713
tools/tiff2pdf.c: prevent heap buffer overflow write
in "Raw"
mode on PlanarConfig=Contig input images.
Fixes MapTools bugzilla
#2715
Reported by team OWL337
libtiff/tif_read.c: TIFFFillStrip() /
TIFFFillTile().
Complementary fix for MapTools bugzilla
#2708
in the isMapped() case, so as to avoid excessive memory
allocation
when we need a temporary buffer but the file is truncated.
libtiff/tif_read.c: TIFFFillStrip() /
TIFFFillTile().
Complementary fix for MapTools bugzilla
#2708
in the isMapped() case, so as to avoid excessive memory
allocation
when we need a temporary buffer but the file is truncated.
libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
arrays that hold StripOffsets/StripByteCounts, when they are smaller
than the expected number of striles, up to 1 million striles, and
error out beyond. Can be tweaked by setting the environment variable
LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
This partially goes against a change added on 2002-12-17 to accept
those arrays of wrong sizes, but is needed to avoid denial of services.
Fixes OSS-Fuzz #2350
Credit to OSS Fuzz
libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
arrays that hold StripOffsets/StripByteCounts, when they are
smaller
than the expected number of striles, up to 1 million striles, and
error out beyond. Can be tweaked by setting the environment variable
LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
This partially goes against a change added on 2002-12-17 to accept
those arrays of wrong sizes, but is needed to avoid denial of services.
Fixes OSS-Fuzz #2350
Credit to OSS Fuzz
libtiff/tif_read.c: add protection against excessive
memory
allocation attempts in TIFFReadDirEntryArray() on short
files.
Effective for mmap'ed case. And non-mmap'ed case, but restricted
to 64bit builds.
Fixes MapTools bugzilla
#2675
libtiff/tif_read.c: add protection against excessive
memory
allocation attempts in TIFFReadDirEntryArray() on short
files.
Effective for mmap'ed case. And non-mmap'ed case, but restricted
to 64bit builds.
Fixes MapTools bugzilla
#2675
libtiff/tif_luv.c: LogLuvInitState(): avoid
excessive memory
allocation when RowsPerStrip tag is missing.
Fixes OSS-Fuzz #2683
Credit to OSS-Fuzz
libtiff/tif_getimage.c: gtTileContig() and
gtTileSeparate():
properly break from loops on error when stoponerr is set, instead
of going on iterating on row based loop.
libtiff/tif_getimage.c: fix fromskew computation when
to-be-skipped
pixel number is not a multiple of the horizontal subsampling, and
also in some other cases. Impact putcontig8bitYCbCr44tile,
putcontig8bitYCbCr42tile, putcontig8bitYCbCr41tile,
putcontig8bitYCbCr21tile and putcontig8bitYCbCr12tile.
Fixes MapTools bugzilla
#2637 (discovered by Agostino Sarubbo)
and OSS-Fuzz #2691 (credit to OSS Fuzz)
libtiff/tif_luv.c: further reduce memory requirements
for temporary
buffer when RowsPerStrip >= image_length in LogLuvInitState() and
LogL16InitState().
Fixes OSS-Fuzz #2700
Credit to OSS Fuzz
libtiff/tif_dirwrite.c: replace assertion related to
not finding the
SubIFD tag by runtime check (in TIFFWriteDirectorySec())
Fixes MapTools bugzilla
#2727
Reported by team OWL337
libtiff/tif_dirwrite.c: replace assertion to tag value
not fitting
on uint32 when selecting the value of SubIFD tag
by runtime check
(in TIFFWriteDirectoryTagSubifd()).
Fixes MapTools bugzilla
#2728
Reported by team OWL337
libtiff/tif_jpeg.c: accept reading the last strip of a
JPEG compressed
file if the codestream height is larger than the truncated height of the
strip. Emit a warning in this situation since this is non compliant.
libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a _TIFFSeekoK()
function that checks if the offset is not bigger than INT64_MAX,
so as
to avoid a -1 error return code of TIFFSeekFile() to
match a required
seek to UINT64_MAX/-1.
Fixes MapTools bugzilla
#2726
Adapted from proposal by Nicolas Ruff.
libtiff/tif_dirread.c: add NULL check to
avoid likely false positive
null-pointer dereference warning by CLang Static Analyzer.
libtiff/libtiff.def: add TIFFReadRGBAStripExt() and TIFFReadRGBATileExt()
Fixes MapTools bugzilla
#2735
libtiff/tif_jpeg.c: add compatibility with libjpeg-
turbo 1.5.2 that
honours max_memory_to_use > 0.
Cf .
libtiff/tif_getimage.c: avoid floating point division
by zero in
initCIELabConversion()
Fixes OSS-Fuzz #3733
Credit to OSS Fuzz