01/01: gnu: libtiff: Fix CVE-2016-5314.

[Leo Famulari]

lfam pushed a commit to branch master
in repository guix.

commit 4e9d5055fbf88ae43a7db7e901359e895fa729e8
Author: Leo Famulari <address@hidden>
Date:   Mon Aug 29 20:53:57 2016 -0400

    gnu: libtiff: Fix CVE-2016-5314.
    
    * gnu/packages/patches/libtiff-CVE-2016-5314.patch: New file.
    * gnu/local.mk (dist_patch_DATA): Add it.
    * gnu/packages/image.scm (libtiff/fixed): Use it.
---
 gnu/local.mk                                     |    1 +
 gnu/packages/image.scm                           |    1 +
 gnu/packages/patches/libtiff-CVE-2016-5314.patch |   45 ++++++++++++++++++++++
 3 files changed, 47 insertions(+)

diff --git a/gnu/local.mk b/gnu/local.mk
index 5809ba8..d75ab54 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -630,6 +630,7 @@ dist_patch_DATA =                                           
\
   %D%/packages/patches/libtiff-CVE-2016-3945.patch             \
   %D%/packages/patches/libtiff-CVE-2016-3990.patch             \
   %D%/packages/patches/libtiff-CVE-2016-3991.patch             \
+  %D%/packages/patches/libtiff-CVE-2016-5314.patch             \
   %D%/packages/patches/libtiff-CVE-2016-5321.patch             \
   %D%/packages/patches/libtiff-CVE-2016-5323.patch             \
   %D%/packages/patches/libtiff-oob-accesses-in-decode.patch    \
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 72a3204..4fdc4ae 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -196,6 +196,7 @@ collection of tools for doing simple manipulations of TIFF 
images.")
                          "libtiff-CVE-2016-3945.patch"
                          "libtiff-CVE-2016-3990.patch"
                          "libtiff-CVE-2016-3991.patch"
+                         "libtiff-CVE-2016-5314.patch"
                          "libtiff-CVE-2016-5321.patch"
                          "libtiff-CVE-2016-5323.patch"))))))
 
diff --git a/gnu/packages/patches/libtiff-CVE-2016-5314.patch 
b/gnu/packages/patches/libtiff-CVE-2016-5314.patch
new file mode 100644
index 0000000..e5380f8
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2016-5314.patch
@@ -0,0 +1,45 @@
+Fix CVE-2016-5314.
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5314
+bugzilla.maptools.org/show_bug.cgi?id=2554
+
+Patch extracted from upstream CVS repo with:
+$ cvs diff -u -r1.43 -r1.44 libtiff/tif_pixarlog.c
+
+Index: libtiff/tif_pixarlog.c
+===================================================================
+RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_pixarlog.c,v
+retrieving revision 1.43
+retrieving revision 1.44
+diff -u -r1.43 -r1.44
+--- libtiff/libtiff/tif_pixarlog.c     27 Dec 2015 20:14:11 -0000      1.43
++++ libtiff/libtiff/tif_pixarlog.c     28 Jun 2016 15:12:19 -0000      1.44
+@@ -459,6 +459,7 @@
+ typedef       struct {
+       TIFFPredictorState      predict;
+       z_stream                stream;
++      tmsize_t                tbuf_size; /* only set/used on reading for now 
*/
+       uint16                  *tbuf; 
+       uint16                  stride;
+       int                     state;
+@@ -694,6 +695,7 @@
+       sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size);
+       if (sp->tbuf == NULL)
+               return (0);
++      sp->tbuf_size = tbuf_size;
+       if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN)
+               sp->user_datafmt = PixarLogGuessDataFmt(td);
+       if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN) {
+@@ -783,6 +785,12 @@
+               TIFFErrorExt(tif->tif_clientdata, module, "ZLib cannot deal 
with buffers this size");
+               return (0);
+       }
++      /* Check that we will not fill more than what was allocated */
++      if (sp->stream.avail_out > sp->tbuf_size)
++      {
++              TIFFErrorExt(tif->tif_clientdata, module, "sp->stream.avail_out 
> sp->tbuf_size");
++              return (0);
++      }
+       do {
+               int state = inflate(&sp->stream, Z_PARTIAL_FLUSH);
+               if (state == Z_STREAM_END) {