francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
60 lines
2.0 KiB
Diff
60 lines
2.0 KiB
Diff
From 782a11d6b5b61c6dc21e714950a4af5bf89f023c Mon Sep 17 00:00:00 2001
|
|
From: Even Rouault <even.rouault@spatialys.com>
|
|
Date: Sun, 22 Feb 2026 23:32:47 +0100
|
|
Subject: [PATCH] TIFFReadRGBAImage(): prevent integer overflow and later heap
|
|
overflow on images with huge width in YCbCr tile decoding functions
|
|
|
|
Fixes https://gitlab.com/libtiff/libtiff/-/issues/787
|
|
|
|
CVE: CVE-2026-4775
|
|
Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/782a11d6b5b61c6dc21e714950a4af5bf89f023c]
|
|
|
|
Signed-off-by: Naman Jain <namanj1@kpit.com>
|
|
---
|
|
libtiff/tif_getimage.c | 8 ++++----
|
|
1 file changed, 4 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
|
|
index 4543dddae..fa82d0910 100644
|
|
--- a/libtiff/tif_getimage.c
|
|
+++ b/libtiff/tif_getimage.c
|
|
@@ -2224,7 +2224,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr44tile)
|
|
uint32_t *cp1 = cp + w + toskew;
|
|
uint32_t *cp2 = cp1 + w + toskew;
|
|
uint32_t *cp3 = cp2 + w + toskew;
|
|
- int32_t incr = 3 * w + 4 * toskew;
|
|
+ const tmsize_t incr = 3 * (tmsize_t)w + 4 * (tmsize_t)toskew;
|
|
|
|
(void)y;
|
|
/* adjust fromskew */
|
|
@@ -2364,7 +2364,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr44tile)
|
|
DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
|
|
{
|
|
uint32_t *cp1 = cp + w + toskew;
|
|
- int32_t incr = 2 * toskew + w;
|
|
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
|
|
|
|
(void)y;
|
|
fromskew = (fromskew / 4) * (4 * 2 + 2);
|
|
@@ -2522,7 +2522,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr41tile)
|
|
DECLAREContigPutFunc(putcontig8bitYCbCr22tile)
|
|
{
|
|
uint32_t *cp2;
|
|
- int32_t incr = 2 * toskew + w;
|
|
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
|
|
(void)y;
|
|
fromskew = (fromskew / 2) * (2 * 2 + 2);
|
|
cp2 = cp + w + toskew;
|
|
@@ -2625,7 +2625,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr21tile)
|
|
DECLAREContigPutFunc(putcontig8bitYCbCr12tile)
|
|
{
|
|
uint32_t *cp2;
|
|
- int32_t incr = 2 * toskew + w;
|
|
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
|
|
(void)y;
|
|
fromskew = (fromskew / 1) * (1 * 2 + 2);
|
|
cp2 = cp + w + toskew;
|
|
--
|
|
GitLab
|
|
|