From 00e122a7b3a839f5ce8b819cb1bfe92cf3781eda Mon Sep 17 00:00:00 2001 From: Brad Bishop Date: Sat, 5 Oct 2019 11:10:57 -0400 Subject: poky: subtree update:81f9e815d3..03d4d9d68f MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adrian Bunk (1): json-c: Don't --enable-rdrand Alessio Igor Bogani (2): wic: Using the right rootfs size during prepare_rootfs rootfs-postcommands: Avoid use of an hard-coded value Alexander Kanavin (1): binutils: drop UPSTREAM_VERSION_UNKNOWN Alexandre Bard (1): systemd: Expose resolv-conf alternative only when resolved is built Andre McCurdy (1): ffmpeg: enable more verbose build logs André Draszik (4): ruby: drop long-merged CVE patches ruby: configure mis-detects isnan/isinf on musl ruby: fix non-IPv6 support packagegroup: fix a comment regarding PACKAGE_ARCH Bruce Ashfield (6): linux-yocto/5.2: update to v5.2.13 linux-yocto/4.19: update to v4.19.72 linux-yocto/5.2: update to v5.2.14 linux-yocto/5.2: update to v5.2.16 linux-yocto/5.2: update to v5.2.17 yocto-bsps: update to v5.2.17 Böszörményi Zoltán via Openembedded-core (1): classes/image-live.bbclass: Don't hardcode cpio.gz Changqing Li (2): devtool.py: change to do clean before remove-layer devtool.py: fix buildclean test Chen Qi (1): systemd: fix NFS regression Dan Tran (1): unzip: Fix CVE-2019-13232 David Reyna (2): bitbake: toaster: issues in import layer when clicking 'add layer' bitbake: toaster: improve warnings when adding dependency to packages Diego Rondini (2): initramfs-framework: fix var name initramfs-framework: support PARTLABEL option Douglas Royds (1): icecc: Don't use icecc when INHIBIT_DEFAULT_DEPS is set He Zhe (1): ltp: Fix hang of cve test cases Heiko Schocher (1): kernel.fitimage.bbclass: remove ramdisk_ctype Jacob Kroon (1): bitbake: tests/data: Test combinations of _append together with override Joe Slater (1): bash-completion: add image feature Jonathan Marler (1): package: Multiple shlib_providers for the same file should error Joshua Watt (8): classes/reproducible_build: Move SDE deploy to another directory oeqa: Test multiconfig parsing bitbake: cookerdata: Add mc conffiles hashes to cache hash bitbake: hashserve: Add missing import bitbake: siggen: Fix attribute error when hashserver fails bitbake: hashserv: Don't daemonize server process local.conf.sample: Add Hash Equivalence classes/reproducible_build: Create SDE destination Khem Raj (7): musl: Fix riscv64 CAS functions qemuriscv: Do not blacklist clang anymore sdk: Install nativesdk locales for all TCLIBC variants strace: Upgrade to 5.3 packagegroups: All groups are not allarch musl: Fix __riscv_mc* containers to match glibc core-image-sato-sdk-ptest: Remove valgrind ptests for riscv Konrad Scherer (1): gen-lockedsig-cache: Replace glob lookup with hash to filename lookup Lei Maohui (1): bluez5: update patch to fix do_patch error when PATCHTOOL = "patch". Li Zhou (1): shadow: use relaxed usernames for all Limeng (1): u-boot: add CVE patches for u-boot Nathan Rossi (2): oeqa/core/utils/concurrencytest.py: Handle exceptions and details oeqa/core/case.py: Encode binary data of log Niclas Svensson (1): devtool: finish: Keep patches ordered when updating bbappend Otavio Salvador (1): mesa: Add freedreno PACKAGECONFIG option Peter Kjellerstedt (3): systemd: Make it build with hwdb disabled devtool: finish: Add suppport for the --no-clean option lib/oe/lsb: Make sure the distro ID is always lowercased Randy MacLeod (1): ffmpeg: update from 4.2 to 4.2.1 Richard Purdie (17): Revert "meta-extsdk: Either an sstate task is a proper task or it isn't" sstatesig: Fix hash equivlanency locked signature issues oeqa/selftest/signing: Fix for hash equivlance server lib/sstatesig: Fix class inheritance problems populate_sdk_ext: Fix for hash equiv bitbake: runqueue: Fix task migration problems bitbake: siggen: Ensure setscenetasks list is available to worker context bitbake: runqueue: Change task migration behaviour for rerunning setscene tasks bitbake: siggen/runqueue: Fix signature mismatch issues bitbake: siggen: Avoid writing misleading sigdata files bitbake: runqueue: Save unihashes more frequently bitbake: runqueue: Small performance optimisation bitbake: siggen: Remove full path from unitaskhashes keys bitbake: tests/runqueue: Fix hashserve shutdown race base: Improve module import error message sanity.conf: Bump minimum bitbake version bitbake: bitbake: Bump verison 1.43.1 -> 1.43.2 Robert Yang (6): cases/bbtests.py: test_bitbake_g(): Check base-files rather than busybox expect: Fix configure error for nativesdk net-tools: Fix installed-vs-shipped for nativesdk expect: Fix buffer overflow error when build in long path apr: Check for libtoolize rather than libtool lttng-ust: Fix for --enable-python-agent Ross Burton (12): oeqa/selftest/reproducible: test ipkgs too distcc: clean up the UI install logic distcc: use --enable-tcp-insecure instead of --make-me-a-botnet distcc: split into client and server packages json-c: clean up recipe json-c: use GitHub for upstream release checking bitbake: fetch2/git: refactor check for git-lfs command bitbake: tests/fetch: add test case for git-lfs handling python3: move runpy to core pango: fix the failing testiter test case opkg: remove redundant systemd inherit lttng-ust: update patch Signed-off-by Trevor Gamblin (5): python3-subunit: ensure runtime dependencies are present python3-pip: ensure pickle is installed lighttpd: remove fam as a PACKAGECONFIG option tiff: fix CVE-2019-14973 opkg: remove pathfinder PACKAGECONFIG option Wang Quanyang (1): kexec-tools: fix arm kexec failure for __NR_kexec_file_load Yi Zhao (1): python: add tk-lib as runtime dependency for python-tkinter Change-Id: I0570125d49f7e4bc3bbf70508cbfd7e10bdbc032 Signed-off-by: Brad Bishop --- .../libtiff/tiff/CVE-2019-14973.patch | 415 +++++++++++++++++++++ .../meta/recipes-multimedia/libtiff/tiff_4.0.10.bb | 4 +- 2 files changed, 418 insertions(+), 1 deletion(-) create mode 100644 poky/meta/recipes-multimedia/libtiff/tiff/CVE-2019-14973.patch (limited to 'poky/meta/recipes-multimedia/libtiff') diff --git a/poky/meta/recipes-multimedia/libtiff/tiff/CVE-2019-14973.patch b/poky/meta/recipes-multimedia/libtiff/tiff/CVE-2019-14973.patch new file mode 100644 index 000000000..8345295d0 --- /dev/null +++ b/poky/meta/recipes-multimedia/libtiff/tiff/CVE-2019-14973.patch @@ -0,0 +1,415 @@ +From 95ac1e3fcc6b643b5bd100f2ea54faca0a003315 Mon Sep 17 00:00:00 2001 +From: Trevor Gamblin +Date: Fri, 20 Sep 2019 09:33:22 -0400 +Subject: [PATCH] libtiff-fix-CVE-2019-14973 + +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/commit/2218055ca67d84be596a13080e8f50f22116555c] +CVE: CVE-2019-14973 + +Signed-off-by: Trevor Gamblin +--- + libtiff/tif_aux.c | 49 +++++++++++++++++++++++++++++++++++++----- + libtiff/tif_getimage.c | 6 ++---- + libtiff/tif_luv.c | 8 +------ + libtiff/tif_pixarlog.c | 7 +----- + libtiff/tif_read.c | 38 +++++++++----------------------- + libtiff/tif_strip.c | 35 ++++-------------------------- + libtiff/tif_tile.c | 27 +++-------------------- + libtiff/tiffiop.h | 7 +++++- + 8 files changed, 71 insertions(+), 106 deletions(-) + +diff --git a/libtiff/tif_aux.c b/libtiff/tif_aux.c +index 4ece162f..33fb8a44 100644 +--- a/libtiff/tif_aux.c ++++ b/libtiff/tif_aux.c +@@ -57,18 +57,57 @@ _TIFFMultiply64(TIFF* tif, uint64 first, uint64 second, const char* where) + return bytes; + } + ++tmsize_t ++_TIFFMultiplySSize(TIFF* tif, tmsize_t first, tmsize_t second, const char* where) ++{ ++ if( first <= 0 || second <= 0 ) ++ { ++ if( tif != NULL && where != NULL ) ++ { ++ TIFFErrorExt(tif->tif_clientdata, where, ++ "Invalid argument to _TIFFMultiplySSize() in %s", where); ++ } ++ return 0; ++ } ++ ++ if( first > TIFF_TMSIZE_T_MAX / second ) ++ { ++ if( tif != NULL && where != NULL ) ++ { ++ TIFFErrorExt(tif->tif_clientdata, where, ++ "Integer overflow in %s", where); ++ } ++ return 0; ++ } ++ return first * second; ++} ++ ++tmsize_t _TIFFCastUInt64ToSSize(TIFF* tif, uint64 val, const char* module) ++{ ++ if( val > (uint64)TIFF_TMSIZE_T_MAX ) ++ { ++ if( tif != NULL && module != NULL ) ++ { ++ TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); ++ } ++ return 0; ++ } ++ return (tmsize_t)val; ++} ++ + void* + _TIFFCheckRealloc(TIFF* tif, void* buffer, + tmsize_t nmemb, tmsize_t elem_size, const char* what) + { + void* cp = NULL; +- tmsize_t bytes = nmemb * elem_size; +- ++ tmsize_t count = _TIFFMultiplySSize(tif, nmemb, elem_size, NULL); + /* +- * XXX: Check for integer overflow. ++ * Check for integer overflow. + */ +- if (nmemb && elem_size && bytes / elem_size == nmemb) +- cp = _TIFFrealloc(buffer, bytes); ++ if (count != 0) ++ { ++ cp = _TIFFrealloc(buffer, count); ++ } + + if (cp == NULL) { + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, +diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c +index 6a9d5a7c..2106ca21 100644 +--- a/libtiff/tif_getimage.c ++++ b/libtiff/tif_getimage.c +@@ -755,9 +755,8 @@ gtTileSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) + uint32 leftmost_tw; + + tilesize = TIFFTileSize(tif); +- bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,tilesize); ++ bufsize = _TIFFMultiplySSize(tif, alpha?4:3,tilesize, "gtTileSeparate"); + if (bufsize == 0) { +- TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate"); + return (0); + } + +@@ -1019,9 +1018,8 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) + uint16 colorchannels; + + stripsize = TIFFStripSize(tif); +- bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,stripsize); ++ bufsize = _TIFFMultiplySSize(tif,alpha?4:3,stripsize, "gtStripSeparate"); + if (bufsize == 0) { +- TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate"); + return (0); + } + +diff --git a/libtiff/tif_luv.c b/libtiff/tif_luv.c +index aa35ea07..46d2dff2 100644 +--- a/libtiff/tif_luv.c ++++ b/libtiff/tif_luv.c +@@ -1264,16 +1264,10 @@ LogL16GuessDataFmt(TIFFDirectory *td) + return (SGILOGDATAFMT_UNKNOWN); + } + +- +-#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0)) +-#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1) +- + static tmsize_t + multiply_ms(tmsize_t m1, tmsize_t m2) + { +- if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 ) +- return 0; +- return m1 * m2; ++ return _TIFFMultiplySSize(NULL, m1, m2, NULL); + } + + static int +diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c +index 7438d692..b52a3ee4 100644 +--- a/libtiff/tif_pixarlog.c ++++ b/libtiff/tif_pixarlog.c +@@ -634,15 +634,10 @@ PixarLogGuessDataFmt(TIFFDirectory *td) + return guess; + } + +-#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0)) +-#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1) +- + static tmsize_t + multiply_ms(tmsize_t m1, tmsize_t m2) + { +- if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 ) +- return 0; +- return m1 * m2; ++ return _TIFFMultiplySSize(NULL, m1, m2, NULL); + } + + static tmsize_t +diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c +index e63810cc..8db39d7a 100644 +--- a/libtiff/tif_read.c ++++ b/libtiff/tif_read.c +@@ -29,9 +29,6 @@ + #include "tiffiop.h" + #include + +-#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0)) +-#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1) +- + int TIFFFillStrip(TIFF* tif, uint32 strip); + int TIFFFillTile(TIFF* tif, uint32 tile); + static int TIFFStartStrip(TIFF* tif, uint32 strip); +@@ -49,6 +46,8 @@ TIFFReadRawTile1(TIFF* tif, uint32 tile, void* buf, tmsize_t size, const char* m + #define THRESHOLD_MULTIPLIER 10 + #define MAX_THRESHOLD (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * INITIAL_THRESHOLD) + ++#define TIFF_INT64_MAX ((((int64)0x7FFFFFFF) << 32) | 0xFFFFFFFF) ++ + /* Read 'size' bytes in tif_rawdata buffer starting at offset 'rawdata_offset' + * Returns 1 in case of success, 0 otherwise. */ + static int TIFFReadAndRealloc( TIFF* tif, tmsize_t size, +@@ -734,23 +733,8 @@ TIFFReadRawStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size) + return ((tmsize_t)(-1)); + } + bytecount = td->td_stripbytecount[strip]; +- if ((int64)bytecount <= 0) { +-#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) +- TIFFErrorExt(tif->tif_clientdata, module, +- "%I64u: Invalid strip byte count, strip %lu", +- (unsigned __int64) bytecount, +- (unsigned long) strip); +-#else +- TIFFErrorExt(tif->tif_clientdata, module, +- "%llu: Invalid strip byte count, strip %lu", +- (unsigned long long) bytecount, +- (unsigned long) strip); +-#endif +- return ((tmsize_t)(-1)); +- } +- bytecountm = (tmsize_t)bytecount; +- if ((uint64)bytecountm!=bytecount) { +- TIFFErrorExt(tif->tif_clientdata, module, "Integer overflow"); ++ bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount, module); ++ if (bytecountm == 0) { + return ((tmsize_t)(-1)); + } + if (size != (tmsize_t)(-1) && size < bytecountm) +@@ -774,7 +758,7 @@ TIFFFillStrip(TIFF* tif, uint32 strip) + if ((tif->tif_flags&TIFF_NOREADRAW)==0) + { + uint64 bytecount = td->td_stripbytecount[strip]; +- if ((int64)bytecount <= 0) { ++ if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) { + #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) + TIFFErrorExt(tif->tif_clientdata, module, + "Invalid strip byte count %I64u, strip %lu", +@@ -801,7 +785,7 @@ TIFFFillStrip(TIFF* tif, uint32 strip) + (bytecount - 4096) / 10 > (uint64)stripsize ) + { + uint64 newbytecount = (uint64)stripsize * 10 + 4096; +- if( (int64)newbytecount >= 0 ) ++ if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX ) + { + #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) + TIFFWarningExt(tif->tif_clientdata, module, +@@ -1196,10 +1180,8 @@ TIFFReadRawTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size) + bytecount64 = td->td_stripbytecount[tile]; + if (size != (tmsize_t)(-1) && (uint64)size < bytecount64) + bytecount64 = (uint64)size; +- bytecountm = (tmsize_t)bytecount64; +- if ((uint64)bytecountm!=bytecount64) +- { +- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); ++ bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module); ++ if( bytecountm == 0 ) { + return ((tmsize_t)(-1)); + } + return (TIFFReadRawTile1(tif, tile, buf, bytecountm, module)); +@@ -1221,7 +1203,7 @@ TIFFFillTile(TIFF* tif, uint32 tile) + if ((tif->tif_flags&TIFF_NOREADRAW)==0) + { + uint64 bytecount = td->td_stripbytecount[tile]; +- if ((int64)bytecount <= 0) { ++ if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) { + #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) + TIFFErrorExt(tif->tif_clientdata, module, + "%I64u: Invalid tile byte count, tile %lu", +@@ -1248,7 +1230,7 @@ TIFFFillTile(TIFF* tif, uint32 tile) + (bytecount - 4096) / 10 > (uint64)stripsize ) + { + uint64 newbytecount = (uint64)stripsize * 10 + 4096; +- if( (int64)newbytecount >= 0 ) ++ if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX ) + { + #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) + TIFFWarningExt(tif->tif_clientdata, module, +diff --git a/libtiff/tif_strip.c b/libtiff/tif_strip.c +index 5b76fba5..2366acf0 100644 +--- a/libtiff/tif_strip.c ++++ b/libtiff/tif_strip.c +@@ -129,15 +129,8 @@ TIFFVStripSize(TIFF* tif, uint32 nrows) + { + static const char module[] = "TIFFVStripSize"; + uint64 m; +- tmsize_t n; + m=TIFFVStripSize64(tif,nrows); +- n=(tmsize_t)m; +- if ((uint64)n!=m) +- { +- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); +- n=0; +- } +- return(n); ++ return _TIFFCastUInt64ToSSize(tif, m, module); + } + + /* +@@ -211,15 +204,8 @@ TIFFStripSize(TIFF* tif) + { + static const char module[] = "TIFFStripSize"; + uint64 m; +- tmsize_t n; + m=TIFFStripSize64(tif); +- n=(tmsize_t)m; +- if ((uint64)n!=m) +- { +- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); +- n=0; +- } +- return(n); ++ return _TIFFCastUInt64ToSSize(tif, m, module); + } + + /* +@@ -330,14 +316,8 @@ TIFFScanlineSize(TIFF* tif) + { + static const char module[] = "TIFFScanlineSize"; + uint64 m; +- tmsize_t n; + m=TIFFScanlineSize64(tif); +- n=(tmsize_t)m; +- if ((uint64)n!=m) { +- TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow"); +- n=0; +- } +- return(n); ++ return _TIFFCastUInt64ToSSize(tif, m, module); + } + + /* +@@ -366,15 +346,8 @@ TIFFRasterScanlineSize(TIFF* tif) + { + static const char module[] = "TIFFRasterScanlineSize"; + uint64 m; +- tmsize_t n; + m=TIFFRasterScanlineSize64(tif); +- n=(tmsize_t)m; +- if ((uint64)n!=m) +- { +- TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow"); +- n=0; +- } +- return(n); ++ return _TIFFCastUInt64ToSSize(tif, m, module); + } + + /* vim: set ts=8 sts=8 sw=8 noet: */ +diff --git a/libtiff/tif_tile.c b/libtiff/tif_tile.c +index 58fe9354..661cc771 100644 +--- a/libtiff/tif_tile.c ++++ b/libtiff/tif_tile.c +@@ -181,15 +181,8 @@ TIFFTileRowSize(TIFF* tif) + { + static const char module[] = "TIFFTileRowSize"; + uint64 m; +- tmsize_t n; + m=TIFFTileRowSize64(tif); +- n=(tmsize_t)m; +- if ((uint64)n!=m) +- { +- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); +- n=0; +- } +- return(n); ++ return _TIFFCastUInt64ToSSize(tif, m, module); + } + + /* +@@ -248,15 +241,8 @@ TIFFVTileSize(TIFF* tif, uint32 nrows) + { + static const char module[] = "TIFFVTileSize"; + uint64 m; +- tmsize_t n; + m=TIFFVTileSize64(tif,nrows); +- n=(tmsize_t)m; +- if ((uint64)n!=m) +- { +- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); +- n=0; +- } +- return(n); ++ return _TIFFCastUInt64ToSSize(tif, m, module); + } + + /* +@@ -272,15 +258,8 @@ TIFFTileSize(TIFF* tif) + { + static const char module[] = "TIFFTileSize"; + uint64 m; +- tmsize_t n; + m=TIFFTileSize64(tif); +- n=(tmsize_t)m; +- if ((uint64)n!=m) +- { +- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); +- n=0; +- } +- return(n); ++ return _TIFFCastUInt64ToSSize(tif, m, module); + } + + /* +diff --git a/libtiff/tiffiop.h b/libtiff/tiffiop.h +index 186c291f..558484fe 100644 +--- a/libtiff/tiffiop.h ++++ b/libtiff/tiffiop.h +@@ -77,6 +77,9 @@ extern int snprintf(char* str, size_t size, const char* format, ...); + #define FALSE 0 + #endif + ++#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0)) ++#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1) ++ + typedef struct client_info { + struct client_info *next; + void *data; +@@ -258,7 +261,7 @@ struct tiff { + #define TIFFhowmany8_64(x) (((x)&0x07)?((uint64)(x)>>3)+1:(uint64)(x)>>3) + #define TIFFroundup_64(x, y) (TIFFhowmany_64(x,y)*(y)) + +-/* Safe multiply which returns zero if there is an integer overflow */ ++/* Safe multiply which returns zero if there is an *unsigned* integer overflow. This macro is not safe for *signed* integer types */ + #define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0) + + #define TIFFmax(A,B) ((A)>(B)?(A):(B)) +@@ -368,6 +371,8 @@ extern TIFFErrorHandlerExt _TIFFerrorHandlerExt; + + extern uint32 _TIFFMultiply32(TIFF*, uint32, uint32, const char*); + extern uint64 _TIFFMultiply64(TIFF*, uint64, uint64, const char*); ++extern tmsize_t _TIFFMultiplySSize(TIFF*, tmsize_t, tmsize_t, const char*); ++extern tmsize_t _TIFFCastUInt64ToSSize(TIFF*, uint64, const char*); + extern void* _TIFFCheckMalloc(TIFF*, tmsize_t, tmsize_t, const char*); + extern void* _TIFFCheckRealloc(TIFF*, void*, tmsize_t, tmsize_t, const char*); + +-- +2.17.1 + diff --git a/poky/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb b/poky/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb index 999496273..0432763cc 100644 --- a/poky/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb +++ b/poky/meta/recipes-multimedia/libtiff/tiff_4.0.10.bb @@ -6,7 +6,9 @@ CVE_PRODUCT = "libtiff" SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ file://CVE-2019-6128.patch \ - file://CVE-2019-7663.patch" + file://CVE-2019-7663.patch \ + file://CVE-2019-14973.patch \ +" SRC_URI[md5sum] = "114192d7ebe537912a2b97408832e7fd" SRC_URI[sha256sum] = "2c52d11ccaf767457db0c46795d9c7d1a8d8f76f68b0b800a3dfe45786b996e4" -- cgit v1.2.3