diff options
author | Brad Bishop <bradleyb@fuzziesquirrel.com> | 2019-04-05 22:28:33 +0300 |
---|---|---|
committer | Brad Bishop <bradleyb@fuzziesquirrel.com> | 2019-04-05 22:31:28 +0300 |
commit | 193236933b0f4ab91b1625b64e2187e2db4e0e8f (patch) | |
tree | e12769d7c76d8b0517d6de3d3c72189753d253ed /poky/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch | |
parent | bd93df9478f2f56ffcbc8cb88f1709c735dcd85b (diff) | |
download | openbmc-193236933b0f4ab91b1625b64e2187e2db4e0e8f.tar.xz |
reset upstream subtrees to HEAD
Reset the following subtrees on HEAD:
poky: 8217b477a1(master)
meta-xilinx: 64aa3d35ae(master)
meta-openembedded: 0435c9e193(master)
meta-raspberrypi: 490a4441ac(master)
meta-security: cb6d1c85ee(master)
Squashed patches:
meta-phosphor: drop systemd 239 patches
meta-phosphor: mrw-api: use correct install path
Change-Id: I268e2646d9174ad305630c6bbd3fbc1a6105f43d
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
Diffstat (limited to 'poky/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch')
-rw-r--r-- | poky/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch | 46 |
1 files changed, 0 insertions, 46 deletions
diff --git a/poky/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch b/poky/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch deleted file mode 100644 index 9b9962ed35..0000000000 --- a/poky/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 9171da596c88e6a2dadcab4a3a89dddd6e1b4655 Mon Sep 17 00:00:00 2001 -From: Nathan Baker <elitebadger@gmail.com> -Date: Thu, 25 Jan 2018 21:28:15 +0000 -Subject: [PATCH] Add workaround to pal2rgb buffer overflow. - -CVE: CVE-2017-17095 - -Upstream-Status: Backport (unchanged) [gitlab.com/libtiff/libtiff/commit/9171da5...] - -Signed-off-by: Joe Slater <joe.slater@windriver.com. - ---- - tools/pal2rgb.c | 17 +++++++++++++++-- - 1 file changed, 15 insertions(+), 2 deletions(-) - -diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c -index 0423598..01fcf94 100644 ---- a/tools/pal2rgb.c -+++ b/tools/pal2rgb.c -@@ -182,8 +182,21 @@ main(int argc, char* argv[]) - { unsigned char *ibuf, *obuf; - register unsigned char* pp; - register uint32 x; -- ibuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(in)); -- obuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(out)); -+ tmsize_t tss_in = TIFFScanlineSize(in); -+ tmsize_t tss_out = TIFFScanlineSize(out); -+ if (tss_out / tss_in < 3) { -+ /* -+ * BUG 2750: The following code does not know about chroma -+ * subsampling of JPEG data. It assumes that the output buffer is 3x -+ * the length of the input buffer due to exploding the palette into -+ * RGB tuples. If this assumption is incorrect, it could lead to a -+ * buffer overflow. Go ahead and fail now to prevent that. -+ */ -+ fprintf(stderr, "Could not determine correct image size for output. Exiting.\n"); -+ return -1; -+ } -+ ibuf = (unsigned char*)_TIFFmalloc(tss_in); -+ obuf = (unsigned char*)_TIFFmalloc(tss_out); - switch (config) { - case PLANARCONFIG_CONTIG: - for (row = 0; row < imagelength; row++) { --- -1.7.9.5 - |