summaryrefslogtreecommitdiff
path: root/poky/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch
diff options
context:
space:
mode:
authorBrad Bishop <bradleyb@fuzziesquirrel.com>2019-04-05 22:28:33 +0300
committerBrad Bishop <bradleyb@fuzziesquirrel.com>2019-04-05 22:31:28 +0300
commit193236933b0f4ab91b1625b64e2187e2db4e0e8f (patch)
treee12769d7c76d8b0517d6de3d3c72189753d253ed /poky/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch
parentbd93df9478f2f56ffcbc8cb88f1709c735dcd85b (diff)
downloadopenbmc-193236933b0f4ab91b1625b64e2187e2db4e0e8f.tar.xz
reset upstream subtrees to HEAD
Reset the following subtrees on HEAD: poky: 8217b477a1(master) meta-xilinx: 64aa3d35ae(master) meta-openembedded: 0435c9e193(master) meta-raspberrypi: 490a4441ac(master) meta-security: cb6d1c85ee(master) Squashed patches: meta-phosphor: drop systemd 239 patches meta-phosphor: mrw-api: use correct install path Change-Id: I268e2646d9174ad305630c6bbd3fbc1a6105f43d Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
Diffstat (limited to 'poky/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch')
-rw-r--r--poky/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch46
1 files changed, 0 insertions, 46 deletions
diff --git a/poky/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch b/poky/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch
deleted file mode 100644
index 9b9962ed35..0000000000
--- a/poky/meta/recipes-multimedia/libtiff/files/CVE-2017-17095.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 9171da596c88e6a2dadcab4a3a89dddd6e1b4655 Mon Sep 17 00:00:00 2001
-From: Nathan Baker <elitebadger@gmail.com>
-Date: Thu, 25 Jan 2018 21:28:15 +0000
-Subject: [PATCH] Add workaround to pal2rgb buffer overflow.
-
-CVE: CVE-2017-17095
-
-Upstream-Status: Backport (unchanged) [gitlab.com/libtiff/libtiff/commit/9171da5...]
-
-Signed-off-by: Joe Slater <joe.slater@windriver.com.
-
----
- tools/pal2rgb.c | 17 +++++++++++++++--
- 1 file changed, 15 insertions(+), 2 deletions(-)
-
-diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c
-index 0423598..01fcf94 100644
---- a/tools/pal2rgb.c
-+++ b/tools/pal2rgb.c
-@@ -182,8 +182,21 @@ main(int argc, char* argv[])
- { unsigned char *ibuf, *obuf;
- register unsigned char* pp;
- register uint32 x;
-- ibuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(in));
-- obuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(out));
-+ tmsize_t tss_in = TIFFScanlineSize(in);
-+ tmsize_t tss_out = TIFFScanlineSize(out);
-+ if (tss_out / tss_in < 3) {
-+ /*
-+ * BUG 2750: The following code does not know about chroma
-+ * subsampling of JPEG data. It assumes that the output buffer is 3x
-+ * the length of the input buffer due to exploding the palette into
-+ * RGB tuples. If this assumption is incorrect, it could lead to a
-+ * buffer overflow. Go ahead and fail now to prevent that.
-+ */
-+ fprintf(stderr, "Could not determine correct image size for output. Exiting.\n");
-+ return -1;
-+ }
-+ ibuf = (unsigned char*)_TIFFmalloc(tss_in);
-+ obuf = (unsigned char*)_TIFFmalloc(tss_out);
- switch (config) {
- case PLANARCONFIG_CONTIG:
- for (row = 0; row < imagelength; row++) {
---
-1.7.9.5
-