From 0acf01fea714af573b814e10cf105c3359a236c3 Mon Sep 17 00:00:00 2001
From: erouault <erouault>
Date: Thu, 1 Jun 2017 12:44:04 +0000
Subject: [PATCH] * libtiff/tif_dirinfo.c, tif_dirread.c: add _TIFFCheckFieldIsValidForCodec(),
and use it in TIFFReadDirectory() so as to ignore fields whose tag is a
codec-specified tag but this codec is not enabled. This avoids TIFFGetField()
to behave differently depending on whether the codec is enabled or not, and
thus can avoid stack based buffer overflows in a number of TIFF utilities
such as tiffsplit, tiffcmp, thumbnail, etc.
Patch derived from 0063-Handle-properly-CODEC-specific-tags.patch
(http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël Hertzog.
Fixes:
http://bugzilla.maptools.org/show_bug.cgi?id=2580
http://bugzilla.maptools.org/show_bug.cgi?id=2693
http://bugzilla.maptools.org/show_bug.cgi?id=2625 (CVE-2016-10095)
http://bugzilla.maptools.org/show_bug.cgi?id=2564 (CVE-2015-7554)
http://bugzilla.maptools.org/show_bug.cgi?id=2561 (CVE-2016-5318)
http://bugzilla.maptools.org/show_bug.cgi?id=2499 (CVE-2014-8128)
http://bugzilla.maptools.org/show_bug.cgi?id=2441
http://bugzilla.maptools.org/show_bug.cgi?id=2433

Upstream-Status: Backport
[https://github.com/vadz/libtiff/commit/4d4fa0b68ae9ae038959ee4f69ebe288ec892f06]

CVE: CVE-2017-9147

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 ChangeLog             |  20 ++++++++++
 libtiff/tif_dir.h     |   1 +
 libtiff/tif_dirinfo.c | 103 ++++++++++++++++++++++++++++++++++++++++++++++++++
 libtiff/tif_dirread.c |   4 ++
 4 files changed, 128 insertions(+)

Index: tiff-4.0.7/ChangeLog
===================================================================
--- tiff-4.0.7.orig/ChangeLog
+++ tiff-4.0.7/ChangeLog
@@ -1,3 +1,23 @@
+2017-06-01  Even Rouault <even.rouault at spatialys.com>
+
+       * libtiff/tif_dirinfo.c, tif_dirread.c: add _TIFFCheckFieldIsValidForCodec(),
+       and use it in TIFFReadDirectory() so as to ignore fields whose tag is a
+       codec-specified tag but this codec is not enabled. This avoids TIFFGetField()
+       to behave differently depending on whether the codec is enabled or not, and
+       thus can avoid stack based buffer overflows in a number of TIFF utilities
+       such as tiffsplit, tiffcmp, thumbnail, etc.
+       Patch derived from 0063-Handle-properly-CODEC-specific-tags.patch
+       (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël Hertzog.
+       Fixes:
+       http://bugzilla.maptools.org/show_bug.cgi?id=2580
+       http://bugzilla.maptools.org/show_bug.cgi?id=2693
+       http://bugzilla.maptools.org/show_bug.cgi?id=2625 (CVE-2016-10095)
+       http://bugzilla.maptools.org/show_bug.cgi?id=2564 (CVE-2015-7554)
+       http://bugzilla.maptools.org/show_bug.cgi?id=2561 (CVE-2016-5318)
+       http://bugzilla.maptools.org/show_bug.cgi?id=2499 (CVE-2014-8128)
+       http://bugzilla.maptools.org/show_bug.cgi?id=2441
+       http://bugzilla.maptools.org/show_bug.cgi?id=2433
+
 2017-01-11 Even Rouault <even.rouault at spatialys.com>
 
 	* tools/tiffcp.c: error out cleanly in cpContig2SeparateByRow and
Index: tiff-4.0.7/libtiff/tif_dir.h
===================================================================
--- tiff-4.0.7.orig/libtiff/tif_dir.h
+++ tiff-4.0.7/libtiff/tif_dir.h
@@ -291,6 +291,7 @@ struct _TIFFField {
 extern int _TIFFMergeFields(TIFF*, const TIFFField[], uint32);
 extern const TIFFField* _TIFFFindOrRegisterField(TIFF *, uint32, TIFFDataType);
 extern  TIFFField* _TIFFCreateAnonField(TIFF *, uint32, TIFFDataType);
+extern int _TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag);
 
 #if defined(__cplusplus)
 }
Index: tiff-4.0.7/libtiff/tif_dirinfo.c
===================================================================
--- tiff-4.0.7.orig/libtiff/tif_dirinfo.c
+++ tiff-4.0.7/libtiff/tif_dirinfo.c
@@ -956,6 +956,109 @@ TIFFMergeFieldInfo(TIFF* tif, const TIFF
 	return 0;
 }
 
+int
+_TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag)
+{
+	/* Filter out non-codec specific tags */
+	switch (tag) {
+	    /* Shared tags */
+	    case TIFFTAG_PREDICTOR:
+	    /* JPEG tags */
+	    case TIFFTAG_JPEGTABLES:
+	    /* OJPEG tags */
+	    case TIFFTAG_JPEGIFOFFSET:
+	    case TIFFTAG_JPEGIFBYTECOUNT:
+	    case TIFFTAG_JPEGQTABLES:
+	    case TIFFTAG_JPEGDCTABLES:
+	    case TIFFTAG_JPEGACTABLES:
+	    case TIFFTAG_JPEGPROC:
+	    case TIFFTAG_JPEGRESTARTINTERVAL:
+	    /* CCITT* */
+	    case TIFFTAG_BADFAXLINES:
+	    case TIFFTAG_CLEANFAXDATA:
+	    case TIFFTAG_CONSECUTIVEBADFAXLINES:
+	    case TIFFTAG_GROUP3OPTIONS:
+	    case TIFFTAG_GROUP4OPTIONS:
+		break;
+	    default:
+		return 1;
+	}
+	/* Check if codec specific tags are allowed for the current
+	 * compression scheme (codec) */
+	switch (tif->tif_dir.td_compression) {
+	    case COMPRESSION_LZW:
+		if (tag == TIFFTAG_PREDICTOR)
+		    return 1;
+		break;
+	    case COMPRESSION_PACKBITS:
+		/* No codec-specific tags */
+		break;
+	    case COMPRESSION_THUNDERSCAN:
+		/* No codec-specific tags */
+		break;
+	    case COMPRESSION_NEXT:
+		/* No codec-specific tags */
+		break;
+	    case COMPRESSION_JPEG:
+		if (tag == TIFFTAG_JPEGTABLES)
+		    return 1;
+		break;
+	    case COMPRESSION_OJPEG:
+		switch (tag) {
+		    case TIFFTAG_JPEGIFOFFSET:
+		    case TIFFTAG_JPEGIFBYTECOUNT:
+		    case TIFFTAG_JPEGQTABLES:
+		    case TIFFTAG_JPEGDCTABLES:
+		    case TIFFTAG_JPEGACTABLES:
+		    case TIFFTAG_JPEGPROC:
+		    case TIFFTAG_JPEGRESTARTINTERVAL:
+			return 1;
+		}
+		break;
+	    case COMPRESSION_CCITTRLE:
+	    case COMPRESSION_CCITTRLEW:
+	    case COMPRESSION_CCITTFAX3:
+	    case COMPRESSION_CCITTFAX4:
+		switch (tag) {
+		    case TIFFTAG_BADFAXLINES:
+		    case TIFFTAG_CLEANFAXDATA:
+		    case TIFFTAG_CONSECUTIVEBADFAXLINES:
+			return 1;
+		    case TIFFTAG_GROUP3OPTIONS:
+			if (tif->tif_dir.td_compression == COMPRESSION_CCITTFAX3)
+			    return 1;
+			break;
+		    case TIFFTAG_GROUP4OPTIONS:
+			if (tif->tif_dir.td_compression == COMPRESSION_CCITTFAX4)
+			    return 1;
+			break;
+		}
+		break;
+	    case COMPRESSION_JBIG:
+		/* No codec-specific tags */
+		break;
+	    case COMPRESSION_DEFLATE:
+	    case COMPRESSION_ADOBE_DEFLATE:
+		if (tag == TIFFTAG_PREDICTOR)
+		    return 1;
+		break;
+	   case COMPRESSION_PIXARLOG:
+		if (tag == TIFFTAG_PREDICTOR)
+		    return 1;
+		break;
+	    case COMPRESSION_SGILOG:
+	    case COMPRESSION_SGILOG24:
+		/* No codec-specific tags */
+		break;
+	    case COMPRESSION_LZMA:
+		if (tag == TIFFTAG_PREDICTOR)
+		    return 1;
+		break;
+
+	}
+	return 0;
+}
+
 /* vim: set ts=8 sts=8 sw=8 noet: */
 
 /*
Index: tiff-4.0.7/libtiff/tif_dirread.c
===================================================================
--- tiff-4.0.7.orig/libtiff/tif_dirread.c
+++ tiff-4.0.7/libtiff/tif_dirread.c
@@ -3566,6 +3566,10 @@ TIFFReadDirectory(TIFF* tif)
 							goto bad;
 						dp->tdir_tag=IGNORE;
 						break;
+                                        default:
+                                            if( !_TIFFCheckFieldIsValidForCodec(tif, dp->tdir_tag) )
+                                                dp->tdir_tag=IGNORE;
+                                            break;
 				}
 			}
 		}
