!153 [sync] PR-152: Fix CVE-2022-3213
From: @openeuler-sync-bot Reviewed-by: @small_leek Signed-off-by: @small_leek
This commit is contained in:
openeuler-ci-bot
Gitee
commit
00a411c4bb
53
CVE-2022-3213-pre1.patch
Normal file
53
CVE-2022-3213-pre1.patch
Normal file
@ -0,0 +1,53 @@
|
||||
From a854a0a8af977a1b67830f02a53d9eb4d877e10d Mon Sep 17 00:00:00 2001
|
||||
From: Cristy <urban-warrior@imagemagick.org>
|
||||
Date: Tue, 21 Jun 2022 15:06:58 -0400
|
||||
Subject: [PATCH] prevent possible buffer overflow
|
||||
|
||||
---
|
||||
coders/tiff.c | 15 ++++++++-------
|
||||
1 file changed, 8 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/coders/tiff.c b/coders/tiff.c
|
||||
index 49c1677cb7..2b64958930 100644
|
||||
--- a/coders/tiff.c
|
||||
+++ b/coders/tiff.c
|
||||
@@ -1903,9 +1903,9 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
*/
|
||||
extent=(samples_per_pixel+1)*TIFFStripSize(tiff);
|
||||
#if defined(TIFF_VERSION_BIG)
|
||||
- extent+=image->columns*sizeof(uint64);
|
||||
+ extent+=samples_per_pixel*sizeof(uint64);
|
||||
#else
|
||||
- extent+=image->columns*sizeof(uint32);
|
||||
+ extent+=samples_per_pixel*sizeof(uint64);
|
||||
#endif
|
||||
strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
|
||||
sizeof(*strip_pixels));
|
||||
@@ -2002,11 +2002,12 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
number_pixels=(MagickSizeType) columns*rows;
|
||||
if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
|
||||
ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
|
||||
- extent=4*MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
|
||||
+ extent=(samples_per_pixel+1)*MagickMax(rows*TIFFTileRowSize(tiff),
|
||||
+ TIFFTileSize(tiff));
|
||||
#if defined(TIFF_VERSION_BIG)
|
||||
- extent+=image->columns*sizeof(uint64);
|
||||
+ extent+=samples_per_pixel*sizeof(uint64);
|
||||
#else
|
||||
- extent+=image->columns*sizeof(uint32);
|
||||
+ extent+=samples_per_pixel*sizeof(uint32);
|
||||
#endif
|
||||
tile_pixels=(unsigned char *) AcquireQuantumMemory(extent,
|
||||
sizeof(*tile_pixels));
|
||||
@@ -2101,9 +2102,9 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
|
||||
number_pixels=(MagickSizeType) image->columns*image->rows;
|
||||
#if defined(TIFF_VERSION_BIG)
|
||||
- number_pixels+=image->columns*sizeof(uint64);
|
||||
+ number_pixels+=samples_per_pixel*sizeof(uint64);
|
||||
#else
|
||||
- number_pixels+=image->columns*sizeof(uint32);
|
||||
+ number_pixels+=samples_per_pixel*sizeof(uint32);
|
||||
#endif
|
||||
generic_info=AcquireVirtualMemory(number_pixels,sizeof(uint32));
|
||||
if (generic_info == (MemoryInfo *) NULL)
|
||||
22
CVE-2022-3213-pre2.patch
Normal file
22
CVE-2022-3213-pre2.patch
Normal file
@ -0,0 +1,22 @@
|
||||
From b11d64704f46cedade2ca3cdcebbc8d1f315035e Mon Sep 17 00:00:00 2001
|
||||
From: Cristy <urban-warrior@imagemagick.org>
|
||||
Date: Tue, 21 Jun 2022 17:14:48 -0400
|
||||
Subject: [PATCH] correct copy/paste error
|
||||
|
||||
---
|
||||
coders/tiff.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/coders/tiff.c b/coders/tiff.c
|
||||
index 2b64958930..e2c6ca1093 100644
|
||||
--- a/coders/tiff.c
|
||||
+++ b/coders/tiff.c
|
||||
@@ -1905,7 +1905,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
#if defined(TIFF_VERSION_BIG)
|
||||
extent+=samples_per_pixel*sizeof(uint64);
|
||||
#else
|
||||
- extent+=samples_per_pixel*sizeof(uint64);
|
||||
+ extent+=samples_per_pixel*sizeof(uint32);
|
||||
#endif
|
||||
strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
|
||||
sizeof(*strip_pixels));
|
||||
54
CVE-2022-3213-pre3.patch
Normal file
54
CVE-2022-3213-pre3.patch
Normal file
@ -0,0 +1,54 @@
|
||||
From 309dfda1122f08fcf349b6f611b3b6df994d9297 Mon Sep 17 00:00:00 2001
|
||||
From: Cristy <urban-warrior@imagemagick.org>
|
||||
Date: Wed, 29 Jun 2022 19:40:56 -0400
|
||||
Subject: [PATCH] eliminate possible buffer overflow
|
||||
|
||||
---
|
||||
coders/tiff.c | 19 ++-----------------
|
||||
1 file changed, 2 insertions(+), 17 deletions(-)
|
||||
|
||||
diff --git a/coders/tiff.c b/coders/tiff.c
|
||||
index e2c6ca1093..6bf4b112e1 100644
|
||||
--- a/coders/tiff.c
|
||||
+++ b/coders/tiff.c
|
||||
@@ -1901,12 +1901,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
/*
|
||||
Convert stripped TIFF image.
|
||||
*/
|
||||
- extent=(samples_per_pixel+1)*TIFFStripSize(tiff);
|
||||
-#if defined(TIFF_VERSION_BIG)
|
||||
- extent+=samples_per_pixel*sizeof(uint64);
|
||||
-#else
|
||||
- extent+=samples_per_pixel*sizeof(uint32);
|
||||
-#endif
|
||||
+ extent=4*(samples_per_pixel+1)*TIFFStripSize(tiff);
|
||||
strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
|
||||
sizeof(*strip_pixels));
|
||||
if (strip_pixels == (unsigned char *) NULL)
|
||||
@@ -2002,13 +1997,8 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
number_pixels=(MagickSizeType) columns*rows;
|
||||
if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
|
||||
ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
|
||||
- extent=(samples_per_pixel+1)*MagickMax(rows*TIFFTileRowSize(tiff),
|
||||
+ extent=4*(samples_per_pixel+1)*MagickMax(rows*TIFFTileRowSize(tiff),
|
||||
TIFFTileSize(tiff));
|
||||
-#if defined(TIFF_VERSION_BIG)
|
||||
- extent+=samples_per_pixel*sizeof(uint64);
|
||||
-#else
|
||||
- extent+=samples_per_pixel*sizeof(uint32);
|
||||
-#endif
|
||||
tile_pixels=(unsigned char *) AcquireQuantumMemory(extent,
|
||||
sizeof(*tile_pixels));
|
||||
if (tile_pixels == (unsigned char *) NULL)
|
||||
@@ -2101,11 +2091,6 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
if (HeapOverflowSanityCheck(image->rows,sizeof(*pixels)) != MagickFalse)
|
||||
ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
|
||||
number_pixels=(MagickSizeType) image->columns*image->rows;
|
||||
-#if defined(TIFF_VERSION_BIG)
|
||||
- number_pixels+=samples_per_pixel*sizeof(uint64);
|
||||
-#else
|
||||
- number_pixels+=samples_per_pixel*sizeof(uint32);
|
||||
-#endif
|
||||
generic_info=AcquireVirtualMemory(number_pixels,sizeof(uint32));
|
||||
if (generic_info == (MemoryInfo *) NULL)
|
||||
ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
|
||||
22
CVE-2022-3213.patch
Normal file
22
CVE-2022-3213.patch
Normal file
@ -0,0 +1,22 @@
|
||||
From 30ccf9a0da1f47161b5935a95be854fe84e6c2a2 Mon Sep 17 00:00:00 2001
|
||||
From: Cristy <urban-warrior@imagemagick.org>
|
||||
Date: Sat, 27 Aug 2022 08:38:57 -0400
|
||||
Subject: [PATCH] squash heap-buffer-overflow, PoC TIFF from Hardik
|
||||
|
||||
---
|
||||
coders/tiff.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/coders/tiff.c b/coders/tiff.c
|
||||
index 132008efbf..a166bea177 100644
|
||||
--- a/coders/tiff.c
|
||||
+++ b/coders/tiff.c
|
||||
@@ -1892,7 +1892,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
|
||||
/*
|
||||
Convert stripped TIFF image.
|
||||
*/
|
||||
- extent=4*(samples_per_pixel+1)*TIFFStripSize(tiff);
|
||||
+ extent=4*((image->depth+7)/8)*(samples_per_pixel+1)*TIFFStripSize(tiff);
|
||||
strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
|
||||
sizeof(*strip_pixels));
|
||||
if (strip_pixels == (unsigned char *) NULL)
|
||||
@ -1,7 +1,7 @@
|
||||
Name: ImageMagick
|
||||
Epoch: 1
|
||||
Version: 7.1.0.28
|
||||
Release: 3
|
||||
Release: 4
|
||||
Summary: Create, edit, compose, or convert bitmap images
|
||||
License: ImageMagick and MIT
|
||||
Url: http://www.imagemagick.org/
|
||||
@ -9,6 +9,10 @@ Source0: https://github.com/ImageMagick/ImageMagick/archive/refs/tags/7.1
|
||||
|
||||
Patch0001: backport-fix-CVE-2022-2719.patch
|
||||
Patch0002: backport-fix-CVE-2022-1115.patch
|
||||
Patch0003: CVE-2022-3213-pre1.patch
|
||||
Patch0004: CVE-2022-3213-pre2.patch
|
||||
Patch0005: CVE-2022-3213-pre3.patch
|
||||
Patch0006: CVE-2022-3213.patch
|
||||
|
||||
BuildRequires: bzip2-devel freetype-devel libjpeg-devel libpng-devel perl-generators
|
||||
BuildRequires: libtiff-devel giflib-devel zlib-devel perl-devel >= 5.8.1 jbigkit-devel
|
||||
@ -163,6 +167,9 @@ rm PerlMagick/demo/Generic.ttf
|
||||
%{_libdir}/pkgconfig/ImageMagick*
|
||||
|
||||
%changelog
|
||||
* Thu Oct 13 2022 chenwenjie <chenwenjie@ncti-gba.cn> - 1:7.1.0.28-4
|
||||
- fix CVE-2022-3213
|
||||
|
||||
* Fri Aug 19 2022 cenhuilin <cenhuilin@kylinos.cn> - 1:7.1.0.28-3
|
||||
- fix CVE-2022-1115
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user