!45 version update
From: @yeah_wang Reviewed-by: @small_leek Signed-off-by: @small_leek
This commit is contained in:
commit
a9b81613dc
Binary file not shown.
@ -1,47 +0,0 @@
|
|||||||
From fb7637359d2dce692392a94ba27dc98466ef7d09 Mon Sep 17 00:00:00 2001
|
|
||||||
From: renmingshuai <eric-github@soroos.net>
|
|
||||||
Date: Thu, 28 Jan 2021 20:35:50 +0800
|
|
||||||
Subject: [PATCH] Fix for CVE-2020-35655 - Read Overflow in PCX Decoding.
|
|
||||||
commit 2f409261eb1228e166868f0b5da5cda52e55bf upstream
|
|
||||||
* Don't trust the image to specify a buffer size
|
|
||||||
Conflict:NA
|
|
||||||
Reference:https://github.com/python-pillow/Pillow/commit/2f409261eb1228e166868f8f0b5da5cda52e55bf
|
|
||||||
---
|
|
||||||
src/PIL/PcxImagePlugin.py | 9 +++++++--
|
|
||||||
1 file changed, 7 insertions(+), 2 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/src/PIL/PcxImagePlugin.py b/src/PIL/PcxImagePlugin.py
|
|
||||||
index f7ae3bf..e77867e 100644
|
|
||||||
--- a/src/PIL/PcxImagePlugin.py
|
|
||||||
+++ b/src/PIL/PcxImagePlugin.py
|
|
||||||
@@ -64,13 +64,13 @@ class PcxImageFile(ImageFile.ImageFile):
|
|
||||||
version = i8(s[1])
|
|
||||||
bits = i8(s[3])
|
|
||||||
planes = i8(s[65])
|
|
||||||
- stride = i16(s, 66)
|
|
||||||
+ ignored_stride = i16(s, 66)
|
|
||||||
logger.debug(
|
|
||||||
"PCX version %s, bits %s, planes %s, stride %s",
|
|
||||||
version,
|
|
||||||
bits,
|
|
||||||
planes,
|
|
||||||
- stride,
|
|
||||||
+ ignored_stride,
|
|
||||||
)
|
|
||||||
|
|
||||||
self.info["dpi"] = i16(s, 12), i16(s, 14)
|
|
||||||
@@ -107,6 +107,11 @@ class PcxImageFile(ImageFile.ImageFile):
|
|
||||||
|
|
||||||
self.mode = mode
|
|
||||||
self._size = bbox[2] - bbox[0], bbox[3] - bbox[1]
|
|
||||||
+
|
|
||||||
+ # don't trust the passed in stride. Calculate for ourselves.
|
|
||||||
+ # CVE-2020-35655
|
|
||||||
+ stride = (self._size[0] * bits + 7) // 8
|
|
||||||
+ stride += stride % 2
|
|
||||||
|
|
||||||
bbox = (0, 0) + self.size
|
|
||||||
logger.debug("size: %sx%s", *self.size)
|
|
||||||
--
|
|
||||||
1.8.3.1
|
|
||||||
|
|
||||||
@ -1,335 +0,0 @@
|
|||||||
From eb8c1206d6b170d4e798a00db7432e023853da5c Mon Sep 17 00:00:00 2001
|
|
||||||
From: wiredfool <eric-github@soroos.net>
|
|
||||||
Date: Sun, 1 Nov 2020 14:16:38 +0000
|
|
||||||
Subject: [PATCH] Fix CVE-2020-35654 - OOB Write in TiffDecode.c
|
|
||||||
|
|
||||||
* In some circumstances with some versions of libtiff (4.1.0+), there
|
|
||||||
could be a 4 byte out of bound write when decoding a YCbCr tiff.
|
|
||||||
* The Pillow code dates to 6.0.0
|
|
||||||
* Found and reported through Tidelift
|
|
||||||
|
|
||||||
reason:Fix CVE-2020-35654 - OOB Write in TiffDecode.c
|
|
||||||
|
|
||||||
Conflict:NA
|
|
||||||
Reference:https://github.com/python-pillow/Pillow/commit/eb8c1206d6b170d4e798a00db7432e023853da5c
|
|
||||||
---
|
|
||||||
src/libImaging/TiffDecode.c | 266 ++++++++++++++++++----------
|
|
||||||
1 files changed, 168 insertions(+), 98 deletions(-)
|
|
||||||
|
|
||||||
diff -Naur a/src/libImaging/TiffDecode.c b/src/libImaging/TiffDecode.c
|
|
||||||
--- a/src/libImaging/TiffDecode.c 2021-03-04 14:28:42.632000000 +0800
|
|
||||||
+++ b/src/libImaging/TiffDecode.c 2021-03-04 14:47:03.790000000 +0800
|
|
||||||
@@ -227,54 +227,182 @@
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
-int ReadStrip(TIFF* tiff, UINT32 row, UINT32* buffer) {
|
|
||||||
- uint16 photometric = 0; // init to not PHOTOMETRIC_YCBCR
|
|
||||||
- TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, &photometric);
|
|
||||||
-
|
|
||||||
+int _decodeStripYCbCr(Imaging im, ImagingCodecState state, TIFF *tiff) {
|
|
||||||
// To avoid dealing with YCbCr subsampling, let libtiff handle it
|
|
||||||
- if (photometric == PHOTOMETRIC_YCBCR) {
|
|
||||||
- TIFFRGBAImage img;
|
|
||||||
- char emsg[1024] = "";
|
|
||||||
- UINT32 rows_per_strip, rows_to_read;
|
|
||||||
- int ok;
|
|
||||||
+ // Use a TIFFRGBAImage wrapping the tiff image, and let libtiff handle
|
|
||||||
+ // all of the conversion. Metadata read from the TIFFRGBAImage could
|
|
||||||
+ // be different from the metadata that the base tiff returns.
|
|
||||||
+
|
|
||||||
+ INT32 strip_row;
|
|
||||||
+ UINT8 *new_data;
|
|
||||||
+ UINT32 rows_per_strip, row_byte_size, rows_to_read;
|
|
||||||
+ int ret;
|
|
||||||
+ TIFFRGBAImage img;
|
|
||||||
+ char emsg[1024] = "";
|
|
||||||
+ int ok;
|
|
||||||
+
|
|
||||||
+ ret = TIFFGetFieldDefaulted(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_strip);
|
|
||||||
+ if (ret != 1) {
|
|
||||||
+ rows_per_strip = state->ysize;
|
|
||||||
+ }
|
|
||||||
+ TRACE(("RowsPerStrip: %u \n", rows_per_strip));
|
|
||||||
|
|
||||||
+ if (!(TIFFRGBAImageOK(tiff, emsg) && TIFFRGBAImageBegin(&img, tiff, 0, emsg))) {
|
|
||||||
+ TRACE(("Decode error, msg: %s", emsg));
|
|
||||||
+ state->errcode = IMAGING_CODEC_BROKEN;
|
|
||||||
+ TIFFClose(tiff);
|
|
||||||
+ return -1;
|
|
||||||
+ }
|
|
||||||
|
|
||||||
- TIFFGetFieldDefaulted(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_strip);
|
|
||||||
- if ((row % rows_per_strip) != 0) {
|
|
||||||
- TRACE(("Row passed to ReadStrip() must be first in a strip."));
|
|
||||||
- return -1;
|
|
||||||
- }
|
|
||||||
+ img.req_orientation = ORIENTATION_TOPLEFT;
|
|
||||||
+ img.col_offset = 0;
|
|
||||||
|
|
||||||
- if (TIFFRGBAImageOK(tiff, emsg) && TIFFRGBAImageBegin(&img, tiff, 0, emsg)) {
|
|
||||||
- TRACE(("Initialized RGBAImage\n"));
|
|
||||||
+ if (state->xsize != img.width || state->ysize != img.height) {
|
|
||||||
+ TRACE(("Inconsistent Image Error: %d =? %d, %d =? %d",
|
|
||||||
+ state->xsize, img.width, state->ysize, img.height));
|
|
||||||
+ state->errcode = IMAGING_CODEC_BROKEN;
|
|
||||||
+ TIFFRGBAImageEnd(&img);
|
|
||||||
+ TIFFClose(tiff);
|
|
||||||
+ return -1;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ /* overflow check for row byte size */
|
|
||||||
+ if (INT_MAX / 4 < img.width) {
|
|
||||||
+ state->errcode = IMAGING_CODEC_MEMORY;
|
|
||||||
+ TIFFRGBAImageEnd(&img);
|
|
||||||
+ TIFFClose(tiff);
|
|
||||||
+ return -1;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ // TiffRGBAImages are 32bits/pixel.
|
|
||||||
+ row_byte_size = img.width * 4;
|
|
||||||
+
|
|
||||||
+ /* overflow check for realloc */
|
|
||||||
+ if (INT_MAX / row_byte_size < rows_per_strip) {
|
|
||||||
+ state->errcode = IMAGING_CODEC_MEMORY;
|
|
||||||
+ TIFFRGBAImageEnd(&img);
|
|
||||||
+ TIFFClose(tiff);
|
|
||||||
+ return -1;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ state->bytes = rows_per_strip * row_byte_size;
|
|
||||||
|
|
||||||
- img.req_orientation = ORIENTATION_TOPLEFT;
|
|
||||||
- img.row_offset = row;
|
|
||||||
- img.col_offset = 0;
|
|
||||||
+ TRACE(("StripSize: %d \n", state->bytes));
|
|
||||||
|
|
||||||
- rows_to_read = min(rows_per_strip, img.height - row);
|
|
||||||
+ /* realloc to fit whole strip */
|
|
||||||
+ /* malloc check above */
|
|
||||||
+ new_data = realloc (state->buffer, state->bytes);
|
|
||||||
+ if (!new_data) {
|
|
||||||
+ state->errcode = IMAGING_CODEC_MEMORY;
|
|
||||||
+ TIFFRGBAImageEnd(&img);
|
|
||||||
+ TIFFClose(tiff);
|
|
||||||
+ return -1;
|
|
||||||
+ }
|
|
||||||
|
|
||||||
- TRACE(("rows to read: %d\n", rows_to_read));
|
|
||||||
- ok = TIFFRGBAImageGet(&img, buffer, img.width, rows_to_read);
|
|
||||||
+ state->buffer = new_data;
|
|
||||||
+
|
|
||||||
+ for (; state->y < state->ysize; state->y += rows_per_strip) {
|
|
||||||
+ img.row_offset = state->y;
|
|
||||||
+ rows_to_read = min(rows_per_strip, img.height - state->y);
|
|
||||||
+
|
|
||||||
+ if (TIFFRGBAImageGet(&img, (UINT32 *)state->buffer, img.width, rows_to_read) == -1) {
|
|
||||||
+ TRACE(("Decode Error, y: %d\n", state->y ));
|
|
||||||
+ state->errcode = IMAGING_CODEC_BROKEN;
|
|
||||||
|
|
||||||
TIFFRGBAImageEnd(&img);
|
|
||||||
- } else {
|
|
||||||
- ok = 0;
|
|
||||||
+ TIFFClose(tiff);
|
|
||||||
+ return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
- if (ok == 0) {
|
|
||||||
- TRACE(("Decode Error, row %d; msg: %s\n", row, emsg));
|
|
||||||
- return -1;
|
|
||||||
+ TRACE(("Decoded strip for row %d \n", state->y));
|
|
||||||
+
|
|
||||||
+ // iterate over each row in the strip and stuff data into image
|
|
||||||
+ for (strip_row = 0; strip_row < min((INT32) rows_per_strip, state->ysize - state->y); strip_row++) {
|
|
||||||
+ TRACE(("Writing data into line %d ; \n", state->y + strip_row));
|
|
||||||
+
|
|
||||||
+ // UINT8 * bbb = state->buffer + strip_row * (state->bytes / rows_per_strip);
|
|
||||||
+ // TRACE(("chars: %x %x %x %x\n", ((UINT8 *)bbb)[0], ((UINT8 *)bbb)[1], ((UINT8 *)bbb)[2], ((UINT8 *)bbb)[3]));
|
|
||||||
+
|
|
||||||
+ state->shuffle((UINT8*) im->image[state->y + state->yoff + strip_row] +
|
|
||||||
+ state->xoff * im->pixelsize,
|
|
||||||
+ state->buffer + strip_row * row_byte_size,
|
|
||||||
+ state->xsize);
|
|
||||||
}
|
|
||||||
+ }
|
|
||||||
+ TIFFRGBAImageEnd(&img);
|
|
||||||
+ return 0;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+int _decodeStrip(Imaging im, ImagingCodecState state, TIFF *tiff) {
|
|
||||||
+ INT32 strip_row;
|
|
||||||
+ UINT8 *new_data;
|
|
||||||
+ UINT32 rows_per_strip, row_byte_size;
|
|
||||||
+ int ret;
|
|
||||||
+
|
|
||||||
+ ret = TIFFGetField(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_strip);
|
|
||||||
+ if (ret != 1) {
|
|
||||||
+ rows_per_strip = state->ysize;
|
|
||||||
+ }
|
|
||||||
+ TRACE(("RowsPerStrip: %u \n", rows_per_strip));
|
|
||||||
|
|
||||||
- return 0;
|
|
||||||
+ // We could use TIFFStripSize, but for YCbCr data it returns subsampled data size
|
|
||||||
+ row_byte_size = (state->xsize * state->bits + 7) / 8;
|
|
||||||
+
|
|
||||||
+ /* overflow check for realloc */
|
|
||||||
+ if (INT_MAX / row_byte_size < rows_per_strip) {
|
|
||||||
+ state->errcode = IMAGING_CODEC_MEMORY;
|
|
||||||
+ TIFFClose(tiff);
|
|
||||||
+ return -1;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ state->bytes = rows_per_strip * row_byte_size;
|
|
||||||
+
|
|
||||||
+ TRACE(("StripSize: %d \n", state->bytes));
|
|
||||||
+
|
|
||||||
+ if (TIFFStripSize(tiff) > state->bytes) {
|
|
||||||
+ // If the strip size as expected by LibTiff isn't what we're expecting, abort.
|
|
||||||
+ // man: TIFFStripSize returns the equivalent size for a strip of data as it would be returned in a
|
|
||||||
+ // call to TIFFReadEncodedStrip ...
|
|
||||||
+
|
|
||||||
+ state->errcode = IMAGING_CODEC_MEMORY;
|
|
||||||
+ TIFFClose(tiff);
|
|
||||||
+ return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
- if (TIFFReadEncodedStrip(tiff, TIFFComputeStrip(tiff, row, 0), (tdata_t)buffer, -1) == -1) {
|
|
||||||
- TRACE(("Decode Error, strip %d\n", TIFFComputeStrip(tiff, row, 0)));
|
|
||||||
+ /* realloc to fit whole strip */
|
|
||||||
+ /* malloc check above */
|
|
||||||
+ new_data = realloc (state->buffer, state->bytes);
|
|
||||||
+ if (!new_data) {
|
|
||||||
+ state->errcode = IMAGING_CODEC_MEMORY;
|
|
||||||
+ TIFFClose(tiff);
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
+ state->buffer = new_data;
|
|
||||||
+
|
|
||||||
+ for (; state->y < state->ysize; state->y += rows_per_strip) {
|
|
||||||
+ if (TIFFReadEncodedStrip(tiff, TIFFComputeStrip(tiff, state->y, 0), (tdata_t)state->buffer, -1) == -1) {
|
|
||||||
+ TRACE(("Decode Error, strip %d\n", TIFFComputeStrip(tiff, state->y, 0)));
|
|
||||||
+ state->errcode = IMAGING_CODEC_BROKEN;
|
|
||||||
+ TIFFClose(tiff);
|
|
||||||
+ return -1;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ TRACE(("Decoded strip for row %d \n", state->y));
|
|
||||||
+
|
|
||||||
+ // iterate over each row in the strip and stuff data into image
|
|
||||||
+ for (strip_row = 0; strip_row < min((INT32) rows_per_strip, state->ysize - state->y); strip_row++) {
|
|
||||||
+ TRACE(("Writing data into line %d ; \n", state->y + strip_row));
|
|
||||||
+
|
|
||||||
+ // UINT8 * bbb = state->buffer + strip_row * (state->bytes / rows_per_strip);
|
|
||||||
+ // TRACE(("chars: %x %x %x %x\n", ((UINT8 *)bbb)[0], ((UINT8 *)bbb)[1], ((UINT8 *)bbb)[2], ((UINT8 *)bbb)[3]));
|
|
||||||
+
|
|
||||||
+ state->shuffle((UINT8*) im->image[state->y + state->yoff + strip_row] +
|
|
||||||
+ state->xoff * im->pixelsize,
|
|
||||||
+ state->buffer + strip_row * row_byte_size,
|
|
||||||
+ state->xsize);
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -283,6 +411,9 @@
|
|
||||||
char *filename = "tempfile.tif";
|
|
||||||
char *mode = "r";
|
|
||||||
TIFF *tiff;
|
|
||||||
+ uint16 photometric = 0; // init to not PHOTOMETRIC_YCBCR
|
|
||||||
+ int isYCbCr = 0;
|
|
||||||
+ int ret;
|
|
||||||
|
|
||||||
/* buffer is the encoded file, bytes is the length of the encoded file */
|
|
||||||
/* it all ends up in state->buffer, which is a uint8* from Imaging.h */
|
|
||||||
@@ -343,6 +474,9 @@
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
+ TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, &photometric);
|
|
||||||
+ isYCbCr = photometric == PHOTOMETRIC_YCBCR;
|
|
||||||
+
|
|
||||||
if (TIFFIsTiled(tiff)) {
|
|
||||||
UINT32 x, y, tile_y, row_byte_size;
|
|
||||||
UINT32 tile_width, tile_length, current_tile_width;
|
|
||||||
@@ -411,75 +545,14 @@
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
- UINT32 strip_row, row_byte_size;
|
|
||||||
- UINT8 *new_data;
|
|
||||||
- UINT32 rows_per_strip;
|
|
||||||
- int ret;
|
|
||||||
-
|
|
||||||
- ret = TIFFGetField(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_strip);
|
|
||||||
- if (ret != 1) {
|
|
||||||
- rows_per_strip = state->ysize;
|
|
||||||
+ if (!isYCbCr) {
|
|
||||||
+ ret = _decodeStrip(im, state, tiff);
|
|
||||||
}
|
|
||||||
- TRACE(("RowsPerStrip: %u \n", rows_per_strip));
|
|
||||||
|
|
||||||
- // We could use TIFFStripSize, but for YCbCr data it returns subsampled data size
|
|
||||||
- row_byte_size = (state->xsize * state->bits + 7) / 8;
|
|
||||||
-
|
|
||||||
- /* overflow check for realloc */
|
|
||||||
- if (INT_MAX / row_byte_size < rows_per_strip) {
|
|
||||||
- state->errcode = IMAGING_CODEC_MEMORY;
|
|
||||||
- TIFFClose(tiff);
|
|
||||||
- return -1;
|
|
||||||
- }
|
|
||||||
-
|
|
||||||
- state->bytes = rows_per_strip * row_byte_size;
|
|
||||||
-
|
|
||||||
- TRACE(("StripSize: %d \n", state->bytes));
|
|
||||||
-
|
|
||||||
- if (TIFFStripSize(tiff) > state->bytes) {
|
|
||||||
- // If the strip size as expected by LibTiff isn't what we're expecting, abort.
|
|
||||||
- // man: TIFFStripSize returns the equivalent size for a strip of data as it would be returned in a
|
|
||||||
- // call to TIFFReadEncodedStrip ...
|
|
||||||
-
|
|
||||||
- state->errcode = IMAGING_CODEC_MEMORY;
|
|
||||||
- TIFFClose(tiff);
|
|
||||||
- return -1;
|
|
||||||
- }
|
|
||||||
-
|
|
||||||
- /* realloc to fit whole strip */
|
|
||||||
- /* malloc check above */
|
|
||||||
- new_data = realloc (state->buffer, state->bytes);
|
|
||||||
- if (!new_data) {
|
|
||||||
- state->errcode = IMAGING_CODEC_MEMORY;
|
|
||||||
- TIFFClose(tiff);
|
|
||||||
- return -1;
|
|
||||||
- }
|
|
||||||
-
|
|
||||||
- state->buffer = new_data;
|
|
||||||
-
|
|
||||||
- for (; state->y < state->ysize; state->y += rows_per_strip) {
|
|
||||||
- if (ReadStrip(tiff, state->y, (UINT32 *)state->buffer) == -1) {
|
|
||||||
- TRACE(("Decode Error, strip %d\n", TIFFComputeStrip(tiff, state->y, 0)));
|
|
||||||
- state->errcode = IMAGING_CODEC_BROKEN;
|
|
||||||
- TIFFClose(tiff);
|
|
||||||
- return -1;
|
|
||||||
- }
|
|
||||||
-
|
|
||||||
- TRACE(("Decoded strip for row %d \n", state->y));
|
|
||||||
-
|
|
||||||
- // iterate over each row in the strip and stuff data into image
|
|
||||||
- for (strip_row = 0; strip_row < min(rows_per_strip, state->ysize - state->y); strip_row++) {
|
|
||||||
- TRACE(("Writing data into line %d ; \n", state->y + strip_row));
|
|
||||||
-
|
|
||||||
- // UINT8 * bbb = state->buffer + strip_row * (state->bytes / rows_per_strip);
|
|
||||||
- // TRACE(("chars: %x %x %x %x\n", ((UINT8 *)bbb)[0], ((UINT8 *)bbb)[1], ((UINT8 *)bbb)[2], ((UINT8 *)bbb)[3]));
|
|
||||||
-
|
|
||||||
- state->shuffle((UINT8*) im->image[state->y + state->yoff + strip_row] +
|
|
||||||
- state->xoff * im->pixelsize,
|
|
||||||
- state->buffer + strip_row * row_byte_size,
|
|
||||||
- state->xsize);
|
|
||||||
- }
|
|
||||||
+ else {
|
|
||||||
+ ret = _decodeStripYCbCr(im, state, tiff);
|
|
||||||
}
|
|
||||||
+ if (ret == -1) { return ret; }
|
|
||||||
}
|
|
||||||
|
|
||||||
TIFFClose(tiff);
|
|
||||||
@ -1,102 +0,0 @@
|
|||||||
diff -rupN --no-dereference Pillow-7.2.0/src/libImaging/SgiRleDecode.c Pillow-7.2.0-new/src/libImaging/SgiRleDecode.c
|
|
||||||
--- Pillow-7.2.0/src/libImaging/SgiRleDecode.c 2020-06-30 09:50:35.000000000 +0200
|
|
||||||
+++ Pillow-7.2.0-new/src/libImaging/SgiRleDecode.c 2021-01-15 19:51:18.176808192 +0100
|
|
||||||
@@ -112,14 +112,33 @@ ImagingSgiRleDecode(Imaging im, ImagingC
|
|
||||||
int err = 0;
|
|
||||||
int status;
|
|
||||||
|
|
||||||
+ /* size check */
|
|
||||||
+ if (im->xsize > INT_MAX / im->bands ||
|
|
||||||
+ im->ysize > INT_MAX / im->bands) {
|
|
||||||
+ state->errcode = IMAGING_CODEC_MEMORY;
|
|
||||||
+ return -1;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
/* Get all data from File descriptor */
|
|
||||||
c = (SGISTATE*)state->context;
|
|
||||||
_imaging_seek_pyFd(state->fd, 0L, SEEK_END);
|
|
||||||
c->bufsize = _imaging_tell_pyFd(state->fd);
|
|
||||||
c->bufsize -= SGI_HEADER_SIZE;
|
|
||||||
+
|
|
||||||
+ c->tablen = im->bands * im->ysize;
|
|
||||||
+ /* below, we populate the starttab and lentab into the bufsize,
|
|
||||||
+ each with 4 bytes per element of tablen
|
|
||||||
+ Check here before we allocate any memory
|
|
||||||
+ */
|
|
||||||
+ if (c->bufsize < 8*c->tablen) {
|
|
||||||
+ state->errcode = IMAGING_CODEC_OVERRUN;
|
|
||||||
+ return -1;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
ptr = malloc(sizeof(UINT8) * c->bufsize);
|
|
||||||
if (!ptr) {
|
|
||||||
- return IMAGING_CODEC_MEMORY;
|
|
||||||
+ state->errcode = IMAGING_CODEC_MEMORY;
|
|
||||||
+ return -1;
|
|
||||||
}
|
|
||||||
_imaging_seek_pyFd(state->fd, SGI_HEADER_SIZE, SEEK_SET);
|
|
||||||
_imaging_read_pyFd(state->fd, (char*)ptr, c->bufsize);
|
|
||||||
@@ -134,18 +153,11 @@ ImagingSgiRleDecode(Imaging im, ImagingC
|
|
||||||
state->ystep = 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
- if (im->xsize > INT_MAX / im->bands ||
|
|
||||||
- im->ysize > INT_MAX / im->bands) {
|
|
||||||
- err = IMAGING_CODEC_MEMORY;
|
|
||||||
- goto sgi_finish_decode;
|
|
||||||
- }
|
|
||||||
-
|
|
||||||
/* Allocate memory for RLE tables and rows */
|
|
||||||
free(state->buffer);
|
|
||||||
state->buffer = NULL;
|
|
||||||
/* malloc overflow check above */
|
|
||||||
state->buffer = calloc(im->xsize * im->bands, sizeof(UINT8) * 2);
|
|
||||||
- c->tablen = im->bands * im->ysize;
|
|
||||||
c->starttab = calloc(c->tablen, sizeof(UINT32));
|
|
||||||
c->lengthtab = calloc(c->tablen, sizeof(UINT32));
|
|
||||||
if (!state->buffer ||
|
|
||||||
@@ -176,7 +188,7 @@ ImagingSgiRleDecode(Imaging im, ImagingC
|
|
||||||
|
|
||||||
if (c->rleoffset + c->rlelength > c->bufsize) {
|
|
||||||
state->errcode = IMAGING_CODEC_OVERRUN;
|
|
||||||
- return -1;
|
|
||||||
+ goto sgi_finish_decode;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* row decompression */
|
|
||||||
@@ -188,7 +200,7 @@ ImagingSgiRleDecode(Imaging im, ImagingC
|
|
||||||
}
|
|
||||||
if (status == -1) {
|
|
||||||
state->errcode = IMAGING_CODEC_OVERRUN;
|
|
||||||
- return -1;
|
|
||||||
+ goto sgi_finish_decode;
|
|
||||||
} else if (status == 1) {
|
|
||||||
goto sgi_finish_decode;
|
|
||||||
}
|
|
||||||
@@ -209,7 +221,8 @@ sgi_finish_decode: ;
|
|
||||||
free(c->lengthtab);
|
|
||||||
free(ptr);
|
|
||||||
if (err != 0){
|
|
||||||
- return err;
|
|
||||||
+ state->errcode=err;
|
|
||||||
+ return -1;
|
|
||||||
}
|
|
||||||
return state->count - c->bufsize;
|
|
||||||
}
|
|
||||||
diff -rupN --no-dereference Pillow-7.2.0/Tests/test_sgi_crash.py Pillow-7.2.0-new/Tests/test_sgi_crash.py
|
|
||||||
--- Pillow-7.2.0/Tests/test_sgi_crash.py 2020-06-30 09:50:35.000000000 +0200
|
|
||||||
+++ Pillow-7.2.0-new/Tests/test_sgi_crash.py 2021-01-15 19:51:18.176808192 +0100
|
|
||||||
@@ -5,7 +5,12 @@ from PIL import Image
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"test_file",
|
|
||||||
- ["Tests/images/sgi_overrun_expandrowF04.bin", "Tests/images/sgi_crash.bin"],
|
|
||||||
+ [
|
|
||||||
+ "Tests/images/sgi_overrun_expandrowF04.bin",
|
|
||||||
+ "Tests/images/sgi_crash.bin",
|
|
||||||
+ "Tests/images/crash-6b7f2244da6d0ae297ee0754a424213444e92778.sgi",
|
|
||||||
+ "Tests/images/ossfuzz-5730089102868480.sgi",
|
|
||||||
+ ],
|
|
||||||
)
|
|
||||||
def test_crashes(test_file):
|
|
||||||
with open(test_file, "rb") as f:
|
|
||||||
@ -1,23 +1,28 @@
|
|||||||
%global py3_incdir %(python3 -c 'import distutils.sysconfig; print(distutils.sysconfig.get_python_inc())')
|
%global py3_incdir %(python3 -c 'import distutils.sysconfig; print(distutils.sysconfig.get_python_inc())')
|
||||||
%global py3_libbuilddir %(python3 -c 'import sys; import sysconfig; print("lib.{p}-{v[0]}.{v[1]}".format(p=sysconfig.get_platform(), v=sys.version_info))')
|
%global py3_libbuilddir %(python3 -c 'import sys; import sysconfig; print("lib.{p}-{v[0]}.{v[1]}".format(p=sysconfig.get_platform(), v=sys.version_info))')
|
||||||
|
|
||||||
|
%global with_docs 0
|
||||||
|
|
||||||
Name: python-pillow
|
Name: python-pillow
|
||||||
Version: 7.2.0
|
Version: 8.1.1
|
||||||
Release: 4
|
Release: 1
|
||||||
Summary: Python image processing library
|
Summary: Python image processing library
|
||||||
License: MIT
|
License: MIT
|
||||||
URL: http://python-pillow.github.io/
|
URL: http://python-pillow.github.io/
|
||||||
Source0: https://github.com/python-pillow/Pillow/archive/%{version}/Pillow-%{version}.tar.gz
|
Source0: https://github.com/python-pillow/Pillow/archive/%{version}/Pillow-%{version}.tar.gz
|
||||||
|
|
||||||
Patch6000: backport-CVE-2020-35653.patch
|
Patch0: python-pillow_spinxwarn.patch
|
||||||
Patch6001: backport-CVE-2020-35654.patch
|
Patch1: python-pillow_sphinx-issues.patch
|
||||||
Patch6002: backport-CVE-2020-35655.patch
|
|
||||||
|
|
||||||
BuildRequires: freetype-devel ghostscript lcms2-devel libimagequant-devel libjpeg-devel
|
|
||||||
BuildRequires: libtiff-devel libwebp-devel openjpeg2-devel tk-devel zlib-devel
|
|
||||||
BuildRequires: python3-cffi python3-devel python3-numpy python3-olefile
|
|
||||||
BuildRequires: python3-setuptools python3-sphinx python3-sphinx_rtd_theme python3-tkinter
|
|
||||||
|
|
||||||
|
BuildRequires: freetype-devel ghostscript lcms2-devel libimagequant-devel libjpeg-devel libraqm-devel libtiff-devel
|
||||||
|
BuildRequires: libwebp-devel openjpeg2-devel tk-devel zlib-devel python3-cffi python3-devel python3-numpy python3-olefile
|
||||||
|
BuildRequires: python3-qt5 python3-setuptools python3-tkinter
|
||||||
|
%if 0%{?with_docs}
|
||||||
|
BuildRequires: make
|
||||||
|
BuildRequires: python3-sphinx
|
||||||
|
BuildRequires: python3-sphinx_rtd_theme
|
||||||
|
BuildRequires: python3-sphinx-removed-in
|
||||||
|
%endif
|
||||||
Requires: ghostscript
|
Requires: ghostscript
|
||||||
|
|
||||||
%global __provides_exclude_from ^%{python3_sitearch}/PIL/.*\\.so$
|
%global __provides_exclude_from ^%{python3_sitearch}/PIL/.*\\.so$
|
||||||
@ -30,12 +35,8 @@ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is sup
|
|||||||
Summary: Python 3 image processing library
|
Summary: Python 3 image processing library
|
||||||
%{?python_provide:%python_provide python3-pillow}
|
%{?python_provide:%python_provide python3-pillow}
|
||||||
Provides: python3-imaging = %{version}-%{release}
|
Provides: python3-imaging = %{version}-%{release}
|
||||||
Provides: python3-pillow-tk = %{version}-%{release} python3-imaging-tk = %{version}-%{release}
|
|
||||||
Provides: python3-pillow-qt = %{version}-%{release} python3-imaging-qt = %{version}-%{release}
|
Requires: python3-olefile
|
||||||
Requires: python3-olefile python3-tkinter python3-PyQt4
|
|
||||||
Obsoletes: python3-pillow-tk < %{version}-%{release} python3-pillow-qt < %{version}-%{release}
|
|
||||||
%{?python_provide:%python_provide python3-pillow-tk}
|
|
||||||
%{?python_provide:%python_provide python3-pillow-qt}
|
|
||||||
|
|
||||||
%description -n python3-pillow
|
%description -n python3-pillow
|
||||||
Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \
|
Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \
|
||||||
@ -44,7 +45,9 @@ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is sup
|
|||||||
%package -n python3-pillow-devel
|
%package -n python3-pillow-devel
|
||||||
Summary: Development files for pillow
|
Summary: Development files for pillow
|
||||||
Requires: python3-devel libjpeg-devel zlib-devel python3-pillow = %{version}-%{release}
|
Requires: python3-devel libjpeg-devel zlib-devel python3-pillow = %{version}-%{release}
|
||||||
|
|
||||||
%{?python_provide:%python_provide python3-pillow-devel}
|
%{?python_provide:%python_provide python3-pillow-devel}
|
||||||
|
|
||||||
Provides: python3-imaging-devel = %{version}-%{release}
|
Provides: python3-imaging-devel = %{version}-%{release}
|
||||||
|
|
||||||
%description -n python3-pillow-devel
|
%description -n python3-pillow-devel
|
||||||
@ -56,26 +59,50 @@ BuildArch: noarch
|
|||||||
Requires: python3-pillow = %{version}-%{release}
|
Requires: python3-pillow = %{version}-%{release}
|
||||||
%{?python_provide:%python_provide python3-pillow-doc}
|
%{?python_provide:%python_provide python3-pillow-doc}
|
||||||
Provides: python3-imaging-doc = %{version}-%{release} python3-pillow-doc = %{version}-%{release}
|
Provides: python3-imaging-doc = %{version}-%{release} python3-pillow-doc = %{version}-%{release}
|
||||||
|
|
||||||
Obsoletes: python3-pillow-doc < %{version}-%{release}
|
Obsoletes: python3-pillow-doc < %{version}-%{release}
|
||||||
|
|
||||||
%description -n python3-pillow-help
|
%description -n python3-pillow-help
|
||||||
Documentation for pillow.
|
Documentation for pillow.
|
||||||
|
|
||||||
|
|
||||||
|
%package -n python3-pillow-tk
|
||||||
|
Summary: Tk interface for pillow
|
||||||
|
Requires: python3-tkinter
|
||||||
|
Requires: python3-pillow = %{version}-%{release}
|
||||||
|
%{?python_provide:%python_provide python3-pillow-tk}
|
||||||
|
Provides: python3-imaging-tk = %{version}-%{release}
|
||||||
|
|
||||||
|
%description -n python3-pillow-tk
|
||||||
|
Tk interface for %{name}.
|
||||||
|
|
||||||
|
|
||||||
|
%package -n python3-pillow-qt
|
||||||
|
Summary: Qt pillow image wrapper
|
||||||
|
Requires: python3-qt5
|
||||||
|
Requires: python3-pillow = %{version}-%{release}
|
||||||
|
%{?python_provide:%python_provide python3-pillow-qt}
|
||||||
|
Provides: python3-imaging-qt = %{version}-%{release}
|
||||||
|
|
||||||
|
%description -n python3-pillow-qt
|
||||||
|
Qt pillow image wrapper.
|
||||||
%prep
|
%prep
|
||||||
%autosetup -p1 -n Pillow-%{version}
|
%autosetup -p1 -n Pillow-%{version}
|
||||||
|
|
||||||
%build
|
%build
|
||||||
|
|
||||||
%py3_build
|
%py3_build
|
||||||
|
|
||||||
|
%if 0%{?with_docs}
|
||||||
PYTHONPATH=$PWD/build/%py3_libbuilddir make -C docs html BUILDDIR=_build_py3 SPHINXBUILD=sphinx-build-%python3_version
|
PYTHONPATH=$PWD/build/%py3_libbuilddir make -C docs html BUILDDIR=_build_py3 SPHINXBUILD=sphinx-build-%python3_version
|
||||||
find . -name "docs/_build_py3/html/.buildinfo" -exec rm {} \;
|
rm -f docs/_build_py3/html/.buildinfo
|
||||||
|
%endif
|
||||||
|
|
||||||
%install
|
%install
|
||||||
mkdir -p %{buildroot}/%{py3_incdir}/Imaging
|
mkdir -p %{buildroot}/%{py3_incdir}/Imaging
|
||||||
install -m 644 src/libImaging/*.h %{buildroot}/%{py3_incdir}/Imaging
|
install -m 644 src/libImaging/*.h %{buildroot}/%{py3_incdir}/Imaging
|
||||||
%py3_install
|
%py3_install
|
||||||
|
|
||||||
|
|
||||||
%check
|
%check
|
||||||
ln -s $PWD/Images $PWD/build/%py3_libbuilddir/Images
|
ln -s $PWD/Images $PWD/build/%py3_libbuilddir/Images
|
||||||
cp -R $PWD/Tests $PWD/build/%py3_libbuilddir/Tests
|
cp -R $PWD/Tests $PWD/build/%py3_libbuilddir/Tests
|
||||||
@ -85,35 +112,37 @@ PYTHONPATH=$PWD %{__python3} selftest.py
|
|||||||
popd
|
popd
|
||||||
|
|
||||||
%files -n python3-pillow
|
%files -n python3-pillow
|
||||||
%doc README.rst CHANGES.rst
|
%doc README.md CHANGES.rst
|
||||||
%license docs/COPYING
|
%license docs/COPYING
|
||||||
%{python3_sitearch}/*
|
%{python3_sitearch}/PIL/
|
||||||
|
%{python3_sitearch}/Pillow-%{version}-py%{python3_version}.egg-info
|
||||||
|
%exclude %{python3_sitearch}/PIL/_imagingtk*
|
||||||
|
%exclude %{python3_sitearch}/PIL/ImageTk*
|
||||||
|
%exclude %{python3_sitearch}/PIL/SpiderImagePlugin*
|
||||||
|
%exclude %{python3_sitearch}/PIL/ImageQt*
|
||||||
|
%exclude %{python3_sitearch}/PIL/__pycache__/ImageTk*
|
||||||
|
%exclude %{python3_sitearch}/PIL/__pycache__/SpiderImagePlugin*
|
||||||
|
%exclude %{python3_sitearch}/PIL/__pycache__/ImageQt*
|
||||||
|
|
||||||
%files -n python3-pillow-devel
|
%files -n python3-pillow-devel
|
||||||
%{py3_incdir}/Imaging/
|
%{py3_incdir}/Imaging/
|
||||||
|
|
||||||
%files -n python3-pillow-help
|
%files -n python3-pillow-help
|
||||||
|
%if 0%{?with_docs}
|
||||||
%doc docs/_build_py3/html
|
%doc docs/_build_py3/html
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%files -n python3-pillow-tk
|
||||||
|
%{python3_sitearch}/PIL/_imagingtk*
|
||||||
|
%{python3_sitearch}/PIL/ImageTk*
|
||||||
|
%{python3_sitearch}/PIL/SpiderImagePlugin*
|
||||||
|
%{python3_sitearch}/PIL/__pycache__/ImageTk*
|
||||||
|
%{python3_sitearch}/PIL/__pycache__/SpiderImagePlugin*
|
||||||
|
|
||||||
|
%files -n python3-pillow-qt
|
||||||
|
%{python3_sitearch}/PIL/ImageQt*
|
||||||
|
%{python3_sitearch}/PIL/__pycache__/ImageQt*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Thu Mar 4 2021 hanhui <hanhui15@huawei.com> - 7.2.0-4
|
* Tue Mar 02 2021 Sandro Mani <manisandro@gmail.com> - 8.1.1-1
|
||||||
- fix CVE-2020-35654
|
- Update to 8.1.1
|
||||||
|
|
||||||
* Tue Feb 23 2021 jinzhimin <jinzhimin2@huawei.com> - 7.2.0-3
|
|
||||||
- fix CVE-2020-35655
|
|
||||||
|
|
||||||
* Thu Jan 28 2021 renmingshuai <renmingshuai@huawei.com> - 7.2.0-2
|
|
||||||
- fix CVE-2020-35653
|
|
||||||
|
|
||||||
* Mon Aug 10 2020 yanglongkang <yanglongkang@huawei.com> - 7.2.0-1
|
|
||||||
- update to 7.2.0
|
|
||||||
|
|
||||||
* Sat Aug 8 2020 shixuantong <shixuantong@huawei.com> - 5.3.0-5
|
|
||||||
- remove python2 support
|
|
||||||
|
|
||||||
* Wed Mar 11 2020 hy <hu.huyan@huawei.com> - 5.3.0-4
|
|
||||||
- fix CVE-2019-16865
|
|
||||||
|
|
||||||
* Thu Dec 12 2019 Senlin Xia <xiasenlin1@huawei.com> - 5.3.0-3
|
|
||||||
- Package init
|
|
||||||
|
|||||||
11
python-pillow_sphinx-issues.patch
Normal file
11
python-pillow_sphinx-issues.patch
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
diff -rupN --no-dereference Pillow-8.1.1/docs/conf.py Pillow-8.1.1-new/docs/conf.py
|
||||||
|
--- Pillow-8.1.1/docs/conf.py 2021-03-01 09:24:03.000000000 +0100
|
||||||
|
+++ Pillow-8.1.1-new/docs/conf.py 2021-03-02 15:10:49.599033773 +0100
|
||||||
|
@@ -32,7 +32,6 @@ extensions = [
|
||||||
|
"sphinx.ext.autodoc",
|
||||||
|
"sphinx.ext.intersphinx",
|
||||||
|
"sphinx.ext.viewcode",
|
||||||
|
- "sphinx_issues",
|
||||||
|
"sphinx_removed_in",
|
||||||
|
]
|
||||||
|
|
||||||
12
python-pillow_spinxwarn.patch
Normal file
12
python-pillow_spinxwarn.patch
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
diff -rupN --no-dereference Pillow-8.1.1/docs/Makefile Pillow-8.1.1-new/docs/Makefile
|
||||||
|
--- Pillow-8.1.1/docs/Makefile 2021-03-01 09:24:03.000000000 +0100
|
||||||
|
+++ Pillow-8.1.1-new/docs/Makefile 2021-03-02 15:10:49.514033779 +0100
|
||||||
|
@@ -42,7 +42,7 @@ clean:
|
||||||
|
-rm -rf $(BUILDDIR)/*
|
||||||
|
|
||||||
|
html:
|
||||||
|
- $(SPHINXBUILD) -b html -W --keep-going $(ALLSPHINXOPTS) $(BUILDDIR)/html
|
||||||
|
+ $(SPHINXBUILD) -b html --keep-going $(ALLSPHINXOPTS) $(BUILDDIR)/html
|
||||||
|
@echo
|
||||||
|
@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
|
||||||
|
|
||||||
Loading…
x
Reference in New Issue
Block a user