- security update
- added patches fix CVE-2020-15503 [bsc#1173674], lack of thumbnail size range check can lead to buffer overflow + libraw-CVE-2020-15503.patch OBS-URL: https://build.opensuse.org/package/show/graphics/libraw?expand=0&rev=137
This commit is contained in:
Git OBS Bridge
parent
c4d57e1859
commit
ab9161749c
133
libraw-CVE-2020-15503.patch
Normal file
133
libraw-CVE-2020-15503.patch
Normal file
@ -0,0 +1,133 @@
|
|||||||
|
Index: LibRaw-0.19.5/libraw/libraw_const.h
|
||||||
|
===================================================================
|
||||||
|
--- LibRaw-0.19.5.orig/libraw/libraw_const.h 2020-07-07 12:42:30.310654582 +0200
|
||||||
|
+++ LibRaw-0.19.5/libraw/libraw_const.h 2020-07-07 12:49:43.141162263 +0200
|
||||||
|
@@ -24,6 +24,11 @@ it under the terms of the one of two lic
|
||||||
|
#define LIBRAW_MAX_ALLOC_MB 2048L
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+/* limit thumbnail size, default is 512Mb*/
|
||||||
|
+#ifndef LIBRAW_MAX_THUMBNAIL_MB
|
||||||
|
+#define LIBRAW_MAX_THUMBNAIL_MB 512L
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
/* Change to non-zero to allow (broken) CRW (and other) files metadata
|
||||||
|
loop prevention */
|
||||||
|
#ifndef LIBRAW_METADATA_LOOP_PREVENTION
|
||||||
|
Index: LibRaw-0.19.5/src/libraw_cxx.cpp
|
||||||
|
===================================================================
|
||||||
|
--- LibRaw-0.19.5.orig/src/libraw_cxx.cpp 2019-08-20 19:34:30.000000000 +0200
|
||||||
|
+++ LibRaw-0.19.5/src/libraw_cxx.cpp 2020-07-07 13:03:23.697916270 +0200
|
||||||
|
@@ -3712,6 +3712,20 @@ libraw_processed_image_t *LibRaw::dcraw_
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (T.tlength < 64u)
|
||||||
|
+ {
|
||||||
|
+ if (errcode)
|
||||||
|
+ *errcode = EINVAL;
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (INT64(T.tlength) > 1024ULL * 1024ULL * LIBRAW_MAX_THUMBNAIL_MB)
|
||||||
|
+ {
|
||||||
|
+ if (errcode)
|
||||||
|
+ *errcode = LIBRAW_TOO_BIG;
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (T.tformat == LIBRAW_THUMBNAIL_BITMAP)
|
||||||
|
{
|
||||||
|
libraw_processed_image_t *ret = (libraw_processed_image_t *)::malloc(sizeof(libraw_processed_image_t) + T.tlength);
|
||||||
|
@@ -3976,6 +3990,12 @@ void LibRaw::kodak_thumb_loader()
|
||||||
|
if (ID.toffset + est_datasize > ID.input->size() + THUMB_READ_BEYOND)
|
||||||
|
throw LIBRAW_EXCEPTION_IO_EOF;
|
||||||
|
|
||||||
|
+ if(INT64(T.theight) * INT64(T.twidth) > 1024ULL * 1024ULL * LIBRAW_MAX_THUMBNAIL_MB)
|
||||||
|
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
|
||||||
|
+
|
||||||
|
+ if (INT64(T.theight) * INT64(T.twidth) < 64ULL)
|
||||||
|
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
|
||||||
|
+
|
||||||
|
// some kodak cameras
|
||||||
|
ushort s_height = S.height, s_width = S.width, s_iwidth = S.iwidth, s_iheight = S.iheight;
|
||||||
|
ushort s_flags = libraw_internal_data.unpacker_data.load_flags;
|
||||||
|
@@ -4237,6 +4257,25 @@ int LibRaw::unpack_thumb(void)
|
||||||
|
CHECK_ORDER_LOW(LIBRAW_PROGRESS_IDENTIFY);
|
||||||
|
CHECK_ORDER_BIT(LIBRAW_PROGRESS_THUMB_LOAD);
|
||||||
|
|
||||||
|
+#define THUMB_SIZE_CHECKT(A) \
|
||||||
|
+ do { \
|
||||||
|
+ if (INT64(A) > 1024ULL * 1024ULL * LIBRAW_MAX_THUMBNAIL_MB) throw LIBRAW_EXCEPTION_IO_CORRUPT; \
|
||||||
|
+ if (INT64(A) > 0 && INT64(A) < 64ULL) throw LIBRAW_EXCEPTION_IO_CORRUPT; \
|
||||||
|
+ } while (0)
|
||||||
|
+
|
||||||
|
+#define THUMB_SIZE_CHECKTNZ(A) \
|
||||||
|
+ do { \
|
||||||
|
+ if (INT64(A) > 1024ULL * 1024ULL * LIBRAW_MAX_THUMBNAIL_MB) throw LIBRAW_EXCEPTION_IO_CORRUPT; \
|
||||||
|
+ if (INT64(A) < 64ULL) throw LIBRAW_EXCEPTION_IO_CORRUPT; \
|
||||||
|
+ } while (0)
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+#define THUMB_SIZE_CHECKWH(W,H) \
|
||||||
|
+ do { \
|
||||||
|
+ if (INT64(W)*INT64(H) > 1024ULL * 1024ULL * LIBRAW_MAX_THUMBNAIL_MB) throw LIBRAW_EXCEPTION_IO_CORRUPT; \
|
||||||
|
+ if (INT64(W)*INT64(H) < 64ULL) throw LIBRAW_EXCEPTION_IO_CORRUPT; \
|
||||||
|
+ } while (0)
|
||||||
|
+
|
||||||
|
try
|
||||||
|
{
|
||||||
|
if (!libraw_internal_data.internal_data.input)
|
||||||
|
@@ -4267,6 +4306,7 @@ int LibRaw::unpack_thumb(void)
|
||||||
|
|
||||||
|
if (INT64(ID.toffset) + tsize > ID.input->size() + THUMB_READ_BEYOND)
|
||||||
|
throw LIBRAW_EXCEPTION_IO_EOF;
|
||||||
|
+ THUMB_SIZE_CHECKT(tsize);
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
@@ -4280,6 +4320,8 @@ int LibRaw::unpack_thumb(void)
|
||||||
|
ID.input->seek(ID.toffset, SEEK_SET);
|
||||||
|
if (write_thumb == &LibRaw::jpeg_thumb)
|
||||||
|
{
|
||||||
|
+ THUMB_SIZE_CHECKTNZ(T.tlength);
|
||||||
|
+
|
||||||
|
if (T.thumb)
|
||||||
|
free(T.thumb);
|
||||||
|
T.thumb = (char *)malloc(T.tlength);
|
||||||
|
@@ -4326,6 +4368,7 @@ int LibRaw::unpack_thumb(void)
|
||||||
|
{
|
||||||
|
if (t_bytesps > 1)
|
||||||
|
throw LIBRAW_EXCEPTION_IO_CORRUPT; // 8-bit thumb, but parsed for more bits
|
||||||
|
+ THUMB_SIZE_CHECKWH(T.twidth, T.theight);
|
||||||
|
int t_length = T.twidth * T.theight * t_colors;
|
||||||
|
|
||||||
|
if (T.tlength && T.tlength < t_length) // try to find tiff ifd with needed offset
|
||||||
|
@@ -4351,6 +4394,7 @@ int LibRaw::unpack_thumb(void)
|
||||||
|
T.tcolors = 1;
|
||||||
|
}
|
||||||
|
T.tlength = total_size;
|
||||||
|
+ THUMB_SIZE_CHECKTNZ(T.tlength);
|
||||||
|
if (T.thumb)
|
||||||
|
free(T.thumb);
|
||||||
|
T.thumb = (char *)malloc(T.tlength);
|
||||||
|
@@ -4384,6 +4428,8 @@ int LibRaw::unpack_thumb(void)
|
||||||
|
if (T.thumb)
|
||||||
|
free(T.thumb);
|
||||||
|
|
||||||
|
+ THUMB_SIZE_CHECKTNZ(T.tlength);
|
||||||
|
+
|
||||||
|
T.thumb = (char *)malloc(T.tlength);
|
||||||
|
if (!T.tcolors)
|
||||||
|
T.tcolors = t_colors;
|
||||||
|
@@ -4404,6 +4450,10 @@ int LibRaw::unpack_thumb(void)
|
||||||
|
int i_length = T.twidth * T.theight * t_colors * 2;
|
||||||
|
if (!T.tlength)
|
||||||
|
T.tlength = o_length;
|
||||||
|
+ THUMB_SIZE_CHECKTNZ(o_length);
|
||||||
|
+ THUMB_SIZE_CHECKTNZ(i_length);
|
||||||
|
+ THUMB_SIZE_CHECKTNZ(T.tlength);
|
||||||
|
+
|
||||||
|
ushort *t_thumb = (ushort *)calloc(i_length, 1);
|
||||||
|
ID.input->read(t_thumb, 1, i_length);
|
||||||
|
if ((libraw_internal_data.unpacker_data.order == 0x4949) == (ntohs(0x1234) == 0x1234))
|
||||||
@ -1,3 +1,11 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue Jul 7 14:20:04 UTC 2020 - pgajdos@suse.com
|
||||||
|
|
||||||
|
- security update
|
||||||
|
- added patches
|
||||||
|
fix CVE-2020-15503 [bsc#1173674], lack of thumbnail size range check can lead to buffer overflow
|
||||||
|
+ libraw-CVE-2020-15503.patch
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Fri Dec 20 09:46:35 UTC 2019 - pgajdos@suse.com
|
Fri Dec 20 09:46:35 UTC 2019 - pgajdos@suse.com
|
||||||
|
|
||||||
|
|||||||
@ -1,7 +1,7 @@
|
|||||||
#
|
#
|
||||||
# spec file for package libraw
|
# spec file for package libraw
|
||||||
#
|
#
|
||||||
# Copyright (c) 2019 SUSE LLC
|
# Copyright (c) 2020 SUSE LLC
|
||||||
#
|
#
|
||||||
# All modifications and additions to the file contributed by third parties
|
# All modifications and additions to the file contributed by third parties
|
||||||
# remain the property of their copyright owners, unless otherwise agreed
|
# remain the property of their copyright owners, unless otherwise agreed
|
||||||
@ -32,6 +32,8 @@ URL: https://www.libraw.org/
|
|||||||
#Git-Clone: git://github.com/LibRaw/LibRaw
|
#Git-Clone: git://github.com/LibRaw/LibRaw
|
||||||
Source: https://www.libraw.org/data/%tar_name-%version.tar.gz
|
Source: https://www.libraw.org/data/%tar_name-%version.tar.gz
|
||||||
Patch1: libraw-Add-Sony-ILCE-7M3.patch
|
Patch1: libraw-Add-Sony-ILCE-7M3.patch
|
||||||
|
# CVE-2020-15503 [bsc#1173674], lack of thumbnail size range check can lead to buffer overflow
|
||||||
|
Patch2: libraw-CVE-2020-15503.patch
|
||||||
BuildRequires: autoconf
|
BuildRequires: autoconf
|
||||||
BuildRequires: automake
|
BuildRequires: automake
|
||||||
BuildRequires: fdupes
|
BuildRequires: fdupes
|
||||||
@ -102,6 +104,7 @@ against LibRaw. LibRaw does not provide dynamic libraries.
|
|||||||
%prep
|
%prep
|
||||||
%setup -q -n %{tar_name}-%{version}
|
%setup -q -n %{tar_name}-%{version}
|
||||||
%patch1 -p1
|
%patch1 -p1
|
||||||
|
%patch2 -p1
|
||||||
|
|
||||||
%build
|
%build
|
||||||
%global _lto_cflags %{_lto_cflags} -ffat-lto-objects
|
%global _lto_cflags %{_lto_cflags} -ffat-lto-objects
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user