On Wed, 2023-07-26 at 17:20 +0530, Hitendra Prajapati wrote: > +Upstream-Status: Backport > [https://gitlab.com/libtiff/libtiff/-/commit/b5c7d4c4e03333ac16b5cfb1 > 1acaaeaa493334f8] > +CVE: CVE-2023-3618 > +Signed-off-by: Hitendra Prajapati <[email protected]> > +--- > + tools/tiffcrop.c | 18 +++++++++++++++--- > + 1 file changed, 15 insertions(+), 3 deletions(-) > + > +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c > +index ce77c74..2c553e3 100644 > +--- a/tools/tiffcrop.c > ++++ b/tools/tiffcrop.c > +@@ -2459,9 +2459,15 @@ main(int argc, char* argv[]) > + { /* Whole image or sections not based on output page size > */ > + if (crop.selections > 0) > + { > +- writeSelections(in, &out, &crop, &image, &dump, seg_buffs, > +- mp, argv[argc - 1], &next_page, > total_pages); > +- } > ++ if (writeSelections(in, &out, &crop, &image, &dump, > ++ seg_buffs, mp, argv[argc - 1], > ++ &next_page, total_pages)) > ++ { > ++ TIFFError("main", > ++ "Unable to write new image selections"); > ++ exit(EXIT_FAILURE); > ++ } > ++ } > + else /* One file all images and sections */ > + { > + if (update_output_file (&out, mp, crop.exp_mode, argv[argc > - 1], > +@@ -7836,6 +7842,12 @@ createCroppedImage(struct image_data *image, > struct crop_mask *crop, > + > + read_buff = *read_buff_ptr; > + > ++ /* Memory is freed before crop_buff_ptr is overwritten */ > ++ if (*crop_buff_ptr != NULL) > ++ { > ++ _TIFFfree(*crop_buff_ptr); > ++ } > ++
This doesn't seem to be part of the commit mentioned above in Upstream- Status. This change is coming from: https://gitlab.com/libtiff/libtiff/-/commit/881a070194783561fd209b7c789a4e75566f7f37 Please backport it as a separate patch. > + /* process full image, no crop buffer needed */ > + crop_buff = read_buff; The commit 881a070194 actually removes this assignment but your patch doesn't seem to be doing that ... Thanks, Anuj
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#184886): https://lists.openembedded.org/g/openembedded-core/message/184886 Mute This Topic: https://lists.openembedded.org/mt/100345399/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
