From b3974df96614b08d418b291b86248ea0ff93c462 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Wed, 6 Aug 2025 22:20:28 +0200 Subject: [PATCH] package/tiff: add patches to fix CVE-2025-8176 Fix the following vulnerability: - CVE-2025-8176 A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-8176 - https://gitlab.com/libtiff/libtiff/-/merge_requests/727 Signed-off-by: Thomas Perale Signed-off-by: Peter Korsgaard --- ...ip-the-first-line-of-the-input-image.patch | 61 +++++++++++++++++++ package/tiff/0002-fix-tiffmedian-bug.patch | 31 ++++++++++ package/tiff/0003-conflict-resolution.patch | 28 +++++++++ package/tiff/tiff.mk | 3 + 4 files changed, 123 insertions(+) create mode 100644 package/tiff/0001-don-t-skip-the-first-line-of-the-input-image.patch create mode 100644 package/tiff/0002-fix-tiffmedian-bug.patch create mode 100644 package/tiff/0003-conflict-resolution.patch diff --git a/package/tiff/0001-don-t-skip-the-first-line-of-the-input-image.patch b/package/tiff/0001-don-t-skip-the-first-line-of-the-input-image.patch new file mode 100644 index 0000000000..bdf4bd8e94 --- /dev/null +++ b/package/tiff/0001-don-t-skip-the-first-line-of-the-input-image.patch @@ -0,0 +1,61 @@ +From 3994cf3b3bc6b54c32f240ca5a412cffa11633fa Mon Sep 17 00:00:00 2001 +From: Lee Howard +Date: Mon, 19 May 2025 10:53:30 -0700 +Subject: [PATCH] Don't skip the first line of the input image. Addresses + issue #703 + +Upstream: https://gitlab.com/libtiff/libtiff/-/commit/3994cf3b3bc6b54c32f240ca5a412cffa11633fa +CVE: CVE-2025-8176 +Signed-off-by: Thomas Perale +--- + tools/tiffdither.c | 4 ++-- + tools/tiffmedian.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/tiffdither.c b/tools/tiffdither.c +index 714fe03d4..bfed6df18 100644 +--- a/tools/tiffdither.c ++++ b/tools/tiffdither.c +@@ -98,7 +98,7 @@ static int fsdither(TIFF *in, TIFF *out) + nextptr = nextline; + for (j = 0; j < imagewidth; ++j) + *nextptr++ = *inptr++; +- for (i = 1; i < imagelength; ++i) ++ for (i = 0; i < imagelength; ++i) + { + tmpptr = thisline; + thisline = nextline; +@@ -146,7 +146,7 @@ static int fsdither(TIFF *in, TIFF *out) + nextptr[0] += v / 16; + } + } +- if (TIFFWriteScanline(out, outline, i - 1, 0) < 0) ++ if (TIFFWriteScanline(out, outline, i, 0) < 0) + goto skip_on_error; + } + goto exit_label; +diff --git a/tools/tiffmedian.c b/tools/tiffmedian.c +index 02b0bc2b4..f6cf26c2c 100644 +--- a/tools/tiffmedian.c ++++ b/tools/tiffmedian.c +@@ -917,7 +917,7 @@ static void quant_fsdither(TIFF *in, TIFF *out) + outline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out)); + + GetInputLine(in, 0, goto bad); /* get first line */ +- for (i = 1; i <= imagelength; ++i) ++ for (i = 0; i <= imagelength; ++i) + { + SWAP(short *, thisline, nextline); + lastline = (i >= imax); +@@ -997,7 +997,7 @@ static void quant_fsdither(TIFF *in, TIFF *out) + nextptr += 3; + } + } +- if (TIFFWriteScanline(out, outline, i - 1, 0) < 0) ++ if (TIFFWriteScanline(out, outline, i, 0) < 0) + break; + } + bad: +-- +GitLab + diff --git a/package/tiff/0002-fix-tiffmedian-bug.patch b/package/tiff/0002-fix-tiffmedian-bug.patch new file mode 100644 index 0000000000..880bade7d8 --- /dev/null +++ b/package/tiff/0002-fix-tiffmedian-bug.patch @@ -0,0 +1,31 @@ +From ce46f002eca4148497363f80fab33f9396bcbeda Mon Sep 17 00:00:00 2001 +From: Lee Howard +Date: Sat, 24 May 2025 21:25:16 -0700 +Subject: [PATCH] Fix tiffmedian bug #707 + +Upstream: https://gitlab.com/libtiff/libtiff/-/merge_requests/727/diffs?commit_id=ce46f002eca4148497363f80fab33f9396bcbeda +CVE: CVE-2025-8176 +Signed-off-by: Thomas Perale +--- + tools/tiffmedian.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/tiffmedian.c b/tools/tiffmedian.c +index f6cf26c2c..8c9978bab 100644 +--- a/tools/tiffmedian.c ++++ b/tools/tiffmedian.c +@@ -414,7 +414,10 @@ static void get_histogram(TIFF *in, Colorbox *box) + for (i = 0; i < imagelength; i++) + { + if (TIFFReadScanline(in, inputline, i, 0) <= 0) +- break; ++ { ++ fprintf(stderr, "Error reading scanline\n"); ++ exit(EXIT_FAILURE); ++ } + inptr = inputline; + for (j = imagewidth; j-- > 0;) + { +-- +GitLab + diff --git a/package/tiff/0003-conflict-resolution.patch b/package/tiff/0003-conflict-resolution.patch new file mode 100644 index 0000000000..0c16aa3271 --- /dev/null +++ b/package/tiff/0003-conflict-resolution.patch @@ -0,0 +1,28 @@ +From ecc4ddbf1f0fed7957d1e20361e37f01907898e0 Mon Sep 17 00:00:00 2001 +From: Lee Howard +Date: Sat, 24 May 2025 21:38:09 -0700 +Subject: [PATCH] conflict resolution + +Upstream: https://gitlab.com/libtiff/libtiff/-/merge_requests/727/diffs?commit_id=ecc4ddbf1f0fed7957d1e20361e37f01907898e0 +CVE: CVE-2025-8176 +Signed-off-by: Thomas Perale +--- + tools/tiffmedian.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/tiffmedian.c b/tools/tiffmedian.c +index 8c9978bab..47e0524bc 100644 +--- a/tools/tiffmedian.c ++++ b/tools/tiffmedian.c +@@ -920,7 +920,7 @@ static void quant_fsdither(TIFF *in, TIFF *out) + outline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out)); + + GetInputLine(in, 0, goto bad); /* get first line */ +- for (i = 0; i <= imagelength; ++i) ++ for (i = 0; i < imagelength; ++i) + { + SWAP(short *, thisline, nextline); + lastline = (i >= imax); +-- +GitLab + diff --git a/package/tiff/tiff.mk b/package/tiff/tiff.mk index 5d7219d7da..bd95fdca7f 100644 --- a/package/tiff/tiff.mk +++ b/package/tiff/tiff.mk @@ -13,6 +13,9 @@ TIFF_CPE_ID_VENDOR = libtiff TIFF_CPE_ID_PRODUCT = libtiff TIFF_INSTALL_STAGING = YES +# 0001-don-t-skip-the-first-line-of-the-input-image.patch, 0002-fix-tiffmedian-bug.patch, 0003-conflict-resolution.patch +TIFF_IGNORE_CVES += CVE-2025-8176 + # webp has a (optional) dependency on tiff, so we can't have webp # support in tiff, or that would create a circular dependency. TIFF_CONF_OPTS = \