diff --git a/backport-CVE-2019-9278.patch b/backport-CVE-2019-9278.patch new file mode 100644 index 0000000..106fc44 --- /dev/null +++ b/backport-CVE-2019-9278.patch @@ -0,0 +1,86 @@ +From 75aa73267fdb1e0ebfbc00369e7312bac43d0566 Mon Sep 17 00:00:00 2001 +From: Marcus Meissner +Date: Sat, 18 Jan 2020 09:29:42 +0100 +Subject: [PATCH] fix CVE-2019-9278 + +avoid the use of unsafe integer overflow checking constructs (unsigned integer operations cannot overflow, so "u1 + u2 > u1" can be optimized away) + +check for the actual sizes, which should also handle the overflows +document other places google patched, but do not seem relevant due to other restrictions + +fixes https://github.com/libexif/libexif/issues/26 +--- + libexif/exif-data.c | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/libexif/exif-data.c b/libexif/exif-data.c +index a6f9c94f..6332cd1a 100644 +--- a/libexif/exif-data.c ++++ b/libexif/exif-data.c +@@ -192,9 +192,15 @@ exif_data_load_data_entry (ExifData *data, ExifEntry *entry, + doff = offset + 8; + + /* Sanity checks */ +- if ((doff + s < doff) || (doff + s < s) || (doff + s > size)) { ++ if (doff >= size) { + exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", +- "Tag data past end of buffer (%u > %u)", doff+s, size); ++ "Tag starts past end of buffer (%u > %u)", doff, size); ++ return 0; ++ } ++ ++ if (s > size - doff) { ++ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", ++ "Tag data goes past end of buffer (%u > %u)", doff+s, size); + return 0; + } + +@@ -315,13 +321,14 @@ exif_data_load_data_thumbnail (ExifData *data, const unsigned char *d, + unsigned int ds, ExifLong o, ExifLong s) + { + /* Sanity checks */ +- if ((o + s < o) || (o + s < s) || (o + s > ds) || (o > ds)) { +- exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", +- "Bogus thumbnail offset (%u) or size (%u).", +- o, s); ++ if (o >= ds) { ++ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail offset (%u).", o); ++ return; ++ } ++ if (s > ds - o) { ++ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail size (%u), max would be %u.", s, ds-o); + return; + } +- + if (data->data) + exif_mem_free (data->priv->mem, data->data); + if (!(data->data = exif_data_alloc (data, s))) { +@@ -947,7 +954,7 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, + exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", + "IFD 0 at %i.", (int) offset); + +- /* Sanity check the offset, being careful about overflow */ ++ /* ds is restricted to 16 bit above, so offset is restricted too, and offset+8 should not overflow. */ + if (offset > ds || offset + 6 + 2 > ds) + return; + +@@ -956,6 +963,7 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, + + /* IFD 1 offset */ + n = exif_get_short (d + 6 + offset, data->priv->order); ++ /* offset < 2<<16, n is 16 bit at most, so this op will not overflow */ + if (offset + 6 + 2 + 12 * n + 4 > ds) + return; + +@@ -964,8 +972,8 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, + exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", + "IFD 1 at %i.", (int) offset); + +- /* Sanity check. */ +- if (offset > ds || offset + 6 > ds) { ++ /* Sanity check. ds is ensured to be above 6 above, offset is 16bit */ ++ if (offset > ds - 6) { + exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, + "ExifData", "Bogus offset of IFD1."); + } else { + diff --git a/backport-CVE-2020-0093.patch b/backport-CVE-2020-0093.patch new file mode 100644 index 0000000..a1e0619 --- /dev/null +++ b/backport-CVE-2020-0093.patch @@ -0,0 +1,34 @@ +From 5ae5973bed1947f4d447dc80b76d5cefadd90133 Mon Sep 17 00:00:00 2001 +From: Marcus Meissner +Date: Sat, 16 May 2020 16:47:42 +0200 +Subject: [PATCH] libexif: Fix read buffer overflow (CVE-2020-0093) + +Make sure the number of bytes being copied from doesn't exceed the +source buffer size. + +From Android repo: +https://android.googlesource.com/platform/external/libexif/+/0335ffc17f9b9a4831c242bb08ea92f605fde7a6%5E%21/#F0 + +Test: testPocBug_148705132 +Bug: 148705132 + +fixes https://github.com/libexif/libexif/issues/42 +--- + libexif/exif-data.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/libexif/exif-data.c b/libexif/exif-data.c +index 6332cd1a..65ae93d5 100644 +--- a/libexif/exif-data.c ++++ b/libexif/exif-data.c +@@ -308,7 +308,9 @@ exif_data_save_data_entry (ExifData *data, ExifEntry *e, + /* Write the data. Fill unneeded bytes with 0. Do not crash with + * e->data is NULL */ + if (e->data) { +- memcpy (*d + 6 + doff, e->data, s); ++ unsigned int len = s; ++ if (e->size < s) len = e->size; ++ memcpy (*d + 6 + doff, e->data, len); + } else { + memset (*d + 6 + doff, 0, s); + } diff --git a/backport-CVE-2020-0181_CVE-2020-0198.patch b/backport-CVE-2020-0181_CVE-2020-0198.patch new file mode 100644 index 0000000..04a02e8 --- /dev/null +++ b/backport-CVE-2020-0181_CVE-2020-0198.patch @@ -0,0 +1,58 @@ +From ce03ad7ef4e8aeefce79192bf5b6f69fae396f0c Mon Sep 17 00:00:00 2001 +From: Marcus Meissner +Date: Mon, 8 Jun 2020 17:27:06 +0200 +Subject: [PATCH] fixed another unsigned integer overflow + +first fixed by google in android fork, +https://android.googlesource.com/platform/external/libexif/+/1e187b62682ffab5003c702657d6d725b4278f16%5E%21/#F0 + +(use a more generic overflow check method, also check second overflow instance.) + +https://security-tracker.debian.org/tracker/CVE-2020-0198 +--- + libexif/exif-data.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/libexif/exif-data.c b/libexif/exif-data.c +index 8b280d3a..b495726d 100644 +--- a/libexif/exif-data.c ++++ b/libexif/exif-data.c +@@ -47,6 +47,8 @@ + #undef JPEG_MARKER_APP1 + #define JPEG_MARKER_APP1 0xe1 + ++#define CHECKOVERFLOW(offset,datasize,structsize) (( offset >= datasize) || (structsize > datasize) || (offset > datasize - structsize )) ++ + static const unsigned char ExifHeader[] = {0x45, 0x78, 0x69, 0x66, 0x00, 0x00}; + + struct _ExifDataPrivate +@@ -327,7 +329,7 @@ exif_data_load_data_thumbnail (ExifData *data, const unsigned char *d, + exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail offset (%u).", o); + return; + } +- if (s > ds - o) { ++ if (CHECKOVERFLOW(o,ds,s)) { + exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail size (%u), max would be %u.", s, ds-o); + return; + } +@@ -420,9 +422,9 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd, + } + + /* Read the number of entries */ +- if ((offset + 2 < offset) || (offset + 2 < 2) || (offset + 2 > ds)) { ++ if (CHECKOVERFLOW(offset, ds, 2)) { + exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", +- "Tag data past end of buffer (%u > %u)", offset+2, ds); ++ "Tag data past end of buffer (%u+2 > %u)", offset, ds); + return; + } + n = exif_get_short (d + offset, data->priv->order); +@@ -431,7 +433,7 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd, + offset += 2; + + /* Check if we have enough data. */ +- if (offset + 12 * n > ds) { ++ if (CHECKOVERFLOW(offset, ds, 12*n)) { + n = (ds - offset) / 12; + exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", + "Short data; only loading %hu entries...", n); diff --git a/libexif.spec b/libexif.spec index 38fbf51..13e10fa 100644 --- a/libexif.spec +++ b/libexif.spec @@ -1,7 +1,7 @@ Name: libexif Summary: Library for extracting extra information from image files Version: 0.6.21 -Release: 23 +Release: 24 License: LGPLv2+ URL: https://libexif.github.io/ Source0: https://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.bz2 @@ -18,6 +18,9 @@ Patch6008: backport-CVE-2020-13113.patch Patch6009: backport-CVE-2020-13114.patch Patch9001: libexif-bugfix-integer-overflow-pentax.patch Patch6010: backport-CVE-2020-13112.patch +Patch6011: backport-CVE-2019-9278.patch +Patch6012: backport-CVE-2020-0181_CVE-2020-0198.patch +Patch6013: backport-CVE-2020-0093.patch BuildRequires: autoconf automake doxygen gettext-devel libtool pkgconfig git @@ -75,6 +78,9 @@ make check %doc libexif-api.html NEWS %changelog +* Mon Oct 17 2022 wangkerong - 0.6.21-24 +- fix CVE-2019-9278,CVE-2020-0181,CVE-2020-0198,CVE-2020-0093 + * Tue Sep 28 2021 wangkerong - 0.6.21-23 - Type:CVE - Id:CVE-2020-13112