Bug 693394 (CVE-2019-14973) – <media-libs/tiff-4.0.10-r2: Integer overflow in _TIFFCheckMalloc() and other implementation-defined behaviour

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Mattias Nissler 2019-09-03 10:31:12 UTC]

Per https://gitlab.com/libtiff/libtiff/commit/1b5e3b6a23827c33acf19ad50ce5ce78f12b3773 :

_TIFFCheckMalloc()/_TIFFCheckRealloc() used a unsafe way to detect overflow
in the multiplication of nmemb and elem_size (which are of type tmsize_t, thus
signed), which was especially easily triggered on 32-bit builds (with recent
enough compilers that assume that signed multiplication cannot overflow, since
this is undefined behaviour by the C standard). The original issue which lead to
this fix was trigged from tif_fax3.c

There were also unsafe (implementation defied), and broken in practice on 64bit
builds, ways of checking that a uint64 fits of a (signed) tmsize_t by doing
(uint64)(tmsize_t)uint64_var != uint64_var comparisons. Those have no known
at that time exploits, but are better to fix in a more bullet-proof way.
Or similarly use of (int64)uint64_var <= 0.

[Comment 1 Larry the Git Cow 2019-09-03 19:46:07 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6f50c6e9a116c3d950db0cd2e131893aca2f1cf2

commit 6f50c6e9a116c3d950db0cd2e131893aca2f1cf2
Author:     Mattias Nissler <[e-mail]>
AuthorDate: 2019-09-03 10:25:18 +0000
Commit:     Aaron Bauman <[e-mail]>
CommitDate: 2019-09-03 19:45:36 +0000

    media-libs/tiff: Pull in patch for CVE-2019-14973
    
    Bug: https://bugs.gentoo.org/693394
    
    Signed-off-by: Mattias Nissler <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/12851
    Signed-off-by: Aaron Bauman <[e-mail]>

 ....0.10-CVE-2019-14973-fix-integer-overflow.patch | 395 +++++++++++++++++++++
 media-libs/tiff/tiff-4.0.10-r2.ebuild              |  85 +++++
 2 files changed, 480 insertions(+)

[Comment 2 Aaron Bauman (RETIRED) 2019-09-03 19:49:03 UTC]

@arches, please stabilize.

[Comment 3 Aaron Bauman (RETIRED) 2019-09-03 22:51:09 UTC]

arm64 stable

[Comment 4 Mikle Kolyada (RETIRED) 2019-09-04 05:57:52 UTC]

amd64 stable

[Comment 5 Rolf Eike Beer 2019-09-04 17:06:21 UTC]

What kind of runtime testing is required here?

[Comment 6 Agostino Sarubbo 2019-09-05 07:44:46 UTC]

ppc stable

[Comment 7 Agostino Sarubbo 2019-09-05 07:46:08 UTC]

ppc64 stable

[Comment 8 Agostino Sarubbo 2019-09-05 07:46:57 UTC]

s390 stable

[Comment 9 Agostino Sarubbo 2019-09-05 11:35:33 UTC]

sparc stable

[Comment 10 Agostino Sarubbo 2019-09-05 15:14:32 UTC]

x86 stable

[Comment 11 Agostino Sarubbo 2019-09-13 12:05:07 UTC]

ia64 stable

[Comment 12 Sergei Trofimovich (RETIRED) 2019-09-20 06:53:36 UTC]

hppa stable

[Comment 13 Matt Turner 2019-09-21 07:24:02 UTC]

alpha stable

[Comment 14 Mikle Kolyada (RETIRED) 2019-11-03 13:42:29 UTC]

arm stable

[Comment 15 Mikle Kolyada (RETIRED) 2019-11-03 13:42:52 UTC]

m68k stable

[Comment 16 Mikle Kolyada (RETIRED) 2019-11-03 13:43:13 UTC]

sh stable

[Comment 17 Mikle Kolyada (RETIRED) 2019-11-03 13:47:44 UTC]

GLSA vote: No.