Patchwork [denzil,02/18] Security Advisory - libexif - CVE-2012-2813

login
mail settings
Submitter Mark Hatle
Date Feb. 7, 2013, 11:56 p.m.
Message ID <4e1b2c3b25f9dcffd220fef7f1e654def7c704cc.1360270199.git.mark.hatle@windriver.com>
Download mbox | patch
Permalink /patch/44267/
State New
Headers show

Comments

Mark Hatle - Feb. 7, 2013, 11:56 p.m.
From: Yue Tao <Yue.Tao@windriver.com>

[ CQID: WIND00366808 ]

The exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF
Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers
to cause a denial of service (out-of-bounds read) or possibly obtain
sensitive information from process memory via crafted EXIF tags in an image.

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
---
 .../libexif/0001-libexif-CVE-2012-2813.patch       | 33 ++++++++++++++++++++++
 meta/recipes-support/libexif/libexif_0.6.20.bb     |  5 +++-
 2 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-support/libexif/libexif/0001-libexif-CVE-2012-2813.patch

Patch

diff --git a/meta/recipes-support/libexif/libexif/0001-libexif-CVE-2012-2813.patch b/meta/recipes-support/libexif/libexif/0001-libexif-CVE-2012-2813.patch
new file mode 100644
index 0000000..fbd0442
--- /dev/null
+++ b/meta/recipes-support/libexif/libexif/0001-libexif-CVE-2012-2813.patch
@@ -0,0 +1,33 @@ 
+Index: libexif/exif-entry.c
+===================================================================
+RCS file: /cvsroot/libexif/libexif/libexif/exif-entry.c,v
+retrieving revision 1.146
+retrieving revision 1.147
+diff -c -u -r1.146 -r1.147
+--- a/libexif/exif-entry.c	12 Jul 2012 17:10:34 -0000	1.146
++++ b/libexif/exif-entry.c	12 Jul 2012 17:12:24 -0000	1.147
+@@ -1346,10 +1346,23 @@
+ 	case EXIF_TAG_XP_AUTHOR:
+ 	case EXIF_TAG_XP_KEYWORDS:
+ 	case EXIF_TAG_XP_SUBJECT:
++	{
++		/* Sanity check the size to prevent overflow */
++		if (e->size+sizeof(unsigned short) < e->size) break;
++
++		/* The tag may not be U+0000-terminated , so make a local
++		   U+0000-terminated copy before converting it */
++		unsigned short *utf16 = exif_mem_alloc (e->priv->mem, e->size+sizeof(unsigned short));
++		if (!utf16) break;
++		memcpy(utf16, e->data, e->size);
++		utf16[e->size/sizeof(unsigned short)] = 0;
++
+ 		/* Warning! The texts are converted from UTF16 to UTF8 */
+ 		/* FIXME: use iconv to convert into the locale encoding */
+-		exif_convert_utf16_to_utf8(val, (unsigned short*)e->data, MIN(maxlen, e->size));
++		exif_convert_utf16_to_utf8(val, utf16, maxlen);
++		exif_mem_free(e->priv->mem, utf16);
+ 		break;
++	}
+ 
+ 	default:
+ 		/* Use a generic value formatting */
diff --git a/meta/recipes-support/libexif/libexif_0.6.20.bb b/meta/recipes-support/libexif/libexif_0.6.20.bb
index f233d3f..a1a1816 100644
--- a/meta/recipes-support/libexif/libexif_0.6.20.bb
+++ b/meta/recipes-support/libexif/libexif_0.6.20.bb
@@ -4,7 +4,10 @@  SECTION = "libs"
 LICENSE = "LGPLv2.1"
 LIC_FILES_CHKSUM = "file://COPYING;md5=243b725d71bb5df4a1e5920b344b86ad"
 
-SRC_URI = "${SOURCEFORGE_MIRROR}/libexif/libexif-${PV}.tar.bz2"
+PR = "r1"
+
+SRC_URI = "${SOURCEFORGE_MIRROR}/libexif/libexif-${PV}.tar.bz2 \
+	  file://0001-libexif-CVE-2012-2813.patch"
 
 SRC_URI[md5sum] = "19844ce6b5d075af16f0d45de1e8a6a3"
 SRC_URI[sha256sum] = "a772d20bd8fb9802d7f0d70fde6ac8872f87d0c66c52b0d14026dafcaa83d715"