GraphicsMagick: TIFF: Automate the collection of TIFF attributes...

changeset 9035beaece92 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=9035beaece92
summary: TIFF: Automate the collection of TIFF attributes.  Fixes "Stack-buffer-overflow in _TIFFVGetField.

diffstat:

 ChangeLog                              |    9 ++
 VisualMagick/installer/inc/version.isx |    4 +-
 coders/tiff.c                          |  102 ++++++++++++++++++++------------
 magick/version.h                       |    4 +-
 www/Changelog.html                     |   11 +++
 5 files changed, 87 insertions(+), 43 deletions(-)

diffs (176 lines):

diff -r 1b96682d4021 -r 9035beaece92 ChangeLog
--- a/ChangeLog	Sun May 21 19:52:00 2023 -0500
+++ b/ChangeLog	Mon May 22 20:30:07 2023 -0500
@@ -1,3 +1,12 @@
+2023-05-22  Bob Friesenhahn  <[email protected]>
+
+	* coders/tiff.c (ReadTIFFImage): Automate the collection of TIFF
+	attributes. Fixes oss-fuzz issue 58754
+	"graphicsmagick:coder_BIGTIFF_fuzzer: Stack-buffer-overflow in
+	_TIFFVGetField" and 58758 "graphicsmagick:coder_PTIF_fuzzer:
+	Stack-buffer-overflow in _TIFFVGetField" which occur with the
+	development version of libtiff.
+
 2023-05-21  Bob Friesenhahn  <[email protected]>
 
 	* coders/tiff.c (RegisterTIFFImage): Provide a note regarding
diff -r 1b96682d4021 -r 9035beaece92 VisualMagick/installer/inc/version.isx
--- a/VisualMagick/installer/inc/version.isx	Sun May 21 19:52:00 2023 -0500
+++ b/VisualMagick/installer/inc/version.isx	Mon May 22 20:30:07 2023 -0500
@@ -10,5 +10,5 @@
 
 #define public MagickPackageName "GraphicsMagick"
 #define public MagickPackageVersion "1.4"
-#define public MagickPackageVersionAddendum ".020230521"
-#define public MagickPackageReleaseDate "snapshot-20230521"
+#define public MagickPackageVersionAddendum ".020230522"
+#define public MagickPackageReleaseDate "snapshot-20230522"
diff -r 1b96682d4021 -r 9035beaece92 coders/tiff.c
--- a/coders/tiff.c	Sun May 21 19:52:00 2023 -0500
+++ b/coders/tiff.c	Mon May 22 20:30:07 2023 -0500
@@ -2313,47 +2313,71 @@
           image->scene=pagenumber;
       }
 
-      if (TIFFGetField(tiff,TIFFTAG_ARTIST,&text) == 1)
-        (void) SetImageAttribute(image,"artist",text);
-
-      if (TIFFGetField(tiff,TIFFTAG_COPYRIGHT,&text) == 1) /* TIFFTAG_COPYRIGHT */
-        (void) SetImageAttribute(image,"copyright",text);
-
-      if (TIFFGetField(tiff,TIFFTAG_DATETIME,&text) == 1)
-        (void) SetImageAttribute(image,"timestamp",text);
-
-      if (TIFFGetField(tiff,TIFFTAG_DOCUMENTNAME,&text) == 1)
-        (void) SetImageAttribute(image,"document",text);
-
-      if (TIFFGetField(tiff,TIFFTAG_HOSTCOMPUTER,&text) == 1)
-        (void) SetImageAttribute(image,"hostcomputer",text);
-
-      if (TIFFGetField(tiff,TIFFTAG_IMAGEDESCRIPTION,&text) == 1)
-        (void) SetImageAttribute(image,"comment",text);
-
-      if (TIFFGetField(tiff,TIFFTAG_MAKE,&text) == 1)
-        (void) SetImageAttribute(image,"make",text);
-
-      if (TIFFGetField(tiff,TIFFTAG_MODEL,&text) == 1)
-        (void) SetImageAttribute(image,"model",text);
-
-      if (TIFFGetField(tiff,TIFFTAG_PAGENAME,&text) == 1)
-        (void) SetImageAttribute(image,"label",text);
-
-      if (TIFFGetField(tiff,TIFFTAG_SOFTWARE,&text) == 1)
-        (void) SetImageAttribute(image,"software",text);
-
       /*
-        "Unsupported" tags return two arguments.
+        Convert TIFF tags to text attributes
       */
-      if ((TIFFGetField(tiff,TIFFTAG_OPIIMAGEID,&count,&text) == 1) && (count) && (text != (const char*) NULL))
-        CopySizedFieldToAttribute("imageid",count,text);
-
-      if ((TIFFGetField(tiff,33423,&count,&text) == 1) && (count) && (text != (const char*) NULL))
-        CopySizedFieldToAttribute("kodak-33423",count,text);
-
-      if ((TIFFGetField(tiff,36867,&count,&text) == 1) && (count) && (text != (const char*) NULL))
-        CopySizedFieldToAttribute("kodak-36867",count,text);
+      {
+        static const struct
+        {
+          uint32 tag;
+          const char name[14];
+        } text_tags[] =
+            {
+             { TIFFTAG_ARTIST, "artist" },
+             { TIFFTAG_COPYRIGHT, "copyright" },
+             { TIFFTAG_DATETIME, "timestamp" },
+             { TIFFTAG_DOCUMENTNAME, "document" },
+             { TIFFTAG_HOSTCOMPUTER, "hostcomputer" },
+             { TIFFTAG_IMAGEDESCRIPTION, "comment" },
+             { TIFFTAG_MAKE, "make" },
+             { TIFFTAG_MODEL, "model" },
+             { TIFFTAG_PAGENAME, "label" },
+             { TIFFTAG_SOFTWARE, "software" },
+#if 0
+             { TIFFTAG_OPIIMAGEID, "imageid" }, /* Causes TIFFFieldWithTag() to return NULL */
+#endif
+             { 33423, "kodak-33423" },
+             { 36867, "kodak-36867" }
+            };
+
+        for (i = 0; i < ArraySize(text_tags); i++)
+          {
+            const uint32 tag = text_tags[i].tag;
+            const char *tag_name = text_tags[i].name;
+            int field_passcount;
+#if TIFFLIB_VERSION <= 20111221
+             /*
+               Before tiff 4.0.0 (20111221), TIFFFieldWithTag returned
+               TIFFFieldInfo * which provides field_passcount
+             */
+            const TIFFFieldInfo* tiff_field=TIFFFieldWithTag(tiff,tag);
+            field_passcount=tiff_field->field_passcount;
+#else
+            const TIFFField *tiff_field=TIFFFieldWithTag(tiff,tag);
+            if (tiff_field == (const TIFFField *) NULL)
+              {
+                (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                      "TIFFFieldWithTag() returns NULL for tag %u \"%s\"", tag, tag_name);
+                continue;
+              }
+            field_passcount=TIFFFieldPassCount(tiff_field);
+#endif
+#if 0
+            (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                  "Field pass count for tag %u \"%s\" is %d", tag, tag_name, field_passcount);
+#endif
+            if (field_passcount)
+              {
+                if ((TIFFGetField(tiff,tag,&count,&text) == 1) && (count) && (text != (const char*) NULL))
+                  CopySizedFieldToAttribute(tag_name,count,text);
+              }
+            else
+              {
+                if ((TIFFGetField(tiff,tag,&text) == 1) && (text != (const char*) NULL))
+                  (void) SetImageAttribute(image,tag_name,text);
+              }
+          }
+      }
 
       if ((photometric == PHOTOMETRIC_PALETTE) ||
           ((photometric == PHOTOMETRIC_MINISWHITE ||
diff -r 1b96682d4021 -r 9035beaece92 magick/version.h
--- a/magick/version.h	Sun May 21 19:52:00 2023 -0500
+++ b/magick/version.h	Mon May 22 20:30:07 2023 -0500
@@ -38,8 +38,8 @@
 #define MagickLibVersion  0x272402
 #define MagickLibVersionText  "1.4"
 #define MagickLibVersionNumber 27,24,2
-#define MagickChangeDate   "20230521"
-#define MagickReleaseDate  "snapshot-20230521"
+#define MagickChangeDate   "20230522"
+#define MagickReleaseDate  "snapshot-20230522"
 
 /*
   The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines
diff -r 1b96682d4021 -r 9035beaece92 www/Changelog.html
--- a/www/Changelog.html	Sun May 21 19:52:00 2023 -0500
+++ b/www/Changelog.html	Mon May 22 20:30:07 2023 -0500
@@ -37,6 +37,17 @@
 </div>
 
 <div class="document">
+<p>2023-05-22  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+<ul class="simple">
+<li><p>coders/tiff.c (ReadTIFFImage): Automate the collection of TIFF
+attributes. Fixes oss-fuzz issue 58754
+&quot;graphicsmagick:coder_BIGTIFF_fuzzer: Stack-buffer-overflow in
+_TIFFVGetField&quot; and 58758 &quot;graphicsmagick:coder_PTIF_fuzzer:
+Stack-buffer-overflow in _TIFFVGetField&quot; which occur with the
+development version of libtiff.</p></li>
+</ul>
+</blockquote>
 <p>2023-05-21  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 <ul class="simple">