Star0
11
代码
代码
Issues
Pull Requests1
项目讨论
Wiki
分析
Star0
11
已开启
fix(cve): 修复 CVE-2026-12912 在 libtiff 中的漏洞 #346
infra_team创建于 6月30日
fix(cve): 修复 CVE-2026-12912 在 libtiff 中的漏洞 #346
已开启
infra_team创建于 6月30日
从infra_team/libtifffix-CVE-2026-12912-master合入到src-openeuler/libtiffmaster
共 3 个文件变更+101-1
Abackport-CVE-2026-12912-01.patch+61-0
@@ -0,0 +1,61 @@
1+From ba2b04b114c5dd945107ccc613cedfcca3af73bb Mon Sep 17 00:00:00 2001
2+From: libtiff upstream <libtiff@gitlab.com>
3+Date: Fri, 25 Apr 2026 00:00:00 +0000
4+Subject: [PATCH 1/2] fix: CVE-2026-12912 - fix heap buffer overflow in PixarLogDecode ABGR mode
5+ 
6+fix: CVE-2026-12912 - PixarLogDecode: fix heap buffer overflow when stride==3
7+ 
8+When horizontalAccumulate8abgr is called with stride==3 (RGB input),
9+it expands each 3-component pixel into 4 output bytes (ABGR). However,
10+the output pointer `op` was only advanced by `llen * sizeof(unsigned char)`
11+which equals stride*width bytes, while the actual data written is
12+(width*4) bytes. This mismatch causes a heap buffer overflow.
13+ 
14+Fix by: 1) adding a buffer size check when stride==3 and 2) advancing
15+op by (imagewidth * 4) instead of llen when stride==3.
16+ 
17+Origin: https://gitlab.com/libtiff/libtiff/-/commit/ba2b04b114c5dd945107ccc613cedfcca3af73bb
18+Upstream-commit: https://gitlab.com/libtiff/libtiff/-/commit/ba2b04b114c5dd945107ccc613cedfcca3af73bb
19+Signed-off-by: infra_team <zhaiwenjie1@huawei.com>
20+---
21+ libtiff/tif_pixarlog.c | 17 ++++++++++++++++-
22+ 1 file changed, 16 insertions(+), 1 deletion(-)
23+ 
24+diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
25+index 8bc1529d7f5e..184661445225 100644
26+--- a/libtiff/tif_pixarlog.c
27++++ b/libtiff/tif_pixarlog.c
28+@@ -863,6 +863,19 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
29+ 
30+ llen = sp->stride * td->td_imagewidth;
31+ 
32++ /* Fix: ABGR with stride=3 expands 3 samples to 4 output bytes per pixel */
33++ if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3)
34++ {
35++ tmsize_t required = (tmsize_t)td->td_imagewidth * 4;
36++ if (occ < required)
37++ {
38++ TIFFErrorExtR(tif, module,
39++ "Output buffer too small for PixarLog ABGR data");
40++ memset(op, 0, (size_t)occ);
41++ return (0);
42++ }
43++ }
44++
45+ (void)s;
46+ assert(sp != NULL);
47+ 
48+@@ -978,7 +991,10 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
49+ case PIXARLOGDATAFMT_8BITABGR:
50+ horizontalAccumulate8abgr(up, llen, sp->stride,
51+ (unsigned char *)op, sp->ToLinear8);
52+- op += llen * sizeof(unsigned char);
53++ if (sp->stride == 3)
54++ op += (unsigned long)td->td_imagewidth * 4;
55++ else
56++ op += (unsigned long)llen * sizeof(unsigned char);
57+ break;
58+ default:
59+ TIFFErrorExtR(tif, module, "Unsupported bits/sample: %" PRIu16,
60+--
61+2.43.0
Abackport-CVE-2026-12912-02.patch+34-0
@@ -0,0 +1,34 @@
1+From 51fa6dfe93f20da0d38f079fbc61c7c960bcbc16 Mon Sep 17 00:00:00 2001
2+From: libtiff upstream <libtiff@gitlab.com>
3+Date: Fri, 25 Apr 2026 00:00:00 +0000
4+Subject: [PATCH 2/2] fix: CVE-2026-12912 - add comment for ABGR stride==3 pointer advance
5+ 
6+fix: CVE-2026-12912 - add explanatory comment for stride==3 ABGR expansion
7+ 
8+Add a comment clarifying why the pointer advance is different for
9+stride==3: horizontalAccumulate8abgr expands 3-component RGB input
10+to 4 bytes/pixel (ABGR) output.
11+ 
12+Origin: https://gitlab.com/libtiff/libtiff/-/commit/51fa6dfe93f20da0d38f079fbc61c7c960bcbc16
13+Upstream-commit: https://gitlab.com/libtiff/libtiff/-/commit/51fa6dfe93f20da0d38f079fbc61c7c960bcbc16
14+Signed-off-by: infra_team <zhaiwenjie1@huawei.com>
15+---
16+ libtiff/tif_pixarlog.c | 3 +++
17+ 1 file changed, 3 insertions(+)
18+ 
19+diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
20+index 184661445225..8efd92737bd0 100644
21+--- a/libtiff/tif_pixarlog.c
22++++ b/libtiff/tif_pixarlog.c
23+@@ -991,6 +991,9 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
24+ case PIXARLOGDATAFMT_8BITABGR:
25+ horizontalAccumulate8abgr(up, llen, sp->stride,
26+ (unsigned char *)op, sp->ToLinear8);
27++
28++ /* For stride == 3 (RGB), horizontalAccumulate8abgr expands to 4
29++ * bytes/pixel (ABGR) */
30+ if (sp->stride == 3)
31+ op += (unsigned long)td->td_imagewidth * 4;
32+ else
33+--
34+2.43.0
Mlibtiff.spec+6-1
@@ -1,6 +1,6 @@
1Name: libtiff1Name: libtiff
2Version: 4.7.12Version: 4.7.1
3-Release: 33+Release: 4
4Summary: TIFF Library and Utilities4Summary: TIFF Library and Utilities
5License: libtiff5License: libtiff
6URL: https://libtiff.gitlab.io/libtiff/6URL: https://libtiff.gitlab.io/libtiff/
@@ -9,6 +9,8 @@ Source0: https://download.osgeo.org/libtiff/tiff-%{version}.tar.xz
9Patch6000: backport-CVE-2026-4775.patch9Patch6000: backport-CVE-2026-4775.patch
10Patch6001: backport-0001-CVE-2026-36849.patch10Patch6001: backport-0001-CVE-2026-36849.patch
11Patch6002: backport-0002-CVE-2026-36849.patch11Patch6002: backport-0002-CVE-2026-36849.patch
12+Patch6003: backport-CVE-2026-12912-01.patch
13+Patch6004: backport-CVE-2026-12912-02.patch
12 14 
13BuildRequires: gcc gcc-c++15BuildRequires: gcc gcc-c++
14BuildRequires: zlib-devel16BuildRequires: zlib-devel
@@ -120,6 +122,9 @@ LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH %make_build check
120%doc TODO ChangeLog doc122%doc TODO ChangeLog doc
121 123 
122%changelog124%changelog
125+* Tue Jun 30 2026 infra_team <zhaiwenjie1@huawei.com> - 4.7.1-4
126+- fix CVE-2026-12912: fix heap buffer overflow in PixarLogDecode ABGR mode
127+ 
123* Thu Jun 18 2026 lingsheng <ultra_planet@qq.com> - 4.7.1-3128* Thu Jun 18 2026 lingsheng <ultra_planet@qq.com> - 4.7.1-3
124- fix CVE-2026-36849129- fix CVE-2026-36849
125 130