Return-Path: <tiff-bounces@lists.maptools.org>
X-Original-To: info@awaresystems.be
Delivered-To: info@awaresystems.be
Received: from mx-i.b-one.net (mx-i.one.com [91.198.169.56])
	by mail9.b-one.net (Postfix) with ESMTP id 9D86840014C
	for <info@awaresystems.be>; Mon,  6 Dec 2010 21:12:55 +0100 (CET)
Received: by mx-i.b-one.net (Postfix, from userid 106)
	id 91CD04718FD9; Mon,  6 Dec 2010 21:12:27 +0100 (CET)
X-Virus-Scanned: by one.com
X-Spam-Flag: NO
X-Spam-Score: 0
X-Spam-Level: 
X-Spam-Status: No, score=0 tagged_above=0 required=4 tests=[none]
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.4
Received: from lists.maptools.org (lists.maptools.org [65.39.174.144]) by
 mx-i.b-one.net (Postfix) with ESMTP id A2D8C4718F7A for
 <info@awaresystems.be>; Mon,  6 Dec 2010 21:12:26 +0100 (CET)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by
 lists.maptools.org (Postfix) with ESMTP id 05CA01D18B0FE; Mon,  6 Dec 2010
 15:11:36 -0500 (EST)
Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130]) by
 lists.maptools.org (Postfix) with ESMTP id EF7911D11BD7F for
 <tiff@lists.maptools.org>; Mon,  6 Dec 2010 15:09:52 -0500 (EST)
Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by
 sss.pgh.pa.us (8.14.2/8.14.2) with ESMTP id oB6K9o24001059; Mon, 6 Dec 2010
 15:09:50 -0500 (EST)
To: Lee Howard <faxguy@howardsilvan.com>
In-reply-to: <4CFD2F2B.5050602@howardsilvan.com> 
References: <AANLkTik8dnMvkDGGPpeiDVsDVzxYsW6Pq6Fq0DkMXu8K@mail.gmail.com>
 <4CFD2F2B.5050602@howardsilvan.com>
Comments: In-reply-to Lee Howard <faxguy@howardsilvan.com> message dated
 "Mon, 06 Dec 2010 10:44:59 -0800"
Date: Mon, 06 Dec 2010 15:09:49 -0500
Message-ID: <1058.1291666189@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
Cc: tiff@lists.maptools.org, imipak <imipak@gmail.com>
Subject: Re: [Tiff] Security vulnerability CVE-2010-3847
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.maptools.org?subject=subscribe>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

Lee Howard <faxguy@howardsilvan.com> writes:
> I've just now committed the in-line patch found on...

> http://bugzilla.maptools.org/show_bug.cgi?id=2228

I find the patch given in #2228 pretty unsatisfactory, as it's
throwing away image quality to produce what seems no better than a
cargo-cult solution to the problem.  Turning off fancy upsampling
doesn't affect the number of output pixels libjpeg produces.  It
would cause it to not *read* adjacent rows for averaging purposes,
but if that causes a segfault then your problem is elsewhere.
It is certainly not fixing the problem explained in #2140, which
is that the required output buffer size is underestimated.

> ... I'm not sure if that small change resolves CVE-2010-3087.  The 
> various distros are using Tom Lane's patch on...

> http://bugzilla.maptools.org/show_bug.cgi?id=2140

> ... as a resolution to CVE-2010-3087.

> You can see on the bug report that Frank seemed to object to Tom's 
> proposal on Bug 2140, so I think for the moment we're stuck there 
> needing some further response from Frank on this.  (Frank?)

For the record, *I* don't much like that patch either :-).  I think it's
OK for the limited purpose of stopping core dumps, but it's far from
resolving all the issues complained of in #2140.

			regards, tom lane
_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
