#181 CVE-2024-28566/28571/28572/28583: TIFF AssignPixel, JPEG src, MakerNote, XBM

[Daniel Rosser]

Applies to FreeImage SVN trunk r1911 (also 3.19.0 [r1909]).

One patch covering the remaining issue #35 FreeImage-own group (GitHub PR #99 / commit 8ebe8e5):

• CVE-2024-28566 — AssignPixel() overflow reading TIFF. Contig/planar copies walked dst_pitch / src_line without stopping at image width or remaining source-row bytes (PluginTIFF.cpp). Helpers AssignContigRow / AssignPlanarRow now stop at both bounds. (NVD text says TIFF; this is FreeImage glue, not libtiff.)
• CVE-2024-28571 — fill_input_buffer() OOB/UAF in PluginJPEG.cpp's libjpeg source manager. jpeg_destroy() must not run before JPEG_EXIT (jpeg_error_exit already destroys); empty src->buffer is rejected; skip_input_data returns if fill produced no bytes.
• CVE-2024-28572 — FreeImage_SetTagValue() heap overflow via Canon MakerNote. processCanonMakerNoteTag() only expands real SHORT/SSHORT camera-state tags and caps the loop at min(count, length/2). FreeImage_SetTagValue() also rejects type_width==0 and count*width overflow.
• CVE-2024-28583 — NVD says XPM readLine(); readLine() actually lives in PluginXBM.cpp. It treated n as a character count then wrote str[n]=NUL, overflowing char line[MAX_LINE]. n is now the buffer size. PluginXPM.cpp also snprintfs the unknown-color error so a long name cannot smash msg[256].

Apply AFTER CVE-2024-28567.patch (TIFF ICC) and CVE-2024-28568.patch (they touch PluginTIFF.cpp / Exif.cpp / PluginXPM.cpp too).

NVD:
https://nvd.nist.gov/vuln/detail/CVE-2024-28566
https://nvd.nist.gov/vuln/detail/CVE-2024-28571
https://nvd.nist.gov/vuln/detail/CVE-2024-28572
https://nvd.nist.gov/vuln/detail/CVE-2024-28583

GitHub: https://github.com/danoli3/FreeImage/commit/8ebe8e5 (PR https://github.com/danoli3/FreeImage/pull/99)

Apply from the FreeImage tree root:

patch -p0 < CVE-2024-28566.patch

[Daniel Rosser]

@drolon ARCH Linux has removed FreeImage due to CVE's Please apply these patches