compat-libtiff3/libtiff-CVE-2026-4775.patch
2026-04-22 13:47:37 +02:00

40 lines
1.3 KiB
Diff

diff -up tiff-3.9.4/libtiff/tif_getimage.c.CVE-2026-4775 tiff-3.9.4/libtiff/tif_getimage.c
--- tiff-3.9.4/libtiff/tif_getimage.c.CVE-2026-4775 2026-04-22 13:16:40.507960671 +0200
+++ tiff-3.9.4/libtiff/tif_getimage.c 2026-04-22 13:19:48.732219288 +0200
@@ -1656,7 +1656,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
uint32* cp1 = cp+w+toskew;
uint32* cp2 = cp1+w+toskew;
uint32* cp3 = cp2+w+toskew;
- int32 incr = 3*w+4*toskew;
+ const int64 incr = 3 * (int64)w + 4 * (int64)toskew;
(void) y;
/* adjust fromskew */
@@ -1751,7 +1751,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
{
uint32* cp1 = cp+w+toskew;
- int32 incr = 2*toskew+w;
+ const int64 incr = 2 * (int64)toskew + w;
(void) y;
fromskew = (fromskew * 10) / 4;
@@ -1873,7 +1873,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
DECLAREContigPutFunc(putcontig8bitYCbCr22tile)
{
uint32* cp2;
- int32 incr = 2*toskew+w;
+ const int64 incr = 2 * (int64)toskew + w;
(void) y;
fromskew = (fromskew / 2) * 6;
cp2 = cp+w+toskew;
@@ -1967,7 +1967,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr2
DECLAREContigPutFunc(putcontig8bitYCbCr12tile)
{
uint32* cp2;
- int32 incr = 2*toskew+w;
+ const int64 incr = 2 * (int64)toskew + w;
(void) y;
fromskew = (fromskew / 2) * 4;
cp2 = cp+w+toskew;