rpms/libtiff
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI libtiff-4.6.0-8.el10_2.4

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-07-20 00:28:11 -04:00
parent fe9f458bdb
commit 891e1e2953
5 changed files with 376 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

220
libtiff-4.6.0-CVE-2023-52355.patch Normal file
View File

@ -0,0 +1,220 @@
diff -up tiff-4.6.0/doc/conf.py.CVE-2023-52355 tiff-4.6.0/doc/conf.py
--- tiff-4.6.0/doc/conf.py.CVE-2023-52355 2023-08-16 15:14:23.000000000 +0200
+++ tiff-4.6.0/doc/conf.py 2026-06-03 09:57:30.411829074 +0200
@@ -124,6 +124,7 @@ man_pages = [
('functions/TIFFmemory', 'TIFFmemory', 'memory management-related functions for use with TIFF files', author, '3tiff'),
('functions/TIFFMergeFieldInfo', 'TIFFMergeFieldInfo', 'add application-defined TIFF tags to the list of known libtiff tags', author, '3tiff'),
('functions/TIFFOpen', 'TIFFOpen', 'open a TIFF file for reading or writing', author, '3tiff'),
+ ('functions/TIFFOpenOptions', 'TIFFOpenOptions', 'a structure that can be passed to the TIFF open"Ext" functions to define internal settings', author, '3tiff'),
('functions/TIFFPrintDirectory', 'TIFFPrintDirectory', 'print a description of a TIFF directory', author, '3tiff'),
('functions/TIFFProcFunctions', 'TIFFProcFunctions', 'set TIFF processing functions', author, '3tiff'),
('functions/TIFFquery', 'TIFFquery', 'query routines', author, '3tiff'),
diff -up tiff-4.6.0/doc/functions/TIFFDeferStrileArrayWriting.rst.CVE-2023-52355 tiff-4.6.0/doc/functions/TIFFDeferStrileArrayWriting.rst
--- tiff-4.6.0/doc/functions/TIFFDeferStrileArrayWriting.rst.CVE-2023-52355 2023-05-22 15:49:02.000000000 +0200
+++ tiff-4.6.0/doc/functions/TIFFDeferStrileArrayWriting.rst 2026-06-03 09:52:37.234152512 +0200
@@ -61,6 +61,11 @@ Diagnostics
All error messages are directed to the :c:func:`TIFFErrorExtR` routine.
Likewise, warning messages are directed to the :c:func:`TIFFWarningExtR` routine.
+Note
+----
+
+This functionality was introduced with libtiff 4.1.
+
See also
--------
diff -up tiff-4.6.0/doc/functions/TIFFError.rst.CVE-2023-52355 tiff-4.6.0/doc/functions/TIFFError.rst
--- tiff-4.6.0/doc/functions/TIFFError.rst.CVE-2023-52355 2023-05-22 15:49:02.000000000 +0200
+++ tiff-4.6.0/doc/functions/TIFFError.rst 2026-06-03 09:52:37.234305928 +0200
@@ -65,6 +65,9 @@ or :c:func:`TIFFClientOpenExt`.
Furthermore, a **custom defined data structure** *user_data* for the
error handler can be given along.
+Please refer to :doc:`/functions/TIFFOpenOptions` for how to setup the
+application-specific handler introduced with libtiff 4.5.
+
Note
----
diff -up tiff-4.6.0/doc/functions/TIFFOpenOptions.rst.CVE-2023-52355 tiff-4.6.0/doc/functions/TIFFOpenOptions.rst
--- tiff-4.6.0/doc/functions/TIFFOpenOptions.rst.CVE-2023-52355 2023-05-22 15:49:02.000000000 +0200
+++ tiff-4.6.0/doc/functions/TIFFOpenOptions.rst 2026-06-03 09:52:37.234592473 +0200
@@ -38,12 +38,17 @@ opaque structure and returns a :c:type:`
:c:func:`TIFFOpenOptionsFree` releases the allocated memory for
:c:type:`TIFFOpenOptions`. The allocated memory for :c:type:`TIFFOpenOptions`
can be released straight after successful execution of the related
-TIFF open"Ext" functions like :c:func:`TIFFOpenExt`.
+TIFFOpen"Ext" functions like :c:func:`TIFFOpenExt`.
:c:func:`TIFFOpenOptionsSetMaxSingleMemAlloc` sets parameter for the
maximum single memory limit in byte that ``libtiff`` internal memory allocation
functions are allowed to request per call.
+.. note::
+ However, the ``libtiff`` external functions :c:func:`_TIFFmalloc`
+ and :c:func:`_TIFFrealloc` **do not apply** this internal memory
+ allocation limit set by :c:func:`TIFFOpenOptionsSetMaxSingleMemAlloc`!
+
:c:func:`TIFFOpenOptionsSetErrorHandlerExtR` sets the function pointer to
an application-specific and per-TIFF handle (re-entrant) error handler.
Furthermore, a pointer to a **custom defined data structure** *errorhandler_user_data*
@@ -55,6 +60,43 @@ The *errorhandler_user_data* argument ma
:c:func:`TIFFOpenOptionsSetErrorHandlerExtR` but for the warning handler,
which is invoked through :c:func:`TIFFWarningExtR`
+Example
+-------
+
+::
+
+ #include "tiffio.h"
+
+ typedef struct MyErrorHandlerUserDataStruct
+ {
+ /* ... any user data structure ... */
+ } MyErrorHandlerUserDataStruct;
+
+ static int myErrorHandler(TIFF *tiff, void *user_data, const char *module,
+ const char *fmt, va_list ap)
+ {
+ MyErrorHandlerUserDataStruct *errorhandler_user_data =
+ (MyErrorHandlerUserDataStruct *)user_data;
+ /*... code of myErrorHandler ...*/
+ return 1;
+ }
+
+
+ main()
+ {
+ tmsize_t limit = (256 * 1024 * 1024);
+ MyErrorHandlerUserDataStruct user_data = { /* ... any data ... */};
+
+ TIFFOpenOptions *opts = TIFFOpenOptionsAlloc();
+ TIFFOpenOptionsSetMaxSingleMemAlloc(opts, limit);
+ TIFFOpenOptionsSetErrorHandlerExtR(opts, myErrorHandler, &user_data);
+ TIFF *tif = TIFFOpenExt("foo.tif", "r", opts);
+ TIFFOpenOptionsFree(opts);
+ /* ... go on here ... */
+
+ TIFFClose(tif);
+ }
+
Note
----
diff -up tiff-4.6.0/doc/functions/TIFFOpen.rst.CVE-2023-52355 tiff-4.6.0/doc/functions/TIFFOpen.rst
--- tiff-4.6.0/doc/functions/TIFFOpen.rst.CVE-2023-52355 2023-05-22 16:03:41.000000000 +0200
+++ tiff-4.6.0/doc/functions/TIFFOpen.rst 2026-06-03 09:52:37.234439597 +0200
@@ -94,8 +94,9 @@ TIFF structure without closing the file
file should be closed using its file descriptor *fd*.
:c:func:`TIFFOpenExt` (added in libtiff 4.5) is like :c:func:`TIFFOpen`,
-but options, such as re-entrant error and warning handlers may be passed
-with the *opts* argument. The *opts* argument may be NULL.
+but options, such as re-entrant error and warning handlers and a limit in byte
+that libtiff internal memory allocation functions are allowed to request per call
+may be passed with the *opts* argument. The *opts* argument may be NULL.
Refer to :doc:`TIFFOpenOptions` for allocating and filling the *opts* argument
parameters. The allocated memory for :c:type:`TIFFOpenOptions`
can be released straight after successful execution of the related
@@ -105,9 +106,7 @@ can be released straight after successfu
but opens a TIFF file with a Unicode filename.
:c:func:`TIFFFdOpenExt` (added in libtiff 4.5) is like :c:func:`TIFFFdOpen`,
-but options, such as re-entrant error and warning handlers may be passed
-with the *opts* argument. The *opts* argument may be NULL.
-Refer to :doc:`TIFFOpenOptions` for filling the *opts* argument.
+but options argument *opts* like for :c:func:`TIFFOpenExt` can be passed.
:c:func:`TIFFSetFileName` sets the file name in the tif-structure
and returns the old file name.
@@ -326,5 +325,5 @@ See also
:doc:`libtiff` (3tiff),
:doc:`TIFFClose` (3tiff),
-:doc:`TIFFStrileQuery`,
+:doc:`TIFFStrileQuery` (3tiff),
:doc:`TIFFOpenOptions`
\ No newline at end of file
diff -up tiff-4.6.0/doc/functions/TIFFStrileQuery.rst.CVE-2023-52355 tiff-4.6.0/doc/functions/TIFFStrileQuery.rst
--- tiff-4.6.0/doc/functions/TIFFStrileQuery.rst.CVE-2023-52355 2023-05-22 15:49:02.000000000 +0200
+++ tiff-4.6.0/doc/functions/TIFFStrileQuery.rst 2026-06-03 09:52:37.234691247 +0200
@@ -66,6 +66,11 @@ Diagnostics
All error messages are directed to the :c:func:`TIFFErrorExtR` routine.
Likewise, warning messages are directed to the :c:func:`TIFFWarningExtR` routine.
+Note
+----
+
+This functionality was introduced with libtiff 4.1.
+
See also
--------
diff -up tiff-4.6.0/doc/libtiff.rst.CVE-2023-52355 tiff-4.6.0/doc/libtiff.rst
--- tiff-4.6.0/doc/libtiff.rst.CVE-2023-52355 2023-05-22 15:48:36.000000000 +0200
+++ tiff-4.6.0/doc/libtiff.rst 2026-06-03 09:52:37.234832360 +0200
@@ -90,11 +90,15 @@ compatibility on machines with a segment
:c:func:`realloc`, and :c:func:`free` routines in the C library.)
To deal with segmented pointer issues ``libtiff`` also provides
-:c:func:`_TIFFmemcpy`, :c:func:`_TIFFmemset`, and :c:func:`_TIFFmemmove`
+:c:func:`_TIFFmemcpy`, :c:func:`_TIFFmemset`, and :c:func:`_TIFFmemcmp`
routines that mimic the equivalent ANSI C routines, but that are
intended for use with memory allocated through :c:func:`_TIFFmalloc`
and :c:func:`_TIFFrealloc`.
+With ``libtiff`` 4.5 a method was introduced to limit the internal
+memory allocation that functions are allowed to request per call
+(see :c:func:`TIFFOpenOptionsSetMaxSingleMemAlloc` and :c:func:`TIFFOpenExt`).
+
Error Handling
--------------
@@ -106,6 +110,10 @@ routine that can be specified with a cal
Likewise warning messages are directed to a single handler routine
that can be specified with a call to :c:func:`TIFFSetWarningHandler`
+Further application-specific and per-TIFF handle (re-entrant) error handler
+and warning handler can be set. Please refer to :doc:`/functions/TIFFError`
+and :doc:`/functions/TIFFOpenOptions`.
+
Basic File Handling
-------------------
@@ -139,7 +147,7 @@ a ``"w"`` argument:
main()
{
TIFF* tif = TIFFOpen("foo.tif", "w");
- ... do stuff ...
+ /* ... do stuff ... */
TIFFClose(tif);
}
@@ -157,6 +165,25 @@ to always call :c:func:`TIFFClose` or :c
buffered information to a file. Note that if you call :c:func:`TIFFClose`
you do not need to call :c:func:`TIFFFlush`.
+.. warning::
+
+ In order to prevent out-of-memory issues when opening a TIFF file
+ :c:func:`TIFFOpenExt` can be used and then the maximum single memory
+ limit in byte that ``libtiff`` internal memory allocation functions
+ are allowed to request per call can be set with
+ :c:func:`TIFFOpenOptionsSetMaxSingleMemAlloc`.
+
+Example
+
+::
+
+ tmsize_t limit = (256 * 1024 * 1024);
+ TIFFOpenOptions *opts = TIFFOpenOptionsAlloc();
+ TIFFOpenOptionsSetMaxSingleMemAlloc(opts, limit);
+ TIFF *tif = TIFFOpenExt("foo.tif", "w", opts);
+ TIFFOpenOptionsFree(opts);
+ /* ... go on here ... */
+
TIFF Directories
----------------

39
libtiff-4.6.0-cve-2026-12912p1of2.patch Normal file
View File

@ -0,0 +1,39 @@
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
index 8bc1529d7f5e4a20b9e20e637df8e500dd4b0de0..8efd92737bd0954baeec27c7525886cb82fdd39b 100644
--- a/libtiff/tif_pixarlog.c
+++ b/libtiff/tif_pixarlog.c
@@ -876,6 +876,19 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
llen = sp->stride * td->td_imagewidth;
+ /* Fix: ABGR with stride=3 expands 3 samples to 4 output bytes per pixel */
+ if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3)
+ {
+ tmsize_t required = (tmsize_t)td->td_imagewidth * 4;
+ if (occ < required)
+ {
+ TIFFErrorExtR(tif, module,
+ "Output buffer too small for PixarLog ABGR data");
+ memset(op, 0, (size_t)occ);
+ return (0);
+ }
+ }
+
(void)s;
assert(sp != NULL);
@@ -991,7 +1004,13 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
case PIXARLOGDATAFMT_8BITABGR:
horizontalAccumulate8abgr(up, llen, sp->stride,
(unsigned char *)op, sp->ToLinear8);
- op += llen * sizeof(unsigned char);
+
+ /* For stride == 3 (RGB), horizontalAccumulate8abgr expands to 4
+ * bytes/pixel (ABGR) */
+ if (sp->stride == 3)
+ op += (unsigned long)td->td_imagewidth * 4;
+ else
+ op += (unsigned long)llen * sizeof(unsigned char);
break;
default:
TIFFErrorExtR(tif, module, "Unsupported bits/sample: %" PRIu16,

57
libtiff-4.6.0-cve-2026-12912p2of2.patch Normal file
View File

@ -0,0 +1,57 @@
From f9bda11bf2fc819b971517582666d56f18b1bc3f Mon Sep 17 00:00:00 2001
From: waugustus <wangdw.augustus@qq.com>
Date: Thu, 7 May 2026 12:48:42 +0800
Subject: [PATCH] pixarlog: complete ABGR bounds check for multi-row strip
decoding
---
libtiff/tif_pixarlog.c | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
index f35f3fb01..a6f62f18b 100644
--- a/libtiff/tif_pixarlog.c
+++ b/libtiff/tif_pixarlog.c
@@ -880,6 +880,12 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3)
{
tmsize_t required = (tmsize_t)td->td_imagewidth * 4;
+ tmsize_t max_rows;
+ tmsize_t max_nsamples;
+
+ /*
+ * Ensure at least one expanded output row fits.
+ */
if (occ < required)
{
TIFFErrorExtR(tif, module,
@@ -887,6 +893,26 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
memset(op, 0, (size_t)occ);
return (0);
}
+
+ /*
+ * PixarLogDecode() may process multiple rows per call
+ * (e.g. strip decoding). Limit nsamples so the total
+ * output written by the loop below never exceeds occ.
+ */
+ max_rows = occ / required;
+ max_nsamples = max_rows * llen;
+
+ /*
+ * Truncate excess rows to preserve as much decoded data
+ * as possible while avoiding output buffer overflow.
+ */
+ if (nsamples > max_nsamples)
+ {
+ TIFFWarningExtR(tif, module,
+ "PixarLog ABGR decode truncated to avoid "
+ "output buffer overflow");
+ nsamples = max_nsamples;
+ }
}
(void)s;
--
GitLab

31
libtiff-4.6.0-reintroduce-ignore.patch Normal file
View File

@ -0,0 +1,31 @@
diff --git a/tools/tiffcp.c b/tools/tiffcp.c
index ebff4721d9fd2fa9cd3b3f209b88f5ae5e8b6f6a..650544e392a6639ccbcbccd4f913b208ca5c704f 100644
--- a/tools/tiffcp.c
+++ b/tools/tiffcp.c
@@ -221,7 +221,7 @@ int main(int argc, char *argv[])
*mp++ = 'w';
*mp = '\0';
- while ((c = getopt(argc, argv, "m:,:b:c:f:l:o:p:r:w:astBLMC8xh")) != -1)
+ while ((c = getopt(argc, argv, "m:,:b:c:f:l:o:p:r:w:aistBLMC8xh")) != -1)
switch (c)
{
case 'm':
@@ -273,6 +273,9 @@ int main(int argc, char *argv[])
else
usage(EXIT_FAILURE);
break;
+ case 'i': /* ignore errors */
+ ignore = TRUE;
+ break;
case 'l': /* tile length */
outtiled = TRUE;
deftilelength = atoi(optarg);
@@ -567,6 +570,7 @@ static const char usage_info[] =
" -L write little-endian instead of native byte order\n"
" -M disable use of memory-mapped files\n"
" -C disable strip chopping\n"
+ " -i ignore read errors\n"
" -b file[,#] bias (dark) monochrome image to be subtracted from all "
"others\n"
" -,=% use % rather than , to separate image #'s (per Note "

31
libtiff.spec
View File

@ -1,7 +1,7 @@
Summary: Library of functions for manipulating TIFF format image files
Name: libtiff
Version: 4.6.0
Release: 8%{?dist}.1
Release: 8%{?dist}.4
License: libtiff
URL: http://www.simplesystems.org/libtiff/
@ -21,11 +21,22 @@ Patch3: libtiff-4.6.0-CVE-2023-52356.patch
# from upstream, for <= 4.7.1, RHEL-159310
# https://gitlab.com/libtiff/libtiff/-/commit/782a11d6b5b61c6dc21e714950a4af5bf89f023c
Patch4: libtiff-4.6.0-CVE-2026-4775.patch
# from upstream, for < 4.7.0, RHEL-178281
# https://gitlab.com/libtiff/libtiff/-/commit/335947359ce2dd3862cd9f7c49f92eba065dfed4.diff
Patch5: libtiff-4.6.0-CVE-2023-52355.patch
# from upstream, for < 4.7.0, RHEL-185328
# https://gitlab.com/libtiff/libtiff/-/commit/1c3ecce8498f634346a7030b1859faca24e126f5
Patch6: libtiff-4.6.0-reintroduce-ignore.patch
# from upstream, for < 4.7.2, RHEL-189374
# https://gitlab.com/libtiff/libtiff/-/merge_requests/873.diff
Patch7: libtiff-4.6.0-cve-2026-12912p1of2.patch
# https://gitlab.com/libtiff/libtiff/-/commit/f9bda11bf2fc819b971517582666d56f18b1bc3f
Patch8: libtiff-4.6.0-cve-2026-12912p2of2.patch
BuildRequires: gcc, gcc-c++
BuildRequires: zlib-devel libjpeg-devel jbigkit-devel libzstd-devel libwebp-devel liblerc-devel
BuildRequires: libtool automake autoconf pkgconfig
BuildRequires: python3-sphinx
BuildRequires: make
%description
@ -76,6 +87,10 @@ image files using the libtiff library.
%patch -P 2 -p1 -b .cve-2025-9900
%patch -P 3 -p1 -b .CVE-2023-52356
%patch -P 4 -p1 -b .CVE-2026-4775
%patch -P 5 -p1 -b .CVE-2023-52355
%patch -P 6 -p1 -b .reintroduce-ignore
%patch -P 7 -p1 -b .cve-2026-12912p1of2
%patch -P 8 -p1 -b .cve-2026-12912p2of2
# Use build system's libtool.m4, not the one in the package.
rm -f libtool.m4
@ -151,6 +166,8 @@ fi
%check
LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH make check
# make sure man pages were created, as it's needed for CVE-2023-52355
test -s $RPM_BUILD_ROOT%{_mandir}/man3/TIFFOpenOptions.3tiff.gz
%files
%license LICENSE.md
@ -174,6 +191,16 @@ LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH make check
%{_mandir}/man1/*
%changelog
* Mon Jul 13 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-8.4
- fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189374)
- make sure documentation is updated during build for CVE-2023-52355 (RHEL-178281)
* Mon Jun 29 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-8.3
- reintroduce ignore option -i as it is required for tests (RHEL-185328)
* Wed Jun 03 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-8.2
- backport documentation change for CVE-2023-52355 (RHEL-178281)
* Mon May 11 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-8.1
- fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159310)