diff --git a/libtiff-4.6.0-CVE-2023-52355.patch b/libtiff-4.6.0-CVE-2023-52355.patch new file mode 100644 index 0000000..49906c8 --- /dev/null +++ b/libtiff-4.6.0-CVE-2023-52355.patch @@ -0,0 +1,220 @@ +diff -up tiff-4.6.0/doc/conf.py.CVE-2023-52355 tiff-4.6.0/doc/conf.py +--- tiff-4.6.0/doc/conf.py.CVE-2023-52355 2023-08-16 15:14:23.000000000 +0200 ++++ tiff-4.6.0/doc/conf.py 2026-06-03 09:57:30.411829074 +0200 +@@ -124,6 +124,7 @@ man_pages = [ + ('functions/TIFFmemory', 'TIFFmemory', 'memory management-related functions for use with TIFF files', author, '3tiff'), + ('functions/TIFFMergeFieldInfo', 'TIFFMergeFieldInfo', 'add application-defined TIFF tags to the list of known libtiff tags', author, '3tiff'), + ('functions/TIFFOpen', 'TIFFOpen', 'open a TIFF file for reading or writing', author, '3tiff'), ++ ('functions/TIFFOpenOptions', 'TIFFOpenOptions', 'a structure that can be passed to the TIFF open"Ext" functions to define internal settings', author, '3tiff'), + ('functions/TIFFPrintDirectory', 'TIFFPrintDirectory', 'print a description of a TIFF directory', author, '3tiff'), + ('functions/TIFFProcFunctions', 'TIFFProcFunctions', 'set TIFF processing functions', author, '3tiff'), + ('functions/TIFFquery', 'TIFFquery', 'query routines', author, '3tiff'), +diff -up tiff-4.6.0/doc/functions/TIFFDeferStrileArrayWriting.rst.CVE-2023-52355 tiff-4.6.0/doc/functions/TIFFDeferStrileArrayWriting.rst +--- tiff-4.6.0/doc/functions/TIFFDeferStrileArrayWriting.rst.CVE-2023-52355 2023-05-22 15:49:02.000000000 +0200 ++++ tiff-4.6.0/doc/functions/TIFFDeferStrileArrayWriting.rst 2026-06-03 09:52:37.234152512 +0200 +@@ -61,6 +61,11 @@ Diagnostics + All error messages are directed to the :c:func:`TIFFErrorExtR` routine. + Likewise, warning messages are directed to the :c:func:`TIFFWarningExtR` routine. + ++Note ++---- ++ ++This functionality was introduced with libtiff 4.1. ++ + See also + -------- + +diff -up tiff-4.6.0/doc/functions/TIFFError.rst.CVE-2023-52355 tiff-4.6.0/doc/functions/TIFFError.rst +--- tiff-4.6.0/doc/functions/TIFFError.rst.CVE-2023-52355 2023-05-22 15:49:02.000000000 +0200 ++++ tiff-4.6.0/doc/functions/TIFFError.rst 2026-06-03 09:52:37.234305928 +0200 +@@ -65,6 +65,9 @@ or :c:func:`TIFFClientOpenExt`. + Furthermore, a **custom defined data structure** *user_data* for the + error handler can be given along. + ++Please refer to :doc:`/functions/TIFFOpenOptions` for how to setup the ++application-specific handler introduced with libtiff 4.5. ++ + Note + ---- + +diff -up tiff-4.6.0/doc/functions/TIFFOpenOptions.rst.CVE-2023-52355 tiff-4.6.0/doc/functions/TIFFOpenOptions.rst +--- tiff-4.6.0/doc/functions/TIFFOpenOptions.rst.CVE-2023-52355 2023-05-22 15:49:02.000000000 +0200 ++++ tiff-4.6.0/doc/functions/TIFFOpenOptions.rst 2026-06-03 09:52:37.234592473 +0200 +@@ -38,12 +38,17 @@ opaque structure and returns a :c:type:` + :c:func:`TIFFOpenOptionsFree` releases the allocated memory for + :c:type:`TIFFOpenOptions`. The allocated memory for :c:type:`TIFFOpenOptions` + can be released straight after successful execution of the related +-TIFF open"Ext" functions like :c:func:`TIFFOpenExt`. ++TIFFOpen"Ext" functions like :c:func:`TIFFOpenExt`. + + :c:func:`TIFFOpenOptionsSetMaxSingleMemAlloc` sets parameter for the + maximum single memory limit in byte that ``libtiff`` internal memory allocation + functions are allowed to request per call. + ++.. note:: ++ However, the ``libtiff`` external functions :c:func:`_TIFFmalloc` ++ and :c:func:`_TIFFrealloc` **do not apply** this internal memory ++ allocation limit set by :c:func:`TIFFOpenOptionsSetMaxSingleMemAlloc`! ++ + :c:func:`TIFFOpenOptionsSetErrorHandlerExtR` sets the function pointer to + an application-specific and per-TIFF handle (re-entrant) error handler. + Furthermore, a pointer to a **custom defined data structure** *errorhandler_user_data* +@@ -55,6 +60,43 @@ The *errorhandler_user_data* argument ma + :c:func:`TIFFOpenOptionsSetErrorHandlerExtR` but for the warning handler, + which is invoked through :c:func:`TIFFWarningExtR` + ++Example ++------- ++ ++:: ++ ++ #include "tiffio.h" ++ ++ typedef struct MyErrorHandlerUserDataStruct ++ { ++ /* ... any user data structure ... */ ++ } MyErrorHandlerUserDataStruct; ++ ++ static int myErrorHandler(TIFF *tiff, void *user_data, const char *module, ++ const char *fmt, va_list ap) ++ { ++ MyErrorHandlerUserDataStruct *errorhandler_user_data = ++ (MyErrorHandlerUserDataStruct *)user_data; ++ /*... code of myErrorHandler ...*/ ++ return 1; ++ } ++ ++ ++ main() ++ { ++ tmsize_t limit = (256 * 1024 * 1024); ++ MyErrorHandlerUserDataStruct user_data = { /* ... any data ... */}; ++ ++ TIFFOpenOptions *opts = TIFFOpenOptionsAlloc(); ++ TIFFOpenOptionsSetMaxSingleMemAlloc(opts, limit); ++ TIFFOpenOptionsSetErrorHandlerExtR(opts, myErrorHandler, &user_data); ++ TIFF *tif = TIFFOpenExt("foo.tif", "r", opts); ++ TIFFOpenOptionsFree(opts); ++ /* ... go on here ... */ ++ ++ TIFFClose(tif); ++ } ++ + Note + ---- + +diff -up tiff-4.6.0/doc/functions/TIFFOpen.rst.CVE-2023-52355 tiff-4.6.0/doc/functions/TIFFOpen.rst +--- tiff-4.6.0/doc/functions/TIFFOpen.rst.CVE-2023-52355 2023-05-22 16:03:41.000000000 +0200 ++++ tiff-4.6.0/doc/functions/TIFFOpen.rst 2026-06-03 09:52:37.234439597 +0200 +@@ -94,8 +94,9 @@ TIFF structure without closing the file + file should be closed using its file descriptor *fd*. + + :c:func:`TIFFOpenExt` (added in libtiff 4.5) is like :c:func:`TIFFOpen`, +-but options, such as re-entrant error and warning handlers may be passed +-with the *opts* argument. The *opts* argument may be NULL. ++but options, such as re-entrant error and warning handlers and a limit in byte ++that libtiff internal memory allocation functions are allowed to request per call ++may be passed with the *opts* argument. The *opts* argument may be NULL. + Refer to :doc:`TIFFOpenOptions` for allocating and filling the *opts* argument + parameters. The allocated memory for :c:type:`TIFFOpenOptions` + can be released straight after successful execution of the related +@@ -105,9 +106,7 @@ can be released straight after successfu + but opens a TIFF file with a Unicode filename. + + :c:func:`TIFFFdOpenExt` (added in libtiff 4.5) is like :c:func:`TIFFFdOpen`, +-but options, such as re-entrant error and warning handlers may be passed +-with the *opts* argument. The *opts* argument may be NULL. +-Refer to :doc:`TIFFOpenOptions` for filling the *opts* argument. ++but options argument *opts* like for :c:func:`TIFFOpenExt` can be passed. + + :c:func:`TIFFSetFileName` sets the file name in the tif-structure + and returns the old file name. +@@ -326,5 +325,5 @@ See also + + :doc:`libtiff` (3tiff), + :doc:`TIFFClose` (3tiff), +-:doc:`TIFFStrileQuery`, ++:doc:`TIFFStrileQuery` (3tiff), + :doc:`TIFFOpenOptions` +\ No newline at end of file +diff -up tiff-4.6.0/doc/functions/TIFFStrileQuery.rst.CVE-2023-52355 tiff-4.6.0/doc/functions/TIFFStrileQuery.rst +--- tiff-4.6.0/doc/functions/TIFFStrileQuery.rst.CVE-2023-52355 2023-05-22 15:49:02.000000000 +0200 ++++ tiff-4.6.0/doc/functions/TIFFStrileQuery.rst 2026-06-03 09:52:37.234691247 +0200 +@@ -66,6 +66,11 @@ Diagnostics + All error messages are directed to the :c:func:`TIFFErrorExtR` routine. + Likewise, warning messages are directed to the :c:func:`TIFFWarningExtR` routine. + ++Note ++---- ++ ++This functionality was introduced with libtiff 4.1. ++ + See also + -------- + +diff -up tiff-4.6.0/doc/libtiff.rst.CVE-2023-52355 tiff-4.6.0/doc/libtiff.rst +--- tiff-4.6.0/doc/libtiff.rst.CVE-2023-52355 2023-05-22 15:48:36.000000000 +0200 ++++ tiff-4.6.0/doc/libtiff.rst 2026-06-03 09:52:37.234832360 +0200 +@@ -90,11 +90,15 @@ compatibility on machines with a segment + :c:func:`realloc`, and :c:func:`free` routines in the C library.) + + To deal with segmented pointer issues ``libtiff`` also provides +-:c:func:`_TIFFmemcpy`, :c:func:`_TIFFmemset`, and :c:func:`_TIFFmemmove` ++:c:func:`_TIFFmemcpy`, :c:func:`_TIFFmemset`, and :c:func:`_TIFFmemcmp` + routines that mimic the equivalent ANSI C routines, but that are + intended for use with memory allocated through :c:func:`_TIFFmalloc` + and :c:func:`_TIFFrealloc`. + ++With ``libtiff`` 4.5 a method was introduced to limit the internal ++memory allocation that functions are allowed to request per call ++(see :c:func:`TIFFOpenOptionsSetMaxSingleMemAlloc` and :c:func:`TIFFOpenExt`). ++ + Error Handling + -------------- + +@@ -106,6 +110,10 @@ routine that can be specified with a cal + Likewise warning messages are directed to a single handler routine + that can be specified with a call to :c:func:`TIFFSetWarningHandler` + ++Further application-specific and per-TIFF handle (re-entrant) error handler ++and warning handler can be set. Please refer to :doc:`/functions/TIFFError` ++and :doc:`/functions/TIFFOpenOptions`. ++ + Basic File Handling + ------------------- + +@@ -139,7 +147,7 @@ a ``"w"`` argument: + main() + { + TIFF* tif = TIFFOpen("foo.tif", "w"); +- ... do stuff ... ++ /* ... do stuff ... */ + TIFFClose(tif); + } + +@@ -157,6 +165,25 @@ to always call :c:func:`TIFFClose` or :c + buffered information to a file. Note that if you call :c:func:`TIFFClose` + you do not need to call :c:func:`TIFFFlush`. + ++.. warning:: ++ ++ In order to prevent out-of-memory issues when opening a TIFF file ++ :c:func:`TIFFOpenExt` can be used and then the maximum single memory ++ limit in byte that ``libtiff`` internal memory allocation functions ++ are allowed to request per call can be set with ++ :c:func:`TIFFOpenOptionsSetMaxSingleMemAlloc`. ++ ++Example ++ ++:: ++ ++ tmsize_t limit = (256 * 1024 * 1024); ++ TIFFOpenOptions *opts = TIFFOpenOptionsAlloc(); ++ TIFFOpenOptionsSetMaxSingleMemAlloc(opts, limit); ++ TIFF *tif = TIFFOpenExt("foo.tif", "w", opts); ++ TIFFOpenOptionsFree(opts); ++ /* ... go on here ... */ ++ + TIFF Directories + ---------------- + diff --git a/libtiff-4.6.0-cve-2026-12912p1of2.patch b/libtiff-4.6.0-cve-2026-12912p1of2.patch new file mode 100644 index 0000000..e3e1d42 --- /dev/null +++ b/libtiff-4.6.0-cve-2026-12912p1of2.patch @@ -0,0 +1,39 @@ +diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c +index 8bc1529d7f5e4a20b9e20e637df8e500dd4b0de0..8efd92737bd0954baeec27c7525886cb82fdd39b 100644 +--- a/libtiff/tif_pixarlog.c ++++ b/libtiff/tif_pixarlog.c +@@ -876,6 +876,19 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s) + + llen = sp->stride * td->td_imagewidth; + ++ /* Fix: ABGR with stride=3 expands 3 samples to 4 output bytes per pixel */ ++ if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3) ++ { ++ tmsize_t required = (tmsize_t)td->td_imagewidth * 4; ++ if (occ < required) ++ { ++ TIFFErrorExtR(tif, module, ++ "Output buffer too small for PixarLog ABGR data"); ++ memset(op, 0, (size_t)occ); ++ return (0); ++ } ++ } ++ + (void)s; + assert(sp != NULL); + +@@ -991,7 +1004,13 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s) + case PIXARLOGDATAFMT_8BITABGR: + horizontalAccumulate8abgr(up, llen, sp->stride, + (unsigned char *)op, sp->ToLinear8); +- op += llen * sizeof(unsigned char); ++ ++ /* For stride == 3 (RGB), horizontalAccumulate8abgr expands to 4 ++ * bytes/pixel (ABGR) */ ++ if (sp->stride == 3) ++ op += (unsigned long)td->td_imagewidth * 4; ++ else ++ op += (unsigned long)llen * sizeof(unsigned char); + break; + default: + TIFFErrorExtR(tif, module, "Unsupported bits/sample: %" PRIu16, diff --git a/libtiff-4.6.0-cve-2026-12912p2of2.patch b/libtiff-4.6.0-cve-2026-12912p2of2.patch new file mode 100644 index 0000000..59e7622 --- /dev/null +++ b/libtiff-4.6.0-cve-2026-12912p2of2.patch @@ -0,0 +1,57 @@ +From f9bda11bf2fc819b971517582666d56f18b1bc3f Mon Sep 17 00:00:00 2001 +From: waugustus +Date: Thu, 7 May 2026 12:48:42 +0800 +Subject: [PATCH] pixarlog: complete ABGR bounds check for multi-row strip + decoding + +--- + libtiff/tif_pixarlog.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c +index f35f3fb01..a6f62f18b 100644 +--- a/libtiff/tif_pixarlog.c ++++ b/libtiff/tif_pixarlog.c +@@ -880,6 +880,12 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s) + if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3) + { + tmsize_t required = (tmsize_t)td->td_imagewidth * 4; ++ tmsize_t max_rows; ++ tmsize_t max_nsamples; ++ ++ /* ++ * Ensure at least one expanded output row fits. ++ */ + if (occ < required) + { + TIFFErrorExtR(tif, module, +@@ -887,6 +893,26 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s) + memset(op, 0, (size_t)occ); + return (0); + } ++ ++ /* ++ * PixarLogDecode() may process multiple rows per call ++ * (e.g. strip decoding). Limit nsamples so the total ++ * output written by the loop below never exceeds occ. ++ */ ++ max_rows = occ / required; ++ max_nsamples = max_rows * llen; ++ ++ /* ++ * Truncate excess rows to preserve as much decoded data ++ * as possible while avoiding output buffer overflow. ++ */ ++ if (nsamples > max_nsamples) ++ { ++ TIFFWarningExtR(tif, module, ++ "PixarLog ABGR decode truncated to avoid " ++ "output buffer overflow"); ++ nsamples = max_nsamples; ++ } + } + + (void)s; +-- +GitLab + diff --git a/libtiff-4.6.0-reintroduce-ignore.patch b/libtiff-4.6.0-reintroduce-ignore.patch new file mode 100644 index 0000000..2ac8bf4 --- /dev/null +++ b/libtiff-4.6.0-reintroduce-ignore.patch @@ -0,0 +1,31 @@ +diff --git a/tools/tiffcp.c b/tools/tiffcp.c +index ebff4721d9fd2fa9cd3b3f209b88f5ae5e8b6f6a..650544e392a6639ccbcbccd4f913b208ca5c704f 100644 +--- a/tools/tiffcp.c ++++ b/tools/tiffcp.c +@@ -221,7 +221,7 @@ int main(int argc, char *argv[]) + + *mp++ = 'w'; + *mp = '\0'; +- while ((c = getopt(argc, argv, "m:,:b:c:f:l:o:p:r:w:astBLMC8xh")) != -1) ++ while ((c = getopt(argc, argv, "m:,:b:c:f:l:o:p:r:w:aistBLMC8xh")) != -1) + switch (c) + { + case 'm': +@@ -273,6 +273,9 @@ int main(int argc, char *argv[]) + else + usage(EXIT_FAILURE); + break; ++ case 'i': /* ignore errors */ ++ ignore = TRUE; ++ break; + case 'l': /* tile length */ + outtiled = TRUE; + deftilelength = atoi(optarg); +@@ -567,6 +570,7 @@ static const char usage_info[] = + " -L write little-endian instead of native byte order\n" + " -M disable use of memory-mapped files\n" + " -C disable strip chopping\n" ++ " -i ignore read errors\n" + " -b file[,#] bias (dark) monochrome image to be subtracted from all " + "others\n" + " -,=% use % rather than , to separate image #'s (per Note " diff --git a/libtiff.spec b/libtiff.spec index 40e58f8..be236b2 100644 --- a/libtiff.spec +++ b/libtiff.spec @@ -1,7 +1,7 @@ Summary: Library of functions for manipulating TIFF format image files Name: libtiff Version: 4.6.0 -Release: 8%{?dist}.1 +Release: 8%{?dist}.4 License: libtiff URL: http://www.simplesystems.org/libtiff/ @@ -21,11 +21,22 @@ Patch3: libtiff-4.6.0-CVE-2023-52356.patch # from upstream, for <= 4.7.1, RHEL-159310 # https://gitlab.com/libtiff/libtiff/-/commit/782a11d6b5b61c6dc21e714950a4af5bf89f023c Patch4: libtiff-4.6.0-CVE-2026-4775.patch +# from upstream, for < 4.7.0, RHEL-178281 +# https://gitlab.com/libtiff/libtiff/-/commit/335947359ce2dd3862cd9f7c49f92eba065dfed4.diff +Patch5: libtiff-4.6.0-CVE-2023-52355.patch +# from upstream, for < 4.7.0, RHEL-185328 +# https://gitlab.com/libtiff/libtiff/-/commit/1c3ecce8498f634346a7030b1859faca24e126f5 +Patch6: libtiff-4.6.0-reintroduce-ignore.patch +# from upstream, for < 4.7.2, RHEL-189374 +# https://gitlab.com/libtiff/libtiff/-/merge_requests/873.diff +Patch7: libtiff-4.6.0-cve-2026-12912p1of2.patch +# https://gitlab.com/libtiff/libtiff/-/commit/f9bda11bf2fc819b971517582666d56f18b1bc3f +Patch8: libtiff-4.6.0-cve-2026-12912p2of2.patch BuildRequires: gcc, gcc-c++ BuildRequires: zlib-devel libjpeg-devel jbigkit-devel libzstd-devel libwebp-devel liblerc-devel BuildRequires: libtool automake autoconf pkgconfig - +BuildRequires: python3-sphinx BuildRequires: make %description @@ -76,6 +87,10 @@ image files using the libtiff library. %patch -P 2 -p1 -b .cve-2025-9900 %patch -P 3 -p1 -b .CVE-2023-52356 %patch -P 4 -p1 -b .CVE-2026-4775 +%patch -P 5 -p1 -b .CVE-2023-52355 +%patch -P 6 -p1 -b .reintroduce-ignore +%patch -P 7 -p1 -b .cve-2026-12912p1of2 +%patch -P 8 -p1 -b .cve-2026-12912p2of2 # Use build system's libtool.m4, not the one in the package. rm -f libtool.m4 @@ -151,6 +166,8 @@ fi %check LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH make check +# make sure man pages were created, as it's needed for CVE-2023-52355 +test -s $RPM_BUILD_ROOT%{_mandir}/man3/TIFFOpenOptions.3tiff.gz %files %license LICENSE.md @@ -174,6 +191,16 @@ LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH make check %{_mandir}/man1/* %changelog +* Mon Jul 13 2026 Michal Hlavinka - 4.6.0-8.4 +- fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189374) +- make sure documentation is updated during build for CVE-2023-52355 (RHEL-178281) + +* Mon Jun 29 2026 Michal Hlavinka - 4.6.0-8.3 +- reintroduce ignore option -i as it is required for tests (RHEL-185328) + +* Wed Jun 03 2026 Michal Hlavinka - 4.6.0-8.2 +- backport documentation change for CVE-2023-52355 (RHEL-178281) + * Mon May 11 2026 Michal Hlavinka - 4.6.0-8.1 - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159310)