rpms/libtiff
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import Oracle_OSS libtiff-4.6.0-6.el10_1.3

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-04-30 11:38:40 -04:00
parent 12a4229786
commit 9ac8ac46f6
2 changed files with 48 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
libtiff-4.6.0-CVE-2026-4775.patch Normal file
View File

@ -0,0 +1,40 @@
diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
index 4543dddaefd9818494635f3912c8b22f772e6ba9..fa82d09105490cca6720a5dd934c51f19052ebe0 100644
--- a/libtiff/tif_getimage.c
+++ b/libtiff/tif_getimage.c
@@ -2224,7 +2224,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr44tile)
uint32_t *cp1 = cp + w + toskew;
uint32_t *cp2 = cp1 + w + toskew;
uint32_t *cp3 = cp2 + w + toskew;
- int32_t incr = 3 * w + 4 * toskew;
+ const tmsize_t incr = 3 * (tmsize_t)w + 4 * (tmsize_t)toskew;
(void)y;
/* adjust fromskew */
@@ -2364,7 +2364,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr44tile)
DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
{
uint32_t *cp1 = cp + w + toskew;
- int32_t incr = 2 * toskew + w;
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
(void)y;
fromskew = (fromskew / 4) * (4 * 2 + 2);
@@ -2522,7 +2522,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr41tile)
DECLAREContigPutFunc(putcontig8bitYCbCr22tile)
{
uint32_t *cp2;
- int32_t incr = 2 * toskew + w;
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
(void)y;
fromskew = (fromskew / 2) * (2 * 2 + 2);
cp2 = cp + w + toskew;
@@ -2625,7 +2625,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr21tile)
DECLAREContigPutFunc(putcontig8bitYCbCr12tile)
{
uint32_t *cp2;
- int32_t incr = 2 * toskew + w;
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
(void)y;
fromskew = (fromskew / 1) * (1 * 2 + 2);
cp2 = cp + w + toskew;

9
libtiff.spec
View File

@ -1,7 +1,7 @@
Summary: Library of functions for manipulating TIFF format image files
Name: libtiff
Version: 4.6.0
Release: 6%{?dist}.2
Release: 6%{?dist}.3
License: libtiff
URL: http://www.simplesystems.org/libtiff/
@ -17,6 +17,9 @@ Patch2: RHEL-112524.patch
# from upstream, for <=4.6.0, RHEL-148254
# https://gitlab.com/libtiff/libtiff/-/merge_requests/546.patch
Patch3: libtiff-4.6.0-CVE-2023-52356.patch
# from upstream, for <= 4.7.1, RHEL-159309
# https://gitlab.com/libtiff/libtiff/-/commit/782a11d6b5b61c6dc21e714950a4af5bf89f023c
Patch4: libtiff-4.6.0-CVE-2026-4775.patch
BuildRequires: gcc, gcc-c++
BuildRequires: zlib-devel libjpeg-devel jbigkit-devel libzstd-devel libwebp-devel liblerc-devel
@ -71,6 +74,7 @@ image files using the libtiff library.
%patch -P 1 -p1 -b .CVE-2024-7006
%patch -P 2 -p1 -b .RHEL-112524
%patch -P 3 -p1 -b .CVE-2023-52356
%patch -P 4 -p1 -b .CVE-2026-4775
# Use build system's libtool.m4, not the one in the package.
rm -f libtool.m4
@ -169,6 +173,9 @@ LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH make check
%{_mandir}/man1/*
%changelog
* Mon Apr 20 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-6.3
- fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159309)
* Wed Mar 11 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-6.2
- fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-148254)