Remove compat subpackage
This commit is contained in:
parent
4b69fc85ef
commit
b6f0d3e539
1
.gitignore
vendored
1
.gitignore
vendored
@ -1,2 +1 @@
|
|||||||
/tiff-4.0.2.tar.gz
|
/tiff-4.0.2.tar.gz
|
||||||
/tiff-3.9.6.tar.gz
|
|
||||||
|
@ -1,71 +0,0 @@
|
|||||||
This patch is submitted to upstream for CVE-2012-1173
|
|
||||||
|
|
||||||
|
|
||||||
diff -Naur tiff-3.9.5.orig/libtiff/tif_getimage.c tiff-3.9.5/libtiff/tif_getimage.c
|
|
||||||
--- tiff-3.9.5.orig/libtiff/tif_getimage.c 2010-07-08 12:17:59.000000000 -0400
|
|
||||||
+++ tiff-3.9.5/libtiff/tif_getimage.c 2012-03-14 14:49:25.796728783 -0400
|
|
||||||
@@ -673,18 +673,24 @@
|
|
||||||
unsigned char* p2;
|
|
||||||
unsigned char* pa;
|
|
||||||
tsize_t tilesize;
|
|
||||||
+ tsize_t bufsize;
|
|
||||||
int32 fromskew, toskew;
|
|
||||||
int alpha = img->alpha;
|
|
||||||
uint32 nrow;
|
|
||||||
int ret = 1, flip;
|
|
||||||
|
|
||||||
tilesize = TIFFTileSize(tif);
|
|
||||||
- buf = (unsigned char*) _TIFFmalloc((alpha?4:3)*tilesize);
|
|
||||||
+ bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,tilesize);
|
|
||||||
+ if (bufsize == 0) {
|
|
||||||
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
|
|
||||||
+ return (0);
|
|
||||||
+ }
|
|
||||||
+ buf = (unsigned char*) _TIFFmalloc(bufsize);
|
|
||||||
if (buf == 0) {
|
|
||||||
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
|
|
||||||
return (0);
|
|
||||||
}
|
|
||||||
- _TIFFmemset(buf, 0, (alpha?4:3)*tilesize);
|
|
||||||
+ _TIFFmemset(buf, 0, bufsize);
|
|
||||||
p0 = buf;
|
|
||||||
p1 = p0 + tilesize;
|
|
||||||
p2 = p1 + tilesize;
|
|
||||||
@@ -880,17 +886,23 @@
|
|
||||||
uint32 rowsperstrip, offset_row;
|
|
||||||
uint32 imagewidth = img->width;
|
|
||||||
tsize_t stripsize;
|
|
||||||
+ tsize_t bufsize;
|
|
||||||
int32 fromskew, toskew;
|
|
||||||
int alpha = img->alpha;
|
|
||||||
int ret = 1, flip;
|
|
||||||
|
|
||||||
stripsize = TIFFStripSize(tif);
|
|
||||||
- p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize);
|
|
||||||
+ bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,stripsize);
|
|
||||||
+ if (bufsize == 0) {
|
|
||||||
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
|
|
||||||
+ return (0);
|
|
||||||
+ }
|
|
||||||
+ p0 = buf = (unsigned char *)_TIFFmalloc(bufsize);
|
|
||||||
if (buf == 0) {
|
|
||||||
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
|
|
||||||
return (0);
|
|
||||||
}
|
|
||||||
- _TIFFmemset(buf, 0, (alpha?4:3)*stripsize);
|
|
||||||
+ _TIFFmemset(buf, 0, bufsize);
|
|
||||||
p1 = p0 + stripsize;
|
|
||||||
p2 = p1 + stripsize;
|
|
||||||
pa = (alpha?(p2+stripsize):NULL);
|
|
||||||
diff -Naur tiff-3.9.5.orig/libtiff/tiffiop.h tiff-3.9.5/libtiff/tiffiop.h
|
|
||||||
--- tiff-3.9.5.orig/libtiff/tiffiop.h 2011-03-28 09:43:43.000000000 -0400
|
|
||||||
+++ tiff-3.9.5/libtiff/tiffiop.h 2012-03-14 14:49:25.797728754 -0400
|
|
||||||
@@ -246,7 +246,7 @@
|
|
||||||
#define TIFFroundup(x, y) (TIFFhowmany(x,y)*(y))
|
|
||||||
|
|
||||||
/* Safe multiply which returns zero if there is an integer overflow */
|
|
||||||
-#define TIFFSafeMultiply(t,v,m) ((((t)m != (t)0) && (((t)((v*m)/m)) == (t)v)) ? (t)(v*m) : (t)0)
|
|
||||||
+#define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
|
|
||||||
|
|
||||||
#define TIFFmax(A,B) ((A)>(B)?(A):(B))
|
|
||||||
#define TIFFmin(A,B) ((A)<(B)?(A):(B))
|
|
@ -1,129 +0,0 @@
|
|||||||
Do strip and tile size calculations in unsigned arithmetic, and then
|
|
||||||
complain if the result overflows signed int32, because callers of these
|
|
||||||
functions expect signed results (tsize_t is signed). CVE-2012-2088
|
|
||||||
|
|
||||||
|
|
||||||
diff -Naur tiff-3.9.6.orig/libtiff/tif_strip.c tiff-3.9.6/libtiff/tif_strip.c
|
|
||||||
--- tiff-3.9.6.orig/libtiff/tif_strip.c 2011-01-03 23:31:28.000000000 -0500
|
|
||||||
+++ tiff-3.9.6/libtiff/tif_strip.c 2012-06-28 11:10:17.898083177 -0400
|
|
||||||
@@ -107,6 +107,7 @@
|
|
||||||
TIFFVStripSize(TIFF* tif, uint32 nrows)
|
|
||||||
{
|
|
||||||
TIFFDirectory *td = &tif->tif_dir;
|
|
||||||
+ uint32 stripsize;
|
|
||||||
|
|
||||||
if (nrows == (uint32) -1)
|
|
||||||
nrows = td->td_imagelength;
|
|
||||||
@@ -122,7 +123,7 @@
|
|
||||||
* YCbCr data for the extended image.
|
|
||||||
*/
|
|
||||||
uint16 ycbcrsubsampling[2];
|
|
||||||
- tsize_t w, scanline, samplingarea;
|
|
||||||
+ uint32 w, scanline, samplingarea;
|
|
||||||
|
|
||||||
TIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING,
|
|
||||||
ycbcrsubsampling + 0,
|
|
||||||
@@ -141,13 +142,27 @@
|
|
||||||
nrows = TIFFroundup(nrows, ycbcrsubsampling[1]);
|
|
||||||
/* NB: don't need TIFFhowmany here 'cuz everything is rounded */
|
|
||||||
scanline = multiply(tif, nrows, scanline, "TIFFVStripSize");
|
|
||||||
- return ((tsize_t)
|
|
||||||
- summarize(tif, scanline,
|
|
||||||
- multiply(tif, 2, scanline / samplingarea,
|
|
||||||
- "TIFFVStripSize"), "TIFFVStripSize"));
|
|
||||||
+ /* a zero anywhere in here means overflow, must return zero */
|
|
||||||
+ if (scanline > 0) {
|
|
||||||
+ uint32 extra =
|
|
||||||
+ multiply(tif, 2, scanline / samplingarea,
|
|
||||||
+ "TIFFVStripSize");
|
|
||||||
+ if (extra > 0)
|
|
||||||
+ stripsize = summarize(tif, scanline, extra,
|
|
||||||
+ "TIFFVStripSize");
|
|
||||||
+ else
|
|
||||||
+ stripsize = 0;
|
|
||||||
+ } else
|
|
||||||
+ stripsize = 0;
|
|
||||||
} else
|
|
||||||
- return ((tsize_t) multiply(tif, nrows, TIFFScanlineSize(tif),
|
|
||||||
- "TIFFVStripSize"));
|
|
||||||
+ stripsize = multiply(tif, nrows, TIFFScanlineSize(tif),
|
|
||||||
+ "TIFFVStripSize");
|
|
||||||
+ /* Because tsize_t is signed, we might have conversion overflow */
|
|
||||||
+ if (((tsize_t) stripsize) < 0) {
|
|
||||||
+ TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "Integer overflow in %s", "TIFFVStripSize");
|
|
||||||
+ stripsize = 0;
|
|
||||||
+ }
|
|
||||||
+ return (tsize_t) stripsize;
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
diff -Naur tiff-3.9.6.orig/libtiff/tif_tile.c tiff-3.9.6/libtiff/tif_tile.c
|
|
||||||
--- tiff-3.9.6.orig/libtiff/tif_tile.c 2010-06-08 14:50:43.000000000 -0400
|
|
||||||
+++ tiff-3.9.6/libtiff/tif_tile.c 2012-06-28 11:10:17.899083079 -0400
|
|
||||||
@@ -174,7 +174,7 @@
|
|
||||||
TIFFTileRowSize(TIFF* tif)
|
|
||||||
{
|
|
||||||
TIFFDirectory *td = &tif->tif_dir;
|
|
||||||
- tsize_t rowsize;
|
|
||||||
+ uint32 rowsize;
|
|
||||||
|
|
||||||
if (td->td_tilelength == 0 || td->td_tilewidth == 0)
|
|
||||||
return ((tsize_t) 0);
|
|
||||||
@@ -193,7 +193,7 @@
|
|
||||||
TIFFVTileSize(TIFF* tif, uint32 nrows)
|
|
||||||
{
|
|
||||||
TIFFDirectory *td = &tif->tif_dir;
|
|
||||||
- tsize_t tilesize;
|
|
||||||
+ uint32 tilesize;
|
|
||||||
|
|
||||||
if (td->td_tilelength == 0 || td->td_tilewidth == 0 ||
|
|
||||||
td->td_tiledepth == 0)
|
|
||||||
@@ -209,12 +209,12 @@
|
|
||||||
* horizontal/vertical subsampling area include
|
|
||||||
* YCbCr data for the extended image.
|
|
||||||
*/
|
|
||||||
- tsize_t w =
|
|
||||||
+ uint32 w =
|
|
||||||
TIFFroundup(td->td_tilewidth, td->td_ycbcrsubsampling[0]);
|
|
||||||
- tsize_t rowsize =
|
|
||||||
+ uint32 rowsize =
|
|
||||||
TIFFhowmany8(multiply(tif, w, td->td_bitspersample,
|
|
||||||
"TIFFVTileSize"));
|
|
||||||
- tsize_t samplingarea =
|
|
||||||
+ uint32 samplingarea =
|
|
||||||
td->td_ycbcrsubsampling[0]*td->td_ycbcrsubsampling[1];
|
|
||||||
if (samplingarea == 0) {
|
|
||||||
TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "Invalid YCbCr subsampling");
|
|
||||||
@@ -223,15 +223,27 @@
|
|
||||||
nrows = TIFFroundup(nrows, td->td_ycbcrsubsampling[1]);
|
|
||||||
/* NB: don't need TIFFhowmany here 'cuz everything is rounded */
|
|
||||||
tilesize = multiply(tif, nrows, rowsize, "TIFFVTileSize");
|
|
||||||
- tilesize = summarize(tif, tilesize,
|
|
||||||
- multiply(tif, 2, tilesize / samplingarea,
|
|
||||||
- "TIFFVTileSize"),
|
|
||||||
+ /* a zero anywhere in here means overflow, must return zero */
|
|
||||||
+ if (tilesize > 0) {
|
|
||||||
+ uint32 extra =
|
|
||||||
+ multiply(tif, 2, tilesize / samplingarea,
|
|
||||||
"TIFFVTileSize");
|
|
||||||
+ if (extra > 0)
|
|
||||||
+ tilesize = summarize(tif, tilesize, extra,
|
|
||||||
+ "TIFFVTileSize");
|
|
||||||
+ else
|
|
||||||
+ tilesize = 0;
|
|
||||||
+ }
|
|
||||||
} else
|
|
||||||
tilesize = multiply(tif, nrows, TIFFTileRowSize(tif),
|
|
||||||
"TIFFVTileSize");
|
|
||||||
- return ((tsize_t)
|
|
||||||
- multiply(tif, tilesize, td->td_tiledepth, "TIFFVTileSize"));
|
|
||||||
+ tilesize = multiply(tif, tilesize, td->td_tiledepth, "TIFFVTileSize");
|
|
||||||
+ /* Because tsize_t is signed, we might have conversion overflow */
|
|
||||||
+ if (((tsize_t) tilesize) < 0) {
|
|
||||||
+ TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "Integer overflow in %s", "TIFFVTileSize");
|
|
||||||
+ tilesize = 0;
|
|
||||||
+ }
|
|
||||||
+ return (tsize_t) tilesize;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
@ -1,246 +0,0 @@
|
|||||||
Defend against integer overflow in buffer size calculations within tiff2pdf.
|
|
||||||
(This is committed upstream, but is not yet in any 3.9.x release.)
|
|
||||||
CVE-2012-2113
|
|
||||||
|
|
||||||
|
|
||||||
diff -Naur tiff-3.9.6.orig/tools/tiff2pdf.c tiff-3.9.6/tools/tiff2pdf.c
|
|
||||||
--- tiff-3.9.6.orig/tools/tiff2pdf.c 2010-12-13 20:45:51.000000000 -0500
|
|
||||||
+++ tiff-3.9.6/tools/tiff2pdf.c 2012-06-28 11:07:27.219923327 -0400
|
|
||||||
@@ -431,6 +431,34 @@
|
|
||||||
(void) handle, (void) data, (void) offset;
|
|
||||||
}
|
|
||||||
|
|
||||||
+static uint64
|
|
||||||
+checkAdd64(uint64 summand1, uint64 summand2, T2P* t2p)
|
|
||||||
+{
|
|
||||||
+ uint64 bytes = summand1 + summand2;
|
|
||||||
+
|
|
||||||
+ if (bytes - summand1 != summand2) {
|
|
||||||
+ TIFFError(TIFF2PDF_MODULE, "Integer overflow");
|
|
||||||
+ t2p->t2p_error = T2P_ERR_ERROR;
|
|
||||||
+ bytes = 0;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ return bytes;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static uint64
|
|
||||||
+checkMultiply64(uint64 first, uint64 second, T2P* t2p)
|
|
||||||
+{
|
|
||||||
+ uint64 bytes = first * second;
|
|
||||||
+
|
|
||||||
+ if (second && bytes / second != first) {
|
|
||||||
+ TIFFError(TIFF2PDF_MODULE, "Integer overflow");
|
|
||||||
+ t2p->t2p_error = T2P_ERR_ERROR;
|
|
||||||
+ bytes = 0;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ return bytes;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
/*
|
|
||||||
|
|
||||||
This is the main function.
|
|
||||||
@@ -1773,9 +1801,7 @@
|
|
||||||
tstrip_t i=0;
|
|
||||||
tstrip_t stripcount=0;
|
|
||||||
#endif
|
|
||||||
-#ifdef OJPEG_SUPPORT
|
|
||||||
- tsize_t k = 0;
|
|
||||||
-#endif
|
|
||||||
+ uint64 k = 0;
|
|
||||||
|
|
||||||
if(t2p->pdf_transcode == T2P_TRANSCODE_RAW){
|
|
||||||
#ifdef CCITT_SUPPORT
|
|
||||||
@@ -1803,19 +1829,25 @@
|
|
||||||
}
|
|
||||||
stripcount=TIFFNumberOfStrips(input);
|
|
||||||
for(i=0;i<stripcount;i++){
|
|
||||||
- k += sbc[i];
|
|
||||||
+ k = checkAdd64(k, sbc[i], t2p);
|
|
||||||
}
|
|
||||||
if(TIFFGetField(input, TIFFTAG_JPEGIFOFFSET, &(t2p->tiff_dataoffset))){
|
|
||||||
if(t2p->tiff_dataoffset != 0){
|
|
||||||
if(TIFFGetField(input, TIFFTAG_JPEGIFBYTECOUNT, &(t2p->tiff_datasize))!=0){
|
|
||||||
if(t2p->tiff_datasize < k) {
|
|
||||||
- t2p->pdf_ojpegiflength=t2p->tiff_datasize;
|
|
||||||
- t2p->tiff_datasize+=k;
|
|
||||||
- t2p->tiff_datasize+=6;
|
|
||||||
- t2p->tiff_datasize+=2*stripcount;
|
|
||||||
TIFFWarning(TIFF2PDF_MODULE,
|
|
||||||
"Input file %s has short JPEG interchange file byte count",
|
|
||||||
TIFFFileName(input));
|
|
||||||
+ t2p->pdf_ojpegiflength=t2p->tiff_datasize;
|
|
||||||
+ k = checkAdd64(k, t2p->tiff_datasize, t2p);
|
|
||||||
+ k = checkAdd64(k, 6, t2p);
|
|
||||||
+ k = checkAdd64(k, stripcount, t2p);
|
|
||||||
+ k = checkAdd64(k, stripcount, t2p);
|
|
||||||
+ t2p->tiff_datasize = (tsize_t) k;
|
|
||||||
+ if ((uint64) t2p->tiff_datasize != k) {
|
|
||||||
+ TIFFError(TIFF2PDF_MODULE, "Integer overflow");
|
|
||||||
+ t2p->t2p_error = T2P_ERR_ERROR;
|
|
||||||
+ }
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
return;
|
|
||||||
@@ -1828,9 +1860,14 @@
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
- t2p->tiff_datasize+=k;
|
|
||||||
- t2p->tiff_datasize+=2*stripcount;
|
|
||||||
- t2p->tiff_datasize+=2048;
|
|
||||||
+ k = checkAdd64(k, stripcount, t2p);
|
|
||||||
+ k = checkAdd64(k, stripcount, t2p);
|
|
||||||
+ k = checkAdd64(k, 2048, t2p);
|
|
||||||
+ t2p->tiff_datasize = (tsize_t) k;
|
|
||||||
+ if ((uint64) t2p->tiff_datasize != k) {
|
|
||||||
+ TIFFError(TIFF2PDF_MODULE, "Integer overflow");
|
|
||||||
+ t2p->t2p_error = T2P_ERR_ERROR;
|
|
||||||
+ }
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
@@ -1839,11 +1876,11 @@
|
|
||||||
uint32 count = 0;
|
|
||||||
if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0 ){
|
|
||||||
if(count > 4){
|
|
||||||
- t2p->tiff_datasize += count;
|
|
||||||
- t2p->tiff_datasize -= 2; /* don't use EOI of header */
|
|
||||||
+ k += count;
|
|
||||||
+ k -= 2; /* don't use EOI of header */
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
- t2p->tiff_datasize = 2; /* SOI for first strip */
|
|
||||||
+ k = 2; /* SOI for first strip */
|
|
||||||
}
|
|
||||||
stripcount=TIFFNumberOfStrips(input);
|
|
||||||
if(!TIFFGetField(input, TIFFTAG_STRIPBYTECOUNTS, &sbc)){
|
|
||||||
@@ -1854,18 +1891,33 @@
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
for(i=0;i<stripcount;i++){
|
|
||||||
- t2p->tiff_datasize += sbc[i];
|
|
||||||
- t2p->tiff_datasize -=4; /* don't use SOI or EOI of strip */
|
|
||||||
+ k = checkAdd64(k, sbc[i], t2p);
|
|
||||||
+ k -=4; /* don't use SOI or EOI of strip */
|
|
||||||
+ }
|
|
||||||
+ k = checkAdd64(k, 2, t2p); /* use EOI of last strip */
|
|
||||||
+ t2p->tiff_datasize = (tsize_t) k;
|
|
||||||
+ if ((uint64) t2p->tiff_datasize != k) {
|
|
||||||
+ TIFFError(TIFF2PDF_MODULE, "Integer overflow");
|
|
||||||
+ t2p->t2p_error = T2P_ERR_ERROR;
|
|
||||||
}
|
|
||||||
- t2p->tiff_datasize +=2; /* use EOI of last strip */
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
(void) 0;
|
|
||||||
}
|
|
||||||
- t2p->tiff_datasize=TIFFScanlineSize(input) * t2p->tiff_length;
|
|
||||||
+ k = checkMultiply64(TIFFScanlineSize(input), t2p->tiff_length, t2p);
|
|
||||||
if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){
|
|
||||||
- t2p->tiff_datasize*= t2p->tiff_samplesperpixel;
|
|
||||||
+ k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
|
|
||||||
+ }
|
|
||||||
+ if (k == 0) {
|
|
||||||
+ /* Assume we had overflow inside TIFFScanlineSize */
|
|
||||||
+ t2p->t2p_error = T2P_ERR_ERROR;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ t2p->tiff_datasize = (tsize_t) k;
|
|
||||||
+ if ((uint64) t2p->tiff_datasize != k) {
|
|
||||||
+ TIFFError(TIFF2PDF_MODULE, "Integer overflow");
|
|
||||||
+ t2p->t2p_error = T2P_ERR_ERROR;
|
|
||||||
}
|
|
||||||
|
|
||||||
return;
|
|
||||||
@@ -1883,6 +1935,7 @@
|
|
||||||
#ifdef JPEG_SUPPORT
|
|
||||||
unsigned char* jpt;
|
|
||||||
#endif
|
|
||||||
+ uint64 k;
|
|
||||||
|
|
||||||
edge |= t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile);
|
|
||||||
edge |= t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile);
|
|
||||||
@@ -1894,14 +1947,17 @@
|
|
||||||
#endif
|
|
||||||
){
|
|
||||||
t2p->tiff_datasize=TIFFTileSize(input);
|
|
||||||
+ if (t2p->tiff_datasize == 0) {
|
|
||||||
+ /* Assume we had overflow inside TIFFTileSize */
|
|
||||||
+ t2p->t2p_error = T2P_ERR_ERROR;
|
|
||||||
+ }
|
|
||||||
return;
|
|
||||||
} else {
|
|
||||||
TIFFGetField(input, TIFFTAG_TILEBYTECOUNTS, &tbc);
|
|
||||||
- t2p->tiff_datasize=tbc[tile];
|
|
||||||
+ k=tbc[tile];
|
|
||||||
#ifdef OJPEG_SUPPORT
|
|
||||||
if(t2p->tiff_compression==COMPRESSION_OJPEG){
|
|
||||||
- t2p->tiff_datasize+=2048;
|
|
||||||
- return;
|
|
||||||
+ k = checkAdd64(k, 2048, t2p);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
#ifdef JPEG_SUPPORT
|
|
||||||
@@ -1909,18 +1965,33 @@
|
|
||||||
uint32 count = 0;
|
|
||||||
if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt)!=0){
|
|
||||||
if(count > 4){
|
|
||||||
- t2p->tiff_datasize += count;
|
|
||||||
- t2p->tiff_datasize -= 2; /* don't use EOI of header or SOI of tile */
|
|
||||||
+ k = checkAdd64(k, count, t2p);
|
|
||||||
+ k -= 2; /* don't use EOI of header or SOI of tile */
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
+ t2p->tiff_datasize = (tsize_t) k;
|
|
||||||
+ if ((uint64) t2p->tiff_datasize != k) {
|
|
||||||
+ TIFFError(TIFF2PDF_MODULE, "Integer overflow");
|
|
||||||
+ t2p->t2p_error = T2P_ERR_ERROR;
|
|
||||||
+ }
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
- t2p->tiff_datasize=TIFFTileSize(input);
|
|
||||||
+ k = TIFFTileSize(input);
|
|
||||||
if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){
|
|
||||||
- t2p->tiff_datasize*= t2p->tiff_samplesperpixel;
|
|
||||||
+ k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
|
|
||||||
+ }
|
|
||||||
+ if (k == 0) {
|
|
||||||
+ /* Assume we had overflow inside TIFFTileSize */
|
|
||||||
+ t2p->t2p_error = T2P_ERR_ERROR;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ t2p->tiff_datasize = (tsize_t) k;
|
|
||||||
+ if ((uint64) t2p->tiff_datasize != k) {
|
|
||||||
+ TIFFError(TIFF2PDF_MODULE, "Integer overflow");
|
|
||||||
+ t2p->t2p_error = T2P_ERR_ERROR;
|
|
||||||
}
|
|
||||||
|
|
||||||
return;
|
|
||||||
@@ -2013,6 +2084,10 @@
|
|
||||||
uint32 max_striplength=0;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
+ /* Fail if prior error (in particular, can't trust tiff_datasize) */
|
|
||||||
+ if (t2p->t2p_error != T2P_ERR_OK)
|
|
||||||
+ return(0);
|
|
||||||
+
|
|
||||||
if(t2p->pdf_transcode == T2P_TRANSCODE_RAW){
|
|
||||||
#ifdef CCITT_SUPPORT
|
|
||||||
if(t2p->pdf_compression == T2P_COMPRESS_G4){
|
|
||||||
@@ -2586,6 +2661,10 @@
|
|
||||||
uint32 xuint32=0;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
+ /* Fail if prior error (in particular, can't trust tiff_datasize) */
|
|
||||||
+ if (t2p->t2p_error != T2P_ERR_OK)
|
|
||||||
+ return(0);
|
|
||||||
+
|
|
||||||
edge |= t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile);
|
|
||||||
edge |= t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile);
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
|||||||
diff -Naur tiff-3.9.6.orig/tools/tiff2pdf.c tiff-3.9.6/tools/tiff2pdf.c
|
|
||||||
--- tiff-3.9.6.orig/tools/tiff2pdf.c 2010-12-13 20:45:51.000000000 -0500
|
|
||||||
+++ tiff-3.9.6/tools/tiff2pdf.c 2012-07-05 13:37:20.143798126 -0400
|
|
||||||
@@ -1035,6 +1035,7 @@
|
|
||||||
"Can't set directory %u of input file %s",
|
|
||||||
i,
|
|
||||||
TIFFFileName(input));
|
|
||||||
+ t2p->t2p_error = T2P_ERR_ERROR;
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
if(TIFFGetField(input, TIFFTAG_PAGENUMBER, &pagen, &paged)){
|
|
90
libtiff.spec
90
libtiff.spec
@ -1,34 +1,18 @@
|
|||||||
Summary: Library of functions for manipulating TIFF format image files
|
Summary: Library of functions for manipulating TIFF format image files
|
||||||
Name: libtiff
|
Name: libtiff
|
||||||
Version: 4.0.2
|
Version: 4.0.2
|
||||||
Release: 5%{?dist}
|
Release: 6%{?dist}
|
||||||
|
|
||||||
License: libtiff
|
License: libtiff
|
||||||
Group: System Environment/Libraries
|
Group: System Environment/Libraries
|
||||||
URL: http://www.remotesensing.org/libtiff/
|
URL: http://www.remotesensing.org/libtiff/
|
||||||
|
|
||||||
# This SRPM includes a copy of libtiff 3.9.x, which is provided as a stopgap
|
Source: ftp://ftp.remotesensing.org/pub/libtiff/tiff-%{version}.tar.gz
|
||||||
# measure to satisfy dependencies on libtiff.so.3 until all applications can
|
|
||||||
# be recompiled. The compatibility library is placed in a separate
|
|
||||||
# sub-RPM, libtiff-compat. There is no support for recompiling source code
|
|
||||||
# against the old version.
|
|
||||||
%global prevversion 3.9.6
|
|
||||||
|
|
||||||
Source0: ftp://ftp.remotesensing.org/pub/libtiff/tiff-%{version}.tar.gz
|
|
||||||
|
|
||||||
Source1: ftp://ftp.remotesensing.org/pub/libtiff/tiff-%{prevversion}.tar.gz
|
|
||||||
|
|
||||||
Patch1: libtiff-4.0.2-bigendian.patch
|
Patch1: libtiff-4.0.2-bigendian.patch
|
||||||
Patch2: libtiff-CVE-2012-3401.patch
|
Patch2: libtiff-CVE-2012-3401.patch
|
||||||
Patch3: libtiff-accessors.patch
|
Patch3: libtiff-accessors.patch
|
||||||
|
|
||||||
# these patches are only needed for prevversion:
|
|
||||||
Patch10: libtiff-CVE-2012-1173-3.9.patch
|
|
||||||
Patch11: libtiff-CVE-2012-2088.patch
|
|
||||||
Patch12: libtiff-CVE-2012-2113.patch
|
|
||||||
Patch13: libtiff-CVE-2012-3401-3.9.patch
|
|
||||||
|
|
||||||
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
|
|
||||||
BuildRequires: zlib-devel libjpeg-devel jbigkit-devel
|
BuildRequires: zlib-devel libjpeg-devel jbigkit-devel
|
||||||
BuildRequires: libtool automake autoconf pkgconfig
|
BuildRequires: libtool automake autoconf pkgconfig
|
||||||
|
|
||||||
@ -45,7 +29,7 @@ format image files.
|
|||||||
Summary: Development tools for programs which will use the libtiff library
|
Summary: Development tools for programs which will use the libtiff library
|
||||||
Group: Development/Libraries
|
Group: Development/Libraries
|
||||||
Requires: %{name}%{?_isa} = %{version}-%{release}
|
Requires: %{name}%{?_isa} = %{version}-%{release}
|
||||||
Requires: pkgconfig
|
Requires: pkgconfig%{?_isa}
|
||||||
|
|
||||||
%description devel
|
%description devel
|
||||||
This package contains the header files and documentation necessary for
|
This package contains the header files and documentation necessary for
|
||||||
@ -75,13 +59,6 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
|
|||||||
This package contains command-line programs for manipulating TIFF format
|
This package contains command-line programs for manipulating TIFF format
|
||||||
image files using the libtiff library.
|
image files using the libtiff library.
|
||||||
|
|
||||||
%package compat
|
|
||||||
Summary: Temporary backwards-compatibility copy of old libtiff
|
|
||||||
Group: Development/Libraries
|
|
||||||
|
|
||||||
%description compat
|
|
||||||
This package contains shared libraries (only) for libtiff 3.9.x.
|
|
||||||
|
|
||||||
%prep
|
%prep
|
||||||
%setup -q -n tiff-%{version}
|
%setup -q -n tiff-%{version}
|
||||||
|
|
||||||
@ -98,22 +75,6 @@ automake --add-missing --copy
|
|||||||
autoconf
|
autoconf
|
||||||
autoheader
|
autoheader
|
||||||
|
|
||||||
# And the same for the compatibility package ...
|
|
||||||
tar xfz %{SOURCE1}
|
|
||||||
pushd tiff-%{prevversion}
|
|
||||||
%patch10 -p1
|
|
||||||
%patch11 -p1
|
|
||||||
%patch12 -p1
|
|
||||||
%patch13 -p1
|
|
||||||
# Use build system's libtool.m4, not the one in the package.
|
|
||||||
rm -f libtool.m4
|
|
||||||
libtoolize --force --copy
|
|
||||||
aclocal -I . -I m4
|
|
||||||
automake --add-missing --copy
|
|
||||||
autoconf
|
|
||||||
autoheader
|
|
||||||
popd
|
|
||||||
|
|
||||||
%build
|
%build
|
||||||
export CFLAGS="%{optflags} -fno-strict-aliasing"
|
export CFLAGS="%{optflags} -fno-strict-aliasing"
|
||||||
%configure --enable-ld-version-script
|
%configure --enable-ld-version-script
|
||||||
@ -121,28 +82,7 @@ make %{?_smp_mflags}
|
|||||||
|
|
||||||
LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH make check
|
LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH make check
|
||||||
|
|
||||||
# And the same for the compatibility package ...
|
|
||||||
pushd tiff-%{prevversion}
|
|
||||||
%configure --disable-jbig
|
|
||||||
make %{?_smp_mflags}
|
|
||||||
popd
|
|
||||||
|
|
||||||
%install
|
%install
|
||||||
rm -rf $RPM_BUILD_ROOT
|
|
||||||
|
|
||||||
# install compat package first, then remove unwanted files
|
|
||||||
pushd tiff-%{prevversion}
|
|
||||||
make DESTDIR=$RPM_BUILD_ROOT install
|
|
||||||
rm -rf $RPM_BUILD_ROOT%{_bindir}
|
|
||||||
rm -rf $RPM_BUILD_ROOT%{_includedir}
|
|
||||||
rm -rf $RPM_BUILD_ROOT%{_mandir}
|
|
||||||
rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/
|
|
||||||
rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/libtiff*.pc
|
|
||||||
rm -f $RPM_BUILD_ROOT%{_libdir}/libtiff*.so
|
|
||||||
rm -f $RPM_BUILD_ROOT%{_libdir}/libtiff*.a
|
|
||||||
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
|
|
||||||
popd
|
|
||||||
|
|
||||||
make DESTDIR=$RPM_BUILD_ROOT install
|
make DESTDIR=$RPM_BUILD_ROOT install
|
||||||
|
|
||||||
# remove what we didn't want installed
|
# remove what we didn't want installed
|
||||||
@ -203,24 +143,16 @@ fi
|
|||||||
# don't include documentation Makefiles, they are a multilib hazard
|
# don't include documentation Makefiles, they are a multilib hazard
|
||||||
find html -name 'Makefile*' | xargs rm
|
find html -name 'Makefile*' | xargs rm
|
||||||
|
|
||||||
%clean
|
|
||||||
rm -rf $RPM_BUILD_ROOT
|
|
||||||
|
|
||||||
%post -p /sbin/ldconfig
|
%post -p /sbin/ldconfig
|
||||||
|
|
||||||
%postun -p /sbin/ldconfig
|
%postun -p /sbin/ldconfig
|
||||||
|
|
||||||
%post compat -p /sbin/ldconfig
|
|
||||||
%postun compat -p /sbin/ldconfig
|
|
||||||
|
|
||||||
%files
|
%files
|
||||||
%defattr(-,root,root,0755)
|
|
||||||
%doc COPYRIGHT README RELEASE-DATE VERSION
|
%doc COPYRIGHT README RELEASE-DATE VERSION
|
||||||
%{_libdir}/libtiff.so.5*
|
%{_libdir}/libtiff.so.*
|
||||||
%{_libdir}/libtiffxx.so.5*
|
%{_libdir}/libtiffxx.so.*
|
||||||
|
|
||||||
%files devel
|
%files devel
|
||||||
%defattr(-,root,root,0755)
|
|
||||||
%doc TODO ChangeLog html
|
%doc TODO ChangeLog html
|
||||||
%{_includedir}/*
|
%{_includedir}/*
|
||||||
%{_libdir}/libtiff.so
|
%{_libdir}/libtiff.so
|
||||||
@ -229,20 +161,18 @@ rm -rf $RPM_BUILD_ROOT
|
|||||||
%{_mandir}/man3/*
|
%{_mandir}/man3/*
|
||||||
|
|
||||||
%files static
|
%files static
|
||||||
%defattr(-,root,root)
|
|
||||||
%{_libdir}/*.a
|
%{_libdir}/*.a
|
||||||
|
|
||||||
%files tools
|
%files tools
|
||||||
%defattr(-,root,root,0755)
|
|
||||||
%{_bindir}/*
|
%{_bindir}/*
|
||||||
%{_mandir}/man1/*
|
%{_mandir}/man1/*
|
||||||
|
|
||||||
%files compat
|
|
||||||
%defattr(-,root,root)
|
|
||||||
%{_libdir}/libtiff.so.3*
|
|
||||||
%{_libdir}/libtiffxx.so.3*
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Aug 3 2012 Tom Lane <tgl@redhat.com> 4.0.2-6
|
||||||
|
- Remove compat subpackage; no longer needed
|
||||||
|
- Minor specfile cleanup per suggestions from Tom Callaway
|
||||||
|
Related: #845110
|
||||||
|
|
||||||
* Thu Aug 2 2012 Tom Lane <tgl@redhat.com> 4.0.2-5
|
* Thu Aug 2 2012 Tom Lane <tgl@redhat.com> 4.0.2-5
|
||||||
- Add accessor functions for opaque type TIFFField (backport of not-yet-released
|
- Add accessor functions for opaque type TIFFField (backport of not-yet-released
|
||||||
upstream feature addition; needed to fix freeimage)
|
upstream feature addition; needed to fix freeimage)
|
||||||
|
Loading…
Reference in New Issue
Block a user