Remove compat subpackage
This commit is contained in:
		
							parent
							
								
									4b69fc85ef
								
							
						
					
					
						commit
						b6f0d3e539
					
				
							
								
								
									
										1
									
								
								.gitignore
									
									
									
									
										vendored
									
									
								
							
							
						
						
									
										1
									
								
								.gitignore
									
									
									
									
										vendored
									
									
								
							| @ -1,2 +1 @@ | |||||||
| /tiff-4.0.2.tar.gz | /tiff-4.0.2.tar.gz | ||||||
| /tiff-3.9.6.tar.gz |  | ||||||
|  | |||||||
| @ -1,71 +0,0 @@ | |||||||
| This patch is submitted to upstream for CVE-2012-1173 |  | ||||||
| 
 |  | ||||||
| 
 |  | ||||||
| diff -Naur tiff-3.9.5.orig/libtiff/tif_getimage.c tiff-3.9.5/libtiff/tif_getimage.c
 |  | ||||||
| --- tiff-3.9.5.orig/libtiff/tif_getimage.c	2010-07-08 12:17:59.000000000 -0400
 |  | ||||||
| +++ tiff-3.9.5/libtiff/tif_getimage.c	2012-03-14 14:49:25.796728783 -0400
 |  | ||||||
| @@ -673,18 +673,24 @@
 |  | ||||||
|  	unsigned char* p2; |  | ||||||
|  	unsigned char* pa; |  | ||||||
|  	tsize_t tilesize; |  | ||||||
| +	tsize_t bufsize;
 |  | ||||||
|  	int32 fromskew, toskew; |  | ||||||
|  	int alpha = img->alpha; |  | ||||||
|  	uint32 nrow; |  | ||||||
|  	int ret = 1, flip; |  | ||||||
|   |  | ||||||
|  	tilesize = TIFFTileSize(tif); |  | ||||||
| -	buf = (unsigned char*) _TIFFmalloc((alpha?4:3)*tilesize);
 |  | ||||||
| +	bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,tilesize);
 |  | ||||||
| +	if (bufsize == 0) {
 |  | ||||||
| +		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
 |  | ||||||
| +		return (0);
 |  | ||||||
| +	}
 |  | ||||||
| +	buf = (unsigned char*) _TIFFmalloc(bufsize);
 |  | ||||||
|  	if (buf == 0) { |  | ||||||
|  		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer"); |  | ||||||
|  		return (0); |  | ||||||
|  	} |  | ||||||
| -	_TIFFmemset(buf, 0, (alpha?4:3)*tilesize);
 |  | ||||||
| +	_TIFFmemset(buf, 0, bufsize);
 |  | ||||||
|  	p0 = buf; |  | ||||||
|  	p1 = p0 + tilesize; |  | ||||||
|  	p2 = p1 + tilesize; |  | ||||||
| @@ -880,17 +886,23 @@
 |  | ||||||
|  	uint32 rowsperstrip, offset_row; |  | ||||||
|  	uint32 imagewidth = img->width; |  | ||||||
|  	tsize_t stripsize; |  | ||||||
| +	tsize_t bufsize;
 |  | ||||||
|  	int32 fromskew, toskew; |  | ||||||
|  	int alpha = img->alpha; |  | ||||||
|  	int ret = 1, flip; |  | ||||||
|   |  | ||||||
|  	stripsize = TIFFStripSize(tif); |  | ||||||
| -	p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize);
 |  | ||||||
| +	bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,stripsize);
 |  | ||||||
| +	if (bufsize == 0) {
 |  | ||||||
| +		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
 |  | ||||||
| +		return (0);
 |  | ||||||
| +	}
 |  | ||||||
| +	p0 = buf = (unsigned char *)_TIFFmalloc(bufsize);
 |  | ||||||
|  	if (buf == 0) { |  | ||||||
|  		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer"); |  | ||||||
|  		return (0); |  | ||||||
|  	} |  | ||||||
| -	_TIFFmemset(buf, 0, (alpha?4:3)*stripsize);
 |  | ||||||
| +	_TIFFmemset(buf, 0, bufsize);
 |  | ||||||
|  	p1 = p0 + stripsize; |  | ||||||
|  	p2 = p1 + stripsize; |  | ||||||
|  	pa = (alpha?(p2+stripsize):NULL); |  | ||||||
| diff -Naur tiff-3.9.5.orig/libtiff/tiffiop.h tiff-3.9.5/libtiff/tiffiop.h
 |  | ||||||
| --- tiff-3.9.5.orig/libtiff/tiffiop.h	2011-03-28 09:43:43.000000000 -0400
 |  | ||||||
| +++ tiff-3.9.5/libtiff/tiffiop.h	2012-03-14 14:49:25.797728754 -0400
 |  | ||||||
| @@ -246,7 +246,7 @@
 |  | ||||||
|  #define	TIFFroundup(x, y) (TIFFhowmany(x,y)*(y)) |  | ||||||
|   |  | ||||||
|  /* Safe multiply which returns zero if there is an integer overflow */ |  | ||||||
| -#define TIFFSafeMultiply(t,v,m) ((((t)m != (t)0) && (((t)((v*m)/m)) == (t)v)) ? (t)(v*m) : (t)0)
 |  | ||||||
| +#define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
 |  | ||||||
|   |  | ||||||
|  #define TIFFmax(A,B) ((A)>(B)?(A):(B)) |  | ||||||
|  #define TIFFmin(A,B) ((A)<(B)?(A):(B)) |  | ||||||
| @ -1,129 +0,0 @@ | |||||||
| Do strip and tile size calculations in unsigned arithmetic, and then |  | ||||||
| complain if the result overflows signed int32, because callers of these |  | ||||||
| functions expect signed results (tsize_t is signed).  CVE-2012-2088 |  | ||||||
| 
 |  | ||||||
| 
 |  | ||||||
| diff -Naur tiff-3.9.6.orig/libtiff/tif_strip.c tiff-3.9.6/libtiff/tif_strip.c
 |  | ||||||
| --- tiff-3.9.6.orig/libtiff/tif_strip.c	2011-01-03 23:31:28.000000000 -0500
 |  | ||||||
| +++ tiff-3.9.6/libtiff/tif_strip.c	2012-06-28 11:10:17.898083177 -0400
 |  | ||||||
| @@ -107,6 +107,7 @@
 |  | ||||||
|  TIFFVStripSize(TIFF* tif, uint32 nrows) |  | ||||||
|  { |  | ||||||
|  	TIFFDirectory *td = &tif->tif_dir; |  | ||||||
| +	uint32 stripsize;
 |  | ||||||
|   |  | ||||||
|  	if (nrows == (uint32) -1) |  | ||||||
|  		nrows = td->td_imagelength; |  | ||||||
| @@ -122,7 +123,7 @@
 |  | ||||||
|  		 * YCbCr data for the extended image. |  | ||||||
|  		 */ |  | ||||||
|  		uint16 ycbcrsubsampling[2]; |  | ||||||
| -		tsize_t w, scanline, samplingarea;
 |  | ||||||
| +		uint32 w, scanline, samplingarea;
 |  | ||||||
|   |  | ||||||
|  		TIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING, |  | ||||||
|  				      ycbcrsubsampling + 0, |  | ||||||
| @@ -141,13 +142,27 @@
 |  | ||||||
|  		nrows = TIFFroundup(nrows, ycbcrsubsampling[1]); |  | ||||||
|  		/* NB: don't need TIFFhowmany here 'cuz everything is rounded */ |  | ||||||
|  		scanline = multiply(tif, nrows, scanline, "TIFFVStripSize"); |  | ||||||
| -		return ((tsize_t)
 |  | ||||||
| -		    summarize(tif, scanline,
 |  | ||||||
| -			      multiply(tif, 2, scanline / samplingarea,
 |  | ||||||
| -				       "TIFFVStripSize"), "TIFFVStripSize"));
 |  | ||||||
| +		/* a zero anywhere in here means overflow, must return zero */
 |  | ||||||
| +		if (scanline > 0) {
 |  | ||||||
| +			uint32 extra =
 |  | ||||||
| +			    multiply(tif, 2, scanline / samplingarea,
 |  | ||||||
| +				     "TIFFVStripSize");
 |  | ||||||
| +			if (extra > 0)
 |  | ||||||
| +				stripsize = summarize(tif, scanline, extra,
 |  | ||||||
| +						      "TIFFVStripSize");
 |  | ||||||
| +			else
 |  | ||||||
| +				stripsize = 0;
 |  | ||||||
| +		} else
 |  | ||||||
| +			stripsize = 0;
 |  | ||||||
|  	} else |  | ||||||
| -		return ((tsize_t) multiply(tif, nrows, TIFFScanlineSize(tif),
 |  | ||||||
| -					   "TIFFVStripSize"));
 |  | ||||||
| +		stripsize = multiply(tif, nrows, TIFFScanlineSize(tif),
 |  | ||||||
| +				     "TIFFVStripSize");
 |  | ||||||
| +	/* Because tsize_t is signed, we might have conversion overflow */
 |  | ||||||
| +	if (((tsize_t) stripsize) < 0) {
 |  | ||||||
| +		TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "Integer overflow in %s", "TIFFVStripSize");
 |  | ||||||
| +		stripsize = 0;
 |  | ||||||
| +	}
 |  | ||||||
| +	return (tsize_t) stripsize;
 |  | ||||||
|  } |  | ||||||
|   |  | ||||||
|   |  | ||||||
| diff -Naur tiff-3.9.6.orig/libtiff/tif_tile.c tiff-3.9.6/libtiff/tif_tile.c
 |  | ||||||
| --- tiff-3.9.6.orig/libtiff/tif_tile.c	2010-06-08 14:50:43.000000000 -0400
 |  | ||||||
| +++ tiff-3.9.6/libtiff/tif_tile.c	2012-06-28 11:10:17.899083079 -0400
 |  | ||||||
| @@ -174,7 +174,7 @@
 |  | ||||||
|  TIFFTileRowSize(TIFF* tif) |  | ||||||
|  { |  | ||||||
|  	TIFFDirectory *td = &tif->tif_dir; |  | ||||||
| -	tsize_t rowsize;
 |  | ||||||
| +	uint32 rowsize;
 |  | ||||||
|  	 |  | ||||||
|  	if (td->td_tilelength == 0 || td->td_tilewidth == 0) |  | ||||||
|  		return ((tsize_t) 0); |  | ||||||
| @@ -193,7 +193,7 @@
 |  | ||||||
|  TIFFVTileSize(TIFF* tif, uint32 nrows) |  | ||||||
|  { |  | ||||||
|  	TIFFDirectory *td = &tif->tif_dir; |  | ||||||
| -	tsize_t tilesize;
 |  | ||||||
| +	uint32 tilesize;
 |  | ||||||
|   |  | ||||||
|  	if (td->td_tilelength == 0 || td->td_tilewidth == 0 || |  | ||||||
|  	    td->td_tiledepth == 0) |  | ||||||
| @@ -209,12 +209,12 @@
 |  | ||||||
|  		 * horizontal/vertical subsampling area include |  | ||||||
|  		 * YCbCr data for the extended image. |  | ||||||
|  		 */ |  | ||||||
| -		tsize_t w =
 |  | ||||||
| +		uint32 w =
 |  | ||||||
|  		    TIFFroundup(td->td_tilewidth, td->td_ycbcrsubsampling[0]); |  | ||||||
| -		tsize_t rowsize =
 |  | ||||||
| +		uint32 rowsize =
 |  | ||||||
|  		    TIFFhowmany8(multiply(tif, w, td->td_bitspersample, |  | ||||||
|  					  "TIFFVTileSize")); |  | ||||||
| -		tsize_t samplingarea =
 |  | ||||||
| +		uint32 samplingarea =
 |  | ||||||
|  		    td->td_ycbcrsubsampling[0]*td->td_ycbcrsubsampling[1]; |  | ||||||
|  		if (samplingarea == 0) { |  | ||||||
|  			TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "Invalid YCbCr subsampling"); |  | ||||||
| @@ -223,15 +223,27 @@
 |  | ||||||
|  		nrows = TIFFroundup(nrows, td->td_ycbcrsubsampling[1]); |  | ||||||
|  		/* NB: don't need TIFFhowmany here 'cuz everything is rounded */ |  | ||||||
|  		tilesize = multiply(tif, nrows, rowsize, "TIFFVTileSize"); |  | ||||||
| -		tilesize = summarize(tif, tilesize,
 |  | ||||||
| -				     multiply(tif, 2, tilesize / samplingarea,
 |  | ||||||
| -					      "TIFFVTileSize"),
 |  | ||||||
| +		/* a zero anywhere in here means overflow, must return zero */
 |  | ||||||
| +		if (tilesize > 0) {
 |  | ||||||
| +			uint32 extra =
 |  | ||||||
| +			    multiply(tif, 2, tilesize / samplingarea,
 |  | ||||||
|  				     "TIFFVTileSize"); |  | ||||||
| +			if (extra > 0)
 |  | ||||||
| +				tilesize = summarize(tif, tilesize, extra,
 |  | ||||||
| +						     "TIFFVTileSize");
 |  | ||||||
| +			else
 |  | ||||||
| +				tilesize = 0;
 |  | ||||||
| +		}
 |  | ||||||
|  	} else |  | ||||||
|  		tilesize = multiply(tif, nrows, TIFFTileRowSize(tif), |  | ||||||
|  				    "TIFFVTileSize"); |  | ||||||
| -	return ((tsize_t)
 |  | ||||||
| -	    multiply(tif, tilesize, td->td_tiledepth, "TIFFVTileSize"));
 |  | ||||||
| +	tilesize = multiply(tif, tilesize, td->td_tiledepth, "TIFFVTileSize");
 |  | ||||||
| +	/* Because tsize_t is signed, we might have conversion overflow */
 |  | ||||||
| +	if (((tsize_t) tilesize) < 0) {
 |  | ||||||
| +		TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "Integer overflow in %s", "TIFFVTileSize");
 |  | ||||||
| +		tilesize = 0;
 |  | ||||||
| +	}
 |  | ||||||
| +	return (tsize_t) tilesize;
 |  | ||||||
|  } |  | ||||||
|   |  | ||||||
|  /* |  | ||||||
| @ -1,246 +0,0 @@ | |||||||
| Defend against integer overflow in buffer size calculations within tiff2pdf. |  | ||||||
| (This is committed upstream, but is not yet in any 3.9.x release.) |  | ||||||
| CVE-2012-2113 |  | ||||||
| 
 |  | ||||||
| 
 |  | ||||||
| diff -Naur tiff-3.9.6.orig/tools/tiff2pdf.c tiff-3.9.6/tools/tiff2pdf.c
 |  | ||||||
| --- tiff-3.9.6.orig/tools/tiff2pdf.c	2010-12-13 20:45:51.000000000 -0500
 |  | ||||||
| +++ tiff-3.9.6/tools/tiff2pdf.c	2012-06-28 11:07:27.219923327 -0400
 |  | ||||||
| @@ -431,6 +431,34 @@
 |  | ||||||
|  	(void) handle, (void) data, (void) offset; |  | ||||||
|  } |  | ||||||
|   |  | ||||||
| +static uint64
 |  | ||||||
| +checkAdd64(uint64 summand1, uint64 summand2, T2P* t2p)
 |  | ||||||
| +{
 |  | ||||||
| +	uint64 bytes = summand1 + summand2;
 |  | ||||||
| +
 |  | ||||||
| +	if (bytes - summand1 != summand2) {
 |  | ||||||
| +		TIFFError(TIFF2PDF_MODULE, "Integer overflow");
 |  | ||||||
| +		t2p->t2p_error = T2P_ERR_ERROR;
 |  | ||||||
| +		bytes = 0;
 |  | ||||||
| +	}
 |  | ||||||
| +
 |  | ||||||
| +	return bytes;
 |  | ||||||
| +}
 |  | ||||||
| +
 |  | ||||||
| +static uint64
 |  | ||||||
| +checkMultiply64(uint64 first, uint64 second, T2P* t2p)
 |  | ||||||
| +{
 |  | ||||||
| +	uint64 bytes = first * second;
 |  | ||||||
| +
 |  | ||||||
| +	if (second && bytes / second != first) {
 |  | ||||||
| +		TIFFError(TIFF2PDF_MODULE, "Integer overflow");
 |  | ||||||
| +		t2p->t2p_error = T2P_ERR_ERROR;
 |  | ||||||
| +		bytes = 0;
 |  | ||||||
| +	}
 |  | ||||||
| +
 |  | ||||||
| +	return bytes;
 |  | ||||||
| +}
 |  | ||||||
| +
 |  | ||||||
|  /* |  | ||||||
|   |  | ||||||
|    This is the main function. |  | ||||||
| @@ -1773,9 +1801,7 @@
 |  | ||||||
|  	tstrip_t i=0; |  | ||||||
|  	tstrip_t stripcount=0; |  | ||||||
|  #endif |  | ||||||
| -#ifdef OJPEG_SUPPORT
 |  | ||||||
| -        tsize_t k = 0;
 |  | ||||||
| -#endif
 |  | ||||||
| +        uint64 k = 0;
 |  | ||||||
|   |  | ||||||
|  	if(t2p->pdf_transcode == T2P_TRANSCODE_RAW){ |  | ||||||
|  #ifdef CCITT_SUPPORT |  | ||||||
| @@ -1803,19 +1829,25 @@
 |  | ||||||
|  			} |  | ||||||
|  			stripcount=TIFFNumberOfStrips(input); |  | ||||||
|  			for(i=0;i<stripcount;i++){ |  | ||||||
| -				k += sbc[i];
 |  | ||||||
| +				k = checkAdd64(k, sbc[i], t2p);
 |  | ||||||
|  			} |  | ||||||
|  			if(TIFFGetField(input, TIFFTAG_JPEGIFOFFSET, &(t2p->tiff_dataoffset))){ |  | ||||||
|  				if(t2p->tiff_dataoffset != 0){ |  | ||||||
|  					if(TIFFGetField(input, TIFFTAG_JPEGIFBYTECOUNT, &(t2p->tiff_datasize))!=0){ |  | ||||||
|  						if(t2p->tiff_datasize < k) { |  | ||||||
| -							t2p->pdf_ojpegiflength=t2p->tiff_datasize;
 |  | ||||||
| -							t2p->tiff_datasize+=k;
 |  | ||||||
| -							t2p->tiff_datasize+=6;
 |  | ||||||
| -							t2p->tiff_datasize+=2*stripcount;
 |  | ||||||
|  							TIFFWarning(TIFF2PDF_MODULE,  |  | ||||||
|  								"Input file %s has short JPEG interchange file byte count",  |  | ||||||
|  								TIFFFileName(input)); |  | ||||||
| +							t2p->pdf_ojpegiflength=t2p->tiff_datasize;
 |  | ||||||
| +							k = checkAdd64(k, t2p->tiff_datasize, t2p);
 |  | ||||||
| +							k = checkAdd64(k, 6, t2p);
 |  | ||||||
| +							k = checkAdd64(k, stripcount, t2p);
 |  | ||||||
| +							k = checkAdd64(k, stripcount, t2p);
 |  | ||||||
| +							t2p->tiff_datasize = (tsize_t) k;
 |  | ||||||
| +							if ((uint64) t2p->tiff_datasize != k) {
 |  | ||||||
| +								TIFFError(TIFF2PDF_MODULE, "Integer overflow");
 |  | ||||||
| +								t2p->t2p_error = T2P_ERR_ERROR;
 |  | ||||||
| +							}
 |  | ||||||
|  							return; |  | ||||||
|  						} |  | ||||||
|  						return; |  | ||||||
| @@ -1828,9 +1860,14 @@
 |  | ||||||
|  					} |  | ||||||
|  				} |  | ||||||
|  			} |  | ||||||
| -			t2p->tiff_datasize+=k;
 |  | ||||||
| -			t2p->tiff_datasize+=2*stripcount;
 |  | ||||||
| -			t2p->tiff_datasize+=2048;
 |  | ||||||
| +			k = checkAdd64(k, stripcount, t2p);
 |  | ||||||
| +			k = checkAdd64(k, stripcount, t2p);
 |  | ||||||
| +			k = checkAdd64(k, 2048, t2p);
 |  | ||||||
| +			t2p->tiff_datasize = (tsize_t) k;
 |  | ||||||
| +			if ((uint64) t2p->tiff_datasize != k) {
 |  | ||||||
| +				TIFFError(TIFF2PDF_MODULE, "Integer overflow");
 |  | ||||||
| +				t2p->t2p_error = T2P_ERR_ERROR;
 |  | ||||||
| +			}
 |  | ||||||
|  			return; |  | ||||||
|  		} |  | ||||||
|  #endif |  | ||||||
| @@ -1839,11 +1876,11 @@
 |  | ||||||
|  			uint32 count = 0; |  | ||||||
|  			if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0 ){ |  | ||||||
|  				if(count > 4){ |  | ||||||
| -					t2p->tiff_datasize += count;
 |  | ||||||
| -					t2p->tiff_datasize -= 2; /* don't use EOI of header */
 |  | ||||||
| +					k += count;
 |  | ||||||
| +					k -= 2; /* don't use EOI of header */
 |  | ||||||
|  				} |  | ||||||
|  			} else { |  | ||||||
| -				t2p->tiff_datasize = 2; /* SOI for first strip */
 |  | ||||||
| +				k = 2; /* SOI for first strip */
 |  | ||||||
|  			} |  | ||||||
|  			stripcount=TIFFNumberOfStrips(input); |  | ||||||
|  			if(!TIFFGetField(input, TIFFTAG_STRIPBYTECOUNTS, &sbc)){ |  | ||||||
| @@ -1854,18 +1891,33 @@
 |  | ||||||
|  				return; |  | ||||||
|  			} |  | ||||||
|  			for(i=0;i<stripcount;i++){ |  | ||||||
| -				t2p->tiff_datasize += sbc[i];
 |  | ||||||
| -				t2p->tiff_datasize -=4; /* don't use SOI or EOI of strip */
 |  | ||||||
| +				k = checkAdd64(k, sbc[i], t2p);
 |  | ||||||
| +				k -=4; /* don't use SOI or EOI of strip */
 |  | ||||||
| +			}
 |  | ||||||
| +			k = checkAdd64(k, 2, t2p); /* use EOI of last strip */
 |  | ||||||
| +			t2p->tiff_datasize = (tsize_t) k;
 |  | ||||||
| +			if ((uint64) t2p->tiff_datasize != k) {
 |  | ||||||
| +				TIFFError(TIFF2PDF_MODULE, "Integer overflow");
 |  | ||||||
| +				t2p->t2p_error = T2P_ERR_ERROR;
 |  | ||||||
|  			} |  | ||||||
| -			t2p->tiff_datasize +=2; /* use EOI of last strip */
 |  | ||||||
|  			return; |  | ||||||
|  		} |  | ||||||
|  #endif |  | ||||||
|  		(void) 0; |  | ||||||
|  	} |  | ||||||
| -	t2p->tiff_datasize=TIFFScanlineSize(input) * t2p->tiff_length;
 |  | ||||||
| +	k = checkMultiply64(TIFFScanlineSize(input), t2p->tiff_length, t2p);
 |  | ||||||
|  	if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){ |  | ||||||
| -		t2p->tiff_datasize*= t2p->tiff_samplesperpixel;
 |  | ||||||
| +		k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
 |  | ||||||
| +	}
 |  | ||||||
| +	if (k == 0) {
 |  | ||||||
| +		/* Assume we had overflow inside TIFFScanlineSize */
 |  | ||||||
| +		t2p->t2p_error = T2P_ERR_ERROR;
 |  | ||||||
| +	}
 |  | ||||||
| +
 |  | ||||||
| +	t2p->tiff_datasize = (tsize_t) k;
 |  | ||||||
| +	if ((uint64) t2p->tiff_datasize != k) {
 |  | ||||||
| +		TIFFError(TIFF2PDF_MODULE, "Integer overflow");
 |  | ||||||
| +		t2p->t2p_error = T2P_ERR_ERROR;
 |  | ||||||
|  	} |  | ||||||
|   |  | ||||||
|  	return; |  | ||||||
| @@ -1883,6 +1935,7 @@
 |  | ||||||
|  #ifdef JPEG_SUPPORT |  | ||||||
|  	unsigned char* jpt; |  | ||||||
|  #endif |  | ||||||
| +        uint64 k;
 |  | ||||||
|   |  | ||||||
|  	edge |= t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile); |  | ||||||
|  	edge |= t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile); |  | ||||||
| @@ -1894,14 +1947,17 @@
 |  | ||||||
|  #endif |  | ||||||
|  		){ |  | ||||||
|  			t2p->tiff_datasize=TIFFTileSize(input); |  | ||||||
| +			if (t2p->tiff_datasize == 0) {
 |  | ||||||
| +				/* Assume we had overflow inside TIFFTileSize */
 |  | ||||||
| +				t2p->t2p_error = T2P_ERR_ERROR;
 |  | ||||||
| +			}
 |  | ||||||
|  			return; |  | ||||||
|  		} else { |  | ||||||
|  			TIFFGetField(input, TIFFTAG_TILEBYTECOUNTS, &tbc); |  | ||||||
| -			t2p->tiff_datasize=tbc[tile];
 |  | ||||||
| +			k=tbc[tile];
 |  | ||||||
|  #ifdef OJPEG_SUPPORT |  | ||||||
|  			if(t2p->tiff_compression==COMPRESSION_OJPEG){ |  | ||||||
| -				t2p->tiff_datasize+=2048;
 |  | ||||||
| -				return;
 |  | ||||||
| +			  	k = checkAdd64(k, 2048, t2p);
 |  | ||||||
|  			} |  | ||||||
|  #endif |  | ||||||
|  #ifdef JPEG_SUPPORT |  | ||||||
| @@ -1909,18 +1965,33 @@
 |  | ||||||
|  				uint32 count = 0; |  | ||||||
|  				if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt)!=0){ |  | ||||||
|  					if(count > 4){ |  | ||||||
| -						t2p->tiff_datasize += count;
 |  | ||||||
| -						t2p->tiff_datasize -= 2; /* don't use EOI of header or SOI of tile */
 |  | ||||||
| +						k = checkAdd64(k, count, t2p);
 |  | ||||||
| +						k -= 2; /* don't use EOI of header or SOI of tile */
 |  | ||||||
|  					} |  | ||||||
|  				} |  | ||||||
|  			} |  | ||||||
|  #endif |  | ||||||
| +			t2p->tiff_datasize = (tsize_t) k;
 |  | ||||||
| +			if ((uint64) t2p->tiff_datasize != k) {
 |  | ||||||
| +				TIFFError(TIFF2PDF_MODULE, "Integer overflow");
 |  | ||||||
| +				t2p->t2p_error = T2P_ERR_ERROR;
 |  | ||||||
| +			}
 |  | ||||||
|  			return; |  | ||||||
|  		} |  | ||||||
|  	} |  | ||||||
| -	t2p->tiff_datasize=TIFFTileSize(input);
 |  | ||||||
| +	k = TIFFTileSize(input);
 |  | ||||||
|  	if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){ |  | ||||||
| -		t2p->tiff_datasize*= t2p->tiff_samplesperpixel;
 |  | ||||||
| +		k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
 |  | ||||||
| +	}
 |  | ||||||
| +	if (k == 0) {
 |  | ||||||
| +		/* Assume we had overflow inside TIFFTileSize */
 |  | ||||||
| +		t2p->t2p_error = T2P_ERR_ERROR;
 |  | ||||||
| +	}
 |  | ||||||
| +
 |  | ||||||
| +	t2p->tiff_datasize = (tsize_t) k;
 |  | ||||||
| +	if ((uint64) t2p->tiff_datasize != k) {
 |  | ||||||
| +		TIFFError(TIFF2PDF_MODULE, "Integer overflow");
 |  | ||||||
| +		t2p->t2p_error = T2P_ERR_ERROR;
 |  | ||||||
|  	} |  | ||||||
|   |  | ||||||
|  	return; |  | ||||||
| @@ -2013,6 +2084,10 @@
 |  | ||||||
|  	uint32 max_striplength=0; |  | ||||||
|  #endif |  | ||||||
|   |  | ||||||
| +	/* Fail if prior error (in particular, can't trust tiff_datasize) */
 |  | ||||||
| +	if (t2p->t2p_error != T2P_ERR_OK)
 |  | ||||||
| +		return(0);
 |  | ||||||
| +
 |  | ||||||
|  	if(t2p->pdf_transcode == T2P_TRANSCODE_RAW){ |  | ||||||
|  #ifdef CCITT_SUPPORT |  | ||||||
|  		if(t2p->pdf_compression == T2P_COMPRESS_G4){ |  | ||||||
| @@ -2586,6 +2661,10 @@
 |  | ||||||
|  	uint32 xuint32=0; |  | ||||||
|  #endif |  | ||||||
|   |  | ||||||
| +	/* Fail if prior error (in particular, can't trust tiff_datasize) */
 |  | ||||||
| +	if (t2p->t2p_error != T2P_ERR_OK)
 |  | ||||||
| +		return(0);
 |  | ||||||
| +
 |  | ||||||
|  	edge |= t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile); |  | ||||||
|  	edge |= t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile); |  | ||||||
|   |  | ||||||
| @ -1,11 +0,0 @@ | |||||||
| diff -Naur tiff-3.9.6.orig/tools/tiff2pdf.c tiff-3.9.6/tools/tiff2pdf.c
 |  | ||||||
| --- tiff-3.9.6.orig/tools/tiff2pdf.c	2010-12-13 20:45:51.000000000 -0500
 |  | ||||||
| +++ tiff-3.9.6/tools/tiff2pdf.c	2012-07-05 13:37:20.143798126 -0400
 |  | ||||||
| @@ -1035,6 +1035,7 @@
 |  | ||||||
|  				"Can't set directory %u of input file %s",  |  | ||||||
|  				i, |  | ||||||
|  				TIFFFileName(input)); |  | ||||||
| +			t2p->t2p_error = T2P_ERR_ERROR;
 |  | ||||||
|  			return; |  | ||||||
|  		} |  | ||||||
|  		if(TIFFGetField(input, TIFFTAG_PAGENUMBER, &pagen, &paged)){ |  | ||||||
							
								
								
									
										90
									
								
								libtiff.spec
									
									
									
									
									
								
							
							
						
						
									
										90
									
								
								libtiff.spec
									
									
									
									
									
								
							| @ -1,34 +1,18 @@ | |||||||
| Summary: Library of functions for manipulating TIFF format image files | Summary: Library of functions for manipulating TIFF format image files | ||||||
| Name: libtiff | Name: libtiff | ||||||
| Version: 4.0.2 | Version: 4.0.2 | ||||||
| Release: 5%{?dist} | Release: 6%{?dist} | ||||||
| 
 | 
 | ||||||
| License: libtiff | License: libtiff | ||||||
| Group: System Environment/Libraries | Group: System Environment/Libraries | ||||||
| URL: http://www.remotesensing.org/libtiff/ | URL: http://www.remotesensing.org/libtiff/ | ||||||
| 
 | 
 | ||||||
| # This SRPM includes a copy of libtiff 3.9.x, which is provided as a stopgap | Source: ftp://ftp.remotesensing.org/pub/libtiff/tiff-%{version}.tar.gz | ||||||
| # measure to satisfy dependencies on libtiff.so.3 until all applications can |  | ||||||
| # be recompiled.  The compatibility library is placed in a separate |  | ||||||
| # sub-RPM, libtiff-compat.  There is no support for recompiling source code |  | ||||||
| # against the old version. |  | ||||||
| %global prevversion 3.9.6 |  | ||||||
| 
 |  | ||||||
| Source0: ftp://ftp.remotesensing.org/pub/libtiff/tiff-%{version}.tar.gz |  | ||||||
| 
 |  | ||||||
| Source1: ftp://ftp.remotesensing.org/pub/libtiff/tiff-%{prevversion}.tar.gz |  | ||||||
| 
 | 
 | ||||||
| Patch1: libtiff-4.0.2-bigendian.patch | Patch1: libtiff-4.0.2-bigendian.patch | ||||||
| Patch2: libtiff-CVE-2012-3401.patch | Patch2: libtiff-CVE-2012-3401.patch | ||||||
| Patch3: libtiff-accessors.patch | Patch3: libtiff-accessors.patch | ||||||
| 
 | 
 | ||||||
| # these patches are only needed for prevversion: |  | ||||||
| Patch10: libtiff-CVE-2012-1173-3.9.patch |  | ||||||
| Patch11: libtiff-CVE-2012-2088.patch |  | ||||||
| Patch12: libtiff-CVE-2012-2113.patch |  | ||||||
| Patch13: libtiff-CVE-2012-3401-3.9.patch |  | ||||||
| 
 |  | ||||||
| BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root |  | ||||||
| BuildRequires: zlib-devel libjpeg-devel jbigkit-devel | BuildRequires: zlib-devel libjpeg-devel jbigkit-devel | ||||||
| BuildRequires: libtool automake autoconf pkgconfig | BuildRequires: libtool automake autoconf pkgconfig | ||||||
| 
 | 
 | ||||||
| @ -45,7 +29,7 @@ format image files. | |||||||
| Summary: Development tools for programs which will use the libtiff library | Summary: Development tools for programs which will use the libtiff library | ||||||
| Group: Development/Libraries | Group: Development/Libraries | ||||||
| Requires: %{name}%{?_isa} = %{version}-%{release} | Requires: %{name}%{?_isa} = %{version}-%{release} | ||||||
| Requires: pkgconfig | Requires: pkgconfig%{?_isa} | ||||||
| 
 | 
 | ||||||
| %description devel | %description devel | ||||||
| This package contains the header files and documentation necessary for | This package contains the header files and documentation necessary for | ||||||
| @ -75,13 +59,6 @@ Requires: %{name}%{?_isa} = %{version}-%{release} | |||||||
| This package contains command-line programs for manipulating TIFF format | This package contains command-line programs for manipulating TIFF format | ||||||
| image files using the libtiff library. | image files using the libtiff library. | ||||||
| 
 | 
 | ||||||
| %package compat |  | ||||||
| Summary: Temporary backwards-compatibility copy of old libtiff |  | ||||||
| Group: Development/Libraries |  | ||||||
| 
 |  | ||||||
| %description compat |  | ||||||
| This package contains shared libraries (only) for libtiff 3.9.x. |  | ||||||
| 
 |  | ||||||
| %prep | %prep | ||||||
| %setup -q -n tiff-%{version} | %setup -q -n tiff-%{version} | ||||||
| 
 | 
 | ||||||
| @ -98,22 +75,6 @@ automake --add-missing --copy | |||||||
| autoconf | autoconf | ||||||
| autoheader | autoheader | ||||||
| 
 | 
 | ||||||
| # And the same for the compatibility package ... |  | ||||||
| 	tar xfz %{SOURCE1} |  | ||||||
| 	pushd tiff-%{prevversion} |  | ||||||
| %patch10 -p1 |  | ||||||
| %patch11 -p1 |  | ||||||
| %patch12 -p1 |  | ||||||
| %patch13 -p1 |  | ||||||
| 	# Use build system's libtool.m4, not the one in the package. |  | ||||||
| 	rm -f libtool.m4 |  | ||||||
| 	libtoolize --force  --copy |  | ||||||
| 	aclocal -I . -I m4 |  | ||||||
| 	automake --add-missing --copy |  | ||||||
| 	autoconf |  | ||||||
| 	autoheader |  | ||||||
| 	popd |  | ||||||
| 
 |  | ||||||
| %build | %build | ||||||
| export CFLAGS="%{optflags} -fno-strict-aliasing" | export CFLAGS="%{optflags} -fno-strict-aliasing" | ||||||
| %configure --enable-ld-version-script | %configure --enable-ld-version-script | ||||||
| @ -121,28 +82,7 @@ make %{?_smp_mflags} | |||||||
| 
 | 
 | ||||||
| LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH make check | LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH make check | ||||||
| 
 | 
 | ||||||
| # And the same for the compatibility package ... |  | ||||||
| 	pushd tiff-%{prevversion} |  | ||||||
| 	%configure --disable-jbig |  | ||||||
| 	make %{?_smp_mflags} |  | ||||||
| 	popd |  | ||||||
| 
 |  | ||||||
| %install | %install | ||||||
| rm -rf $RPM_BUILD_ROOT |  | ||||||
| 
 |  | ||||||
| # install compat package first, then remove unwanted files |  | ||||||
| 	pushd tiff-%{prevversion} |  | ||||||
| 	make DESTDIR=$RPM_BUILD_ROOT install |  | ||||||
| 	rm -rf $RPM_BUILD_ROOT%{_bindir} |  | ||||||
| 	rm -rf $RPM_BUILD_ROOT%{_includedir} |  | ||||||
| 	rm -rf $RPM_BUILD_ROOT%{_mandir} |  | ||||||
| 	rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/ |  | ||||||
| 	rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/libtiff*.pc |  | ||||||
| 	rm -f $RPM_BUILD_ROOT%{_libdir}/libtiff*.so |  | ||||||
| 	rm -f $RPM_BUILD_ROOT%{_libdir}/libtiff*.a |  | ||||||
| 	rm -f $RPM_BUILD_ROOT%{_libdir}/*.la |  | ||||||
| 	popd |  | ||||||
| 
 |  | ||||||
| make DESTDIR=$RPM_BUILD_ROOT install | make DESTDIR=$RPM_BUILD_ROOT install | ||||||
| 
 | 
 | ||||||
| # remove what we didn't want installed | # remove what we didn't want installed | ||||||
| @ -203,24 +143,16 @@ fi | |||||||
| # don't include documentation Makefiles, they are a multilib hazard | # don't include documentation Makefiles, they are a multilib hazard | ||||||
| find html -name 'Makefile*' | xargs rm | find html -name 'Makefile*' | xargs rm | ||||||
| 
 | 
 | ||||||
| %clean |  | ||||||
| rm -rf $RPM_BUILD_ROOT |  | ||||||
| 
 |  | ||||||
| %post -p /sbin/ldconfig | %post -p /sbin/ldconfig | ||||||
| 
 | 
 | ||||||
| %postun -p /sbin/ldconfig | %postun -p /sbin/ldconfig | ||||||
| 
 | 
 | ||||||
| %post compat -p /sbin/ldconfig |  | ||||||
| %postun compat -p /sbin/ldconfig |  | ||||||
| 
 |  | ||||||
| %files | %files | ||||||
| %defattr(-,root,root,0755) |  | ||||||
| %doc COPYRIGHT README RELEASE-DATE VERSION | %doc COPYRIGHT README RELEASE-DATE VERSION | ||||||
| %{_libdir}/libtiff.so.5* | %{_libdir}/libtiff.so.* | ||||||
| %{_libdir}/libtiffxx.so.5* | %{_libdir}/libtiffxx.so.* | ||||||
| 
 | 
 | ||||||
| %files devel | %files devel | ||||||
| %defattr(-,root,root,0755) |  | ||||||
| %doc TODO ChangeLog html | %doc TODO ChangeLog html | ||||||
| %{_includedir}/* | %{_includedir}/* | ||||||
| %{_libdir}/libtiff.so | %{_libdir}/libtiff.so | ||||||
| @ -229,20 +161,18 @@ rm -rf $RPM_BUILD_ROOT | |||||||
| %{_mandir}/man3/* | %{_mandir}/man3/* | ||||||
| 
 | 
 | ||||||
| %files static | %files static | ||||||
| %defattr(-,root,root) |  | ||||||
| %{_libdir}/*.a | %{_libdir}/*.a | ||||||
| 
 | 
 | ||||||
| %files tools | %files tools | ||||||
| %defattr(-,root,root,0755) |  | ||||||
| %{_bindir}/* | %{_bindir}/* | ||||||
| %{_mandir}/man1/* | %{_mandir}/man1/* | ||||||
| 
 | 
 | ||||||
| %files compat |  | ||||||
| %defattr(-,root,root) |  | ||||||
| %{_libdir}/libtiff.so.3* |  | ||||||
| %{_libdir}/libtiffxx.so.3* |  | ||||||
| 
 |  | ||||||
| %changelog | %changelog | ||||||
|  | * Fri Aug  3 2012 Tom Lane <tgl@redhat.com> 4.0.2-6 | ||||||
|  | - Remove compat subpackage; no longer needed | ||||||
|  | - Minor specfile cleanup per suggestions from Tom Callaway | ||||||
|  | Related: #845110 | ||||||
|  | 
 | ||||||
| * Thu Aug  2 2012 Tom Lane <tgl@redhat.com> 4.0.2-5 | * Thu Aug  2 2012 Tom Lane <tgl@redhat.com> 4.0.2-5 | ||||||
| - Add accessor functions for opaque type TIFFField (backport of not-yet-released | - Add accessor functions for opaque type TIFFField (backport of not-yet-released | ||||||
|   upstream feature addition; needed to fix freeimage) |   upstream feature addition; needed to fix freeimage) | ||||||
|  | |||||||
		Loading…
	
		Reference in New Issue
	
	Block a user