Import from CS git

SOURCES/RHEL-112533.patch

@@ -0,0 +1,51 @@
+From 3e164d0fa9c48dbdc76620442ffbb02de9e5724e Mon Sep 17 00:00:00 2001
+From: Su Laus <sulau@freenet.de>
+Date: Wed, 11 Jun 2025 19:45:19 +0000
+Subject: [PATCH] tif_getimage.c: Fix buffer underflow crash for less raster
+ rows at TIFFReadRGBAImageOriented()
+
+---
+ libtiff/tif_getimage.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
+index 4f32b3a..70a0362 100644
+--- a/libtiff/tif_getimage.c
++++ b/libtiff/tif_getimage.c
+@@ -511,6 +511,22 @@ TIFFRGBAImageGet(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
+ 		"No \"put\" routine setupl; probably can not handle image format");
+ 		return (0);
+     }
++    /* Verify raster width and height against image width and height. */
++    if (h > img->height)
++    {
++        /* Adapt parameters to read only available lines and put image at
++         * the bottom of the raster. */
++        raster += (size_t)(h - img->height) * w;
++        h = img->height;
++    }
++    if (w > img->width)
++    {
++        TIFFWarningExt(img->tif->tif_clientdata, TIFFFileName(img->tif),
++                        "Raster width of %d shall not be larger than image "
++                        "width of %d -> raster width adapted for reading",
++                        w, img->width);
++        w = img->width;
++    }
+     return (*img->get)(img, raster, w, h);
+ }
+ 
+@@ -529,9 +545,7 @@ TIFFReadRGBAImageOriented(TIFF* tif,
+ 
+ 	if (TIFFRGBAImageOK(tif, emsg) && TIFFRGBAImageBegin(&img, tif, stop, emsg)) {
+ 		img.req_orientation = (uint16)orientation;
+-		/* XXX verify rwidth and rheight against width and height */
+-		ok = TIFFRGBAImageGet(&img, raster+(rheight-img.height)*rwidth,
+-			rwidth, img.height);
++		ok = TIFFRGBAImageGet(&img, raster, rwidth, rheight);
+ 		TIFFRGBAImageEnd(&img);
+ 	} else {
+ 		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", emsg);
+-- 
+2.47.3
+

SOURCES/RHEL-120230.patch

@@ -0,0 +1,70 @@
+From 0117a16f9c0b6e3462b8547fa56ea90f3e198b10 Mon Sep 17 00:00:00 2001
+From: Lee Howard <faxguy@howardsilvan.com>
+Date: Mon, 19 May 2025 10:53:30 -0700
+Subject: [PATCH] Don't skip the first line of the input image. Addresses issue
+ #703
+
+---
+ tools/tiffdither.c | 4 ++--
+ tools/tiffmedian.c | 9 ++++++---
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/tools/tiffdither.c b/tools/tiffdither.c
+index 247553c..cc41c51 100644
+--- a/tools/tiffdither.c
++++ b/tools/tiffdither.c
+@@ -93,7 +93,7 @@ fsdither(TIFF* in, TIFF* out)
+ 	nextptr = nextline;
+ 	for (j = 0; j < imagewidth; ++j)
+ 		*nextptr++ = *inptr++;
+-	for (i = 1; i < imagelength; ++i) {
++	for (i = 0; i < imagelength; ++i) {
+ 		tmpptr = thisline;
+ 		thisline = nextline;
+ 		nextline = tmpptr;
+@@ -136,7 +136,7 @@ fsdither(TIFF* in, TIFF* out)
+ 					nextptr[0] += v / 16;
+ 			}
+ 		}
+-		if (TIFFWriteScanline(out, outline, i-1, 0) < 0)
++		if (TIFFWriteScanline(out, outline, i, 0) < 0)
+ 			goto skip_on_error;
+ 	}
+ 	goto exit_label;
+diff --git a/tools/tiffmedian.c b/tools/tiffmedian.c
+index f0c892e..99fd1f2 100644
+--- a/tools/tiffmedian.c
++++ b/tools/tiffmedian.c
+@@ -370,7 +370,10 @@ get_histogram(TIFF* in, Colorbox* box)
+ 	}
+ 	for (i = 0; i < imagelength; i++) {
+ 		if (TIFFReadScanline(in, inputline, i, 0) <= 0)
+-			break;
++		{
++			fprintf(stderr, "Error reading scanline\n");
++			exit(EXIT_FAILURE);
++		}
+ 		inptr = inputline;
+ 		for (j = imagewidth; j-- > 0;) {
+ 			red = (*inptr++) & 0xff >> COLOR_SHIFT;
+@@ -829,7 +832,7 @@ quant_fsdither(TIFF* in, TIFF* out)
+ 	outline = (unsigned char *) _TIFFmalloc(TIFFScanlineSize(out));
+ 
+ 	GetInputLine(in, 0, goto bad);		/* get first line */
+-	for (i = 1; i <= imagelength; ++i) {
++	for (i = 0; i < imagelength; ++i) {
+ 		SWAP(short *, thisline, nextline);
+ 		lastline = (i >= imax);
+ 		if (i <= imax)
+@@ -900,7 +903,7 @@ quant_fsdither(TIFF* in, TIFF* out)
+ 				nextptr += 3;
+ 			}
+ 		}
+-		if (TIFFWriteScanline(out, outline, i-1, 0) < 0)
++		if (TIFFWriteScanline(out, outline, i, 0) < 0)
+ 			break;
+ 	}
+ bad:
+-- 
+2.47.3
+

SPECS/libtiff.spec

@@ -1,7 +1,7 @@
 Summary:       Library of functions for manipulating TIFF format image files
 Name:          libtiff
 Version:       4.0.9
-Release:       34%{?dist}
+Release:       36%{?dist}
 License:       libtiff
 Group:         System Environment/Libraries
 URL:           http://www.simplesystems.org/libtiff/
@@ -63,6 +63,14 @@ Patch44:       libtiff-4.6.0-CVE-2024-7006.patch
 # https://gitlab.com/libtiff/libtiff/-/commit/9171da596c88e6a2dadcab4a3a89dddd6e1b4655
 Patch45:       libtiff-4.0.9-CVE-2017-17095.patch
 
+# Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented(), RHEL-112533
+# CVE-2025-9900
+Patch46:       RHEL-112533.patch
+
+# Fix skipping first line of input image in tiffdither and tiffmedian, RHEL-120230
+# CVE-2025-8176
+Patch47:       RHEL-120230.patch
+
 BuildRequires: gcc, gcc-c++
 BuildRequires: zlib-devel libjpeg-devel jbigkit-devel
 BuildRequires: libtool automake autoconf pkgconfig
@@ -215,6 +223,14 @@ find html -name 'Makefile*' | xargs rm
 %{_mandir}/man1/*
 
 %changelog
+* Mon Nov 03 2025 RHEL Packaging Agent <jotnar@redhat.com> - 4.0.9-36
+- fix CVE-2025-8176: prevent skipping first line in tiffdither and
+  tiffmedian tools (RHEL-120230)
+
+* Tue Oct 14 2025 RHEL Packaging Agent <jotnar@redhat.com> - 4.0.9-35
+- fix CVE-2025-9900: buffer underflow crash in TIFFReadRGBAImageOriented()
+  (RHEL-112533)
+
 * Tue Apr 22 2025 Michal Hlavinka <mhlavink@redhat.com> - 4.0.9-34
 - fix CVE-2017-17095: heap-based buffer overflow in pal2rgb (RHEL-87363)