libtiff/libtiff-4.4.0-CVE-2026-4775.patch
2026-04-20 15:13:46 +02:00

40 lines
1.4 KiB
Diff

diff -up tiff-4.0.9/libtiff/tif_getimage.c.CVE-2026-4775 tiff-4.0.9/libtiff/tif_getimage.c
--- tiff-4.0.9/libtiff/tif_getimage.c.CVE-2026-4775 2026-04-20 14:46:44.329742232 +0200
+++ tiff-4.0.9/libtiff/tif_getimage.c 2026-04-20 14:46:44.337742095 +0200
@@ -1900,7 +1900,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
uint32* cp1 = cp+w+toskew;
uint32* cp2 = cp1+w+toskew;
uint32* cp3 = cp2+w+toskew;
- int32 incr = 3*w+4*toskew;
+ const tmsize_t incr = 3 * (tmsize_t)w + 4 * (tmsize_t)toskew;
(void) y;
/* adjust fromskew */
@@ -2004,7 +2004,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
{
uint32* cp1 = cp+w+toskew;
- int32 incr = 2*toskew+w;
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
(void) y;
fromskew = (fromskew / 4) * (4*2+2);
@@ -2130,7 +2130,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
DECLAREContigPutFunc(putcontig8bitYCbCr22tile)
{
uint32* cp2;
- int32 incr = 2*toskew+w;
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
(void) y;
fromskew = (fromskew / 2) * (2*2+2);
cp2 = cp+w+toskew;
@@ -2225,7 +2225,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr2
DECLAREContigPutFunc(putcontig8bitYCbCr12tile)
{
uint32* cp2;
- int32 incr = 2*toskew+w;
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
(void) y;
fromskew = (fromskew / 1) * (1 * 2 + 2);
cp2 = cp+w+toskew;