* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2016-08-03 13:38 Lars Wendler
0 siblings, 0 replies; 14+ messages in thread
From: Lars Wendler @ 2016-08-03 13:38 UTC (permalink / raw
To: gentoo-commits
commit: c833e82151f379f180b50c7dff58b8f989a9c1a9
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 3 13:37:49 2016 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Wed Aug 3 13:38:12 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c833e821
media-libs/tiff: Revbump for security bug #585274
Removing vulnerable gif2tiff (CVE-2016-5102)
Upstream seems to no longer ship this tool with >=tiff-4.0.7 versions.
Package-Manager: portage-2.3.0
Signed-off-by: Lars Wendler <polynomial-c <AT> gentoo.org>
.../tiff/files/tiff-4.0.6-gif2tiff_removal.patch | 37 +++++++++++
media-libs/tiff/tiff-4.0.6-r1.ebuild | 74 ++++++++++++++++++++++
2 files changed, 111 insertions(+)
diff --git a/media-libs/tiff/files/tiff-4.0.6-gif2tiff_removal.patch b/media-libs/tiff/files/tiff-4.0.6-gif2tiff_removal.patch
new file mode 100644
index 0000000..9cf4ec5
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.6-gif2tiff_removal.patch
@@ -0,0 +1,37 @@
+# Removing vulnerable gif2tiff (CVE-2016-5102)
+# Upstream seems to no longer ship this tool with >=tiff-4.0.7 versions.
+
+http://bugzilla.maptools.org/show_bug.cgi?id=2552
+https://bugzilla.redhat.com/show_bug.cgi?id=1343407
+https://bugs.gentoo.org/585274
+
+--- tiff-4.0.6/man/Makefile.am
++++ tiff-4.0.6/man/Makefile.am
+@@ -27,7 +27,6 @@
+ bmp2tiff.1 \
+ fax2ps.1 \
+ fax2tiff.1 \
+- gif2tiff.1 \
+ pal2rgb.1 \
+ ppm2tiff.1 \
+ ras2tiff.1 \
+--- tiff-4.0.6/tools/Makefile.am
++++ tiff-4.0.6/tools/Makefile.am
+@@ -34,7 +34,6 @@
+ bmp2tiff \
+ fax2ps \
+ fax2tiff \
+- gif2tiff \
+ pal2rgb \
+ ppm2tiff \
+ ras2tiff \
+@@ -73,9 +72,6 @@
+ fax2tiff_SOURCES = fax2tiff.c
+ fax2tiff_LDADD = $(LIBTIFF) $(LIBPORT)
+
+-gif2tiff_SOURCES = gif2tiff.c
+-gif2tiff_LDADD = $(LIBTIFF) $(LIBPORT)
+-
+ pal2rgb_SOURCES = pal2rgb.c
+ pal2rgb_LDADD = $(LIBTIFF) $(LIBPORT)
+
diff --git a/media-libs/tiff/tiff-4.0.6-r1.ebuild b/media-libs/tiff/tiff-4.0.6-r1.ebuild
new file mode 100644
index 0000000..b652b05
--- /dev/null
+++ b/media-libs/tiff/tiff-4.0.6-r1.ebuild
@@ -0,0 +1,74 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI=6
+inherit autotools eutils libtool multilib-minimal
+
+DESCRIPTION="Tag Image File Format (TIFF) library"
+HOMEPAGE="http://www.remotesensing.org/libtiff/"
+SRC_URI="http://download.osgeo.org/libtiff/${P}.tar.gz
+ ftp://ftp.remotesensing.org/pub/libtiff/${P}.tar.gz"
+
+LICENSE="libtiff"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~x86-interix ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~x64-solaris ~x86-solaris"
+IUSE="+cxx jbig jpeg lzma static-libs test zlib"
+
+RDEPEND="jpeg? ( >=virtual/jpeg-0-r2:0=[${MULTILIB_USEDEP}] )
+ jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
+ lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
+ zlib? ( >=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}] )
+ abi_x86_32? (
+ !<=app-emulation/emul-linux-x86-baselibs-20130224-r9
+ !app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)]
+ )"
+DEPEND="${RDEPEND}"
+
+REQUIRED_USE="test? ( jpeg )" #483132
+
+MULTILIB_WRAPPED_HEADERS=(
+ /usr/include/tiffconf.h
+)
+
+PATCHES=(
+ "${FILESDIR}/${P}-gif2tiff_removal.patch" # 585274
+)
+
+src_prepare() {
+ default
+ eautoreconf
+}
+
+multilib_src_configure() {
+ ECONF_SOURCE="${S}" econf \
+ $(use_enable static-libs static) \
+ $(use_enable zlib) \
+ $(use_enable jpeg) \
+ $(use_enable jbig) \
+ $(use_enable lzma) \
+ $(use_enable cxx) \
+ --without-x
+
+ # remove useless subdirs
+ if ! multilib_is_native_abi ; then
+ sed -i \
+ -e 's/ tools//' \
+ -e 's/ contrib//' \
+ -e 's/ man//' \
+ -e 's/ html//' \
+ Makefile || die
+ fi
+}
+
+multilib_src_test() {
+ if ! multilib_is_native_abi ; then
+ emake -C tools
+ fi
+ emake check
+}
+
+multilib_src_install_all() {
+ prune_libtool_files --all
+ rm -f "${ED}"/usr/share/doc/${PF}/{COPYRIGHT,README*,RELEASE-DATE,TODO,VERSION}
+}
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2017-03-31 3:36 Mike Frysinger
0 siblings, 0 replies; 14+ messages in thread
From: Mike Frysinger @ 2017-03-31 3:36 UTC (permalink / raw
To: gentoo-commits
commit: f61e94523aef88e99d1140307b83bd518a450a14
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 31 03:27:50 2017 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Fri Mar 31 03:29:47 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f61e9452
media-libs/tiff: pull in various upstream fixes #610330 #614020 #614022 #614024 #612172
.../tiff/files/tiff-4.0.7-CVE-2016-10266.patch | 46 ++++
.../tiff/files/tiff-4.0.7-CVE-2016-10267.patch | 53 ++++
.../tiff/files/tiff-4.0.7-CVE-2017-5225.patch | 74 ++++++
media-libs/tiff/files/tiff-4.0.7-bug2130.patch | 112 +++++++++
media-libs/tiff/files/tiff-4.0.7-bug2535.patch | 54 ++++
media-libs/tiff/files/tiff-4.0.7-bug2594.patch | 28 +++
media-libs/tiff/files/tiff-4.0.7-bug2597.patch | 41 +++
media-libs/tiff/files/tiff-4.0.7-bug2598.patch | 31 +++
media-libs/tiff/files/tiff-4.0.7-bug2599.patch | 54 ++++
media-libs/tiff/files/tiff-4.0.7-bug2604.patch | 108 ++++++++
media-libs/tiff/files/tiff-4.0.7-bug2605.patch | 55 ++++
media-libs/tiff/files/tiff-4.0.7-bug2607.patch | 41 +++
media-libs/tiff/files/tiff-4.0.7-bug2608.patch | 104 ++++++++
media-libs/tiff/files/tiff-4.0.7-bug2610.patch | 46 ++++
media-libs/tiff/files/tiff-4.0.7-bug2619.patch | 46 ++++
media-libs/tiff/files/tiff-4.0.7-bug2620.patch | 29 +++
media-libs/tiff/files/tiff-4.0.7-bug2621.patch | 49 ++++
media-libs/tiff/files/tiff-4.0.7-bug2627.patch | 59 +++++
media-libs/tiff/files/tiff-4.0.7-bug2631.patch | 34 +++
.../tiff/files/tiff-4.0.7-bug2633-bug2634.patch | 41 +++
media-libs/tiff/files/tiff-4.0.7-bug2635.patch | 33 +++
media-libs/tiff/files/tiff-4.0.7-bug2638.patch | 29 +++
media-libs/tiff/files/tiff-4.0.7-bug2639.patch | 58 +++++
media-libs/tiff/files/tiff-4.0.7-bug2640.patch | 28 +++
...iff-4.0.7-bug2642-bug2643-bug2646-bug2647.patch | 278 +++++++++++++++++++++
media-libs/tiff/files/tiff-4.0.7-bug2644.patch | 45 ++++
media-libs/tiff/files/tiff-4.0.7-bug2648.patch | 33 +++
media-libs/tiff/files/tiff-4.0.7-bug2650-2.patch | 26 ++
media-libs/tiff/files/tiff-4.0.7-bug2650.patch | 54 ++++
media-libs/tiff/files/tiff-4.0.7-bug2651.patch | 86 +++++++
media-libs/tiff/files/tiff-4.0.7-bug2653.patch | 33 +++
media-libs/tiff/files/tiff-4.0.7-bug2658.patch | 33 +++
media-libs/tiff/files/tiff-4.0.7-bug2659-2.patch | 41 +++
media-libs/tiff/files/tiff-4.0.7-bug2659.patch | 34 +++
media-libs/tiff/files/tiff-4.0.7-bug2665.patch | 43 ++++
.../tiff/files/tiff-4.0.7-hylafax-hack.patch | 38 +++
media-libs/tiff/tiff-4.0.7-r1.ebuild | 112 +++++++++
37 files changed, 2109 insertions(+)
diff --git a/media-libs/tiff/files/tiff-4.0.7-CVE-2016-10266.patch b/media-libs/tiff/files/tiff-4.0.7-CVE-2016-10266.patch
new file mode 100644
index 00000000000..67e0ca41c99
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-CVE-2016-10266.patch
@@ -0,0 +1,46 @@
+http://bugzilla.maptools.org/show_bug.cgi?id=2596
+
+From d7520d28685b96a28421ef01fb66cea8d1a96dfc Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Fri, 2 Dec 2016 21:56:56 +0000
+Subject: [PATCH] * libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow
+ in TIFFReadEncodedStrip() that caused an integer division by zero. Reported
+ by Agostino Sarubbo. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2596
+
+---
+ ChangeLog | 7 +++++++
+ libtiff/tif_read.c | 4 ++--
+ libtiff/tiffiop.h | 6 +++++-
+ 3 files changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
+index 80035929f033..29a311db0cb7 100644
+--- a/libtiff/tif_read.c
++++ b/libtiff/tif_read.c
+@@ -346,7 +346,7 @@ TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
+ rowsperstrip=td->td_rowsperstrip;
+ if (rowsperstrip>td->td_imagelength)
+ rowsperstrip=td->td_imagelength;
+- stripsperplane=((td->td_imagelength+rowsperstrip-1)/rowsperstrip);
++ stripsperplane= TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip);
+ stripinplane=(strip%stripsperplane);
+ plane=(uint16)(strip/stripsperplane);
+ rows=td->td_imagelength-stripinplane*rowsperstrip;
+diff --git a/libtiff/tiffiop.h b/libtiff/tiffiop.h
+index 8bcd0c172c08..5294ee78ffaf 100644
+--- a/libtiff/tiffiop.h
++++ b/libtiff/tiffiop.h
+@@ -250,6 +250,10 @@ struct tiff {
+ #define TIFFhowmany_32(x, y) (((uint32)x < (0xffffffff - (uint32)(y-1))) ? \
+ ((((uint32)(x))+(((uint32)(y))-1))/((uint32)(y))) : \
+ 0U)
++/* Variant of TIFFhowmany_32() that doesn't return 0 if x close to MAXUINT. */
++/* Caution: TIFFhowmany_32_maxuint_compat(x,y)*y might overflow */
++#define TIFFhowmany_32_maxuint_compat(x, y) \
++ (((uint32)(x) / (uint32)(y)) + ((((uint32)(x) % (uint32)(y)) != 0) ? 1 : 0))
+ #define TIFFhowmany8_32(x) (((x)&0x07)?((uint32)(x)>>3)+1:(uint32)(x)>>3)
+ #define TIFFroundup_32(x, y) (TIFFhowmany_32(x,y)*(y))
+ #define TIFFhowmany_64(x, y) ((((uint64)(x))+(((uint64)(y))-1))/((uint64)(y)))
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-CVE-2016-10267.patch b/media-libs/tiff/files/tiff-4.0.7-CVE-2016-10267.patch
new file mode 100644
index 00000000000..04d9729ff73
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-CVE-2016-10267.patch
@@ -0,0 +1,53 @@
+http://bugzilla.maptools.org/show_bug.cgi?id=2611
+
+From bd06f6c97dff0b30de0f80227d782ea448c14b19 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 3 Dec 2016 11:15:18 +0000
+Subject: [PATCH] * libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case
+ of failure in OJPEGPreDecode(). This will avoid a divide by zero, and
+ potential other issues. Reported by Agostino Sarubbo. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2611
+
+---
+ ChangeLog | 7 +++++++
+ libtiff/tif_ojpeg.c | 10 +++++++++-
+ 2 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
+index 30a1812634e0..93839d8f3e11 100644
+--- a/libtiff/tif_ojpeg.c
++++ b/libtiff/tif_ojpeg.c
+@@ -244,6 +244,7 @@ typedef enum {
+
+ typedef struct {
+ TIFF* tif;
++ int decoder_ok;
+ #ifndef LIBJPEG_ENCAP_EXTERNAL
+ JMP_BUF exit_jmpbuf;
+ #endif
+@@ -722,6 +723,7 @@ OJPEGPreDecode(TIFF* tif, uint16 s)
+ }
+ sp->write_curstrile++;
+ }
++ sp->decoder_ok = 1;
+ return(1);
+ }
+
+@@ -784,8 +786,14 @@ OJPEGPreDecodeSkipScanlines(TIFF* tif)
+ static int
+ OJPEGDecode(TIFF* tif, uint8* buf, tmsize_t cc, uint16 s)
+ {
++ static const char module[]="OJPEGDecode";
+ OJPEGState* sp=(OJPEGState*)tif->tif_data;
+ (void)s;
++ if( !sp->decoder_ok )
++ {
++ TIFFErrorExt(tif->tif_clientdata,module,"Cannot decode: decoder not correctly initialized");
++ return 0;
++ }
+ if (sp->libjpeg_jpeg_query_style==0)
+ {
+ if (OJPEGDecodeRaw(tif,buf,cc)==0)
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-CVE-2017-5225.patch b/media-libs/tiff/files/tiff-4.0.7-CVE-2017-5225.patch
new file mode 100644
index 00000000000..7f961474ba9
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-CVE-2017-5225.patch
@@ -0,0 +1,74 @@
+https://bugs.gentoo.org/610330
+
+From 24bc05876f5a1a300a3c4eb0fa8e8cea6a256f9f Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Wed, 11 Jan 2017 19:25:44 +0000
+Subject: [PATCH] * tools/tiffcp.c: error out cleanly in cpContig2SeparateByRow
+ and cpSeparate2ContigByRow if BitsPerSample != 8 to avoid heap based
+ overflow. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2656 and
+ http://bugzilla.maptools.org/show_bug.cgi?id=2657
+
+---
+ ChangeLog | 7 +++++++
+ tools/tiffcp.c | 26 +++++++++++++++++++++++---
+ 2 files changed, 30 insertions(+), 3 deletions(-)
+
+diff --git a/tools/tiffcp.c b/tools/tiffcp.c
+index 49c9d37125a6..489459a7f6a4 100644
+--- a/tools/tiffcp.c
++++ b/tools/tiffcp.c
+@@ -591,7 +591,7 @@ static copyFunc pickCopyFunc(TIFF*, TIFF*, uint16, uint16);
+ static int
+ tiffcp(TIFF* in, TIFF* out)
+ {
+- uint16 bitspersample, samplesperpixel = 1;
++ uint16 bitspersample = 1, samplesperpixel = 1;
+ uint16 input_compression, input_photometric = PHOTOMETRIC_MINISBLACK;
+ copyFunc cf;
+ uint32 width, length;
+@@ -1067,6 +1067,16 @@ DECLAREcpFunc(cpContig2SeparateByRow)
+ register uint32 n;
+ uint32 row;
+ tsample_t s;
++ uint16 bps = 0;
++
++ (void) TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps);
++ if( bps != 8 )
++ {
++ TIFFError(TIFFFileName(in),
++ "Error, can only handle BitsPerSample=8 in %s",
++ "cpContig2SeparateByRow");
++ return 0;
++ }
+
+ inbuf = _TIFFmalloc(scanlinesizein);
+ outbuf = _TIFFmalloc(scanlinesizeout);
+@@ -1120,6 +1130,16 @@ DECLAREcpFunc(cpSeparate2ContigByRow)
+ register uint32 n;
+ uint32 row;
+ tsample_t s;
++ uint16 bps = 0;
++
++ (void) TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps);
++ if( bps != 8 )
++ {
++ TIFFError(TIFFFileName(in),
++ "Error, can only handle BitsPerSample=8 in %s",
++ "cpSeparate2ContigByRow");
++ return 0;
++ }
+
+ inbuf = _TIFFmalloc(scanlinesizein);
+ outbuf = _TIFFmalloc(scanlinesizeout);
+@@ -1784,7 +1804,7 @@ pickCopyFunc(TIFF* in, TIFF* out, uint16 bitspersample, uint16 samplesperpixel)
+ uint32 w, l, tw, tl;
+ int bychunk;
+
+- (void) TIFFGetField(in, TIFFTAG_PLANARCONFIG, &shortv);
++ (void) TIFFGetFieldDefaulted(in, TIFFTAG_PLANARCONFIG, &shortv);
+ if (shortv != config && bitspersample != 8 && samplesperpixel > 1) {
+ fprintf(stderr,
+ "%s: Cannot handle different planar configuration w/ bits/sample != 8\n",
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2130.patch b/media-libs/tiff/files/tiff-4.0.7-bug2130.patch
new file mode 100644
index 00000000000..b565fecc029
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2130.patch
@@ -0,0 +1,112 @@
+From c2faaeaa7887c24c574297e8e2f36208df9dc229 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Wed, 11 Jan 2017 20:33:35 +0000
+Subject: [PATCH] * libtiff/tif_luv.c, tif_lzw.c, tif_packbits.c: return 0 in
+ Encode functions instead of -1 when TIFFFlushData1() fails. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2130
+
+---
+ ChangeLog | 6 ++++++
+ libtiff/tif_luv.c | 12 ++++++------
+ libtiff/tif_lzw.c | 8 +++++---
+ libtiff/tif_packbits.c | 6 +++---
+ 4 files changed, 20 insertions(+), 12 deletions(-)
+
+diff --git a/libtiff/tif_luv.c b/libtiff/tif_luv.c
+index f42ac0131fee..1f6d8ba3ea5a 100644
+--- a/libtiff/tif_luv.c
++++ b/libtiff/tif_luv.c
+@@ -473,7 +473,7 @@ LogL16Encode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
+ tif->tif_rawcp = op;
+ tif->tif_rawcc = tif->tif_rawdatasize - occ;
+ if (!TIFFFlushData1(tif))
+- return (-1);
++ return (0);
+ op = tif->tif_rawcp;
+ occ = tif->tif_rawdatasize - tif->tif_rawcc;
+ }
+@@ -505,7 +505,7 @@ LogL16Encode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
+ tif->tif_rawcp = op;
+ tif->tif_rawcc = tif->tif_rawdatasize - occ;
+ if (!TIFFFlushData1(tif))
+- return (-1);
++ return (0);
+ op = tif->tif_rawcp;
+ occ = tif->tif_rawdatasize - tif->tif_rawcc;
+ }
+@@ -565,7 +565,7 @@ LogLuvEncode24(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
+ tif->tif_rawcp = op;
+ tif->tif_rawcc = tif->tif_rawdatasize - occ;
+ if (!TIFFFlushData1(tif))
+- return (-1);
++ return (0);
+ op = tif->tif_rawcp;
+ occ = tif->tif_rawdatasize - tif->tif_rawcc;
+ }
+@@ -624,7 +624,7 @@ LogLuvEncode32(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
+ tif->tif_rawcp = op;
+ tif->tif_rawcc = tif->tif_rawdatasize - occ;
+ if (!TIFFFlushData1(tif))
+- return (-1);
++ return (0);
+ op = tif->tif_rawcp;
+ occ = tif->tif_rawdatasize - tif->tif_rawcc;
+ }
+@@ -656,7 +656,7 @@ LogLuvEncode32(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
+ tif->tif_rawcp = op;
+ tif->tif_rawcc = tif->tif_rawdatasize - occ;
+ if (!TIFFFlushData1(tif))
+- return (-1);
++ return (0);
+ op = tif->tif_rawcp;
+ occ = tif->tif_rawdatasize - tif->tif_rawcc;
+ }
+diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
+index 240e19c2e058..5ba35ec1305f 100644
+--- a/libtiff/tif_lzw.c
++++ b/libtiff/tif_lzw.c
+@@ -969,7 +969,8 @@ LZWEncode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
+ */
+ if (op > limit) {
+ tif->tif_rawcc = (tmsize_t)(op - tif->tif_rawdata);
+- TIFFFlushData1(tif);
++ if( !TIFFFlushData1(tif) )
++ return 0;
+ op = tif->tif_rawdata;
+ }
+ PutNextCode(op, ent);
+@@ -1054,7 +1055,8 @@ LZWPostEncode(TIFF* tif)
+
+ if (op > sp->enc_rawlimit) {
+ tif->tif_rawcc = (tmsize_t)(op - tif->tif_rawdata);
+- TIFFFlushData1(tif);
++ if( !TIFFFlushData1(tif) )
++ return 0;
+ op = tif->tif_rawdata;
+ }
+ if (sp->enc_oldcode != (hcode_t) -1) {
+diff --git a/libtiff/tif_packbits.c b/libtiff/tif_packbits.c
+index d2a0165de9dd..0495e688a6be 100644
+--- a/libtiff/tif_packbits.c
++++ b/libtiff/tif_packbits.c
+@@ -99,7 +99,7 @@ PackBitsEncode(TIFF* tif, uint8* buf, tmsize_t cc, uint16 s)
+ slop = (long)(op - lastliteral);
+ tif->tif_rawcc += (tmsize_t)(lastliteral - tif->tif_rawcp);
+ if (!TIFFFlushData1(tif))
+- return (-1);
++ return (0);
+ op = tif->tif_rawcp;
+ while (slop-- > 0)
+ *op++ = *lastliteral++;
+@@ -107,7 +107,7 @@ PackBitsEncode(TIFF* tif, uint8* buf, tmsize_t cc, uint16 s)
+ } else {
+ tif->tif_rawcc += (tmsize_t)(op - tif->tif_rawcp);
+ if (!TIFFFlushData1(tif))
+- return (-1);
++ return (0);
+ op = tif->tif_rawcp;
+ }
+ }
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2535.patch b/media-libs/tiff/files/tiff-4.0.7-bug2535.patch
new file mode 100644
index 00000000000..c44a8f05d20
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2535.patch
@@ -0,0 +1,54 @@
+From c4e376852d82936885833441169684267983691f Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Wed, 11 Jan 2017 12:51:59 +0000
+Subject: [PATCH] * libtiff/tif_dirwrite.c: in
+ TIFFWriteDirectoryTagCheckedRational, replace assertion by runtime check to
+ error out if passed value is strictly negative. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2535
+
+* tools/tiffcrop.c: remove extraneous TIFFClose() in error code path, that
+caused double free.
+Related to http://bugzilla.maptools.org/show_bug.cgi?id=2535
+---
+ ChangeLog | 11 +++++++++++
+ libtiff/tif_dirwrite.c | 11 ++++++++---
+ tools/tiffcrop.c | 3 +--
+ 3 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c
+index d34f6f611d39..055324db078f 100644
+--- a/libtiff/tif_dirwrite.c
++++ b/libtiff/tif_dirwrite.c
+@@ -2094,10 +2094,15 @@ TIFFWriteDirectoryTagCheckedSlong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* d
+ static int
+ TIFFWriteDirectoryTagCheckedRational(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
+ {
++ static const char module[] = "TIFFWriteDirectoryTagCheckedRational";
+ uint32 m[2];
+- assert(value>=0.0);
+ assert(sizeof(uint32)==4);
+- if (value<=0.0)
++ if( value < 0 )
++ {
++ TIFFErrorExt(tif->tif_clientdata,module,"Negative value is illegal");
++ return 0;
++ }
++ else if (value==0.0)
+ {
+ m[0]=0;
+ m[1]=1;
+diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
+index 21dd08720d77..c69177e052d4 100644
+--- a/tools/tiffcrop.c
++++ b/tools/tiffcrop.c
+@@ -7996,7 +7996,6 @@ writeCroppedImage(TIFF *in, TIFF *out, struct image_data *image,
+ if (!TIFFWriteDirectory(out))
+ {
+ TIFFError("","Failed to write IFD for page number %d", pagenum);
+- TIFFClose(out);
+ return (-1);
+ }
+
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2594.patch b/media-libs/tiff/files/tiff-4.0.7-bug2594.patch
new file mode 100644
index 00000000000..b2bc26e9064
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2594.patch
@@ -0,0 +1,28 @@
+From a56820e2022e23610c1ea99fbf621d73d1e36348 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 3 Dec 2016 14:18:48 +0000
+Subject: [PATCH] * tools/tiffinfo.c: fix null pointer dereference in -r mode
+ when the image has no StripByteCount tag. Reported by Agostino Sarubbo. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2594
+
+---
+ ChangeLog | 7 +++++++
+ tools/tiffinfo.c | 4 ++--
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/tools/tiffinfo.c b/tools/tiffinfo.c
+index b02c7d46bed0..4d58055de85c 100644
+--- a/tools/tiffinfo.c
++++ b/tools/tiffinfo.c
+@@ -417,7 +417,7 @@ TIFFReadRawData(TIFF* tif, int bitrev)
+ uint64* stripbc=NULL;
+
+ TIFFGetField(tif, TIFFTAG_STRIPBYTECOUNTS, &stripbc);
+- if (nstrips > 0) {
++ if (stripbc != NULL && nstrips > 0) {
+ uint32 bufsize = (uint32) stripbc[0];
+ tdata_t buf = _TIFFmalloc(bufsize);
+ tstrip_t s;
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2597.patch b/media-libs/tiff/files/tiff-4.0.7-bug2597.patch
new file mode 100644
index 00000000000..9cd29cfab77
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2597.patch
@@ -0,0 +1,41 @@
+From 5ad5e64f8530a827482645986f5bb4e4613d0aa7 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 3 Dec 2016 14:42:40 +0000
+Subject: [PATCH] * tools/tiffcp.c: avoid potential division by zero is
+ BitsPerSamples tag is missing. Reported by Agostino sarubbo. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2597
+
+---
+ ChangeLog | 7 +++++++
+ tools/tiffcp.c | 10 ++++++++--
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/tools/tiffcp.c b/tools/tiffcp.c
+index 6dfb9a91bfa9..c8e48c3c2bb3 100644
+--- a/tools/tiffcp.c
++++ b/tools/tiffcp.c
+@@ -1378,7 +1378,7 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
+ uint8* bufp = (uint8*) buf;
+ uint32 tw, tl;
+ uint32 row;
+- uint16 bps, bytes_per_sample;
++ uint16 bps = 0, bytes_per_sample;
+
+ tilebuf = _TIFFmalloc(tilesize);
+ if (tilebuf == 0)
+@@ -1387,6 +1387,12 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
+ (void) TIFFGetField(in, TIFFTAG_TILEWIDTH, &tw);
+ (void) TIFFGetField(in, TIFFTAG_TILELENGTH, &tl);
+ (void) TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps);
++ if( bps == 0 )
++ {
++ TIFFError(TIFFFileName(in), "Error, cannot read BitsPerSample");
++ status = 0;
++ goto done;
++ }
+ assert( bps % 8 == 0 );
+ bytes_per_sample = bps/8;
+
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2598.patch b/media-libs/tiff/files/tiff-4.0.7-bug2598.patch
new file mode 100644
index 00000000000..c0a0d1a8db1
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2598.patch
@@ -0,0 +1,31 @@
+http://bugzilla.maptools.org/show_bug.cgi?id=2598
+
+From bc3d7392e43545c7c6375897458a7a3e8ee4d9d8 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Fri, 2 Dec 2016 22:13:32 +0000
+Subject: [PATCH] * tools/tiffcp.c: avoid uint32 underflow in cpDecodedStrips
+ that can cause various issues, such as buffer overflows in the library.
+ Reported by Agostino Sarubbo. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2598
+
+---
+ ChangeLog | 7 +++++++
+ tools/tiffcp.c | 4 ++--
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/tools/tiffcp.c b/tools/tiffcp.c
+index 338a3d113bf8..6dfb9a91bfa9 100644
+--- a/tools/tiffcp.c
++++ b/tools/tiffcp.c
+@@ -985,7 +985,7 @@ DECLAREcpFunc(cpDecodedStrips)
+ tstrip_t s, ns = TIFFNumberOfStrips(in);
+ uint32 row = 0;
+ _TIFFmemset(buf, 0, stripsize);
+- for (s = 0; s < ns; s++) {
++ for (s = 0; s < ns && row < imagelength; s++) {
+ tsize_t cc = (row + rowsperstrip > imagelength) ?
+ TIFFVStripSize(in, imagelength - row) : stripsize;
+ if (TIFFReadEncodedStrip(in, s, buf, cc) < 0
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2599.patch b/media-libs/tiff/files/tiff-4.0.7-bug2599.patch
new file mode 100644
index 00000000000..929bb447bf7
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2599.patch
@@ -0,0 +1,54 @@
+From 9bbbe303c8e5db20d7f687ee1ca19c98fb852044 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 3 Dec 2016 15:30:31 +0000
+Subject: [PATCH] * tools/tif_dir.c: when TIFFGetField(, TIFFTAG_NUMBEROFINKS,
+ ) is called, limit the return number of inks to SamplesPerPixel, so that code
+ that parses ink names doesn't go past the end of the buffer. Reported by
+ Agostino Sarubbo. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2599
+
+Reported by Agostino Sarubbo.
+---
+ ChangeLog | 10 +++++++++-
+ libtiff/tif_dir.c | 28 +++++++++++++++++++++++++++-
+ 2 files changed, 36 insertions(+), 2 deletions(-)
+
+diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
+index ad21655a6ee9..2574e748b3be 100644
+--- a/libtiff/tif_dir.c
++++ b/libtiff/tif_dir.c
+@@ -854,6 +854,32 @@ _TIFFVGetField(TIFF* tif, uint32 tag, va_list ap)
+ if( fip == NULL ) /* cannot happen since TIFFGetField() already checks it */
+ return 0;
+
++ if( tag == TIFFTAG_NUMBEROFINKS )
++ {
++ int i;
++ for (i = 0; i < td->td_customValueCount; i++) {
++ uint16 val;
++ TIFFTagValue *tv = td->td_customValues + i;
++ if (tv->info->field_tag != tag)
++ continue;
++ val = *(uint16 *)tv->value;
++ /* Truncate to SamplesPerPixel, since the */
++ /* setting code for INKNAMES assume that there are SamplesPerPixel */
++ /* inknames. */
++ /* Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2599 */
++ if( val > td->td_samplesperpixel )
++ {
++ TIFFWarningExt(tif->tif_clientdata,"_TIFFVGetField",
++ "Truncating NumberOfInks from %u to %u",
++ val, td->td_samplesperpixel);
++ val = td->td_samplesperpixel;
++ }
++ *va_arg(ap, uint16*) = val;
++ return 1;
++ }
++ return 0;
++ }
++
+ /*
+ * We want to force the custom code to be used for custom
+ * fields even if the tag happens to match a well known
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2604.patch b/media-libs/tiff/files/tiff-4.0.7-bug2604.patch
new file mode 100644
index 00000000000..cc3f4cf3ce9
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2604.patch
@@ -0,0 +1,108 @@
+From ebc6029128555df725e6ad77a983134350bfc831 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Fri, 2 Dec 2016 23:05:51 +0000
+Subject: [PATCH] * libtiff/tif_pixarlog.c, libtiff/tif_luv.c: fix heap-based
+ buffer overflow on generation of PixarLog / LUV compressed files, with
+ ColorMap, TransferFunction attached and nasty plays with bitspersample. The
+ fix for LUV has not been tested, but suffers from the same kind of issue of
+ PixarLog. Reported by Agostino Sarubbo. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2604
+
+---
+ ChangeLog | 10 ++++++++++
+ libtiff/tif_luv.c | 20 +++++++++++++++-----
+ libtiff/tif_pixarlog.c | 19 ++++++++++++++++---
+ 3 files changed, 41 insertions(+), 8 deletions(-)
+
+diff --git a/libtiff/tif_luv.c b/libtiff/tif_luv.c
+index ca08f30a76b6..f42ac0131fee 100644
+--- a/libtiff/tif_luv.c
++++ b/libtiff/tif_luv.c
+@@ -158,6 +158,7 @@
+ typedef struct logLuvState LogLuvState;
+
+ struct logLuvState {
++ int encoder_state; /* 1 if encoder correctly initialized */
+ int user_datafmt; /* user data format */
+ int encode_meth; /* encoding method */
+ int pixel_size; /* bytes per pixel */
+@@ -1552,6 +1553,7 @@ LogLuvSetupEncode(TIFF* tif)
+ td->td_photometric, "must be either LogLUV or LogL");
+ break;
+ }
++ sp->encoder_state = 1;
+ return (1);
+ notsupported:
+ TIFFErrorExt(tif->tif_clientdata, module,
+@@ -1563,19 +1565,27 @@ notsupported:
+ static void
+ LogLuvClose(TIFF* tif)
+ {
++ LogLuvState* sp = (LogLuvState*) tif->tif_data;
+ TIFFDirectory *td = &tif->tif_dir;
+
++ assert(sp != 0);
+ /*
+ * For consistency, we always want to write out the same
+ * bitspersample and sampleformat for our TIFF file,
+ * regardless of the data format being used by the application.
+ * Since this routine is called after tags have been set but
+ * before they have been recorded in the file, we reset them here.
++ * Note: this is really a nasty approach. See PixarLogClose
+ */
+- td->td_samplesperpixel =
+- (td->td_photometric == PHOTOMETRIC_LOGL) ? 1 : 3;
+- td->td_bitspersample = 16;
+- td->td_sampleformat = SAMPLEFORMAT_INT;
++ if( sp->encoder_state )
++ {
++ /* See PixarLogClose. Might avoid issues with tags whose size depends
++ * on those below, but not completely sure this is enough. */
++ td->td_samplesperpixel =
++ (td->td_photometric == PHOTOMETRIC_LOGL) ? 1 : 3;
++ td->td_bitspersample = 16;
++ td->td_sampleformat = SAMPLEFORMAT_INT;
++ }
+ }
+
+ static void
+diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
+index f4af2bab7ce5..9836dce63450 100644
+--- a/libtiff/tif_pixarlog.c
++++ b/libtiff/tif_pixarlog.c
+@@ -1233,8 +1233,10 @@ PixarLogPostEncode(TIFF* tif)
+ static void
+ PixarLogClose(TIFF* tif)
+ {
++ PixarLogState* sp = (PixarLogState*) tif->tif_data;
+ TIFFDirectory *td = &tif->tif_dir;
+
++ assert(sp != 0);
+ /* In a really sneaky (and really incorrect, and untruthful, and
+ * troublesome, and error-prone) maneuver that completely goes against
+ * the spirit of TIFF, and breaks TIFF, on close, we covertly
+@@ -1243,8 +1245,19 @@ PixarLogClose(TIFF* tif)
+ * readers that don't know about PixarLog, or how to set
+ * the PIXARLOGDATFMT pseudo-tag.
+ */
+- td->td_bitspersample = 8;
+- td->td_sampleformat = SAMPLEFORMAT_UINT;
++
++ if (sp->state&PLSTATE_INIT) {
++ /* We test the state to avoid an issue such as in
++ * http://bugzilla.maptools.org/show_bug.cgi?id=2604
++ * What appends in that case is that the bitspersample is 1 and
++ * a TransferFunction is set. The size of the TransferFunction
++ * depends on 1<<bitspersample. So if we increase it, an access
++ * out of the buffer will happen at directory flushing.
++ * Another option would be to clear those targs.
++ */
++ td->td_bitspersample = 8;
++ td->td_sampleformat = SAMPLEFORMAT_UINT;
++ }
+ }
+
+ static void
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2605.patch b/media-libs/tiff/files/tiff-4.0.7-bug2605.patch
new file mode 100644
index 00000000000..335e4348d3f
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2605.patch
@@ -0,0 +1,55 @@
+From cd4832257daf222833ae172b3923268fec5b71b9 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 3 Dec 2016 16:50:02 +0000
+Subject: [PATCH] * tools/tiffcp.c: replace assert( (bps % 8) == 0 ) by a non
+ assert check. Reported by Agostino Sarubbo. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2605
+
+---
+ ChangeLog | 6 ++++++
+ tools/tiffcp.c | 17 +++++++++++++----
+ 2 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/tools/tiffcp.c b/tools/tiffcp.c
+index 6d96bb89f555..49c9d37125a6 100644
+--- a/tools/tiffcp.c
++++ b/tools/tiffcp.c
+@@ -45,7 +45,6 @@
+ #include <string.h>
+
+ #include <ctype.h>
+-#include <assert.h>
+
+ #ifdef HAVE_UNISTD_H
+ # include <unistd.h>
+@@ -1393,7 +1392,12 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
+ status = 0;
+ goto done;
+ }
+- assert( bps % 8 == 0 );
++ if( (bps % 8) != 0 )
++ {
++ TIFFError(TIFFFileName(in), "Error, cannot handle BitsPerSample that is not a multiple of 8");
++ status = 0;
++ goto done;
++ }
+ bytes_per_sample = bps/8;
+
+ for (row = 0; row < imagelength; row += tl) {
+@@ -1584,7 +1588,12 @@ DECLAREwriteFunc(writeBufferToSeparateTiles)
+ _TIFFfree(obuf);
+ return 0;
+ }
+- assert( bps % 8 == 0 );
++ if( (bps % 8) != 0 )
++ {
++ TIFFError(TIFFFileName(out), "Error, cannot handle BitsPerSample that is not a multiple of 8");
++ _TIFFfree(obuf);
++ return 0;
++ }
+ bytes_per_sample = bps/8;
+
+ for (row = 0; row < imagelength; row += tl) {
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2607.patch b/media-libs/tiff/files/tiff-4.0.7-bug2607.patch
new file mode 100644
index 00000000000..532259e91cb
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2607.patch
@@ -0,0 +1,41 @@
+From c99f44478d6f0491da5b98c8cea14f565a021e22 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 3 Dec 2016 15:44:15 +0000
+Subject: [PATCH] * tools/tiffcp.c: avoid potential division by zero is
+ BitsPerSamples tag is missing. Reported by Agostino Sarubbo. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2607
+
+---
+ ChangeLog | 7 +++++++
+ tools/tiffcp.c | 10 ++++++++--
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/tools/tiffcp.c b/tools/tiffcp.c
+index c8e48c3c2bb3..142cbb0ecfc2 100644
+--- a/tools/tiffcp.c
++++ b/tools/tiffcp.c
+@@ -1569,7 +1569,7 @@ DECLAREwriteFunc(writeBufferToSeparateTiles)
+ uint8* bufp = (uint8*) buf;
+ uint32 tl, tw;
+ uint32 row;
+- uint16 bps, bytes_per_sample;
++ uint16 bps = 0, bytes_per_sample;
+
+ obuf = _TIFFmalloc(TIFFTileSize(out));
+ if (obuf == NULL)
+@@ -1578,6 +1578,12 @@ DECLAREwriteFunc(writeBufferToSeparateTiles)
+ (void) TIFFGetField(out, TIFFTAG_TILELENGTH, &tl);
+ (void) TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw);
+ (void) TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps);
++ if( bps == 0 )
++ {
++ TIFFError(TIFFFileName(out), "Error, cannot read BitsPerSample");
++ _TIFFfree(obuf);
++ return 0;
++ }
+ assert( bps % 8 == 0 );
+ bytes_per_sample = bps/8;
+
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2608.patch b/media-libs/tiff/files/tiff-4.0.7-bug2608.patch
new file mode 100644
index 00000000000..afe2c25a293
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2608.patch
@@ -0,0 +1,104 @@
+From 92adbddc283782d71d81dbccf72ed2c279f90097 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 3 Dec 2016 11:02:15 +0000
+Subject: [PATCH] * libtiff/tif_dirread.c: modify
+ ChopUpSingleUncompressedStrip() to instanciate compute ntrips as
+ TIFFhowmany_32(td->td_imagelength, rowsperstrip), instead of a logic based on
+ the total size of data. Which is faulty is the total size of data is not
+ sufficient to fill the whole image, and thus results in reading outside of
+ the StripByCounts/StripOffsets arrays when using TIFFReadScanline(). Reported
+ by Agostino Sarubbo. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2608.
+
+* libtiff/tif_strip.c: revert the change in TIFFNumberOfStrips() done
+for http://bugzilla.maptools.org/show_bug.cgi?id=2587 / CVE-2016-9273 since
+the above change is a better fix that makes it unnecessary.
+---
+ ChangeLog | 15 +++++++++++++++
+ libtiff/tif_dirread.c | 24 +++++++++++-------------
+ libtiff/tif_strip.c | 11 +----------
+ 3 files changed, 27 insertions(+), 23 deletions(-)
+
+diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
+index 01070f2ecebd..f2905286c0d0 100644
+--- a/libtiff/tif_dirread.c
++++ b/libtiff/tif_dirread.c
+@@ -5502,8 +5502,7 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
+ uint64 rowblockbytes;
+ uint64 stripbytes;
+ uint32 strip;
+- uint64 nstrips64;
+- uint32 nstrips32;
++ uint32 nstrips;
+ uint32 rowsperstrip;
+ uint64* newcounts;
+ uint64* newoffsets;
+@@ -5534,18 +5533,17 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
+ return;
+
+ /*
+- * never increase the number of strips in an image
++ * never increase the number of rows per strip
+ */
+ if (rowsperstrip >= td->td_rowsperstrip)
+ return;
+- nstrips64 = TIFFhowmany_64(bytecount, stripbytes);
+- if ((nstrips64==0)||(nstrips64>0xFFFFFFFF)) /* something is wonky, do nothing. */
+- return;
+- nstrips32 = (uint32)nstrips64;
++ nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
++ if( nstrips == 0 )
++ return;
+
+- newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
++ newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
+ "for chopped \"StripByteCounts\" array");
+- newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
++ newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
+ "for chopped \"StripOffsets\" array");
+ if (newcounts == NULL || newoffsets == NULL) {
+ /*
+@@ -5562,18 +5560,18 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
+ * Fill the strip information arrays with new bytecounts and offsets
+ * that reflect the broken-up format.
+ */
+- for (strip = 0; strip < nstrips32; strip++) {
++ for (strip = 0; strip < nstrips; strip++) {
+ if (stripbytes > bytecount)
+ stripbytes = bytecount;
+ newcounts[strip] = stripbytes;
+- newoffsets[strip] = offset;
++ newoffsets[strip] = stripbytes ? offset : 0;
+ offset += stripbytes;
+ bytecount -= stripbytes;
+ }
+ /*
+ * Replace old single strip info with multi-strip info.
+ */
+- td->td_stripsperimage = td->td_nstrips = nstrips32;
++ td->td_stripsperimage = td->td_nstrips = nstrips;
+ TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
+
+ _TIFFfree(td->td_stripbytecount);
+diff --git a/libtiff/tif_strip.c b/libtiff/tif_strip.c
+index b6098dd31241..6e9f2ef6ddf2 100644
+--- a/libtiff/tif_strip.c
++++ b/libtiff/tif_strip.c
+@@ -63,15 +63,6 @@ TIFFNumberOfStrips(TIFF* tif)
+ TIFFDirectory *td = &tif->tif_dir;
+ uint32 nstrips;
+
+- /* If the value was already computed and store in td_nstrips, then return it,
+- since ChopUpSingleUncompressedStrip might have altered and resized the
+- since the td_stripbytecount and td_stripoffset arrays to the new value
+- after the initial affectation of td_nstrips = TIFFNumberOfStrips() in
+- tif_dirread.c ~line 3612.
+- See http://bugzilla.maptools.org/show_bug.cgi?id=2587 */
+- if( td->td_nstrips )
+- return td->td_nstrips;
+-
+ nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
+ TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
+ if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2610.patch b/media-libs/tiff/files/tiff-4.0.7-bug2610.patch
new file mode 100644
index 00000000000..f76e83922d6
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2610.patch
@@ -0,0 +1,46 @@
+From ee00edfbe833647d59ad87cac82f1b4c0c902179 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 3 Dec 2016 16:40:01 +0000
+Subject: [PATCH] * tools/tiffcp.c: fix uint32 underflow/overflow that can
+ cause heap-based buffer overflow. Reported by Agostino Sarubbo. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2610
+
+---
+ ChangeLog | 7 +++++++
+ tools/tiffcp.c | 8 ++++----
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/tools/tiffcp.c b/tools/tiffcp.c
+index 142cbb0ecfc2..6d96bb89f555 100644
+--- a/tools/tiffcp.c
++++ b/tools/tiffcp.c
+@@ -1163,7 +1163,7 @@ bad:
+
+ static void
+ cpStripToTile(uint8* out, uint8* in,
+- uint32 rows, uint32 cols, int outskew, int inskew)
++ uint32 rows, uint32 cols, int outskew, int64 inskew)
+ {
+ while (rows-- > 0) {
+ uint32 j = cols;
+@@ -1320,7 +1320,7 @@ DECLAREreadFunc(readContigTilesIntoBuffer)
+ tdata_t tilebuf;
+ uint32 imagew = TIFFScanlineSize(in);
+ uint32 tilew = TIFFTileRowSize(in);
+- int iskew = imagew - tilew;
++ int64 iskew = (int64)imagew - (int64)tilew;
+ uint8* bufp = (uint8*) buf;
+ uint32 tw, tl;
+ uint32 row;
+@@ -1348,7 +1348,7 @@ DECLAREreadFunc(readContigTilesIntoBuffer)
+ status = 0;
+ goto done;
+ }
+- if (colb + tilew > imagew) {
++ if (colb > iskew) {
+ uint32 width = imagew - colb;
+ uint32 oskew = tilew - width;
+ cpStripToTile(bufp + colb,
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2619.patch b/media-libs/tiff/files/tiff-4.0.7-bug2619.patch
new file mode 100644
index 00000000000..0e0053883a3
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2619.patch
@@ -0,0 +1,46 @@
+From cb840651f037c59895b67d44b46a34127bb082dd Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 3 Dec 2016 13:00:03 +0000
+Subject: [PATCH] * tools/tiffcrop.c: fix integer division by zero when
+ BitsPerSample is missing. Reported by Agostina Sarubo. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2619
+
+---
+ ChangeLog | 6 ++++++
+ tools/tiffcrop.c | 8 ++++----
+ 2 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
+index 9122aab37530..21dd08720d77 100644
+--- a/tools/tiffcrop.c
++++ b/tools/tiffcrop.c
+@@ -1164,7 +1164,7 @@ writeBufferToSeparateStrips (TIFF* out, uint8* buf,
+ tdata_t obuf;
+
+ (void) TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
+- (void) TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps);
++ (void) TIFFGetFieldDefaulted(out, TIFFTAG_BITSPERSAMPLE, &bps);
+ bytes_per_sample = (bps + 7) / 8;
+ if( width == 0 ||
+ (uint32)bps * (uint32)spp > TIFF_UINT32_MAX / width ||
+@@ -4760,7 +4760,7 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
+ int i, bytes_per_sample, bytes_per_pixel, shift_width, result = 1;
+ uint32 j;
+ int32 bytes_read = 0;
+- uint16 bps, planar;
++ uint16 bps = 0, planar;
+ uint32 nstrips;
+ uint32 strips_per_sample;
+ uint32 src_rowsize, dst_rowsize, rows_processed, rps;
+@@ -4780,7 +4780,7 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
+ }
+
+ memset (srcbuffs, '\0', sizeof(srcbuffs));
+- TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps);
++ TIFFGetFieldDefaulted(in, TIFFTAG_BITSPERSAMPLE, &bps);
+ TIFFGetFieldDefaulted(in, TIFFTAG_PLANARCONFIG, &planar);
+ TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rps);
+ if (rps > length)
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2620.patch b/media-libs/tiff/files/tiff-4.0.7-bug2620.patch
new file mode 100644
index 00000000000..1b37177c5f9
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2620.patch
@@ -0,0 +1,29 @@
+From 76c4b35f114bc9614700accd22cc4a0b4b6b92d3 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 3 Dec 2016 11:35:56 +0000
+Subject: [PATCH] * tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i
+ (ignore) mode so that the output buffer is correctly incremented to avoid
+ write outside bounds. Reported by Agostino Sarubbo. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2620
+
+---
+ ChangeLog | 7 +++++++
+ tools/tiffcrop.c | 4 ++--
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
+index 722b132cee6d..bdcbd63ed70b 100644
+--- a/tools/tiffcrop.c
++++ b/tools/tiffcrop.c
+@@ -3698,7 +3698,7 @@ static int readContigStripsIntoBuffer (TIFF* in, uint8* buf)
+ (unsigned long) strip, (unsigned long)rows);
+ return 0;
+ }
+- bufp += bytes_read;
++ bufp += stripsize;
+ }
+
+ return 1;
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2621.patch b/media-libs/tiff/files/tiff-4.0.7-bug2621.patch
new file mode 100644
index 00000000000..7bb1d57e3e9
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2621.patch
@@ -0,0 +1,49 @@
+From d7045ed1501ec99c4e56174813bb1cb5c9a559ef Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 3 Dec 2016 12:19:32 +0000
+Subject: [PATCH] * tools/tiffcrop.c: add 3 extra bytes at end of strip buffer
+ in readSeparateStripsIntoBuffer() to avoid read outside of heap allocated
+ buffer. Reported by Agostina Sarubo. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2621
+
+---
+ ChangeLog | 7 +++++++
+ tools/tiffcrop.c | 14 ++++++++++++--
+ 2 files changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
+index bdcbd63ed70b..9122aab37530 100644
+--- a/tools/tiffcrop.c
++++ b/tools/tiffcrop.c
+@@ -4815,10 +4815,17 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
+ nstrips = TIFFNumberOfStrips(in);
+ strips_per_sample = nstrips /spp;
+
++ /* Add 3 padding bytes for combineSeparateSamples32bits */
++ if( (size_t) stripsize > 0xFFFFFFFFU - 3U )
++ {
++ TIFFError("readSeparateStripsIntoBuffer", "Integer overflow when calculating buffer size.");
++ exit(-1);
++ }
++
+ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
+ {
+ srcbuffs[s] = NULL;
+- buff = _TIFFmalloc(stripsize);
++ buff = _TIFFmalloc(stripsize + 3);
+ if (!buff)
+ {
+ TIFFError ("readSeparateStripsIntoBuffer",
+@@ -4827,6 +4834,9 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
+ _TIFFfree (srcbuffs[i]);
+ return 0;
+ }
++ buff[stripsize] = 0;
++ buff[stripsize+1] = 0;
++ buff[stripsize+2] = 0;
+ srcbuffs[s] = buff;
+ }
+
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2627.patch b/media-libs/tiff/files/tiff-4.0.7-bug2627.patch
new file mode 100644
index 00000000000..11a3f3cd3f5
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2627.patch
@@ -0,0 +1,59 @@
+From f88bfadb6d1fac1d0d081058216da659e1f5a628 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sun, 18 Dec 2016 22:28:42 +0000
+Subject: [PATCH] * libtiff/tif_getimage.c: fix potential memory leaks in error
+ code path of TIFFRGBAImageBegin(). Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2627
+
+---
+ ChangeLog | 6 ++++++
+ libtiff/tif_getimage.c | 21 +++++++++------------
+ 2 files changed, 15 insertions(+), 12 deletions(-)
+
+diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
+index c0eb6df0b09a..2ea838556732 100644
+--- a/libtiff/tif_getimage.c
++++ b/libtiff/tif_getimage.c
+@@ -283,6 +283,13 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int stop, char emsg[1024])
+ img->redcmap = NULL;
+ img->greencmap = NULL;
+ img->bluecmap = NULL;
++ img->Map = NULL;
++ img->BWmap = NULL;
++ img->PALmap = NULL;
++ img->ycbcr = NULL;
++ img->cielab = NULL;
++ img->UaToAa = NULL;
++ img->Bitdepth16To8 = NULL;
+ img->req_orientation = ORIENTATION_BOTLEFT; /* It is the default */
+
+ img->tif = tif;
+@@ -468,13 +475,6 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int stop, char emsg[1024])
+ photoTag, img->photometric);
+ goto fail_return;
+ }
+- img->Map = NULL;
+- img->BWmap = NULL;
+- img->PALmap = NULL;
+- img->ycbcr = NULL;
+- img->cielab = NULL;
+- img->UaToAa = NULL;
+- img->Bitdepth16To8 = NULL;
+ TIFFGetField(tif, TIFFTAG_IMAGEWIDTH, &img->width);
+ TIFFGetField(tif, TIFFTAG_IMAGELENGTH, &img->height);
+ TIFFGetFieldDefaulted(tif, TIFFTAG_ORIENTATION, &img->orientation);
+@@ -494,10 +494,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int stop, char emsg[1024])
+ return 1;
+
+ fail_return:
+- _TIFFfree( img->redcmap );
+- _TIFFfree( img->greencmap );
+- _TIFFfree( img->bluecmap );
+- img->redcmap = img->greencmap = img->bluecmap = NULL;
++ TIFFRGBAImageEnd( img );
+ return 0;
+ }
+
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2631.patch b/media-libs/tiff/files/tiff-4.0.7-bug2631.patch
new file mode 100644
index 00000000000..6e1011b072d
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2631.patch
@@ -0,0 +1,34 @@
+From 101253c74cde97203dab28c4f3bd0994cea5804c Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 14 Jan 2017 13:12:33 +0000
+Subject: [PATCH] * tools/raw2tiff.c: avoid integer division by zero. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2631
+
+---
+ ChangeLog | 5 +++++
+ tools/raw2tiff.c | 10 ++++++++--
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/tools/raw2tiff.c b/tools/raw2tiff.c
+index 7298e80a95c9..083e9ee73f0f 100644
+--- a/tools/raw2tiff.c
++++ b/tools/raw2tiff.c
+@@ -408,8 +408,14 @@ guessSize(int fd, TIFFDataType dtype, _TIFF_off_t hdr_size, uint32 nbands,
+ } else if (*width == 0 && *length == 0) {
+ unsigned int fail = 0;
+ fprintf(stderr, "Image width and height are not specified.\n");
++ w = (uint32) sqrt(imagesize / longt);
++ if( w == 0 )
++ {
++ fprintf(stderr, "Too small image size.\n");
++ return -1;
++ }
+
+- for (w = (uint32) sqrt(imagesize / longt);
++ for (;
+ w < sqrt(imagesize * longt);
+ w++) {
+ if (imagesize % w == 0) {
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2633-bug2634.patch b/media-libs/tiff/files/tiff-4.0.7-bug2633-bug2634.patch
new file mode 100644
index 00000000000..d68e86ebea2
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2633-bug2634.patch
@@ -0,0 +1,41 @@
+From 95a32fbbadf54e7527c7e3b66fd603503b29dde9 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 17 Dec 2016 19:45:28 +0000
+Subject: [PATCH] * tools/tiff2ps.c: fix 2 heap-based buffer overflows (in
+ PSDataBW and PSDataColorContig). Reported by Agostino Sarubbo. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2633 and
+ http://bugzilla.maptools.org/show_bug.cgi?id=2634.
+
+---
+ ChangeLog | 7 +++++++
+ tools/tiff2ps.c | 9 +++++++--
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/tools/tiff2ps.c b/tools/tiff2ps.c
+index 82a5d84b41f5..71df4309ee0c 100644
+--- a/tools/tiff2ps.c
++++ b/tools/tiff2ps.c
+@@ -2440,6 +2440,11 @@ PSDataColorContig(FILE* fd, TIFF* tif, uint32 w, uint32 h, int nc)
+ unsigned char *cp, c;
+
+ (void) w;
++ if( es <= 0 )
++ {
++ TIFFError(filename, "Inconsistent value of es: %d", es);
++ return;
++ }
+ tf_buf = (unsigned char *) _TIFFmalloc(tf_bytesperrow);
+ if (tf_buf == NULL) {
+ TIFFError(filename, "No space for scanline buffer");
+@@ -2692,7 +2697,7 @@ PSDataBW(FILE* fd, TIFF* tif, uint32 w, uint32 h)
+
+ if (alpha) {
+ int adjust;
+- while (cc-- > 0) {
++ while (cc-- > 1) {
+ DOBREAK(breaklen, 1, fd);
+ /*
+ * For images with alpha, matte against
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2635.patch b/media-libs/tiff/files/tiff-4.0.7-bug2635.patch
new file mode 100644
index 00000000000..8756115c905
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2635.patch
@@ -0,0 +1,33 @@
+From a7b470d67f2b98599b2c9cd9945db6eea735cc47 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sun, 18 Dec 2016 10:37:59 +0000
+Subject: [PATCH] * tools/tiff2pdf.c: prevent heap-based buffer overflow in -j
+ mode on a paletted image. Note: this fix errors out before the overflow
+ happens. There could probably be a better fix. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2635
+
+---
+ ChangeLog | 7 +++++++
+ tools/tiff2pdf.c | 8 +++++++-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
+index fe8a6ea7e101..afea414bebf6 100644
+--- a/tools/tiff2pdf.c
++++ b/tools/tiff2pdf.c
+@@ -3654,6 +3654,12 @@ tsize_t t2p_sample_realize_palette(T2P* t2p, unsigned char* buffer){
+ uint32 j=0;
+ sample_count=t2p->tiff_width*t2p->tiff_length;
+ component_count=t2p->tiff_samplesperpixel;
++ if( sample_count * component_count > t2p->tiff_datasize )
++ {
++ TIFFError(TIFF2PDF_MODULE, "Error: sample_count * component_count > t2p->tiff_datasize");
++ t2p->t2p_error = T2P_ERR_ERROR;
++ return 1;
++ }
+
+ for(i=sample_count;i>0;i--){
+ palette_offset=buffer[i-1] * component_count;
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2638.patch b/media-libs/tiff/files/tiff-4.0.7-bug2638.patch
new file mode 100644
index 00000000000..15541576c58
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2638.patch
@@ -0,0 +1,29 @@
+From 9f5536843f2ae641542bb81a3023dbc581fac184 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Tue, 20 Dec 2016 17:13:26 +0000
+Subject: [PATCH] * tools/tiff2pdf.c: fix wrong usage of memcpy() that can
+ trigger unspecified behaviour. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2638
+
+---
+ ChangeLog | 6 ++++++
+ tools/tiff2pdf.c | 5 +++--
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
+index afea414bebf6..78ffa77d123a 100644
+--- a/tools/tiff2pdf.c
++++ b/tools/tiff2pdf.c
+@@ -3593,7 +3593,8 @@ void t2p_tile_collapse_left(
+
+ edgescanwidth = (scanwidth * edgetilewidth + (tilewidth - 1))/ tilewidth;
+ for(i=0;i<tilelength;i++){
+- _TIFFmemcpy(
++ /* We use memmove() since there can be overlaps in src and dst buffers for the first items */
++ memmove(
+ &(((char*)buffer)[edgescanwidth*i]),
+ &(((char*)buffer)[scanwidth*i]),
+ edgescanwidth);
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2639.patch b/media-libs/tiff/files/tiff-4.0.7-bug2639.patch
new file mode 100644
index 00000000000..b894775dc70
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2639.patch
@@ -0,0 +1,58 @@
+From 6a61192a98665d870dcb835452cb9c5757ccd27c Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Tue, 20 Dec 2016 17:24:35 +0000
+Subject: [PATCH] * tools/tiff2pdf.c: avoid potential invalid memory read in
+ t2p_writeproc. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2639
+
+---
+ ChangeLog | 6 ++++++
+ tools/tiff2pdf.c | 20 +++++++++++---------
+ 2 files changed, 17 insertions(+), 9 deletions(-)
+
+diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
+index 78ffa77d123a..5348f1a765fe 100644
+--- a/tools/tiff2pdf.c
++++ b/tools/tiff2pdf.c
+@@ -2896,6 +2896,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
+ }
+ if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) {
+ if (count >= 4) {
++ int retTIFFReadRawTile;
+ /* Ignore EOI marker of JpegTables */
+ _TIFFmemcpy(buffer, jpt, count - 2);
+ bufferoffset += count - 2;
+@@ -2903,22 +2904,23 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
+ table_end[0] = buffer[bufferoffset-2];
+ table_end[1] = buffer[bufferoffset-1];
+ xuint32 = bufferoffset;
+- bufferoffset -= 2;
+- bufferoffset += TIFFReadRawTile(
++ bufferoffset -= 2;
++ retTIFFReadRawTile= TIFFReadRawTile(
+ input,
+ tile,
+ (tdata_t) &(((unsigned char*)buffer)[bufferoffset]),
+ -1);
++ if( retTIFFReadRawTile < 0 )
++ {
++ _TIFFfree(buffer);
++ t2p->t2p_error = T2P_ERR_ERROR;
++ return(0);
++ }
++ bufferoffset += retTIFFReadRawTile;
+ /* Overwrite SOI marker of image scan with previously */
+ /* saved end of JpegTables */
+ buffer[xuint32-2]=table_end[0];
+ buffer[xuint32-1]=table_end[1];
+- } else {
+- bufferoffset += TIFFReadRawTile(
+- input,
+- tile,
+- (tdata_t) &(((unsigned char*)buffer)[bufferoffset]),
+- -1);
+ }
+ }
+ t2pWriteFile(output, (tdata_t) buffer, bufferoffset);
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2640.patch b/media-libs/tiff/files/tiff-4.0.7-bug2640.patch
new file mode 100644
index 00000000000..2569f47a54b
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2640.patch
@@ -0,0 +1,28 @@
+From 548b62fae49637b621766c721884d59a55c9a2d8 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Tue, 20 Dec 2016 17:28:17 +0000
+Subject: [PATCH] * tools/tiff2pdf.c: avoid potential heap-based overflow in
+ t2p_readwrite_pdf_image_tile(). Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2640
+
+---
+ ChangeLog | 6 ++++++
+ tools/tiff2pdf.c | 4 ++--
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
+index 5348f1a765fe..8e4e24ef9e82 100644
+--- a/tools/tiff2pdf.c
++++ b/tools/tiff2pdf.c
+@@ -2895,7 +2895,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
+ return(0);
+ }
+ if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) {
+- if (count >= 4) {
++ if (count > 4) {
+ int retTIFFReadRawTile;
+ /* Ignore EOI marker of JpegTables */
+ _TIFFmemcpy(buffer, jpt, count - 2);
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2642-bug2643-bug2646-bug2647.patch b/media-libs/tiff/files/tiff-4.0.7-bug2642-bug2643-bug2646-bug2647.patch
new file mode 100644
index 00000000000..6f01774b9d5
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2642-bug2643-bug2646-bug2647.patch
@@ -0,0 +1,278 @@
+From f049eba476a1ed60adc6534452ccf0022c2d1908 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Wed, 11 Jan 2017 16:09:02 +0000
+Subject: [PATCH] * libtiff/tif_dir.c, tif_dirread.c, tif_dirwrite.c: implement
+ various clampings of double to other data types to avoid undefined behaviour
+ if the output range isn't big enough to hold the input value. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2643
+ http://bugzilla.maptools.org/show_bug.cgi?id=2642
+ http://bugzilla.maptools.org/show_bug.cgi?id=2646
+ http://bugzilla.maptools.org/show_bug.cgi?id=2647
+
+---
+ ChangeLog | 10 ++++++
+ libtiff/tif_dir.c | 20 ++++++++---
+ libtiff/tif_dirread.c | 12 +++++--
+ libtiff/tif_dirwrite.c | 92 ++++++++++++++++++++++++++++++++++++++++++++------
+ 4 files changed, 116 insertions(+), 18 deletions(-)
+
+diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
+index 2574e748b3be..36c7ae57641a 100644
+--- a/libtiff/tif_dir.c
++++ b/libtiff/tif_dir.c
+@@ -31,6 +31,7 @@
+ * (and also some miscellaneous stuff)
+ */
+ #include "tiffiop.h"
++#include <float.h>
+
+ /*
+ * These are used in the backwards compatibility code...
+@@ -154,6 +155,15 @@ bad:
+ return (0);
+ }
+
++static float TIFFClampDoubleToFloat( double val )
++{
++ if( val > FLT_MAX )
++ return FLT_MAX;
++ if( val < -FLT_MAX )
++ return -FLT_MAX;
++ return (float)val;
++}
++
+ static int
+ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
+ {
+@@ -312,13 +322,13 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
+ dblval = va_arg(ap, double);
+ if( dblval < 0 )
+ goto badvaluedouble;
+- td->td_xresolution = (float) dblval;
++ td->td_xresolution = TIFFClampDoubleToFloat( dblval );
+ break;
+ case TIFFTAG_YRESOLUTION:
+ dblval = va_arg(ap, double);
+ if( dblval < 0 )
+ goto badvaluedouble;
+- td->td_yresolution = (float) dblval;
++ td->td_yresolution = TIFFClampDoubleToFloat( dblval );
+ break;
+ case TIFFTAG_PLANARCONFIG:
+ v = (uint16) va_arg(ap, uint16_vap);
+@@ -327,10 +337,10 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
+ td->td_planarconfig = (uint16) v;
+ break;
+ case TIFFTAG_XPOSITION:
+- td->td_xposition = (float) va_arg(ap, double);
++ td->td_xposition = TIFFClampDoubleToFloat( va_arg(ap, double) );
+ break;
+ case TIFFTAG_YPOSITION:
+- td->td_yposition = (float) va_arg(ap, double);
++ td->td_yposition = TIFFClampDoubleToFloat( va_arg(ap, double) );
+ break;
+ case TIFFTAG_RESOLUTIONUNIT:
+ v = (uint16) va_arg(ap, uint16_vap);
+diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
+index eae3430612d0..f8628fd6d5d2 100644
+--- a/libtiff/tif_dirread.c
++++ b/libtiff/tif_dirread.c
+@@ -40,6 +40,7 @@
+ */
+
+ #include "tiffiop.h"
++#include <float.h>
+
+ #define IGNORE 0 /* tag placeholder used below */
+ #define FAILED_FII ((uint32) -1)
+@@ -2406,7 +2407,14 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEnt
+ ma=(double*)origdata;
+ mb=data;
+ for (n=0; n<count; n++)
+- *mb++=(float)(*ma++);
++ {
++ double val = *ma++;
++ if( val > FLT_MAX )
++ val = FLT_MAX;
++ else if( val < -FLT_MAX )
++ val = -FLT_MAX;
++ *mb++=(float)val;
++ }
+ }
+ break;
+ }
+diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c
+index 055324db078f..f7339685130d 100644
+--- a/libtiff/tif_dirwrite.c
++++ b/libtiff/tif_dirwrite.c
+@@ -30,6 +30,7 @@
+ * Directory Write Support Routines.
+ */
+ #include "tiffiop.h"
++#include <float.h>
+
+ #ifdef HAVE_IEEEFP
+ #define TIFFCvtNativeToIEEEFloat(tif, n, fp)
+@@ -939,6 +940,69 @@ bad:
+ return(0);
+ }
+
++static float TIFFClampDoubleToFloat( double val )
++{
++ if( val > FLT_MAX )
++ return FLT_MAX;
++ if( val < -FLT_MAX )
++ return -FLT_MAX;
++ return (float)val;
++}
++
++static int8 TIFFClampDoubleToInt8( double val )
++{
++ if( val > 127 )
++ return 127;
++ if( val < -128 || val != val )
++ return -128;
++ return (int8)val;
++}
++
++static int16 TIFFClampDoubleToInt16( double val )
++{
++ if( val > 32767 )
++ return 32767;
++ if( val < -32768 || val != val )
++ return -32768;
++ return (int16)val;
++}
++
++static int32 TIFFClampDoubleToInt32( double val )
++{
++ if( val > 0x7FFFFFFF )
++ return 0x7FFFFFFF;
++ if( val < -0x7FFFFFFF-1 || val != val )
++ return -0x7FFFFFFF-1;
++ return (int32)val;
++}
++
++static uint8 TIFFClampDoubleToUInt8( double val )
++{
++ if( val < 0 )
++ return 0;
++ if( val > 255 || val != val )
++ return 255;
++ return (uint8)val;
++}
++
++static uint16 TIFFClampDoubleToUInt16( double val )
++{
++ if( val < 0 )
++ return 0;
++ if( val > 65535 || val != val )
++ return 65535;
++ return (uint16)val;
++}
++
++static uint32 TIFFClampDoubleToUInt32( double val )
++{
++ if( val < 0 )
++ return 0;
++ if( val > 0xFFFFFFFFU || val != val )
++ return 0xFFFFFFFFU;
++ return (uint32)val;
++}
++
+ static int
+ TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
+ {
+@@ -959,7 +1023,7 @@ TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* di
+ if (tif->tif_dir.td_bitspersample<=32)
+ {
+ for (i = 0; i < count; ++i)
+- ((float*)conv)[i] = (float)value[i];
++ ((float*)conv)[i] = TIFFClampDoubleToFloat(value[i]);
+ ok = TIFFWriteDirectoryTagFloatArray(tif,ndir,dir,tag,count,(float*)conv);
+ }
+ else
+@@ -971,19 +1035,19 @@ TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* di
+ if (tif->tif_dir.td_bitspersample<=8)
+ {
+ for (i = 0; i < count; ++i)
+- ((int8*)conv)[i] = (int8)value[i];
++ ((int8*)conv)[i] = TIFFClampDoubleToInt8(value[i]);
+ ok = TIFFWriteDirectoryTagSbyteArray(tif,ndir,dir,tag,count,(int8*)conv);
+ }
+ else if (tif->tif_dir.td_bitspersample<=16)
+ {
+ for (i = 0; i < count; ++i)
+- ((int16*)conv)[i] = (int16)value[i];
++ ((int16*)conv)[i] = TIFFClampDoubleToInt16(value[i]);
+ ok = TIFFWriteDirectoryTagSshortArray(tif,ndir,dir,tag,count,(int16*)conv);
+ }
+ else
+ {
+ for (i = 0; i < count; ++i)
+- ((int32*)conv)[i] = (int32)value[i];
++ ((int32*)conv)[i] = TIFFClampDoubleToInt32(value[i]);
+ ok = TIFFWriteDirectoryTagSlongArray(tif,ndir,dir,tag,count,(int32*)conv);
+ }
+ break;
+@@ -991,19 +1055,19 @@ TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* di
+ if (tif->tif_dir.td_bitspersample<=8)
+ {
+ for (i = 0; i < count; ++i)
+- ((uint8*)conv)[i] = (uint8)value[i];
++ ((uint8*)conv)[i] = TIFFClampDoubleToUInt8(value[i]);
+ ok = TIFFWriteDirectoryTagByteArray(tif,ndir,dir,tag,count,(uint8*)conv);
+ }
+ else if (tif->tif_dir.td_bitspersample<=16)
+ {
+ for (i = 0; i < count; ++i)
+- ((uint16*)conv)[i] = (uint16)value[i];
++ ((uint16*)conv)[i] = TIFFClampDoubleToUInt16(value[i]);
+ ok = TIFFWriteDirectoryTagShortArray(tif,ndir,dir,tag,count,(uint16*)conv);
+ }
+ else
+ {
+ for (i = 0; i < count; ++i)
+- ((uint32*)conv)[i] = (uint32)value[i];
++ ((uint32*)conv)[i] = TIFFClampDoubleToUInt32(value[i]);
+ ok = TIFFWriteDirectoryTagLongArray(tif,ndir,dir,tag,count,(uint32*)conv);
+ }
+ break;
+@@ -2102,12 +2166,17 @@ TIFFWriteDirectoryTagCheckedRational(TIFF* tif, uint32* ndir, TIFFDirEntry* dir,
+ TIFFErrorExt(tif->tif_clientdata,module,"Negative value is illegal");
+ return 0;
+ }
++ else if( value != value )
++ {
++ TIFFErrorExt(tif->tif_clientdata,module,"Not-a-number value is illegal");
++ return 0;
++ }
+ else if (value==0.0)
+ {
+ m[0]=0;
+ m[1]=1;
+ }
+- else if (value==(double)(uint32)value)
++ else if (value <= 0xFFFFFFFFU && value==(double)(uint32)value)
+ {
+ m[0]=(uint32)value;
+ m[1]=1;
+@@ -2148,12 +2217,13 @@ TIFFWriteDirectoryTagCheckedRationalArray(TIFF* tif, uint32* ndir, TIFFDirEntry*
+ }
+ for (na=value, nb=m, nc=0; nc<count; na++, nb+=2, nc++)
+ {
+- if (*na<=0.0)
++ if (*na<=0.0 || *na != *na)
+ {
+ nb[0]=0;
+ nb[1]=1;
+ }
+- else if (*na==(float)(uint32)(*na))
++ else if (*na >= 0 && *na <= (float)0xFFFFFFFFU &&
++ *na==(float)(uint32)(*na))
+ {
+ nb[0]=(uint32)(*na);
+ nb[1]=1;
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2644.patch b/media-libs/tiff/files/tiff-4.0.7-bug2644.patch
new file mode 100644
index 00000000000..b4ec01a3217
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2644.patch
@@ -0,0 +1,45 @@
+From 699097af4e22e48fc78ae7ae02807ec37f0d31fe Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Wed, 11 Jan 2017 13:28:01 +0000
+Subject: [PATCH] * libtiff/tif_dirread.c: avoid division by floating point 0
+ in TIFFReadDirEntryCheckedRational() and TIFFReadDirEntryCheckedSrational(),
+ and return 0 in that case (instead of infinity as before presumably)
+ Apparently some sanitizers do not like those divisions by zero. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2644
+
+---
+ ChangeLog | 8 ++++++++
+ libtiff/tif_dirread.c | 12 +++++++++---
+ 2 files changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
+index f2905286c0d0..eae3430612d0 100644
+--- a/libtiff/tif_dirread.c
++++ b/libtiff/tif_dirread.c
+@@ -2872,7 +2872,10 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFD
+ m.l = direntry->tdir_offset.toff_long8;
+ if (tif->tif_flags&TIFF_SWAB)
+ TIFFSwabArrayOfLong(m.i,2);
+- if (m.i[0]==0)
++ /* Not completely sure what we should do when m.i[1]==0, but some */
++ /* sanitizers do not like division by 0.0: */
++ /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
++ if (m.i[0]==0 || m.i[1]==0)
+ *value=0.0;
+ else
+ *value=(double)m.i[0]/(double)m.i[1];
+@@ -2900,7 +2903,10 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFF
+ m.l=direntry->tdir_offset.toff_long8;
+ if (tif->tif_flags&TIFF_SWAB)
+ TIFFSwabArrayOfLong(m.i,2);
+- if ((int32)m.i[0]==0)
++ /* Not completely sure what we should do when m.i[1]==0, but some */
++ /* sanitizers do not like division by 0.0: */
++ /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
++ if ((int32)m.i[0]==0 || m.i[1]==0)
+ *value=0.0;
+ else
+ *value=(double)((int32)m.i[0])/(double)m.i[1];
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2648.patch b/media-libs/tiff/files/tiff-4.0.7-bug2648.patch
new file mode 100644
index 00000000000..a3e2f59dc27
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2648.patch
@@ -0,0 +1,33 @@
+From 569ffefa61f3237fa2221730621c869216c465a6 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Wed, 11 Jan 2017 16:13:50 +0000
+Subject: [PATCH] * libtiff/tif_jpeg.c: validate BitsPerSample in
+ JPEGSetupEncode() to avoid undefined behaviour caused by invalid shift
+ exponent. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2648
+
+---
+ ChangeLog | 6 ++++++
+ libtiff/tif_jpeg.c | 9 ++++++++-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/libtiff/tif_jpeg.c b/libtiff/tif_jpeg.c
+index 09ef4949f9ee..e45e2a4e17f8 100644
+--- a/libtiff/tif_jpeg.c
++++ b/libtiff/tif_jpeg.c
+@@ -1632,6 +1632,13 @@ JPEGSetupEncode(TIFF* tif)
+ "Invalig horizontal/vertical sampling value");
+ return (0);
+ }
++ if( td->td_bitspersample > 16 )
++ {
++ TIFFErrorExt(tif->tif_clientdata, module,
++ "BitsPerSample %d not allowed for JPEG",
++ td->td_bitspersample);
++ return (0);
++ }
+
+ /*
+ * A ReferenceBlackWhite field *must* be present since the
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2650-2.patch b/media-libs/tiff/files/tiff-4.0.7-bug2650-2.patch
new file mode 100644
index 00000000000..eba5b8f50ba
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2650-2.patch
@@ -0,0 +1,26 @@
+From 08e5d199b0a1c80fc81a1cc718e5d9d019517e37 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Wed, 11 Jan 2017 17:48:11 +0000
+Subject: [PATCH] Initialize variable to fix MSVC warning (caused by previous
+ commit)
+
+---
+ libtiff/tif_read.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
+index 8c5af6a8f5f7..b2edb029a90c 100644
+--- a/libtiff/tif_read.c
++++ b/libtiff/tif_read.c
+@@ -420,7 +420,7 @@ TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size,
+ return ((tmsize_t)(-1));
+ }
+ } else {
+- tmsize_t ma;
++ tmsize_t ma = 0;
+ tmsize_t n;
+ if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||
+ ((ma=(tmsize_t)td->td_stripoffset[strip])>tif->tif_size))
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2650.patch b/media-libs/tiff/files/tiff-4.0.7-bug2650.patch
new file mode 100644
index 00000000000..2aac26987d5
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2650.patch
@@ -0,0 +1,54 @@
+From 5368b55d0f88a34ede3d21782d3142b2e11e6eb9 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Wed, 11 Jan 2017 16:33:34 +0000
+Subject: [PATCH] * libtiff/tif_read.c: avoid potential undefined behaviour on
+ signed integer addition in TIFFReadRawStrip1() in isMapped() case. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2650
+
+---
+ ChangeLog | 6 ++++++
+ libtiff/tif_read.c | 29 +++++++++++++++++++----------
+ 2 files changed, 25 insertions(+), 10 deletions(-)
+
+diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
+index 29a311db0cb7..8c5af6a8f5f7 100644
+--- a/libtiff/tif_read.c
++++ b/libtiff/tif_read.c
+@@ -420,16 +420,25 @@ TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size,
+ return ((tmsize_t)(-1));
+ }
+ } else {
+- tmsize_t ma,mb;
++ tmsize_t ma;
+ tmsize_t n;
+- ma=(tmsize_t)td->td_stripoffset[strip];
+- mb=ma+size;
+- if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||(ma>tif->tif_size))
+- n=0;
+- else if ((mb<ma)||(mb<size)||(mb>tif->tif_size))
+- n=tif->tif_size-ma;
+- else
+- n=size;
++ if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||
++ ((ma=(tmsize_t)td->td_stripoffset[strip])>tif->tif_size))
++ {
++ n=0;
++ }
++ else if( ma > TIFF_TMSIZE_T_MAX - size )
++ {
++ n=0;
++ }
++ else
++ {
++ tmsize_t mb=ma+size;
++ if (mb>tif->tif_size)
++ n=tif->tif_size-ma;
++ else
++ n=size;
++ }
+ if (n!=size) {
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
+ TIFFErrorExt(tif->tif_clientdata, module,
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2651.patch b/media-libs/tiff/files/tiff-4.0.7-bug2651.patch
new file mode 100644
index 00000000000..1b800189c59
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2651.patch
@@ -0,0 +1,86 @@
+From 669faf71833c4c2e72774b2e732ca4d28b149c83 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Wed, 11 Jan 2017 19:02:49 +0000
+Subject: [PATCH] * libtiff/tiffiop.h, tif_unix.c, tif_win32.c, tif_vms.c: add
+ _TIFFcalloc()
+
+* libtiff/tif_read.c: TIFFReadBufferSetup(): use _TIFFcalloc() to zero
+initialize tif_rawdata.
+Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2651
+---
+ ChangeLog | 8 ++++++++
+ libtiff/tif_read.c | 6 ++++--
+ libtiff/tif_unix.c | 10 +++++++++-
+ libtiff/tif_vms.c | 10 +++++++++-
+ libtiff/tif_win32.c | 10 +++++++++-
+ libtiff/tiffio.h | 3 ++-
+ 6 files changed, 41 insertions(+), 6 deletions(-)
+
+diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
+index b2edb029a90c..6a8c7daf3dfa 100644
+--- a/libtiff/tif_read.c
++++ b/libtiff/tif_read.c
+@@ -985,7 +985,9 @@ TIFFReadBufferSetup(TIFF* tif, void* bp, tmsize_t size)
+ "Invalid buffer size");
+ return (0);
+ }
+- tif->tif_rawdata = (uint8*) _TIFFmalloc(tif->tif_rawdatasize);
++ /* Initialize to zero to avoid uninitialized buffers in case of */
++ /* short reads (http://bugzilla.maptools.org/show_bug.cgi?id=2651) */
++ tif->tif_rawdata = (uint8*) _TIFFcalloc(1, tif->tif_rawdatasize);
+ tif->tif_flags |= TIFF_MYBUFFER;
+ }
+ if (tif->tif_rawdata == NULL) {
+diff --git a/libtiff/tif_unix.c b/libtiff/tif_unix.c
+index 81e9d6653c2a..80c437cfa37a 100644
+--- a/libtiff/tif_unix.c
++++ b/libtiff/tif_unix.c
+@@ -316,6 +316,14 @@ _TIFFmalloc(tmsize_t s)
+ return (malloc((size_t) s));
+ }
+
++void* _TIFFcalloc(tmsize_t nmemb, tmsize_t siz)
++{
++ if( nmemb == 0 || siz == 0 )
++ return ((void *) NULL);
++
++ return calloc((size_t) nmemb, (size_t)siz);
++}
++
+ void
+ _TIFFfree(void* p)
+ {
+diff --git a/libtiff/tif_win32.c b/libtiff/tif_win32.c
+index 24b824f1bd56..090baed87135 100644
+--- a/libtiff/tif_win32.c
++++ b/libtiff/tif_win32.c
+@@ -360,6 +360,14 @@ _TIFFmalloc(tmsize_t s)
+ return (malloc((size_t) s));
+ }
+
++void* _TIFFcalloc(tmsize_t nmemb, tmsize_t siz)
++{
++ if( nmemb == 0 || siz == 0 )
++ return ((void *) NULL);
++
++ return calloc((size_t) nmemb, (size_t)siz);
++}
++
+ void
+ _TIFFfree(void* p)
+ {
+diff --git a/libtiff/tiffio.h b/libtiff/tiffio.h
+index 6e508181dbce..ef61b5c06a03 100644
+--- a/libtiff/tiffio.h
++++ b/libtiff/tiffio.h
+@@ -293,6 +293,7 @@ extern TIFFCodec* TIFFGetConfiguredCODECs(void);
+ */
+
+ extern void* _TIFFmalloc(tmsize_t s);
++extern void* _TIFFcalloc(tmsize_t nmemb, tmsize_t siz);
+ extern void* _TIFFrealloc(void* p, tmsize_t s);
+ extern void _TIFFmemset(void* p, int v, tmsize_t c);
+ extern void _TIFFmemcpy(void* d, const void* s, tmsize_t c);
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2653.patch b/media-libs/tiff/files/tiff-4.0.7-bug2653.patch
new file mode 100644
index 00000000000..b65a94daeac
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2653.patch
@@ -0,0 +1,33 @@
+From 5083c41f3a6824f392adf3a6dce1548afded4211 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Wed, 11 Jan 2017 12:15:01 +0000
+Subject: [PATCH] * libtiff/tif_jpeg.c: avoid integer division by zero in
+ JPEGSetupEncode() when horizontal or vertical sampling is set to 0. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2653
+
+---
+ ChangeLog | 6 ++++++
+ libtiff/tif_jpeg.c | 9 ++++++++-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/libtiff/tif_jpeg.c b/libtiff/tif_jpeg.c
+index dc4364c821a4..09ef4949f9ee 100644
+--- a/libtiff/tif_jpeg.c
++++ b/libtiff/tif_jpeg.c
+@@ -1626,6 +1626,13 @@ JPEGSetupEncode(TIFF* tif)
+ case PHOTOMETRIC_YCBCR:
+ sp->h_sampling = td->td_ycbcrsubsampling[0];
+ sp->v_sampling = td->td_ycbcrsubsampling[1];
++ if( sp->h_sampling == 0 || sp->v_sampling == 0 )
++ {
++ TIFFErrorExt(tif->tif_clientdata, module,
++ "Invalig horizontal/vertical sampling value");
++ return (0);
++ }
++
+ /*
+ * A ReferenceBlackWhite field *must* be present since the
+ * default value is inappropriate for YCbCr. Fill in the
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2658.patch b/media-libs/tiff/files/tiff-4.0.7-bug2658.patch
new file mode 100644
index 00000000000..9f2bb6a50ee
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2658.patch
@@ -0,0 +1,33 @@
+From 928f0b0b2881ac32b32d9e165e88e3c9aed0fb9c Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Wed, 11 Jan 2017 16:38:26 +0000
+Subject: [PATCH] =?UTF-8?q?*=20libtiff/tif=5Fgetimage.c:=20add=20explicit?=
+ =?UTF-8?q?=20uint32=20cast=20in=20putagreytile=20to=20avoid=20UndefinedBe?=
+ =?UTF-8?q?haviorSanitizer=20warning.=20Patch=20by=20Nicol=C3=A1s=20Pe?=
+ =?UTF-8?q?=C3=B1a.=20Fixes=20http://bugzilla.maptools.org/show=5Fbug.cgi?=
+ =?UTF-8?q?=3Fid=3D2658?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+---
+ ChangeLog | 7 +++++++
+ libtiff/tif_getimage.c | 4 ++--
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
+index 2ea838556732..52a2402f7171 100644
+--- a/libtiff/tif_getimage.c
++++ b/libtiff/tif_getimage.c
+@@ -1302,7 +1302,7 @@ DECLAREContigPutFunc(putagreytile)
+ while (h-- > 0) {
+ for (x = w; x-- > 0;)
+ {
+- *cp++ = BWmap[*pp][0] & (*(pp+1) << 24 | ~A1);
++ *cp++ = BWmap[*pp][0] & ((uint32)*(pp+1) << 24 | ~A1);
+ pp += samplesperpixel;
+ }
+ cp += toskew;
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2659-2.patch b/media-libs/tiff/files/tiff-4.0.7-bug2659-2.patch
new file mode 100644
index 00000000000..539536fe4ff
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2659-2.patch
@@ -0,0 +1,41 @@
+From 41236c5f744eaa691e23e55f5a5dd556a65e211e Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Thu, 12 Jan 2017 19:23:20 +0000
+Subject: [PATCH] * libtiff/tif_ojpeg.c: fix leak in
+ OJPEGReadHeaderInfoSecTablesQTable, OJPEGReadHeaderInfoSecTablesDcTable and
+ OJPEGReadHeaderInfoSecTablesAcTable
+
+---
+ ChangeLog | 3 ++-
+ libtiff/tif_ojpeg.c | 8 +++++++-
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
+index ac70d1b14c4f..bd4cff5d8921 100644
+--- a/libtiff/tif_ojpeg.c
++++ b/libtiff/tif_ojpeg.c
+@@ -1790,7 +1790,10 @@ OJPEGReadHeaderInfoSecTablesQTable(TIFF* tif)
+ TIFFSeekFile(tif,sp->qtable_offset[m],SEEK_SET);
+ p=(uint32)TIFFReadFile(tif,&ob[sizeof(uint32)+5],64);
+ if (p!=64)
++ {
++ _TIFFfree(ob);
+ return(0);
++ }
+ sp->qtable[m]=ob;
+ sp->sof_tq[m]=m;
+ }
+@@ -1854,7 +1857,10 @@ OJPEGReadHeaderInfoSecTablesDcTable(TIFF* tif)
+ rb[sizeof(uint32)+5+n]=o[n];
+ p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q);
+ if (p!=q)
++ {
++ _TIFFfree(rb);
+ return(0);
++ }
+ sp->dctable[m]=rb;
+ sp->sos_tda[m]=(m<<4);
+ }
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2659.patch b/media-libs/tiff/files/tiff-4.0.7-bug2659.patch
new file mode 100644
index 00000000000..8afab46b888
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2659.patch
@@ -0,0 +1,34 @@
+From 7c501dbfb5315f31798f9123026210260cbe7432 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Thu, 12 Jan 2017 17:43:25 +0000
+Subject: [PATCH] =?UTF-8?q?*=20libtiff/tif=5Fojpeg.c:=20fix=20leak=20in=20?=
+ =?UTF-8?q?OJPEGReadHeaderInfoSecTablesAcTable=20when=20read=20fails.=20Pa?=
+ =?UTF-8?q?tch=20by=20Nicol=C3=A1s=20Pe=C3=B1a.=20Fixes=20http://bugzilla.?=
+ =?UTF-8?q?maptools.org/show=5Fbug.cgi=3Fid=3D2659?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+---
+ ChangeLog | 7 +++++++
+ libtiff/tif_ojpeg.c | 5 ++++-
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
+index 93839d8f3e11..ac70d1b14c4f 100644
+--- a/libtiff/tif_ojpeg.c
++++ b/libtiff/tif_ojpeg.c
+@@ -1918,7 +1918,10 @@ OJPEGReadHeaderInfoSecTablesAcTable(TIFF* tif)
+ rb[sizeof(uint32)+5+n]=o[n];
+ p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q);
+ if (p!=q)
++ {
++ _TIFFfree(rb);
+ return(0);
++ }
+ sp->actable[m]=rb;
+ sp->sos_tda[m]=(sp->sos_tda[m]|m);
+ }
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2665.patch b/media-libs/tiff/files/tiff-4.0.7-bug2665.patch
new file mode 100644
index 00000000000..020adca8e7a
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-bug2665.patch
@@ -0,0 +1,43 @@
+From e345ce2ad81c85eb8e469b7b959067b2681957ca Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 18 Feb 2017 20:30:26 +0000
+Subject: [PATCH] =?UTF-8?q?*=20libtiff/tif=5Fpixarlog.c:=20fix=20memory=20?=
+ =?UTF-8?q?leak=20in=20error=20code=20path=20of=20PixarLogSetupDecode().?=
+ =?UTF-8?q?=20Patch=20by=20Nicol=C3=A1s=20Pe=C3=B1a.=20Fixes=20http://bugz?=
+ =?UTF-8?q?illa.maptools.org/show=5Fbug.cgi=3Fid=3D2665?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+---
+ ChangeLog | 6 ++++++
+ libtiff/tif_pixarlog.c | 8 +++++++-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
+index 9836dce63450..972ee75e0324 100644
+--- a/libtiff/tif_pixarlog.c
++++ b/libtiff/tif_pixarlog.c
+@@ -699,6 +699,9 @@ PixarLogSetupDecode(TIFF* tif)
+ if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN)
+ sp->user_datafmt = PixarLogGuessDataFmt(td);
+ if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN) {
++ _TIFFfree(sp->tbuf);
++ sp->tbuf = NULL;
++ sp->tbuf_size = 0;
+ TIFFErrorExt(tif->tif_clientdata, module,
+ "PixarLog compression can't handle bits depth/data format combination (depth: %d)",
+ td->td_bitspersample);
+@@ -706,6 +709,9 @@ PixarLogSetupDecode(TIFF* tif)
+ }
+
+ if (inflateInit(&sp->stream) != Z_OK) {
++ _TIFFfree(sp->tbuf);
++ sp->tbuf = NULL;
++ sp->tbuf_size = 0;
+ TIFFErrorExt(tif->tif_clientdata, module, "%s", sp->stream.msg ? sp->stream.msg : "(null)");
+ return (0);
+ } else {
+--
+2.12.0
+
diff --git a/media-libs/tiff/files/tiff-4.0.7-hylafax-hack.patch b/media-libs/tiff/files/tiff-4.0.7-hylafax-hack.patch
new file mode 100644
index 00000000000..69158200ac7
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-hylafax-hack.patch
@@ -0,0 +1,38 @@
+https://bugs.gentoo.org/612172
+
+From 96bb01f5d834e0b01c0231768c43b8d309aede34 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Tue, 13 Dec 2016 18:15:48 +0000
+Subject: [PATCH] * libtiff/tif_fax3.h: revert change done on 2016-01-09 that
+ made Param member of TIFFFaxTabEnt structure a uint16 to reduce size of the
+ binary. It happens that the Hylafax software uses the tables that follow this
+ typedef (TIFFFaxMainTable, TIFFFaxWhiteTable, TIFFFaxBlackTable), also they
+ are not in a public libtiff header. Raised by Lee Howard. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2636
+
+---
+ ChangeLog | 10 ++++++++++
+ libtiff/tif_fax3.h | 6 ++++--
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/libtiff/tif_fax3.h b/libtiff/tif_fax3.h
+index e0b2ca6bfc9d..45ce43f1cf2e 100644
+--- a/libtiff/tif_fax3.h
++++ b/libtiff/tif_fax3.h
+@@ -81,10 +81,12 @@ extern void _TIFFFax3fillruns(unsigned char*, uint32*, uint32*, uint32);
+ #define S_MakeUp 11
+ #define S_EOL 12
+
++/* WARNING: do not change the layout of this structure as the Halyfax software */
++/* really depends on it. See http://bugzilla.maptools.org/show_bug.cgi?id=2636 */
+ typedef struct { /* state table entry */
+ unsigned char State; /* see above */
+ unsigned char Width; /* width of code in bits */
+- uint16 Param; /* unsigned 16-bit run length in bits */
++ uint32 Param; /* unsigned 32-bit run length in bits (holds on 16 bit actually, but cannot be changed. See above warning) */
+ } TIFFFaxTabEnt;
+
+ extern const TIFFFaxTabEnt TIFFFaxMainTable[];
+--
+2.12.0
+
diff --git a/media-libs/tiff/tiff-4.0.7-r1.ebuild b/media-libs/tiff/tiff-4.0.7-r1.ebuild
new file mode 100644
index 00000000000..ca37cb0af05
--- /dev/null
+++ b/media-libs/tiff/tiff-4.0.7-r1.ebuild
@@ -0,0 +1,112 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+inherit autotools eutils libtool multilib-minimal
+
+DESCRIPTION="Tag Image File Format (TIFF) library"
+HOMEPAGE="http://libtiff.maptools.org"
+SRC_URI="http://download.osgeo.org/libtiff/${P}.tar.gz
+ ftp://ftp.remotesensing.org/pub/libtiff/${P}.tar.gz"
+
+LICENSE="libtiff"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~x64-solaris ~x86-solaris"
+IUSE="+cxx jbig jpeg lzma static-libs test zlib"
+
+RDEPEND="jpeg? ( >=virtual/jpeg-0-r2:0=[${MULTILIB_USEDEP}] )
+ jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
+ lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
+ zlib? ( >=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}] )
+ abi_x86_32? (
+ !<=app-emulation/emul-linux-x86-baselibs-20130224-r9
+ !app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)]
+ )"
+DEPEND="${RDEPEND}"
+
+REQUIRED_USE="test? ( jpeg )" #483132
+
+PATCHES=(
+ "${FILESDIR}"/${P}-CVE-2016-10266.patch
+ "${FILESDIR}"/${P}-bug2598.patch
+ "${FILESDIR}"/${P}-bug2604.patch
+ "${FILESDIR}"/${P}-bug2608.patch
+ "${FILESDIR}"/${P}-CVE-2016-10267.patch
+ "${FILESDIR}"/${P}-bug2620.patch
+ "${FILESDIR}"/${P}-bug2621.patch
+ "${FILESDIR}"/${P}-bug2619.patch
+ "${FILESDIR}"/${P}-bug2594.patch
+ "${FILESDIR}"/${P}-bug2597.patch
+ "${FILESDIR}"/${P}-bug2599.patch
+ "${FILESDIR}"/${P}-bug2607.patch
+ "${FILESDIR}"/${P}-bug2610.patch
+ "${FILESDIR}"/${P}-bug2605.patch
+ "${FILESDIR}"/${P}-hylafax-hack.patch #612172
+ "${FILESDIR}"/${P}-bug2633-bug2634.patch
+ "${FILESDIR}"/${P}-bug2635.patch
+ "${FILESDIR}"/${P}-bug2627.patch
+ "${FILESDIR}"/${P}-bug2638.patch
+ "${FILESDIR}"/${P}-bug2639.patch
+ "${FILESDIR}"/${P}-bug2640.patch
+ "${FILESDIR}"/${P}-bug2653.patch
+ "${FILESDIR}"/${P}-bug2535.patch
+ "${FILESDIR}"/${P}-bug2644.patch
+ "${FILESDIR}"/${P}-bug2642-bug2643-bug2646-bug2647.patch
+ "${FILESDIR}"/${P}-bug2648.patch
+ "${FILESDIR}"/${P}-bug2650.patch
+ "${FILESDIR}"/${P}-bug2658.patch
+ "${FILESDIR}"/${P}-bug2650-2.patch
+ "${FILESDIR}"/${P}-bug2651.patch
+ "${FILESDIR}"/${P}-CVE-2017-5225.patch #610330
+ "${FILESDIR}"/${P}-bug2130.patch
+ "${FILESDIR}"/${P}-bug2659.patch
+ "${FILESDIR}"/${P}-bug2659-2.patch
+ "${FILESDIR}"/${P}-bug2631.patch
+ "${FILESDIR}"/${P}-bug2665.patch
+)
+
+MULTILIB_WRAPPED_HEADERS=(
+ /usr/include/tiffconf.h
+)
+
+src_prepare() {
+ default
+
+ # tiffcp-thumbnail.sh fails as thumbnail binary doesn't get built anymore since tiff-4.0.7
+ sed '/tiffcp-thumbnail\.sh/d' -i test/Makefile.am || die
+
+ eautoreconf
+}
+
+multilib_src_configure() {
+ ECONF_SOURCE="${S}" econf \
+ $(use_enable static-libs static) \
+ $(use_enable zlib) \
+ $(use_enable jpeg) \
+ $(use_enable jbig) \
+ $(use_enable lzma) \
+ $(use_enable cxx) \
+ --without-x
+
+ # remove useless subdirs
+ if ! multilib_is_native_abi ; then
+ sed -i \
+ -e 's/ tools//' \
+ -e 's/ contrib//' \
+ -e 's/ man//' \
+ -e 's/ html//' \
+ Makefile || die
+ fi
+}
+
+multilib_src_test() {
+ if ! multilib_is_native_abi ; then
+ emake -C tools
+ fi
+ emake check
+}
+
+multilib_src_install_all() {
+ prune_libtool_files --all
+ rm -f "${ED}"/usr/share/doc/${PF}/{COPYRIGHT,README*,RELEASE-DATE,TODO,VERSION}
+}
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2017-03-31 3:43 Mike Frysinger
0 siblings, 0 replies; 14+ messages in thread
From: Mike Frysinger @ 2017-03-31 3:43 UTC (permalink / raw
To: gentoo-commits
commit: 7ec3d94b9cb12fb65a0274021d154b9b0d7977c8
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 31 03:43:18 2017 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Fri Mar 31 03:43:18 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7ec3d94b
media-libs/tiff: pull in upstream fix for fax2tiff #598938
media-libs/tiff/files/tiff-4.0.7-fax2tiff.patch | 39 +++++++++++++++++++++++++
media-libs/tiff/tiff-4.0.7-r1.ebuild | 1 +
2 files changed, 40 insertions(+)
diff --git a/media-libs/tiff/files/tiff-4.0.7-fax2tiff.patch b/media-libs/tiff/files/tiff-4.0.7-fax2tiff.patch
new file mode 100644
index 00000000000..f3476e98d6f
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.7-fax2tiff.patch
@@ -0,0 +1,39 @@
+https://bugs.gentoo.org/598938
+
+From 82c53c6f19d8d7854b9b88aa16802f31b1cc258c Mon Sep 17 00:00:00 2001
+From: Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
+Date: Sun, 20 Nov 2016 18:04:52 +0000
+Subject: [PATCH] =?UTF-8?q?*=20tools/fax2tiff.c=20(main):=20Applied=20patc?=
+ =?UTF-8?q?h=20by=20J=C3=B6rg=20Ahrens=20to=20fix=20passing=20client=20dat?=
+ =?UTF-8?q?a=20for=20Win32=20builds=20using=20tif=5Fwin32.c=20(USE=5FWIN32?=
+ =?UTF-8?q?=5FFILEIO=20defined)=20for=20file=20I/O.=20=20Patch=20was=20pro?=
+ =?UTF-8?q?vided=20via=20email=20on=20November=2020,=202016.?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+---
+ ChangeLog | 7 +++++++
+ tools/fax2tiff.c | 5 +++--
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/tools/fax2tiff.c b/tools/fax2tiff.c
+index e00de5277bc2..01f85540ac9c 100644
+--- a/tools/fax2tiff.c
++++ b/tools/fax2tiff.c
+@@ -283,10 +283,11 @@ main(int argc, char* argv[])
+ }
+ #if defined(_WIN32) && defined(USE_WIN32_FILEIO)
+ client_data.fh = _get_osfhandle(fileno(in));
++ TIFFSetClientdata(faxTIFF, (thandle_t) client_data.fh);
+ #else
+ client_data.fd = fileno(in);
++ TIFFSetClientdata(faxTIFF, (thandle_t) client_data.fd);
+ #endif
+- TIFFSetClientdata(faxTIFF, (thandle_t) &client_data);
+ TIFFSetFileName(faxTIFF, (const char*)argv[optind]);
+ TIFFSetField(out, TIFFTAG_IMAGEWIDTH, xsize);
+ TIFFSetField(out, TIFFTAG_BITSPERSAMPLE, 1);
+--
+2.12.0
+
diff --git a/media-libs/tiff/tiff-4.0.7-r1.ebuild b/media-libs/tiff/tiff-4.0.7-r1.ebuild
index ca37cb0af05..dbf9257f2cc 100644
--- a/media-libs/tiff/tiff-4.0.7-r1.ebuild
+++ b/media-libs/tiff/tiff-4.0.7-r1.ebuild
@@ -27,6 +27,7 @@ DEPEND="${RDEPEND}"
REQUIRED_USE="test? ( jpeg )" #483132
PATCHES=(
+ "${FILESDIR}"/${P}-fax2tiff.patch #598938
"${FILESDIR}"/${P}-CVE-2016-10266.patch
"${FILESDIR}"/${P}-bug2598.patch
"${FILESDIR}"/${P}-bug2604.patch
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2018-01-26 22:25 Mike Frysinger
0 siblings, 0 replies; 14+ messages in thread
From: Mike Frysinger @ 2018-01-26 22:25 UTC (permalink / raw
To: gentoo-commits
commit: eb1365ccd7332af4595538bc6b2244058db7b79b
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 26 03:54:26 2018 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Fri Jan 26 22:25:18 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=eb1365cc
media-libs/tiff: add upstream fix for CVE-2017-9935 #624696
Also drop some pdfium patches that they dropped when moving to 4.0.8.
Bug: https://bugs.gentoo.org/624696
.../tiff/files/tiff-4.0.9-CVE-2017-9935.patch | 153 +++++++++++++++++++++
media-libs/tiff/tiff-4.0.9-r1.ebuild | 79 +++++++++++
2 files changed, 232 insertions(+)
diff --git a/media-libs/tiff/files/tiff-4.0.9-CVE-2017-9935.patch b/media-libs/tiff/files/tiff-4.0.9-CVE-2017-9935.patch
new file mode 100644
index 00000000000..96a10aa9b37
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.9-CVE-2017-9935.patch
@@ -0,0 +1,153 @@
+From 3dd8f6a357981a4090f126ab9025056c938b6940 Mon Sep 17 00:00:00 2001
+From: Brian May <brian@linuxpenguins.xyz>
+Date: Thu, 7 Dec 2017 07:46:47 +1100
+Subject: [PATCH] tiff2pdf: Fix CVE-2017-9935
+
+Fix for http://bugzilla.maptools.org/show_bug.cgi?id=2704
+
+This vulnerability - at least for the supplied test case - is because we
+assume that a tiff will only have one transfer function that is the same
+for all pages. This is not required by the TIFF standards.
+
+We than read the transfer function for every page. Depending on the
+transfer function, we allocate either 2 or 4 bytes to the XREF buffer.
+We allocate this memory after we read in the transfer function for the
+page.
+
+For the first exploit - POC1, this file has 3 pages. For the first page
+we allocate 2 extra extra XREF entries. Then for the next page 2 more
+entries. Then for the last page the transfer function changes and we
+allocate 4 more entries.
+
+When we read the file into memory, we assume we have 4 bytes extra for
+each and every page (as per the last transfer function we read). Which
+is not correct, we only have 2 bytes extra for the first 2 pages. As a
+result, we end up writing past the end of the buffer.
+
+There are also some related issues that this also fixes. For example,
+TIFFGetField can return uninitalized pointer values, and the logic to
+detect a N=3 vs N=1 transfer function seemed rather strange.
+
+It is also strange that we declare the transfer functions to be of type
+float, when the standard says they are unsigned 16 bit values. This is
+fixed in another patch.
+
+This patch will check to ensure that the N value for every transfer
+function is the same for every page. If this changes, we abort with an
+error. In theory, we should perhaps check that the transfer function
+itself is identical for every page, however we don't do that due to the
+confusion of the type of the data in the transfer function.
+---
+ libtiff/tif_dir.c | 3 +++
+ tools/tiff2pdf.c | 65 +++++++++++++++++++++++++++++++++++++------------------
+ 2 files changed, 47 insertions(+), 21 deletions(-)
+
+diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
+index 2ccaf448fc40..cbf2b6933a40 100644
+--- a/libtiff/tif_dir.c
++++ b/libtiff/tif_dir.c
+@@ -1065,6 +1065,9 @@ _TIFFVGetField(TIFF* tif, uint32 tag, va_list ap)
+ if (td->td_samplesperpixel - td->td_extrasamples > 1) {
+ *va_arg(ap, uint16**) = td->td_transferfunction[1];
+ *va_arg(ap, uint16**) = td->td_transferfunction[2];
++ } else {
++ *va_arg(ap, uint16**) = NULL;
++ *va_arg(ap, uint16**) = NULL;
+ }
+ break;
+ case TIFFTAG_REFERENCEBLACKWHITE:
+diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
+index d1a9b0959f84..c3ec07465e5a 100644
+--- a/tools/tiff2pdf.c
++++ b/tools/tiff2pdf.c
+@@ -1047,6 +1047,8 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
+ uint16 pagen=0;
+ uint16 paged=0;
+ uint16 xuint16=0;
++ uint16 tiff_transferfunctioncount=0;
++ float* tiff_transferfunction[3];
+
+ directorycount=TIFFNumberOfDirectories(input);
+ t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE)));
+@@ -1147,26 +1149,48 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
+ }
+ #endif
+ if (TIFFGetField(input, TIFFTAG_TRANSFERFUNCTION,
+- &(t2p->tiff_transferfunction[0]),
+- &(t2p->tiff_transferfunction[1]),
+- &(t2p->tiff_transferfunction[2]))) {
+- if((t2p->tiff_transferfunction[1] != (float*) NULL) &&
+- (t2p->tiff_transferfunction[2] != (float*) NULL) &&
+- (t2p->tiff_transferfunction[1] !=
+- t2p->tiff_transferfunction[0])) {
+- t2p->tiff_transferfunctioncount = 3;
+- t2p->tiff_pages[i].page_extra += 4;
+- t2p->pdf_xrefcount += 4;
+- } else {
+- t2p->tiff_transferfunctioncount = 1;
+- t2p->tiff_pages[i].page_extra += 2;
+- t2p->pdf_xrefcount += 2;
+- }
+- if(t2p->pdf_minorversion < 2)
+- t2p->pdf_minorversion = 2;
++ &(tiff_transferfunction[0]),
++ &(tiff_transferfunction[1]),
++ &(tiff_transferfunction[2]))) {
++
++ if((tiff_transferfunction[1] != (float*) NULL) &&
++ (tiff_transferfunction[2] != (float*) NULL)
++ ) {
++ tiff_transferfunctioncount=3;
++ } else {
++ tiff_transferfunctioncount=1;
++ }
+ } else {
+- t2p->tiff_transferfunctioncount=0;
++ tiff_transferfunctioncount=0;
+ }
++
++ if (i > 0){
++ if (tiff_transferfunctioncount != t2p->tiff_transferfunctioncount){
++ TIFFError(
++ TIFF2PDF_MODULE,
++ "Different transfer function on page %d",
++ i);
++ t2p->t2p_error = T2P_ERR_ERROR;
++ return;
++ }
++ }
++
++ t2p->tiff_transferfunctioncount = tiff_transferfunctioncount;
++ t2p->tiff_transferfunction[0] = tiff_transferfunction[0];
++ t2p->tiff_transferfunction[1] = tiff_transferfunction[1];
++ t2p->tiff_transferfunction[2] = tiff_transferfunction[2];
++ if(tiff_transferfunctioncount == 3){
++ t2p->tiff_pages[i].page_extra += 4;
++ t2p->pdf_xrefcount += 4;
++ if(t2p->pdf_minorversion < 2)
++ t2p->pdf_minorversion = 2;
++ } else if (tiff_transferfunctioncount == 1){
++ t2p->tiff_pages[i].page_extra += 2;
++ t2p->pdf_xrefcount += 2;
++ if(t2p->pdf_minorversion < 2)
++ t2p->pdf_minorversion = 2;
++ }
++
+ if( TIFFGetField(
+ input,
+ TIFFTAG_ICCPROFILE,
+@@ -1828,9 +1852,8 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){
+ &(t2p->tiff_transferfunction[1]),
+ &(t2p->tiff_transferfunction[2]))) {
+ if((t2p->tiff_transferfunction[1] != (float*) NULL) &&
+- (t2p->tiff_transferfunction[2] != (float*) NULL) &&
+- (t2p->tiff_transferfunction[1] !=
+- t2p->tiff_transferfunction[0])) {
++ (t2p->tiff_transferfunction[2] != (float*) NULL)
++ ) {
+ t2p->tiff_transferfunctioncount=3;
+ } else {
+ t2p->tiff_transferfunctioncount=1;
+--
+2.15.1
+
diff --git a/media-libs/tiff/tiff-4.0.9-r1.ebuild b/media-libs/tiff/tiff-4.0.9-r1.ebuild
new file mode 100644
index 00000000000..fbb216176cd
--- /dev/null
+++ b/media-libs/tiff/tiff-4.0.9-r1.ebuild
@@ -0,0 +1,79 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+inherit autotools eutils libtool multilib-minimal
+
+DESCRIPTION="Tag Image File Format (TIFF) library"
+HOMEPAGE="http://libtiff.maptools.org"
+SRC_URI="http://download.osgeo.org/libtiff/${P}.tar.gz
+ ftp://ftp.remotesensing.org/pub/libtiff/${P}.tar.gz"
+
+LICENSE="libtiff"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~x64-solaris ~x86-solaris"
+IUSE="+cxx jbig jpeg lzma static-libs test zlib"
+
+RDEPEND="jpeg? ( >=virtual/jpeg-0-r2:0=[${MULTILIB_USEDEP}] )
+ jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
+ lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
+ zlib? ( >=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}] )
+ abi_x86_32? (
+ !<=app-emulation/emul-linux-x86-baselibs-20130224-r9
+ !app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)]
+ )"
+DEPEND="${RDEPEND}"
+
+REQUIRED_USE="test? ( jpeg )" #483132
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-4.0.7-pdfium-0006-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch
+ "${FILESDIR}"/${PN}-4.0.7-pdfium-0008-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch
+ "${FILESDIR}"/${P}-CVE-2017-9935.patch #624696
+)
+
+MULTILIB_WRAPPED_HEADERS=(
+ /usr/include/tiffconf.h
+)
+
+src_prepare() {
+ default
+
+ # tiffcp-thumbnail.sh fails as thumbnail binary doesn't get built anymore since tiff-4.0.7
+ sed '/tiffcp-thumbnail\.sh/d' -i test/Makefile.am || die
+
+ eautoreconf
+}
+
+multilib_src_configure() {
+ ECONF_SOURCE="${S}" econf \
+ $(use_enable static-libs static) \
+ $(use_enable zlib) \
+ $(use_enable jpeg) \
+ $(use_enable jbig) \
+ $(use_enable lzma) \
+ $(use_enable cxx) \
+ --without-x
+
+ # remove useless subdirs
+ if ! multilib_is_native_abi ; then
+ sed -i \
+ -e 's/ tools//' \
+ -e 's/ contrib//' \
+ -e 's/ man//' \
+ -e 's/ html//' \
+ Makefile || die
+ fi
+}
+
+multilib_src_test() {
+ if ! multilib_is_native_abi ; then
+ emake -C tools
+ fi
+ emake check
+}
+
+multilib_src_install_all() {
+ prune_libtool_files --all
+ rm -f "${ED}"/usr/share/doc/${PF}/{COPYRIGHT,README*,RELEASE-DATE,TODO,VERSION}
+}
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2018-02-16 15:30 Lars Wendler
0 siblings, 0 replies; 14+ messages in thread
From: Lars Wendler @ 2018-02-16 15:30 UTC (permalink / raw
To: gentoo-commits
commit: 88961c859ba1efbe6e3555246444dc0456bddcb8
Author: Michael Vetter <jubalh <AT> iodoru <DOT> org>
AuthorDate: Fri Feb 16 15:04:47 2018 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Fri Feb 16 15:21:33 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=88961c85
media-libs/tiff: Patch to fix type (CVE-2017-9935)
CVE-2017-9935 has a second commit with ID
d4f213636b6f950498a1386083199bd7f65676b9 to fix the type of the table.
Bug: https://bugs.gentoo.org/624696
Package-Manager: Portage-2.3.19, Repoman-2.3.6
Closes: https://github.com/gentoo/gentoo/pull/7204
...ff-4.0.9-CVE-2017-9935-fix-incorrect-type.patch | 58 ++++++++++++++++
media-libs/tiff/tiff-4.0.9-r2.ebuild | 80 ++++++++++++++++++++++
2 files changed, 138 insertions(+)
diff --git a/media-libs/tiff/files/tiff-4.0.9-CVE-2017-9935-fix-incorrect-type.patch b/media-libs/tiff/files/tiff-4.0.9-CVE-2017-9935-fix-incorrect-type.patch
new file mode 100644
index 00000000000..101618ee7d5
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.0.9-CVE-2017-9935-fix-incorrect-type.patch
@@ -0,0 +1,58 @@
+From d4f213636b6f950498a1386083199bd7f65676b9 Mon Sep 17 00:00:00 2001
+From: Brian May <brian@linuxpenguins.xyz>
+Date: Thu, 7 Dec 2017 07:49:20 +1100
+Subject: [PATCH] tiff2pdf: Fix apparent incorrect type for transfer table
+
+The standard says the transfer table contains unsigned 16 bit values,
+I have no idea why we refer to them as floats.
+---
+ tools/tiff2pdf.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
+index c3ec074..484776c 100644
+--- a/tools/tiff2pdf.c
++++ b/tools/tiff2pdf.c
+@@ -237,7 +237,7 @@ typedef struct {
+ float tiff_whitechromaticities[2];
+ float tiff_primarychromaticities[6];
+ float tiff_referenceblackwhite[2];
+- float* tiff_transferfunction[3];
++ uint16* tiff_transferfunction[3];
+ int pdf_image_interpolate; /* 0 (default) : do not interpolate,
+ 1 : interpolate */
+ uint16 tiff_transferfunctioncount;
+@@ -1048,7 +1048,7 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
+ uint16 paged=0;
+ uint16 xuint16=0;
+ uint16 tiff_transferfunctioncount=0;
+- float* tiff_transferfunction[3];
++ uint16* tiff_transferfunction[3];
+
+ directorycount=TIFFNumberOfDirectories(input);
+ t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE)));
+@@ -1153,8 +1153,8 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
+ &(tiff_transferfunction[1]),
+ &(tiff_transferfunction[2]))) {
+
+- if((tiff_transferfunction[1] != (float*) NULL) &&
+- (tiff_transferfunction[2] != (float*) NULL)
++ if((tiff_transferfunction[1] != (uint16*) NULL) &&
++ (tiff_transferfunction[2] != (uint16*) NULL)
+ ) {
+ tiff_transferfunctioncount=3;
+ } else {
+@@ -1851,8 +1851,8 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){
+ &(t2p->tiff_transferfunction[0]),
+ &(t2p->tiff_transferfunction[1]),
+ &(t2p->tiff_transferfunction[2]))) {
+- if((t2p->tiff_transferfunction[1] != (float*) NULL) &&
+- (t2p->tiff_transferfunction[2] != (float*) NULL)
++ if((t2p->tiff_transferfunction[1] != (uint16*) NULL) &&
++ (t2p->tiff_transferfunction[2] != (uint16*) NULL)
+ ) {
+ t2p->tiff_transferfunctioncount=3;
+ } else {
+--
+libgit2 0.26.0
+
diff --git a/media-libs/tiff/tiff-4.0.9-r2.ebuild b/media-libs/tiff/tiff-4.0.9-r2.ebuild
new file mode 100644
index 00000000000..aafbb887102
--- /dev/null
+++ b/media-libs/tiff/tiff-4.0.9-r2.ebuild
@@ -0,0 +1,80 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+inherit autotools eutils libtool multilib-minimal
+
+DESCRIPTION="Tag Image File Format (TIFF) library"
+HOMEPAGE="http://libtiff.maptools.org"
+SRC_URI="http://download.osgeo.org/libtiff/${P}.tar.gz
+ ftp://ftp.remotesensing.org/pub/libtiff/${P}.tar.gz"
+
+LICENSE="libtiff"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~x64-solaris ~x86-solaris"
+IUSE="+cxx jbig jpeg lzma static-libs test zlib"
+
+RDEPEND="jpeg? ( >=virtual/jpeg-0-r2:0=[${MULTILIB_USEDEP}] )
+ jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
+ lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
+ zlib? ( >=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}] )
+ abi_x86_32? (
+ !<=app-emulation/emul-linux-x86-baselibs-20130224-r9
+ !app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)]
+ )"
+DEPEND="${RDEPEND}"
+
+REQUIRED_USE="test? ( jpeg )" #483132
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-4.0.7-pdfium-0006-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch
+ "${FILESDIR}"/${PN}-4.0.7-pdfium-0008-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch
+ "${FILESDIR}"/${P}-CVE-2017-9935.patch #624696
+ "${FILESDIR}"/${P}-CVE-2017-9935-fix-incorrect-type.patch #624696
+)
+
+MULTILIB_WRAPPED_HEADERS=(
+ /usr/include/tiffconf.h
+)
+
+src_prepare() {
+ default
+
+ # tiffcp-thumbnail.sh fails as thumbnail binary doesn't get built anymore since tiff-4.0.7
+ sed '/tiffcp-thumbnail\.sh/d' -i test/Makefile.am || die
+
+ eautoreconf
+}
+
+multilib_src_configure() {
+ ECONF_SOURCE="${S}" econf \
+ $(use_enable static-libs static) \
+ $(use_enable zlib) \
+ $(use_enable jpeg) \
+ $(use_enable jbig) \
+ $(use_enable lzma) \
+ $(use_enable cxx) \
+ --without-x
+
+ # remove useless subdirs
+ if ! multilib_is_native_abi ; then
+ sed -i \
+ -e 's/ tools//' \
+ -e 's/ contrib//' \
+ -e 's/ man//' \
+ -e 's/ html//' \
+ Makefile || die
+ fi
+}
+
+multilib_src_test() {
+ if ! multilib_is_native_abi ; then
+ emake -C tools
+ fi
+ emake check
+}
+
+multilib_src_install_all() {
+ prune_libtool_files --all
+ rm -f "${ED}"/usr/share/doc/${PF}/{COPYRIGHT,README*,RELEASE-DATE,TODO,VERSION}
+}
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2020-01-29 21:44 Andreas Sturmlechner
0 siblings, 0 replies; 14+ messages in thread
From: Andreas Sturmlechner @ 2020-01-29 21:44 UTC (permalink / raw
To: gentoo-commits
commit: 2b07bec238b4b2e98288cf4880faad4b504366ee
Author: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 29 21:43:33 2020 +0000
Commit: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org>
CommitDate: Wed Jan 29 21:44:32 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2b07bec2
media-libs/tiff: 4.0.10-r2 security cleanup
If no one else will do it...
Bug: https://bugs.gentoo.org/699868
Package-Manager: Portage-2.3.86, Repoman-2.3.20
Signed-off-by: Andreas Sturmlechner <asturm <AT> gentoo.org>
media-libs/tiff/Manifest | 1 -
...-2018-17000-tif_dirwrite-null-dereference.patch | 33 --
....0.10-CVE-2019-14973-fix-integer-overflow.patch | 395 ---------------------
.../tiff-4.0.10-CVE-2019-6128-pal2rgb-leak.patch | 48 ---
....0.10-CVE-2019-7663-tiffcpIntegerOverflow.patch | 73 ----
media-libs/tiff/tiff-4.0.10-r2.ebuild | 86 -----
6 files changed, 636 deletions(-)
diff --git a/media-libs/tiff/Manifest b/media-libs/tiff/Manifest
index 189741c8a7c..facf160fb14 100644
--- a/media-libs/tiff/Manifest
+++ b/media-libs/tiff/Manifest
@@ -1,2 +1 @@
-DIST tiff-4.0.10.tar.gz 2402867 BLAKE2B 0305453f22150c31d00d2de756736f58c49a288e19b2a66bdd01319ce4688742f6eab4009eaf1817125d41f53a23de17eb6265a3ebae458ec24f5dbb3d49764e SHA512 d213e5db09fd56b8977b187c5a756f60d6e3e998be172550c2892dbdb4b2a8e8c750202bc863fe27d0d1c577ab9de1710d15e9f6ed665aadbfd857525a81eea8
DIST tiff-4.1.0.tar.gz 2421581 BLAKE2B 1f9b92d08dc95633bb005a635bbcecd8fa5e4f30c14f059b42aafbb4a52b4fb1b84b1e97cea33f3102f5808cb28f93bc8fcbae2b041c6227c97f90b4f9b8e631 SHA512 fd541dcb11e3d5afaa1ec2f073c9497099727a52f626b338ef87dc93ca2e23ca5f47634015a4beac616d4e8f05acf7b7cd5797fb218758cc2ad31b390491c5a6
diff --git a/media-libs/tiff/files/tiff-4.0.10-CVE-2018-17000-tif_dirwrite-null-dereference.patch b/media-libs/tiff/files/tiff-4.0.10-CVE-2018-17000-tif_dirwrite-null-dereference.patch
deleted file mode 100644
index 321c6a428af..00000000000
--- a/media-libs/tiff/files/tiff-4.0.10-CVE-2018-17000-tif_dirwrite-null-dereference.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-https://crbug.com/901306
-
-commit 802d3cbf3043be5dce5317e140ccb1c17a6a2d39
-Author: Thomas Bernard <miniupnp@free.fr>
-Date: Tue Jan 29 11:21:47 2019 +0100
-
- TIFFWriteDirectoryTagTransferfunction() : fix NULL dereferencing
-
- http://bugzilla.maptools.org/show_bug.cgi?id=2833
-
- we must check the pointer is not NULL before memcmp() the memory
-
-diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c
-index c15a28dbd8fcb99b81fa5a1d44fcbcda881f42a7..ef30c869d30e210d90be16ce91f44087925fbad3 100644
---- a/libtiff/tif_dirwrite.c
-+++ b/libtiff/tif_dirwrite.c
-@@ -1893,12 +1893,14 @@ TIFFWriteDirectoryTagTransferfunction(TIFF* tif, uint32* ndir, TIFFDirEntry* dir
- n=3;
- if (n==3)
- {
-- if (!_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16)))
-+ if (tif->tif_dir.td_transferfunction[2] == NULL ||
-+ !_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16)))
- n=2;
- }
- if (n==2)
- {
-- if (!_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[1],m*sizeof(uint16)))
-+ if (tif->tif_dir.td_transferfunction[1] == NULL ||
-+ !_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[1],m*sizeof(uint16)))
- n=1;
- }
- if (n==0)
diff --git a/media-libs/tiff/files/tiff-4.0.10-CVE-2019-14973-fix-integer-overflow.patch b/media-libs/tiff/files/tiff-4.0.10-CVE-2019-14973-fix-integer-overflow.patch
deleted file mode 100644
index cbcbfd9d7f0..00000000000
--- a/media-libs/tiff/files/tiff-4.0.10-CVE-2019-14973-fix-integer-overflow.patch
+++ /dev/null
@@ -1,395 +0,0 @@
-From 6ebfcac47224d3b8661c501967d495135449883e Mon Sep 17 00:00:00 2001
-From: Even Rouault <even.rouault@spatialys.com>
-Date: Sat, 10 Aug 2019 18:25:03 +0200
-Subject: [PATCH] Fix integer overflow in _TIFFCheckMalloc() and other
- implementation-defined behaviour (CVE-2019-14973)
-
-_TIFFCheckMalloc()/_TIFFCheckRealloc() used a unsafe way to detect overflow
-in the multiplication of nmemb and elem_size (which are of type tmsize_t, thus
-signed), which was especially easily triggered on 32-bit builds (with recent
-enough compilers that assume that signed multiplication cannot overflow, since
-this is undefined behaviour by the C standard). The original issue which lead to
-this fix was trigged from tif_fax3.c
-
-There were also unsafe (implementation defied), and broken in practice on 64bit
-builds, ways of checking that a uint64 fits of a (signed) tmsize_t by doing
-(uint64)(tmsize_t)uint64_var != uint64_var comparisons. Those have no known
-at that time exploits, but are better to fix in a more bullet-proof way.
-Or similarly use of (int64)uint64_var <= 0.
-
---- a/libtiff/tif_aux.c
-+++ b/libtiff/tif_aux.c
-@@ -57,18 +57,57 @@ _TIFFMultiply64(TIFF* tif, uint64 first, uint64 second, const char* where)
- return bytes;
- }
-
-+tmsize_t
-+_TIFFMultiplySSize(TIFF* tif, tmsize_t first, tmsize_t second, const char* where)
-+{
-+ if( first <= 0 || second <= 0 )
-+ {
-+ if( tif != NULL && where != NULL )
-+ {
-+ TIFFErrorExt(tif->tif_clientdata, where,
-+ "Invalid argument to _TIFFMultiplySSize() in %s", where);
-+ }
-+ return 0;
-+ }
-+
-+ if( first > TIFF_TMSIZE_T_MAX / second )
-+ {
-+ if( tif != NULL && where != NULL )
-+ {
-+ TIFFErrorExt(tif->tif_clientdata, where,
-+ "Integer overflow in %s", where);
-+ }
-+ return 0;
-+ }
-+ return first * second;
-+}
-+
-+tmsize_t _TIFFCastUInt64ToSSize(TIFF* tif, uint64 val, const char* module)
-+{
-+ if( val > (uint64)TIFF_TMSIZE_T_MAX )
-+ {
-+ if( tif != NULL && module != NULL )
-+ {
-+ TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
-+ }
-+ return 0;
-+ }
-+ return (tmsize_t)val;
-+}
-+
- void*
- _TIFFCheckRealloc(TIFF* tif, void* buffer,
- tmsize_t nmemb, tmsize_t elem_size, const char* what)
- {
- void* cp = NULL;
-- tmsize_t bytes = nmemb * elem_size;
--
-+ tmsize_t count = _TIFFMultiplySSize(tif, nmemb, elem_size, NULL);
- /*
-- * XXX: Check for integer overflow.
-+ * Check for integer overflow.
- */
-- if (nmemb && elem_size && bytes / elem_size == nmemb)
-- cp = _TIFFrealloc(buffer, bytes);
-+ if (count != 0)
-+ {
-+ cp = _TIFFrealloc(buffer, count);
-+ }
-
- if (cp == NULL) {
- TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
---- a/libtiff/tif_getimage.c
-+++ b/libtiff/tif_getimage.c
-@@ -755,9 +755,8 @@ gtTileSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
- uint32 leftmost_tw;
-
- tilesize = TIFFTileSize(tif);
-- bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,tilesize);
-+ bufsize = _TIFFMultiplySSize(tif, alpha?4:3,tilesize, "gtTileSeparate");
- if (bufsize == 0) {
-- TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
- return (0);
- }
-
-@@ -1019,9 +1018,8 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
- uint16 colorchannels;
-
- stripsize = TIFFStripSize(tif);
-- bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,stripsize);
-+ bufsize = _TIFFMultiplySSize(tif,alpha?4:3,stripsize, "gtStripSeparate");
- if (bufsize == 0) {
-- TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
- return (0);
- }
-
---- a/libtiff/tif_luv.c
-+++ b/libtiff/tif_luv.c
-@@ -1264,16 +1264,10 @@ LogL16GuessDataFmt(TIFFDirectory *td)
- return (SGILOGDATAFMT_UNKNOWN);
- }
-
--
--#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
--#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
--
- static tmsize_t
- multiply_ms(tmsize_t m1, tmsize_t m2)
- {
-- if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 )
-- return 0;
-- return m1 * m2;
-+ return _TIFFMultiplySSize(NULL, m1, m2, NULL);
- }
-
- static int
---- a/libtiff/tif_pixarlog.c
-+++ b/libtiff/tif_pixarlog.c
-@@ -634,15 +634,10 @@ PixarLogGuessDataFmt(TIFFDirectory *td)
- return guess;
- }
-
--#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
--#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
--
- static tmsize_t
- multiply_ms(tmsize_t m1, tmsize_t m2)
- {
-- if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 )
-- return 0;
-- return m1 * m2;
-+ return _TIFFMultiplySSize(NULL, m1, m2, NULL);
- }
-
- static tmsize_t
---- a/libtiff/tif_read.c
-+++ b/libtiff/tif_read.c
-@@ -29,9 +29,6 @@
- #include "tiffiop.h"
- #include <stdio.h>
-
--#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
--#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
--
- int TIFFFillStrip(TIFF* tif, uint32 strip);
- int TIFFFillTile(TIFF* tif, uint32 tile);
- static int TIFFStartStrip(TIFF* tif, uint32 strip);
-@@ -49,6 +46,8 @@ TIFFReadRawTile1(TIFF* tif, uint32 tile, void* buf, tmsize_t size, const char* m
- #define THRESHOLD_MULTIPLIER 10
- #define MAX_THRESHOLD (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * INITIAL_THRESHOLD)
-
-+#define TIFF_INT64_MAX ((((int64)0x7FFFFFFF) << 32) | 0xFFFFFFFF)
-+
- /* Read 'size' bytes in tif_rawdata buffer starting at offset 'rawdata_offset'
- * Returns 1 in case of success, 0 otherwise. */
- static int TIFFReadAndRealloc( TIFF* tif, tmsize_t size,
-@@ -734,23 +733,8 @@ TIFFReadRawStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
- return ((tmsize_t)(-1));
- }
- bytecount = td->td_stripbytecount[strip];
-- if ((int64)bytecount <= 0) {
--#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
-- TIFFErrorExt(tif->tif_clientdata, module,
-- "%I64u: Invalid strip byte count, strip %lu",
-- (unsigned __int64) bytecount,
-- (unsigned long) strip);
--#else
-- TIFFErrorExt(tif->tif_clientdata, module,
-- "%llu: Invalid strip byte count, strip %lu",
-- (unsigned long long) bytecount,
-- (unsigned long) strip);
--#endif
-- return ((tmsize_t)(-1));
-- }
-- bytecountm = (tmsize_t)bytecount;
-- if ((uint64)bytecountm!=bytecount) {
-- TIFFErrorExt(tif->tif_clientdata, module, "Integer overflow");
-+ bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount, module);
-+ if (bytecountm == 0) {
- return ((tmsize_t)(-1));
- }
- if (size != (tmsize_t)(-1) && size < bytecountm)
-@@ -774,7 +758,7 @@ TIFFFillStrip(TIFF* tif, uint32 strip)
- if ((tif->tif_flags&TIFF_NOREADRAW)==0)
- {
- uint64 bytecount = td->td_stripbytecount[strip];
-- if ((int64)bytecount <= 0) {
-+ if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) {
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- TIFFErrorExt(tif->tif_clientdata, module,
- "Invalid strip byte count %I64u, strip %lu",
-@@ -801,7 +785,7 @@ TIFFFillStrip(TIFF* tif, uint32 strip)
- (bytecount - 4096) / 10 > (uint64)stripsize )
- {
- uint64 newbytecount = (uint64)stripsize * 10 + 4096;
-- if( (int64)newbytecount >= 0 )
-+ if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX )
- {
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- TIFFWarningExt(tif->tif_clientdata, module,
-@@ -1196,10 +1180,8 @@ TIFFReadRawTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
- bytecount64 = td->td_stripbytecount[tile];
- if (size != (tmsize_t)(-1) && (uint64)size < bytecount64)
- bytecount64 = (uint64)size;
-- bytecountm = (tmsize_t)bytecount64;
-- if ((uint64)bytecountm!=bytecount64)
-- {
-- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
-+ bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module);
-+ if( bytecountm == 0 ) {
- return ((tmsize_t)(-1));
- }
- return (TIFFReadRawTile1(tif, tile, buf, bytecountm, module));
-@@ -1221,7 +1203,7 @@ TIFFFillTile(TIFF* tif, uint32 tile)
- if ((tif->tif_flags&TIFF_NOREADRAW)==0)
- {
- uint64 bytecount = td->td_stripbytecount[tile];
-- if ((int64)bytecount <= 0) {
-+ if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) {
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- TIFFErrorExt(tif->tif_clientdata, module,
- "%I64u: Invalid tile byte count, tile %lu",
-@@ -1248,7 +1230,7 @@ TIFFFillTile(TIFF* tif, uint32 tile)
- (bytecount - 4096) / 10 > (uint64)stripsize )
- {
- uint64 newbytecount = (uint64)stripsize * 10 + 4096;
-- if( (int64)newbytecount >= 0 )
-+ if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX )
- {
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- TIFFWarningExt(tif->tif_clientdata, module,
---- a/libtiff/tif_strip.c
-+++ b/libtiff/tif_strip.c
-@@ -129,15 +129,8 @@ TIFFVStripSize(TIFF* tif, uint32 nrows)
- {
- static const char module[] = "TIFFVStripSize";
- uint64 m;
-- tmsize_t n;
- m=TIFFVStripSize64(tif,nrows);
-- n=(tmsize_t)m;
-- if ((uint64)n!=m)
-- {
-- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
-- n=0;
-- }
-- return(n);
-+ return _TIFFCastUInt64ToSSize(tif, m, module);
- }
-
- /*
-@@ -211,15 +204,8 @@ TIFFStripSize(TIFF* tif)
- {
- static const char module[] = "TIFFStripSize";
- uint64 m;
-- tmsize_t n;
- m=TIFFStripSize64(tif);
-- n=(tmsize_t)m;
-- if ((uint64)n!=m)
-- {
-- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
-- n=0;
-- }
-- return(n);
-+ return _TIFFCastUInt64ToSSize(tif, m, module);
- }
-
- /*
-@@ -330,14 +316,8 @@ TIFFScanlineSize(TIFF* tif)
- {
- static const char module[] = "TIFFScanlineSize";
- uint64 m;
-- tmsize_t n;
- m=TIFFScanlineSize64(tif);
-- n=(tmsize_t)m;
-- if ((uint64)n!=m) {
-- TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow");
-- n=0;
-- }
-- return(n);
-+ return _TIFFCastUInt64ToSSize(tif, m, module);
- }
-
- /*
-@@ -366,15 +346,8 @@ TIFFRasterScanlineSize(TIFF* tif)
- {
- static const char module[] = "TIFFRasterScanlineSize";
- uint64 m;
-- tmsize_t n;
- m=TIFFRasterScanlineSize64(tif);
-- n=(tmsize_t)m;
-- if ((uint64)n!=m)
-- {
-- TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow");
-- n=0;
-- }
-- return(n);
-+ return _TIFFCastUInt64ToSSize(tif, m, module);
- }
-
- /* vim: set ts=8 sts=8 sw=8 noet: */
---- a/libtiff/tif_tile.c
-+++ b/libtiff/tif_tile.c
-@@ -181,15 +181,8 @@ TIFFTileRowSize(TIFF* tif)
- {
- static const char module[] = "TIFFTileRowSize";
- uint64 m;
-- tmsize_t n;
- m=TIFFTileRowSize64(tif);
-- n=(tmsize_t)m;
-- if ((uint64)n!=m)
-- {
-- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
-- n=0;
-- }
-- return(n);
-+ return _TIFFCastUInt64ToSSize(tif, m, module);
- }
-
- /*
-@@ -248,15 +241,8 @@ TIFFVTileSize(TIFF* tif, uint32 nrows)
- {
- static const char module[] = "TIFFVTileSize";
- uint64 m;
-- tmsize_t n;
- m=TIFFVTileSize64(tif,nrows);
-- n=(tmsize_t)m;
-- if ((uint64)n!=m)
-- {
-- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
-- n=0;
-- }
-- return(n);
-+ return _TIFFCastUInt64ToSSize(tif, m, module);
- }
-
- /*
-@@ -272,15 +258,8 @@ TIFFTileSize(TIFF* tif)
- {
- static const char module[] = "TIFFTileSize";
- uint64 m;
-- tmsize_t n;
- m=TIFFTileSize64(tif);
-- n=(tmsize_t)m;
-- if ((uint64)n!=m)
-- {
-- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
-- n=0;
-- }
-- return(n);
-+ return _TIFFCastUInt64ToSSize(tif, m, module);
- }
-
- /*
---- a/libtiff/tiffiop.h
-+++ b/libtiff/tiffiop.h
-@@ -77,6 +77,9 @@ extern int snprintf(char* str, size_t size, const char* format, ...);
- #define FALSE 0
- #endif
-
-+#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
-+#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
-+
- typedef struct client_info {
- struct client_info *next;
- void *data;
-@@ -258,7 +261,7 @@ struct tiff {
- #define TIFFhowmany8_64(x) (((x)&0x07)?((uint64)(x)>>3)+1:(uint64)(x)>>3)
- #define TIFFroundup_64(x, y) (TIFFhowmany_64(x,y)*(y))
-
--/* Safe multiply which returns zero if there is an integer overflow */
-+/* Safe multiply which returns zero if there is an *unsigned* integer overflow. This macro is not safe for *signed* integer types */
- #define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
-
- #define TIFFmax(A,B) ((A)>(B)?(A):(B))
-@@ -368,6 +371,8 @@ extern TIFFErrorHandlerExt _TIFFerrorHandlerExt;
-
- extern uint32 _TIFFMultiply32(TIFF*, uint32, uint32, const char*);
- extern uint64 _TIFFMultiply64(TIFF*, uint64, uint64, const char*);
-+extern tmsize_t _TIFFMultiplySSize(TIFF*, tmsize_t, tmsize_t, const char*);
-+extern tmsize_t _TIFFCastUInt64ToSSize(TIFF*, uint64, const char*);
- extern void* _TIFFCheckMalloc(TIFF*, tmsize_t, tmsize_t, const char*);
- extern void* _TIFFCheckRealloc(TIFF*, void*, tmsize_t, tmsize_t, const char*);
-
diff --git a/media-libs/tiff/files/tiff-4.0.10-CVE-2019-6128-pal2rgb-leak.patch b/media-libs/tiff/files/tiff-4.0.10-CVE-2019-6128-pal2rgb-leak.patch
deleted file mode 100644
index 38d020fec24..00000000000
--- a/media-libs/tiff/files/tiff-4.0.10-CVE-2019-6128-pal2rgb-leak.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-https://crbug.com/923647
-
-commit ae0bed1fe530a82faf2e9ea1775109dbf301a971
-Merge: 933784a1 0c74a9f4
-Author: Even Rouault <even.rouault@spatialys.com>
-Date: Sat Feb 2 14:46:05 2019 +0000
-
- Merge branch 'master' into 'master'
-
- Fix for simple memory leak that was assigned CVE-2019-6128.
-
- See merge request libtiff/libtiff!50
-
-diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c
-index 01d8502ecf7a8a7f015e49ca9378a1a741cbc06b..9492f1cf1212177bf7e97d307757d0977c898e90 100644
---- a/tools/pal2rgb.c
-+++ b/tools/pal2rgb.c
-@@ -118,12 +118,14 @@ main(int argc, char* argv[])
- shortv != PHOTOMETRIC_PALETTE) {
- fprintf(stderr, "%s: Expecting a palette image.\n",
- argv[optind]);
-+ (void) TIFFClose(in);
- return (-1);
- }
- if (!TIFFGetField(in, TIFFTAG_COLORMAP, &rmap, &gmap, &bmap)) {
- fprintf(stderr,
- "%s: No colormap (not a valid palette image).\n",
- argv[optind]);
-+ (void) TIFFClose(in);
- return (-1);
- }
- bitspersample = 0;
-@@ -131,11 +133,14 @@ main(int argc, char* argv[])
- if (bitspersample != 8) {
- fprintf(stderr, "%s: Sorry, can only handle 8-bit images.\n",
- argv[optind]);
-+ (void) TIFFClose(in);
- return (-1);
- }
- out = TIFFOpen(argv[optind+1], "w");
-- if (out == NULL)
-+ if (out == NULL) {
-+ (void) TIFFClose(in);
- return (-2);
-+ }
- cpTags(in, out);
- TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &imagewidth);
- TIFFGetField(in, TIFFTAG_IMAGELENGTH, &imagelength);
diff --git a/media-libs/tiff/files/tiff-4.0.10-CVE-2019-7663-tiffcpIntegerOverflow.patch b/media-libs/tiff/files/tiff-4.0.10-CVE-2019-7663-tiffcpIntegerOverflow.patch
deleted file mode 100644
index a68ba2f4bbd..00000000000
--- a/media-libs/tiff/files/tiff-4.0.10-CVE-2019-7663-tiffcpIntegerOverflow.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 2b0d0e699730d1f26bbeba8397bfdf0e9e01e59d Mon Sep 17 00:00:00 2001
-From: Thomas Bernard <miniupnp@free.fr>
-Date: Mon, 11 Feb 2019 10:05:33 +0100
-Subject: [PATCH 1/2] check that (Tile Width)*(Samples/Pixel) do no overflow
-
-fixes bug 2833
----
- tools/tiffcp.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/tools/tiffcp.c b/tools/tiffcp.c
-index 2f406e2d7..f0ee2c029 100644
---- a/tools/tiffcp.c
-+++ b/tools/tiffcp.c
-@@ -1408,7 +1408,7 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
- int status = 1;
- uint32 imagew = TIFFRasterScanlineSize(in);
- uint32 tilew = TIFFTileRowSize(in);
-- int iskew = imagew - tilew*spp;
-+ int iskew;
- tsize_t tilesize = TIFFTileSize(in);
- tdata_t tilebuf;
- uint8* bufp = (uint8*) buf;
-@@ -1416,6 +1416,12 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
- uint32 row;
- uint16 bps = 0, bytes_per_sample;
-
-+ if (spp > (0x7fffffff / tilew))
-+ {
-+ TIFFError(TIFFFileName(in), "Error, cannot handle that much samples per tile row (Tile Width * Samples/Pixel)");
-+ return 0;
-+ }
-+ iskew = imagew - tilew*spp;
- tilebuf = _TIFFmalloc(tilesize);
- if (tilebuf == 0)
- return 0;
---
-2.21.0
-
-
-From 7cc76e9bc40bc8eb329a718ab26ecef7dd1afd94 Mon Sep 17 00:00:00 2001
-From: Thomas Bernard <miniupnp@free.fr>
-Date: Mon, 11 Feb 2019 21:42:03 +0100
-Subject: [PATCH 2/2] tiffcp.c: use INT_MAX
-
----
- tools/tiffcp.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/tools/tiffcp.c b/tools/tiffcp.c
-index f0ee2c029..8c81aa4f2 100644
---- a/tools/tiffcp.c
-+++ b/tools/tiffcp.c
-@@ -41,6 +41,7 @@
- #include <stdio.h>
- #include <stdlib.h>
- #include <string.h>
-+#include <limits.h>
-
- #include <ctype.h>
-
-@@ -1416,7 +1417,7 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
- uint32 row;
- uint16 bps = 0, bytes_per_sample;
-
-- if (spp > (0x7fffffff / tilew))
-+ if (spp > (INT_MAX / tilew))
- {
- TIFFError(TIFFFileName(in), "Error, cannot handle that much samples per tile row (Tile Width * Samples/Pixel)");
- return 0;
---
-2.21.0
-
diff --git a/media-libs/tiff/tiff-4.0.10-r2.ebuild b/media-libs/tiff/tiff-4.0.10-r2.ebuild
deleted file mode 100644
index b4932f3df86..00000000000
--- a/media-libs/tiff/tiff-4.0.10-r2.ebuild
+++ /dev/null
@@ -1,86 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit autotools libtool multilib-minimal
-
-DESCRIPTION="Tag Image File Format (TIFF) library"
-HOMEPAGE="http://libtiff.maptools.org"
-SRC_URI="https://download.osgeo.org/libtiff/${P}.tar.gz"
-
-LICENSE="libtiff"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 ~riscv s390 sh sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="+cxx jbig jpeg lzma static-libs test webp zlib zstd"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
- jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
- jpeg? ( >=virtual/jpeg-0-r2:0=[${MULTILIB_USEDEP}] )
- lzma? ( >=app-arch/xz-utils-5.0.5-r1[${MULTILIB_USEDEP}] )
- webp? ( media-libs/libwebp:=[${MULTILIB_USEDEP}] )
- zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
- zstd? ( >=app-arch/zstd-1.3.7-r1:=[${MULTILIB_USEDEP}] )
-"
-DEPEND="${RDEPEND}"
-
-REQUIRED_USE="test? ( jpeg )" #483132
-
-PATCHES=(
- "${FILESDIR}"/${PN}-4.0.10-CVE-2018-17000-tif_dirwrite-null-dereference.patch
- "${FILESDIR}"/${PN}-4.0.10-CVE-2019-6128-pal2rgb-leak.patch
- "${FILESDIR}"/${PN}-4.0.10-CVE-2019-7663-tiffcpIntegerOverflow.patch
- "${FILESDIR}"/${P}-CVE-2019-14973-fix-integer-overflow.patch
-)
-
-MULTILIB_WRAPPED_HEADERS=(
- /usr/include/tiffconf.h
-)
-
-src_prepare() {
- default
-
- # tiffcp-thumbnail.sh fails as thumbnail binary doesn't get built anymore since tiff-4.0.7
- sed '/tiffcp-thumbnail\.sh/d' -i test/Makefile.am || die
-
- eautoreconf
-}
-
-multilib_src_configure() {
- local myeconfargs=(
- --without-x
- --with-docdir="${EPREFIX}"/usr/share/doc/${PF}
- $(use_enable cxx)
- $(use_enable jbig)
- $(use_enable jpeg)
- $(use_enable lzma)
- $(use_enable static-libs static)
- $(use_enable webp)
- $(use_enable zlib)
- $(use_enable zstd)
- )
- ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-
- # remove useless subdirs
- if ! multilib_is_native_abi ; then
- sed -i \
- -e 's/ tools//' \
- -e 's/ contrib//' \
- -e 's/ man//' \
- -e 's/ html//' \
- Makefile || die
- fi
-}
-
-multilib_src_test() {
- if ! multilib_is_native_abi ; then
- emake -C tools
- fi
- emake check
-}
-
-multilib_src_install_all() {
- find "${ED}" -name '*.la' -delete || die
- rm "${ED}"/usr/share/doc/${PF}/{COPYRIGHT,README*,RELEASE-DATE,TODO,VERSION} || die
-}
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2022-05-21 0:10 Sam James
0 siblings, 0 replies; 14+ messages in thread
From: Sam James @ 2022-05-21 0:10 UTC (permalink / raw
To: gentoo-commits
commit: bcf80a84c69f026b3e7df8bec1b0732c2dc7b658
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sat May 21 00:07:26 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sat May 21 00:09:23 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bcf80a84
media-libs/tiff: add 4.4.0_rc1 (unkeyworded)
Bug: https://bugs.gentoo.org/821925
Bug: https://bugs.gentoo.org/830981
Bug: https://bugs.gentoo.org/837560
Signed-off-by: Sam James <sam <AT> gentoo.org>
media-libs/tiff/Manifest | 2 +
.../files/tiff-4.4.0_rc1-skip-thumbnail-test.patch | 32 ++++++++
media-libs/tiff/tiff-4.4.0_rc1.ebuild | 91 ++++++++++++++++++++++
3 files changed, 125 insertions(+)
diff --git a/media-libs/tiff/Manifest b/media-libs/tiff/Manifest
index 45849b27483d..a5238360727a 100644
--- a/media-libs/tiff/Manifest
+++ b/media-libs/tiff/Manifest
@@ -1 +1,3 @@
DIST tiff-4.3.0.tar.gz 2808254 BLAKE2B 433a087249541f6142dd25b6dc807018639908175b0d73b4af3aa301af2dee3d76184e4689e7b2f1f9b73567ac78d50456ee94fffe00bad6da05375cf2d94d92 SHA512 e04a4a6c542e58a174c1e9516af3908acf1d3d3e1096648c5514f4963f73e7af27387a76b0fbabe43cf867a18874088f963796a7cd6e45deb998692e3e235493
+DIST tiff-4.4.0rc1.tar.xz 1929292 BLAKE2B d05a2fb293557d1e7cdec116c65c8338d7714af7b6abd8dd3bb2b476d62e044adc7d6c298843649d63c6bc09f6ce4660ee23638f9beb716937ccf236c2829dcf SHA512 c9611faadc9b1199f3aba9a43bfa160c77c11558d1fa358b42115ed78db73c8387531c0668cc9021842c58f1c02f8d84264d3600e1039dfe6f866822ad91cff9
+DIST tiff-4.4.0rc1.tar.xz.sig 310 BLAKE2B 00dc8ff9c232ec4cca8b294659e6379b9bb512b58cd3d2f9231e7c10111510ac56aff3c6fc133a47f9fafc27595e099297c25940414495d8ea7f5a75aa43e9d2 SHA512 4ffdcbf5a8ce4a3be543d0ad43101ddcdb6ef22c3da5768c86660a40cc0cab48032a65c5e7bb0667f43d55dad5aa09dc0df302e2f9dbc9f24b8ccac643a0408c
diff --git a/media-libs/tiff/files/tiff-4.4.0_rc1-skip-thumbnail-test.patch b/media-libs/tiff/files/tiff-4.4.0_rc1-skip-thumbnail-test.patch
new file mode 100644
index 000000000000..574a02dd3487
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.4.0_rc1-skip-thumbnail-test.patch
@@ -0,0 +1,32 @@
+https://gitlab.com/libtiff/libtiff/-/merge_requests/334
+
+From 62a49eeb3f0c986c5fcbfc53cd3d7ef2a3fab9b3 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Sat, 21 May 2022 01:01:35 +0100
+Subject: [PATCH] test/tiffcp-thumbnail.sh: skip test if tools aren't built
+
+In Gentoo, we avoid building the tools for multilib (32-bit, x86) builds on
+amd64/x86_64 because we only need the library to keep binary applications working.
+
+This causes a test failure in just tiffcp-thumbnail.sh as the 'thumbnail'
+binary isn't built. Skip it if unavailable as it's only a single test.
+
+Fixes: https://gitlab.com/libtiff/libtiff/-/issues/421
+--- a/test/tiffcp-thumbnail.sh
++++ b/test/tiffcp-thumbnail.sh
+@@ -4,7 +4,12 @@
+ #
+ . ${srcdir:-.}/common.sh
+
++if [ ! -x "${TIFFCP}" ] || [ ! -x "${THUMBNAIL}" ] ; then
++ # https://gitlab.com/libtiff/libtiff/-/issues/421
++ exit 77
++fi
++
+ outfile1=o-tiffcp-thumbnail-in.tif
+ outfile2=o-tiffcp-thumbnail-out.tif
+ f_test_convert "${TIFFCP} -c g3:1d" "${IMG_MINISWHITE_1C_1B}" "${outfile1}"
+-f_test_convert "${THUMBNAIL}" "${outfile1}" "${outfile2}"
+\ No newline at end of file
++f_test_convert "${THUMBNAIL}" "${outfile1}" "${outfile2}"
+GitLab
diff --git a/media-libs/tiff/tiff-4.4.0_rc1.ebuild b/media-libs/tiff/tiff-4.4.0_rc1.ebuild
new file mode 100644
index 000000000000..c0f7bb48982e
--- /dev/null
+++ b/media-libs/tiff/tiff-4.4.0_rc1.ebuild
@@ -0,0 +1,91 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+QA_PKGCONFIG_VERSION="$(ver_cut 1-3)"
+
+# Release signer can vary per version but not clear if others will be doing
+# them in future, so gone with Even Rouault for now as he does other geosci
+# stuff too like PROJ, GDAL. Previous release manager of TIFF was
+# GraphicsMagick maintainer Bob Friesenhahn. Please be careful when verifying
+# who made releases.
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/rouault.asc
+inherit multilib-minimal verify-sig
+
+MY_P="${P/_rc/rc}"
+DESCRIPTION="Tag Image File Format (TIFF) library"
+HOMEPAGE="http://libtiff.maptools.org"
+SRC_URI="https://download.osgeo.org/libtiff/${MY_P}.tar.xz"
+SRC_URI+=" verify-sig? ( https://download.osgeo.org/libtiff/${MY_P}.tar.xz.sig )"
+S="${WORKDIR}/${PN}-$(ver_cut 1-3)"
+
+LICENSE="libtiff"
+SLOT="0"
+if [[ ${PV} != *_rc* ]] ; then
+ KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+fi
+IUSE="+cxx jbig jpeg lzma static-libs test webp zlib zstd"
+RESTRICT="!test? ( test )"
+
+# bug #483132
+REQUIRED_USE="test? ( jpeg )"
+
+RDEPEND="jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
+ jpeg? ( media-libs/libjpeg-turbo:=[${MULTILIB_USEDEP}] )
+ lzma? ( >=app-arch/xz-utils-5.0.5-r1[${MULTILIB_USEDEP}] )
+ webp? ( media-libs/libwebp:=[${MULTILIB_USEDEP}] )
+ zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
+ zstd? ( >=app-arch/zstd-1.3.7-r1:=[${MULTILIB_USEDEP}] )"
+DEPEND="${RDEPEND}"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-evenrouault )"
+
+MULTILIB_WRAPPED_HEADERS=(
+ /usr/include/tiffconf.h
+)
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-4.4.0_rc1-skip-thumbnail-test.patch
+)
+
+multilib_src_configure() {
+ local myeconfargs=(
+ --without-x
+ --with-docdir="${EPREFIX}"/usr/share/doc/${PF}
+ $(use_enable cxx)
+ $(use_enable jbig)
+ $(use_enable jpeg)
+ $(use_enable lzma)
+ $(use_enable static-libs static)
+ $(use_enable webp)
+ $(use_enable zlib)
+ $(use_enable zstd)
+ )
+
+ ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+
+ # Remove components (like tools) that are irrelevant for the multilib
+ # build which we only want libraries for.
+ # TODO: upstream options to disable these properly
+ if ! multilib_is_native_abi ; then
+ sed -i \
+ -e 's/ tools//' \
+ -e 's/ contrib//' \
+ -e 's/ man//' \
+ -e 's/ html//' \
+ Makefile || die
+ fi
+}
+
+multilib_src_test() {
+ if ! multilib_is_native_abi ; then
+ emake -C tools
+ fi
+
+ emake check
+}
+
+multilib_src_install_all() {
+ find "${ED}" -type f -name '*.la' -delete || die
+ rm "${ED}"/usr/share/doc/${PF}/{COPYRIGHT,README*,RELEASE-DATE,TODO,VERSION} || die
+}
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2023-01-24 16:12 Andreas Sturmlechner
0 siblings, 0 replies; 14+ messages in thread
From: Andreas Sturmlechner @ 2023-01-24 16:12 UTC (permalink / raw
To: gentoo-commits
commit: 70d25ca63199f98c7f5bfb6d9f54023eec9048d1
Author: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org>
AuthorDate: Tue Jan 24 14:12:10 2023 +0000
Commit: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org>
CommitDate: Tue Jan 24 16:11:33 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=70d25ca6
media-libs/tiff: drop 4.4.0-r1, 4.4.0-r2
Bug: https://bugs.gentoo.org/856478
Signed-off-by: Andreas Sturmlechner <asturm <AT> gentoo.org>
media-libs/tiff/Manifest | 2 -
.../files/tiff-4.4.0-hylafaxplus-regression.patch | 34 -------
.../files/tiff-4.4.0_rc1-skip-thumbnail-test.patch | 32 -------
media-libs/tiff/tiff-4.4.0-r1.ebuild | 97 --------------------
media-libs/tiff/tiff-4.4.0-r2.ebuild | 102 ---------------------
5 files changed, 267 deletions(-)
diff --git a/media-libs/tiff/Manifest b/media-libs/tiff/Manifest
index 1d32e5a570fc..1d5a4c20c28c 100644
--- a/media-libs/tiff/Manifest
+++ b/media-libs/tiff/Manifest
@@ -1,4 +1,2 @@
-DIST tiff-4.4.0.tar.xz 1929292 BLAKE2B d05a2fb293557d1e7cdec116c65c8338d7714af7b6abd8dd3bb2b476d62e044adc7d6c298843649d63c6bc09f6ce4660ee23638f9beb716937ccf236c2829dcf SHA512 c9611faadc9b1199f3aba9a43bfa160c77c11558d1fa358b42115ed78db73c8387531c0668cc9021842c58f1c02f8d84264d3600e1039dfe6f866822ad91cff9
-DIST tiff-4.4.0.tar.xz.sig 310 BLAKE2B 00dc8ff9c232ec4cca8b294659e6379b9bb512b58cd3d2f9231e7c10111510ac56aff3c6fc133a47f9fafc27595e099297c25940414495d8ea7f5a75aa43e9d2 SHA512 4ffdcbf5a8ce4a3be543d0ad43101ddcdb6ef22c3da5768c86660a40cc0cab48032a65c5e7bb0667f43d55dad5aa09dc0df302e2f9dbc9f24b8ccac643a0408c
DIST tiff-4.5.0.tar.xz 2320900 BLAKE2B c69801ba9d55b1ed27a92d31d8cd16937fe69299fbf5450efb4a6caa60245b72ddade110daae78f2198613640383623f76ec2265ba785375d0a85c7909b73fe9 SHA512 c6c866064c2dd5d1711c6ece7bafe5f011f5ce26c0aeaecbff79c05b5671f44150324bea95a0665cc43331883114de855ee1cd87ed733bff0f4d0814515b9f10
DIST tiff-4.5.0.tar.xz.sig 310 BLAKE2B bbe7f9600061416227276424eb220714a1375d3e295cb0c5b7f76074324c1a2698a5029dde3e734331e9caf02d8a086273ded2ab09285857dbbfe3ad83506912 SHA512 8cef09755f4efe68db69591967e495852cf63c2d8113a877a2254f536d38c60b6dc864c07089249cd8109a8408672a297ae9e59d8233687bc2796dc158ccfb32
diff --git a/media-libs/tiff/files/tiff-4.4.0-hylafaxplus-regression.patch b/media-libs/tiff/files/tiff-4.4.0-hylafaxplus-regression.patch
deleted file mode 100644
index c640f6e1b1a7..000000000000
--- a/media-libs/tiff/files/tiff-4.4.0-hylafaxplus-regression.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-https://bugs.gentoo.org/883641
-https://gitlab.com/libtiff/libtiff/-/issues/489
-https://gitlab.com/libtiff/libtiff/-/commit/72de8fd00be8a583a6b16cc0b700105020d249ba
-
-From 72de8fd00be8a583a6b16cc0b700105020d249ba Mon Sep 17 00:00:00 2001
-From: Even Rouault <even.rouault@spatialys.com>
-Date: Tue, 29 Nov 2022 14:57:27 +0100
-Subject: [PATCH] TIFFWriteRawStrip(): restore capabilities to append data in
- the current strip (fixes #489)
-
-This fixes a regression of libtiff 4.4.0
---- a/libtiff/tif_write.c
-+++ b/libtiff/tif_write.c
-@@ -341,10 +341,13 @@ TIFFWriteRawStrip(TIFF* tif, uint32_t strip, void* data, tmsize_t cc)
- return ((tmsize_t) -1);
- }
-
-- tif->tif_curstrip = strip;
-+ if (tif->tif_curstrip != strip)
-+ {
-+ tif->tif_curstrip = strip;
-
-- /* this informs TIFFAppendToStrip() we have changed or reset strip */
-- tif->tif_curoff = 0;
-+ /* this informs TIFFAppendToStrip() we have changed or reset strip */
-+ tif->tif_curoff = 0;
-+ }
-
- if (td->td_stripsperimage == 0) {
- TIFFErrorExtR(tif, module,"Zero strips per image");
---
-GitLab
-
-
diff --git a/media-libs/tiff/files/tiff-4.4.0_rc1-skip-thumbnail-test.patch b/media-libs/tiff/files/tiff-4.4.0_rc1-skip-thumbnail-test.patch
deleted file mode 100644
index 574a02dd3487..000000000000
--- a/media-libs/tiff/files/tiff-4.4.0_rc1-skip-thumbnail-test.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-https://gitlab.com/libtiff/libtiff/-/merge_requests/334
-
-From 62a49eeb3f0c986c5fcbfc53cd3d7ef2a3fab9b3 Mon Sep 17 00:00:00 2001
-From: Sam James <sam@gentoo.org>
-Date: Sat, 21 May 2022 01:01:35 +0100
-Subject: [PATCH] test/tiffcp-thumbnail.sh: skip test if tools aren't built
-
-In Gentoo, we avoid building the tools for multilib (32-bit, x86) builds on
-amd64/x86_64 because we only need the library to keep binary applications working.
-
-This causes a test failure in just tiffcp-thumbnail.sh as the 'thumbnail'
-binary isn't built. Skip it if unavailable as it's only a single test.
-
-Fixes: https://gitlab.com/libtiff/libtiff/-/issues/421
---- a/test/tiffcp-thumbnail.sh
-+++ b/test/tiffcp-thumbnail.sh
-@@ -4,7 +4,12 @@
- #
- . ${srcdir:-.}/common.sh
-
-+if [ ! -x "${TIFFCP}" ] || [ ! -x "${THUMBNAIL}" ] ; then
-+ # https://gitlab.com/libtiff/libtiff/-/issues/421
-+ exit 77
-+fi
-+
- outfile1=o-tiffcp-thumbnail-in.tif
- outfile2=o-tiffcp-thumbnail-out.tif
- f_test_convert "${TIFFCP} -c g3:1d" "${IMG_MINISWHITE_1C_1B}" "${outfile1}"
--f_test_convert "${THUMBNAIL}" "${outfile1}" "${outfile2}"
-\ No newline at end of file
-+f_test_convert "${THUMBNAIL}" "${outfile1}" "${outfile2}"
-GitLab
diff --git a/media-libs/tiff/tiff-4.4.0-r1.ebuild b/media-libs/tiff/tiff-4.4.0-r1.ebuild
deleted file mode 100644
index 4fce57119100..000000000000
--- a/media-libs/tiff/tiff-4.4.0-r1.ebuild
+++ /dev/null
@@ -1,97 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-QA_PKGCONFIG_VERSION="$(ver_cut 1-3)"
-
-# Release signer can vary per version but not clear if others will be doing
-# them in future, so gone with Even Rouault for now as he does other geosci
-# stuff too like PROJ, GDAL. Previous release manager of TIFF was
-# GraphicsMagick maintainer Bob Friesenhahn. Please be careful when verifying
-# who made releases.
-VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/rouault.asc
-inherit multilib-minimal verify-sig libtool flag-o-matic
-
-MY_P="${P/_rc/rc}"
-DESCRIPTION="Tag Image File Format (TIFF) library"
-HOMEPAGE="http://libtiff.maptools.org"
-SRC_URI="https://download.osgeo.org/libtiff/${MY_P}.tar.xz"
-SRC_URI+=" verify-sig? ( https://download.osgeo.org/libtiff/${MY_P}.tar.xz.sig )"
-S="${WORKDIR}/${PN}-$(ver_cut 1-3)"
-
-LICENSE="libtiff"
-SLOT="0"
-if [[ ${PV} != *_rc* ]] ; then
- KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-fi
-IUSE="+cxx jbig jpeg lzma static-libs test webp zlib zstd"
-RESTRICT="!test? ( test )"
-
-# bug #483132
-REQUIRED_USE="test? ( jpeg )"
-
-RDEPEND="jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
- jpeg? ( media-libs/libjpeg-turbo:=[${MULTILIB_USEDEP}] )
- lzma? ( >=app-arch/xz-utils-5.0.5-r1[${MULTILIB_USEDEP}] )
- webp? ( media-libs/libwebp:=[${MULTILIB_USEDEP}] )
- zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
- zstd? ( >=app-arch/zstd-1.3.7-r1:=[${MULTILIB_USEDEP}] )"
-DEPEND="${RDEPEND}"
-BDEPEND="verify-sig? ( sec-keys/openpgp-keys-evenrouault )"
-
-MULTILIB_WRAPPED_HEADERS=(
- /usr/include/tiffconf.h
-)
-
-PATCHES=(
- "${FILESDIR}"/${PN}-4.4.0_rc1-skip-thumbnail-test.patch
-)
-
-src_prepare() {
- default
- elibtoolize
-}
-
-multilib_src_configure() {
- local myeconfargs=(
- --without-x
- --with-docdir="${EPREFIX}"/usr/share/doc/${PF}
- $(use_enable cxx)
- $(use_enable jbig)
- $(use_enable jpeg)
- $(use_enable lzma)
- $(use_enable static-libs static)
- $(use_enable webp)
- $(use_enable zlib)
- $(use_enable zstd)
- )
-
- append-lfs-flags
- ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-
- # Remove components (like tools) that are irrelevant for the multilib
- # build which we only want libraries for.
- # TODO: upstream options to disable these properly
- if ! multilib_is_native_abi ; then
- sed -i \
- -e 's/ tools//' \
- -e 's/ contrib//' \
- -e 's/ man//' \
- -e 's/ html//' \
- Makefile || die
- fi
-}
-
-multilib_src_test() {
- if ! multilib_is_native_abi ; then
- emake -C tools
- fi
-
- emake check
-}
-
-multilib_src_install_all() {
- find "${ED}" -type f -name '*.la' -delete || die
- rm "${ED}"/usr/share/doc/${PF}/{COPYRIGHT,README*,RELEASE-DATE,TODO,VERSION} || die
-}
diff --git a/media-libs/tiff/tiff-4.4.0-r2.ebuild b/media-libs/tiff/tiff-4.4.0-r2.ebuild
deleted file mode 100644
index 9f2ae8c6446f..000000000000
--- a/media-libs/tiff/tiff-4.4.0-r2.ebuild
+++ /dev/null
@@ -1,102 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-QA_PKGCONFIG_VERSION="$(ver_cut 1-3)"
-
-# Release signer can vary per version but not clear if others will be doing
-# them in future, so gone with Even Rouault for now as he does other geosci
-# stuff too like PROJ, GDAL. Previous release manager of TIFF was
-# GraphicsMagick maintainer Bob Friesenhahn. Please be careful when verifying
-# who made releases.
-VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/rouault.asc
-inherit multilib-minimal verify-sig libtool flag-o-matic
-
-MY_P="${P/_rc/rc}"
-DESCRIPTION="Tag Image File Format (TIFF) library"
-HOMEPAGE="http://libtiff.maptools.org"
-SRC_URI="https://download.osgeo.org/libtiff/${MY_P}.tar.xz"
-SRC_URI+=" verify-sig? ( https://download.osgeo.org/libtiff/${MY_P}.tar.xz.sig )"
-S="${WORKDIR}/${PN}-$(ver_cut 1-3)"
-
-LICENSE="libtiff"
-SLOT="0"
-if [[ ${PV} != *_rc* ]] ; then
- KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-fi
-IUSE="+cxx jbig jpeg lzma static-libs test webp zlib zstd"
-RESTRICT="!test? ( test )"
-
-# bug #483132
-REQUIRED_USE="test? ( jpeg )"
-
-RDEPEND="jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
- jpeg? ( media-libs/libjpeg-turbo:=[${MULTILIB_USEDEP}] )
- lzma? ( >=app-arch/xz-utils-5.0.5-r1[${MULTILIB_USEDEP}] )
- webp? ( media-libs/libwebp:=[${MULTILIB_USEDEP}] )
- zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
- zstd? ( >=app-arch/zstd-1.3.7-r1:=[${MULTILIB_USEDEP}] )"
-DEPEND="${RDEPEND}"
-BDEPEND="verify-sig? ( sec-keys/openpgp-keys-evenrouault )"
-
-MULTILIB_WRAPPED_HEADERS=(
- /usr/include/tiffconf.h
-)
-
-PATCHES=(
- "${FILESDIR}"/${PN}-4.4.0_rc1-skip-thumbnail-test.patch
- "${FILESDIR}"/${P}-hylafaxplus-regression.patch
-)
-
-src_prepare() {
- default
-
- # Added to fix cross-compilation
- elibtoolize
-}
-
-multilib_src_configure() {
- append-lfs-flags
-
- local myeconfargs=(
- --without-x
- --with-docdir="${EPREFIX}"/usr/share/doc/${PF}
- $(use_enable cxx)
- $(use_enable jbig)
- $(use_enable jpeg)
- $(use_enable lzma)
- $(use_enable static-libs static)
- $(use_enable webp)
- $(use_enable zlib)
- $(use_enable zstd)
- )
-
- ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-
- # Remove components (like tools) that are irrelevant for the multilib
- # build which we only want libraries for.
- # TODO: upstream options to disable these properly
- # https://gitlab.com/libtiff/libtiff/-/merge_requests/334
- if ! multilib_is_native_abi ; then
- sed -i \
- -e 's/ tools//' \
- -e 's/ contrib//' \
- -e 's/ man//' \
- -e 's/ html//' \
- Makefile || die
- fi
-}
-
-multilib_src_test() {
- if ! multilib_is_native_abi ; then
- emake -C tools
- fi
-
- emake check
-}
-
-multilib_src_install_all() {
- find "${ED}" -type f -name '*.la' -delete || die
- rm "${ED}"/usr/share/doc/${PF}/{COPYRIGHT,README*,RELEASE-DATE,TODO,VERSION} || die
-}
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2023-02-07 4:30 Sam James
0 siblings, 0 replies; 14+ messages in thread
From: Sam James @ 2023-02-07 4:30 UTC (permalink / raw
To: gentoo-commits
commit: 7a7119ce544ba3de8179b4b9ec93c0032a069ecd
Author: Michael Vetter <jubalh <AT> iodoru <DOT> org>
AuthorDate: Sat Feb 4 18:56:16 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Feb 7 04:29:50 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7a7119ce
media-libs/tiff: Fix CVE-2022-48281
Bug: https://bugs.gentoo.org/891839
Upstream: https://gitlab.com/libtiff/libtiff/-/issues/488
Signed-off-by: Michael Vetter <jubalh <AT> iodoru.org>
Closes: https://github.com/gentoo/gentoo/pull/29426
Signed-off-by: Sam James <sam <AT> gentoo.org>
.../tiff/files/tiff-4.5.0-CVE-2022-48281.patch | 14 ++++
media-libs/tiff/tiff-4.5.0-r1.ebuild | 90 ++++++++++++++++++++++
2 files changed, 104 insertions(+)
diff --git a/media-libs/tiff/files/tiff-4.5.0-CVE-2022-48281.patch b/media-libs/tiff/files/tiff-4.5.0-CVE-2022-48281.patch
new file mode 100644
index 000000000000..070f642da454
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.5.0-CVE-2022-48281.patch
@@ -0,0 +1,14 @@
+Index: tiff-4.5.0/tools/tiffcrop.c
+===================================================================
+--- tiff-4.5.0.orig/tools/tiffcrop.c
++++ tiff-4.5.0/tools/tiffcrop.c
+@@ -8591,7 +8591,7 @@ static int processCropSelections(struct
+ cropsize + NUM_BUFF_OVERSIZE_BYTES);
+ else
+ {
+- prev_cropsize = seg_buffs[0].size;
++ prev_cropsize = seg_buffs[i].size;
+ if (prev_cropsize < cropsize)
+ {
+ next_buff = _TIFFrealloc(
+
diff --git a/media-libs/tiff/tiff-4.5.0-r1.ebuild b/media-libs/tiff/tiff-4.5.0-r1.ebuild
new file mode 100644
index 000000000000..bbbf78771312
--- /dev/null
+++ b/media-libs/tiff/tiff-4.5.0-r1.ebuild
@@ -0,0 +1,90 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+QA_PKGCONFIG_VERSION="$(ver_cut 1-3)"
+
+# Release signer can vary per version but not clear if others will be doing
+# them in future, so gone with Even Rouault for now as he does other geosci
+# stuff too like PROJ, GDAL. Previous release manager of TIFF was
+# GraphicsMagick maintainer Bob Friesenhahn. Please be careful when verifying
+# who made releases.
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/rouault.asc
+inherit autotools multilib-minimal verify-sig flag-o-matic
+
+MY_P="${P/_rc/rc}"
+DESCRIPTION="Tag Image File Format (TIFF) library"
+HOMEPAGE="http://libtiff.maptools.org"
+SRC_URI="https://download.osgeo.org/libtiff/${MY_P}.tar.xz"
+SRC_URI+=" verify-sig? ( https://download.osgeo.org/libtiff/${MY_P}.tar.xz.sig )"
+S="${WORKDIR}/${PN}-$(ver_cut 1-3)"
+
+LICENSE="libtiff"
+SLOT="0/6"
+if [[ ${PV} != *_rc* ]] ; then
+ KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+fi
+IUSE="+cxx jbig jpeg lzma static-libs test webp zlib zstd"
+RESTRICT="!test? ( test )"
+
+# bug #483132
+REQUIRED_USE="test? ( jpeg )"
+
+RDEPEND="jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
+ jpeg? ( media-libs/libjpeg-turbo:=[${MULTILIB_USEDEP}] )
+ lzma? ( >=app-arch/xz-utils-5.0.5-r1[${MULTILIB_USEDEP}] )
+ webp? ( media-libs/libwebp:=[${MULTILIB_USEDEP}] )
+ zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
+ zstd? ( >=app-arch/zstd-1.3.7-r1:=[${MULTILIB_USEDEP}] )"
+DEPEND="${RDEPEND}"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-evenrouault )"
+
+MULTILIB_WRAPPED_HEADERS=(
+ /usr/include/tiffconf.h
+)
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-4.5.0_rc1-skip-tools-tests-multilib.patch
+ "${FILESDIR}"/${PN}-4.5.0-CVE-2022-48281.patch
+)
+
+src_prepare() {
+ default
+
+ # Added to fix cross-compilation
+ #elibtoolize
+
+ # For skip-tools-tests-multilib.patch
+ eautoreconf
+}
+
+multilib_src_configure() {
+ append-lfs-flags
+
+ local myeconfargs=(
+ --disable-sphinx
+ --without-x
+ --with-docdir="${EPREFIX}"/usr/share/doc/${PF}
+ $(use_enable cxx)
+ $(use_enable jbig)
+ $(use_enable jpeg)
+ $(use_enable lzma)
+ $(use_enable static-libs static)
+ $(use_enable test tests)
+ $(use_enable webp)
+ $(use_enable zlib)
+ $(use_enable zstd)
+
+ $(multilib_native_enable docs)
+ $(multilib_native_enable contrib)
+ $(multilib_native_enable tools)
+ )
+
+ ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+ find "${ED}" -type f -name '*.la' -delete || die
+ rm "${ED}"/usr/share/doc/${PF}/{README*,RELEASE-DATE,TODO,VERSION} || die
+}
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2023-02-22 16:23 Sam James
0 siblings, 0 replies; 14+ messages in thread
From: Sam James @ 2023-02-22 16:23 UTC (permalink / raw
To: gentoo-commits
commit: c57fa2f06ec67e7994f12a4e4c6e2e3b7ed2541b
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 22 16:22:25 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Feb 22 16:22:25 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c57fa2f0
Revert "media-libs/tiff: Fix several CVEs"
This reverts commit 7ebadfbb4602052047e063e83e78cf398d2610c5.
Reverting so I can fix the Bug tag I messed up.
Signed-off-by: Sam James <sam <AT> gentoo.org>
...CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch | 287 ---------------------
...CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch | 131 ----------
media-libs/tiff/tiff-4.5.0-r2.ebuild | 92 -------
3 files changed, 510 deletions(-)
diff --git a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch b/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch
deleted file mode 100644
index 70a9b8269ec5..000000000000
--- a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch
+++ /dev/null
@@ -1,287 +0,0 @@
-Index: tiff-4.5.0/tools/tiffcrop.c
-===================================================================
-Upstream commits:
-https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68
-https://gitlab.com/libtiff/libtiff/-/commit/9c22495e5eeeae9e00a1596720c969656bb8d678
-From 9c22495e5eeeae9e00a1596720c969656bb8d678 Mon Sep 17 00:00:00 2001
-From: Su_Laus <sulau@freenet.de>
-Date: Fri, 3 Feb 2023 15:31:31 +0100
-Subject: [PATCH] tiffcrop correctly update buffersize after rotateImage()
- fix#520 rotateImage() set up a new buffer and calculates its size
- individually. Therefore, seg_buffs[] size needs to be updated accordingly.
- Before this fix, the seg_buffs buffer size was calculated with a different
- formula than within rotateImage().
-
-Closes #520.
----
- tools/tiffcrop.c | 36 ++++++++++++++++++++----------------
- 1 file changed, 20 insertions(+), 16 deletions(-)
-
-diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
-index 7db69883..f8b66188 100644
---- a/tools/tiffcrop.c
-+++ b/tools/tiffcrop.c
-@@ -577,7 +577,7 @@ static int rotateContigSamples24bits(uint16_t, uint16_t, uint16_t, uint32_t,
- static int rotateContigSamples32bits(uint16_t, uint16_t, uint16_t, uint32_t,
- uint32_t, uint32_t, uint8_t *, uint8_t *);
- static int rotateImage(uint16_t, struct image_data *, uint32_t *, uint32_t *,
-- unsigned char **);
-+ unsigned char **, size_t *);
- static int mirrorImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
- unsigned char *);
- static int invertImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
-@@ -7243,7 +7243,7 @@ static int correct_orientation(struct image_data *image,
- }
-
- if (rotateImage(rotation, image, &image->width, &image->length,
-- work_buff_ptr))
-+ work_buff_ptr, NULL))
- {
- TIFFError("correct_orientation", "Unable to rotate image");
- return (-1);
-@@ -8563,8 +8563,12 @@ static int processCropSelections(struct image_data *image,
- if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can
- reallocate the buffer */
- {
-+ /* rotateImage() set up a new buffer and calculates its size
-+ * individually. Therefore, seg_buffs size needs to be updated
-+ * accordingly. */
-+ size_t rot_buf_size = 0;
- if (rotateImage(crop->rotation, image, &crop->combined_width,
-- &crop->combined_length, &crop_buff))
-+ &crop->combined_length, &crop_buff, &rot_buf_size))
- {
- TIFFError("processCropSelections",
- "Failed to rotate composite regions by %" PRIu32
-@@ -8573,9 +8577,7 @@ static int processCropSelections(struct image_data *image,
- return (-1);
- }
- seg_buffs[0].buffer = crop_buff;
-- seg_buffs[0].size =
-- (((crop->combined_width * image->bps + 7) / 8) * image->spp) *
-- crop->combined_length;
-+ seg_buffs[0].size = rot_buf_size;
- }
- }
- else /* Separated Images */
-@@ -8686,10 +8688,13 @@ static int processCropSelections(struct image_data *image,
- * ->yres, what it schouldn't do here, when more than one
- * section is processed. ToDo: Therefore rotateImage() and its
- * usage has to be reworked (e.g. like mirrorImage()) !!
-- */
-- if (rotateImage(crop->rotation, image,
-- &crop->regionlist[i].width,
-- &crop->regionlist[i].length, &crop_buff))
-+ * Furthermore, rotateImage() set up a new buffer and calculates
-+ * its size individually. Therefore, seg_buffs size needs to be
-+ * updated accordingly. */
-+ size_t rot_buf_size = 0;
-+ if (rotateImage(
-+ crop->rotation, image, &crop->regionlist[i].width,
-+ &crop->regionlist[i].length, &crop_buff, &rot_buf_size))
- {
- TIFFError("processCropSelections",
- "Failed to rotate crop region by %" PRIu16
-@@ -8702,10 +8707,7 @@ static int processCropSelections(struct image_data *image,
- crop->combined_width = total_width;
- crop->combined_length = total_length;
- seg_buffs[i].buffer = crop_buff;
-- seg_buffs[i].size =
-- (((crop->regionlist[i].width * image->bps + 7) / 8) *
-- image->spp) *
-- crop->regionlist[i].length;
-+ seg_buffs[i].size = rot_buf_size;
- }
- } /* for crop->selections loop */
- } /* Separated Images (else case) */
-@@ -8836,7 +8838,7 @@ static int createCroppedImage(struct image_data *image, struct crop_mask *crop,
- CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
- {
- if (rotateImage(crop->rotation, image, &crop->combined_width,
-- &crop->combined_length, crop_buff_ptr))
-+ &crop->combined_length, crop_buff_ptr, NULL))
- {
- TIFFError("createCroppedImage",
- "Failed to rotate image or cropped selection by %" PRIu16
-@@ -9552,7 +9554,7 @@ static int rotateContigSamples32bits(uint16_t rotation, uint16_t spp,
- /* Rotate an image by a multiple of 90 degrees clockwise */
- static int rotateImage(uint16_t rotation, struct image_data *image,
- uint32_t *img_width, uint32_t *img_length,
-- unsigned char **ibuff_ptr)
-+ unsigned char **ibuff_ptr, size_t *rot_buf_size)
- {
- int shift_width;
- uint32_t bytes_per_pixel, bytes_per_sample;
-@@ -9610,6 +9612,8 @@ static int rotateImage(uint16_t rotation, struct image_data *image,
- return (-1);
- }
- _TIFFmemset(rbuff, '\0', buffsize + NUM_BUFF_OVERSIZE_BYTES);
-+ if (rot_buf_size != NULL)
-+ *rot_buf_size = buffsize;
-
- ibuff = *ibuff_ptr;
- switch (rotation)
---
-GitLab
-
-From 69818e2f2d246e6631ac2a2da692c3706b849c38 Mon Sep 17 00:00:00 2001
-From: Su_Laus <sulau@freenet.de>
-Date: Sun, 29 Jan 2023 11:09:26 +0100
-Subject: [PATCH] tiffcrop: Amend rotateImage() not to toggle the input (main)
- image width and length parameters when only cropped image sections are
- rotated. Remove buffptr from region structure because never used.
-
-Closes #492 #493 #494 #495 #499 #518 #519
----
- tools/tiffcrop.c | 59 ++++++++++++++++++++++++++++--------------------
- 1 file changed, 35 insertions(+), 24 deletions(-)
-
-diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
-index ebea7475..519871ec 100644
---- a/tools/tiffcrop.c
-+++ b/tools/tiffcrop.c
-@@ -296,7 +296,6 @@ struct region
- uint32_t width; /* width in pixels */
- uint32_t length; /* length in pixels */
- uint32_t buffsize; /* size of buffer needed to hold the cropped region */
-- unsigned char *buffptr; /* address of start of the region */
- };
-
- /* Cropping parameters from command line and image data
-@@ -577,7 +576,7 @@ static int rotateContigSamples24bits(uint16_t, uint16_t, uint16_t, uint32_t,
- static int rotateContigSamples32bits(uint16_t, uint16_t, uint16_t, uint32_t,
- uint32_t, uint32_t, uint8_t *, uint8_t *);
- static int rotateImage(uint16_t, struct image_data *, uint32_t *, uint32_t *,
-- unsigned char **, size_t *);
-+ unsigned char **, size_t *, int);
- static int mirrorImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
- unsigned char *);
- static int invertImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
-@@ -5782,7 +5781,6 @@ static void initCropMasks(struct crop_mask *cps)
- cps->regionlist[i].width = 0;
- cps->regionlist[i].length = 0;
- cps->regionlist[i].buffsize = 0;
-- cps->regionlist[i].buffptr = NULL;
- cps->zonelist[i].position = 0;
- cps->zonelist[i].total = 0;
- }
-@@ -7266,9 +7264,13 @@ static int correct_orientation(struct image_data *image,
- (uint16_t)(image->adjustments & ROTATE_ANY));
- return (-1);
- }
--
-- if (rotateImage(rotation, image, &image->width, &image->length,
-- work_buff_ptr, NULL))
-+ /* Dummy variable in order not to switch two times the
-+ * image->width,->length within rotateImage(),
-+ * but switch xres, yres there. */
-+ uint32_t width = image->width;
-+ uint32_t length = image->length;
-+ if (rotateImage(rotation, image, &width, &length, work_buff_ptr, NULL,
-+ TRUE))
- {
- TIFFError("correct_orientation", "Unable to rotate image");
- return (-1);
-@@ -7377,7 +7379,6 @@ static int extractCompositeRegions(struct image_data *image,
- /* These should not be needed for composite images */
- crop->regionlist[i].width = crop_width;
- crop->regionlist[i].length = crop_length;
-- crop->regionlist[i].buffptr = crop_buff;
-
- src_rowsize = ((img_width * bps * spp) + 7) / 8;
- dst_rowsize = (((crop_width * bps * count) + 7) / 8);
-@@ -7640,7 +7641,6 @@ static int extractSeparateRegion(struct image_data *image,
-
- crop->regionlist[region].width = crop_width;
- crop->regionlist[region].length = crop_length;
-- crop->regionlist[region].buffptr = crop_buff;
-
- src = read_buff;
- dst = crop_buff;
-@@ -8635,7 +8635,8 @@ static int processCropSelections(struct image_data *image,
- * accordingly. */
- size_t rot_buf_size = 0;
- if (rotateImage(crop->rotation, image, &crop->combined_width,
-- &crop->combined_length, &crop_buff, &rot_buf_size))
-+ &crop->combined_length, &crop_buff, &rot_buf_size,
-+ FALSE))
- {
- TIFFError("processCropSelections",
- "Failed to rotate composite regions by %" PRIu32
-@@ -8759,9 +8760,10 @@ static int processCropSelections(struct image_data *image,
- * its size individually. Therefore, seg_buffs size needs to be
- * updated accordingly. */
- size_t rot_buf_size = 0;
-- if (rotateImage(
-- crop->rotation, image, &crop->regionlist[i].width,
-- &crop->regionlist[i].length, &crop_buff, &rot_buf_size))
-+ if (rotateImage(crop->rotation, image,
-+ &crop->regionlist[i].width,
-+ &crop->regionlist[i].length, &crop_buff,
-+ &rot_buf_size, FALSE))
- {
- TIFFError("processCropSelections",
- "Failed to rotate crop region by %" PRIu16
-@@ -8905,7 +8907,7 @@ static int createCroppedImage(struct image_data *image, struct crop_mask *crop,
- CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
- {
- if (rotateImage(crop->rotation, image, &crop->combined_width,
-- &crop->combined_length, crop_buff_ptr, NULL))
-+ &crop->combined_length, crop_buff_ptr, NULL, TRUE))
- {
- TIFFError("createCroppedImage",
- "Failed to rotate image or cropped selection by %" PRIu16
-@@ -9621,7 +9623,8 @@ static int rotateContigSamples32bits(uint16_t rotation, uint16_t spp,
- /* Rotate an image by a multiple of 90 degrees clockwise */
- static int rotateImage(uint16_t rotation, struct image_data *image,
- uint32_t *img_width, uint32_t *img_length,
-- unsigned char **ibuff_ptr, size_t *rot_buf_size)
-+ unsigned char **ibuff_ptr, size_t *rot_buf_size,
-+ int rot_image_params)
- {
- int shift_width;
- uint32_t bytes_per_pixel, bytes_per_sample;
-@@ -9869,11 +9872,15 @@ static int rotateImage(uint16_t rotation, struct image_data *image,
-
- *img_width = length;
- *img_length = width;
-- image->width = length;
-- image->length = width;
-- res_temp = image->xres;
-- image->xres = image->yres;
-- image->yres = res_temp;
-+ /* Only toggle image parameters if whole input image is rotated. */
-+ if (rot_image_params)
-+ {
-+ image->width = length;
-+ image->length = width;
-+ res_temp = image->xres;
-+ image->xres = image->yres;
-+ image->yres = res_temp;
-+ }
- break;
-
- case 270:
-@@ -9956,11 +9963,15 @@ static int rotateImage(uint16_t rotation, struct image_data *image,
-
- *img_width = length;
- *img_length = width;
-- image->width = length;
-- image->length = width;
-- res_temp = image->xres;
-- image->xres = image->yres;
-- image->yres = res_temp;
-+ /* Only toggle image parameters if whole input image is rotated. */
-+ if (rot_image_params)
-+ {
-+ image->width = length;
-+ image->length = width;
-+ res_temp = image->xres;
-+ image->xres = image->yres;
-+ image->yres = res_temp;
-+ }
- break;
- default:
- break;
---
-GitLab
diff --git a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch b/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch
deleted file mode 100644
index 41fe439f9159..000000000000
--- a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-Index: tiff-4.5.0/tools/tiffcrop.c
-===================================================================
-Upstream commit:
-https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00
-From 82a7fbb1fa7228499ffeb3a57a1d106a9626d57c Mon Sep 17 00:00:00 2001
-From: Su Laus <sulau@freenet.de>
-Date: Sun, 5 Feb 2023 15:53:15 +0000
-Subject: [PATCH] tiffcrop: added check for assumption on composite images
- (fixes #496)
-
-tiffcrop: For composite images with more than one region, the combined_length or combined_width always needs to be equal, respectively. Otherwise, even the first section/region copy action might cause buffer overrun. This is now checked before the first copy action.
-
-Closes #496, #497, #498, #500, #501.
----
- tools/tiffcrop.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++--
- 1 file changed, 66 insertions(+), 2 deletions(-)
-
-diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
-index 84e26ac6..480b927c 100644
---- a/tools/tiffcrop.c
-+++ b/tools/tiffcrop.c
-@@ -5935,18 +5935,40 @@ static int computeInputPixelOffsets(struct crop_mask *crop,
-
- crop->regionlist[i].buffsize = buffsize;
- crop->bufftotal += buffsize;
-+
-+ /* For composite images with more than one region, the
-+ * combined_length or combined_width always needs to be equal,
-+ * respectively.
-+ * Otherwise, even the first section/region copy
-+ * action might cause buffer overrun. */
- if (crop->img_mode == COMPOSITE_IMAGES)
- {
- switch (crop->edge_ref)
- {
- case EDGE_LEFT:
- case EDGE_RIGHT:
-+ if (i > 0 && zlength != crop->combined_length)
-+ {
-+ TIFFError(
-+ "computeInputPixelOffsets",
-+ "Only equal length regions can be combined for "
-+ "-E left or right");
-+ return (-1);
-+ }
- crop->combined_length = zlength;
- crop->combined_width += zwidth;
- break;
- case EDGE_BOTTOM:
- case EDGE_TOP: /* width from left, length from top */
- default:
-+ if (i > 0 && zwidth != crop->combined_width)
-+ {
-+ TIFFError("computeInputPixelOffsets",
-+ "Only equal width regions can be "
-+ "combined for -E "
-+ "top or bottom");
-+ return (-1);
-+ }
- crop->combined_width = zwidth;
- crop->combined_length += zlength;
- break;
-@@ -7301,6 +7323,46 @@ static int extractCompositeRegions(struct image_data *image,
- crop->combined_width = 0;
- crop->combined_length = 0;
-
-+ /* If there is more than one region, check beforehand whether all the width
-+ * and length values of the regions are the same, respectively. */
-+ switch (crop->edge_ref)
-+ {
-+ default:
-+ case EDGE_TOP:
-+ case EDGE_BOTTOM:
-+ for (i = 1; i < crop->selections; i++)
-+ {
-+ uint32_t crop_width0 =
-+ crop->regionlist[i - 1].x2 - crop->regionlist[i - 1].x1 + 1;
-+ uint32_t crop_width1 =
-+ crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1;
-+ if (crop_width0 != crop_width1)
-+ {
-+ TIFFError("extractCompositeRegions",
-+ "Only equal width regions can be combined for -E "
-+ "top or bottom");
-+ return (1);
-+ }
-+ }
-+ break;
-+ case EDGE_LEFT:
-+ case EDGE_RIGHT:
-+ for (i = 1; i < crop->selections; i++)
-+ {
-+ uint32_t crop_length0 =
-+ crop->regionlist[i - 1].y2 - crop->regionlist[i - 1].y1 + 1;
-+ uint32_t crop_length1 =
-+ crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1;
-+ if (crop_length0 != crop_length1)
-+ {
-+ TIFFError("extractCompositeRegions",
-+ "Only equal length regions can be combined for "
-+ "-E left or right");
-+ return (1);
-+ }
-+ }
-+ }
-+
- for (i = 0; i < crop->selections; i++)
- {
- /* rows, columns, width, length are expressed in pixels */
-@@ -7325,7 +7387,8 @@ static int extractCompositeRegions(struct image_data *image,
- default:
- case EDGE_TOP:
- case EDGE_BOTTOM:
-- if ((i > 0) && (crop_width != crop->regionlist[i - 1].width))
-+ if ((crop->selections > i + 1) &&
-+ (crop_width != crop->regionlist[i + 1].width))
- {
- TIFFError("extractCompositeRegions",
- "Only equal width regions can be combined for -E "
-@@ -7418,7 +7481,8 @@ static int extractCompositeRegions(struct image_data *image,
- case EDGE_LEFT: /* splice the pieces of each row together, side by
- side */
- case EDGE_RIGHT:
-- if ((i > 0) && (crop_length != crop->regionlist[i - 1].length))
-+ if ((crop->selections > i + 1) &&
-+ (crop_length != crop->regionlist[i + 1].length))
- {
- TIFFError("extractCompositeRegions",
- "Only equal length regions can be combined for "
---
-GitLab
diff --git a/media-libs/tiff/tiff-4.5.0-r2.ebuild b/media-libs/tiff/tiff-4.5.0-r2.ebuild
deleted file mode 100644
index 00f6bb711511..000000000000
--- a/media-libs/tiff/tiff-4.5.0-r2.ebuild
+++ /dev/null
@@ -1,92 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-QA_PKGCONFIG_VERSION="$(ver_cut 1-3)"
-
-# Release signer can vary per version but not clear if others will be doing
-# them in future, so gone with Even Rouault for now as he does other geosci
-# stuff too like PROJ, GDAL. Previous release manager of TIFF was
-# GraphicsMagick maintainer Bob Friesenhahn. Please be careful when verifying
-# who made releases.
-VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/rouault.asc
-inherit autotools multilib-minimal verify-sig flag-o-matic
-
-MY_P="${P/_rc/rc}"
-DESCRIPTION="Tag Image File Format (TIFF) library"
-HOMEPAGE="http://libtiff.maptools.org"
-SRC_URI="https://download.osgeo.org/libtiff/${MY_P}.tar.xz"
-SRC_URI+=" verify-sig? ( https://download.osgeo.org/libtiff/${MY_P}.tar.xz.sig )"
-S="${WORKDIR}/${PN}-$(ver_cut 1-3)"
-
-LICENSE="libtiff"
-SLOT="0/6"
-if [[ ${PV} != *_rc* ]] ; then
- KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-fi
-IUSE="+cxx jbig jpeg lzma static-libs test webp zlib zstd"
-RESTRICT="!test? ( test )"
-
-# bug #483132
-REQUIRED_USE="test? ( jpeg )"
-
-RDEPEND="jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
- jpeg? ( media-libs/libjpeg-turbo:=[${MULTILIB_USEDEP}] )
- lzma? ( >=app-arch/xz-utils-5.0.5-r1[${MULTILIB_USEDEP}] )
- webp? ( media-libs/libwebp:=[${MULTILIB_USEDEP}] )
- zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
- zstd? ( >=app-arch/zstd-1.3.7-r1:=[${MULTILIB_USEDEP}] )"
-DEPEND="${RDEPEND}"
-BDEPEND="verify-sig? ( sec-keys/openpgp-keys-evenrouault )"
-
-MULTILIB_WRAPPED_HEADERS=(
- /usr/include/tiffconf.h
-)
-
-PATCHES=(
- "${FILESDIR}"/${PN}-4.5.0_rc1-skip-tools-tests-multilib.patch
- "${FILESDIR}"/${PN}-4.5.0-CVE-2022-48281.patch
- "${FILESDIR}"/${PN}-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch
- "${FILESDIR}"/${PN}-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch
-)
-
-src_prepare() {
- default
-
- # Added to fix cross-compilation
- #elibtoolize
-
- # For skip-tools-tests-multilib.patch
- eautoreconf
-}
-
-multilib_src_configure() {
- append-lfs-flags
-
- local myeconfargs=(
- --disable-sphinx
- --without-x
- --with-docdir="${EPREFIX}"/usr/share/doc/${PF}
- $(use_enable cxx)
- $(use_enable jbig)
- $(use_enable jpeg)
- $(use_enable lzma)
- $(use_enable static-libs static)
- $(use_enable test tests)
- $(use_enable webp)
- $(use_enable zlib)
- $(use_enable zstd)
-
- $(multilib_native_enable docs)
- $(multilib_native_enable contrib)
- $(multilib_native_enable tools)
- )
-
- ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-multilib_src_install_all() {
- find "${ED}" -type f -name '*.la' -delete || die
- rm "${ED}"/usr/share/doc/${PF}/{README*,RELEASE-DATE,TODO,VERSION} || die
-}
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2024-11-19 20:59 Andreas K. Hüttel
0 siblings, 0 replies; 14+ messages in thread
From: Andreas K. Hüttel @ 2024-11-19 20:59 UTC (permalink / raw
To: gentoo-commits
commit: 65658e69ca2fbab2b6b762bf7631f638f676479f
Author: Andreas K. Hüttel <dilfridge <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 19 20:58:34 2024 +0000
Commit: Andreas K. Hüttel <dilfridge <AT> gentoo <DOT> org>
CommitDate: Tue Nov 19 20:59:03 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=65658e69
media-libs/tiff: drop 4.5.0-r2, 4.5.1
Closes: https://bugs.gentoo.org/898320
Signed-off-by: Andreas K. Hüttel <dilfridge <AT> gentoo.org>
media-libs/tiff/Manifest | 4 -
.../tiff/files/tiff-4.5.0-CVE-2022-48281.patch | 14 -
...CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch | 287 ---------------------
...CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch | 131 ----------
.../tiff-4.5.0_rc1-skip-tools-tests-multilib.patch | 52 ----
media-libs/tiff/tiff-4.5.0-r2.ebuild | 92 -------
media-libs/tiff/tiff-4.5.1.ebuild | 84 ------
7 files changed, 664 deletions(-)
diff --git a/media-libs/tiff/Manifest b/media-libs/tiff/Manifest
index b9ee3c2b77a6..4a09898bc72a 100644
--- a/media-libs/tiff/Manifest
+++ b/media-libs/tiff/Manifest
@@ -1,7 +1,3 @@
-DIST tiff-4.5.0.tar.xz 2320900 BLAKE2B c69801ba9d55b1ed27a92d31d8cd16937fe69299fbf5450efb4a6caa60245b72ddade110daae78f2198613640383623f76ec2265ba785375d0a85c7909b73fe9 SHA512 c6c866064c2dd5d1711c6ece7bafe5f011f5ce26c0aeaecbff79c05b5671f44150324bea95a0665cc43331883114de855ee1cd87ed733bff0f4d0814515b9f10
-DIST tiff-4.5.0.tar.xz.sig 310 BLAKE2B bbe7f9600061416227276424eb220714a1375d3e295cb0c5b7f76074324c1a2698a5029dde3e734331e9caf02d8a086273ded2ab09285857dbbfe3ad83506912 SHA512 8cef09755f4efe68db69591967e495852cf63c2d8113a877a2254f536d38c60b6dc864c07089249cd8109a8408672a297ae9e59d8233687bc2796dc158ccfb32
-DIST tiff-4.5.1.tar.xz 2228040 BLAKE2B 793c03593c46d6f804f622f5ff7e799751ee79e87ec1575801d2238fbcd2e89ed657a5081d3651e337f1bb14603ff94a15aad878e7fdf2cf75ada38eed64d9d2 SHA512 fc6af93d36598527480c517ddc4f19fe72e9f07ef4997e5731604253c8db0b9bae816ba7a56985bf22fbbb48db1fab5ed4c2b32a5145bc9477ef24b221a61179
-DIST tiff-4.5.1.tar.xz.sig 310 BLAKE2B fd5e3ff9c55790777b9d2587910cfb47953a27925bdf8610fc5b9db05a5662b534df542e3658db7b897c8de510479d0a7f0773092ac2f71e3c7bcb4beb14594f SHA512 10e434de0140bbd7e3830860bb611796b65fff5e718a2d5fb2857959ff63149d73b4e1f3f7c4be2c27f8ca863b0e4b7731332544eba948ce10097552e1779aee
DIST tiff-4.6.0.tar.xz 2124388 BLAKE2B 3b508b02b0a536c5bc8e67fe4c1b09ae9c830252786ef4764202c14d673d1ef9634694de7a5893a3551dec684d00bad9d0442c7fea7bcd09238b9960d443cf62 SHA512 4cd9bb485bcac9c5efdd0c4814f2a38a762a3b69e70d909c05a24e2e9d2bd27357b9814e0cb1cee3898355d6ccfcf1615f715125c8ab8c651db474073734ab03
DIST tiff-4.6.0.tar.xz.sig 310 BLAKE2B 9f159a5839dd41bda34eceeed6e451455fbcfec5d51ebb097038e3977a391a751e91a9f683375593f45af0f9c8f0dbe55a0cc437fe4512537b30d513adfdb2c0 SHA512 da87b4294e17d49cf60e81ec5285f503291532423330552e41dddfb672c0636e95b8a80d603c3095abbee469cb7dce63c2df0c22b751a3bf8541550f97f78b49
DIST tiff-4.7.0.tar.xz 2286220 BLAKE2B a5df7f3ae71821a13ff5a31db012191dd1b022b1c87fe81f90fd4b4a1349b7aa15d7b336d5fa8ac9e84edcfac5fe46214d9ea54790cb037438c6a5334980c11e SHA512 4234bc3d1a4de38587e21eb7d5785d6e11bc5f73c3d412dd44b9f7bcc42122d940ad017450a949dce5c3b270018829593202bff815a02d23268d9b9723266fe0
diff --git a/media-libs/tiff/files/tiff-4.5.0-CVE-2022-48281.patch b/media-libs/tiff/files/tiff-4.5.0-CVE-2022-48281.patch
deleted file mode 100644
index e38d17df9cc2..000000000000
--- a/media-libs/tiff/files/tiff-4.5.0-CVE-2022-48281.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-https://gitlab.com/libtiff/libtiff/-/issues/488
-https://bugs.gentoo.org/891839
---- a/tools/tiffcrop.c
-+++ b/tools/tiffcrop.c
-@@ -8591,7 +8591,7 @@ static int processCropSelections(struct
- cropsize + NUM_BUFF_OVERSIZE_BYTES);
- else
- {
-- prev_cropsize = seg_buffs[0].size;
-+ prev_cropsize = seg_buffs[i].size;
- if (prev_cropsize < cropsize)
- {
- next_buff = _TIFFrealloc(
-
diff --git a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch b/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch
deleted file mode 100644
index 70a9b8269ec5..000000000000
--- a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch
+++ /dev/null
@@ -1,287 +0,0 @@
-Index: tiff-4.5.0/tools/tiffcrop.c
-===================================================================
-Upstream commits:
-https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68
-https://gitlab.com/libtiff/libtiff/-/commit/9c22495e5eeeae9e00a1596720c969656bb8d678
-From 9c22495e5eeeae9e00a1596720c969656bb8d678 Mon Sep 17 00:00:00 2001
-From: Su_Laus <sulau@freenet.de>
-Date: Fri, 3 Feb 2023 15:31:31 +0100
-Subject: [PATCH] tiffcrop correctly update buffersize after rotateImage()
- fix#520 rotateImage() set up a new buffer and calculates its size
- individually. Therefore, seg_buffs[] size needs to be updated accordingly.
- Before this fix, the seg_buffs buffer size was calculated with a different
- formula than within rotateImage().
-
-Closes #520.
----
- tools/tiffcrop.c | 36 ++++++++++++++++++++----------------
- 1 file changed, 20 insertions(+), 16 deletions(-)
-
-diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
-index 7db69883..f8b66188 100644
---- a/tools/tiffcrop.c
-+++ b/tools/tiffcrop.c
-@@ -577,7 +577,7 @@ static int rotateContigSamples24bits(uint16_t, uint16_t, uint16_t, uint32_t,
- static int rotateContigSamples32bits(uint16_t, uint16_t, uint16_t, uint32_t,
- uint32_t, uint32_t, uint8_t *, uint8_t *);
- static int rotateImage(uint16_t, struct image_data *, uint32_t *, uint32_t *,
-- unsigned char **);
-+ unsigned char **, size_t *);
- static int mirrorImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
- unsigned char *);
- static int invertImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
-@@ -7243,7 +7243,7 @@ static int correct_orientation(struct image_data *image,
- }
-
- if (rotateImage(rotation, image, &image->width, &image->length,
-- work_buff_ptr))
-+ work_buff_ptr, NULL))
- {
- TIFFError("correct_orientation", "Unable to rotate image");
- return (-1);
-@@ -8563,8 +8563,12 @@ static int processCropSelections(struct image_data *image,
- if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can
- reallocate the buffer */
- {
-+ /* rotateImage() set up a new buffer and calculates its size
-+ * individually. Therefore, seg_buffs size needs to be updated
-+ * accordingly. */
-+ size_t rot_buf_size = 0;
- if (rotateImage(crop->rotation, image, &crop->combined_width,
-- &crop->combined_length, &crop_buff))
-+ &crop->combined_length, &crop_buff, &rot_buf_size))
- {
- TIFFError("processCropSelections",
- "Failed to rotate composite regions by %" PRIu32
-@@ -8573,9 +8577,7 @@ static int processCropSelections(struct image_data *image,
- return (-1);
- }
- seg_buffs[0].buffer = crop_buff;
-- seg_buffs[0].size =
-- (((crop->combined_width * image->bps + 7) / 8) * image->spp) *
-- crop->combined_length;
-+ seg_buffs[0].size = rot_buf_size;
- }
- }
- else /* Separated Images */
-@@ -8686,10 +8688,13 @@ static int processCropSelections(struct image_data *image,
- * ->yres, what it schouldn't do here, when more than one
- * section is processed. ToDo: Therefore rotateImage() and its
- * usage has to be reworked (e.g. like mirrorImage()) !!
-- */
-- if (rotateImage(crop->rotation, image,
-- &crop->regionlist[i].width,
-- &crop->regionlist[i].length, &crop_buff))
-+ * Furthermore, rotateImage() set up a new buffer and calculates
-+ * its size individually. Therefore, seg_buffs size needs to be
-+ * updated accordingly. */
-+ size_t rot_buf_size = 0;
-+ if (rotateImage(
-+ crop->rotation, image, &crop->regionlist[i].width,
-+ &crop->regionlist[i].length, &crop_buff, &rot_buf_size))
- {
- TIFFError("processCropSelections",
- "Failed to rotate crop region by %" PRIu16
-@@ -8702,10 +8707,7 @@ static int processCropSelections(struct image_data *image,
- crop->combined_width = total_width;
- crop->combined_length = total_length;
- seg_buffs[i].buffer = crop_buff;
-- seg_buffs[i].size =
-- (((crop->regionlist[i].width * image->bps + 7) / 8) *
-- image->spp) *
-- crop->regionlist[i].length;
-+ seg_buffs[i].size = rot_buf_size;
- }
- } /* for crop->selections loop */
- } /* Separated Images (else case) */
-@@ -8836,7 +8838,7 @@ static int createCroppedImage(struct image_data *image, struct crop_mask *crop,
- CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
- {
- if (rotateImage(crop->rotation, image, &crop->combined_width,
-- &crop->combined_length, crop_buff_ptr))
-+ &crop->combined_length, crop_buff_ptr, NULL))
- {
- TIFFError("createCroppedImage",
- "Failed to rotate image or cropped selection by %" PRIu16
-@@ -9552,7 +9554,7 @@ static int rotateContigSamples32bits(uint16_t rotation, uint16_t spp,
- /* Rotate an image by a multiple of 90 degrees clockwise */
- static int rotateImage(uint16_t rotation, struct image_data *image,
- uint32_t *img_width, uint32_t *img_length,
-- unsigned char **ibuff_ptr)
-+ unsigned char **ibuff_ptr, size_t *rot_buf_size)
- {
- int shift_width;
- uint32_t bytes_per_pixel, bytes_per_sample;
-@@ -9610,6 +9612,8 @@ static int rotateImage(uint16_t rotation, struct image_data *image,
- return (-1);
- }
- _TIFFmemset(rbuff, '\0', buffsize + NUM_BUFF_OVERSIZE_BYTES);
-+ if (rot_buf_size != NULL)
-+ *rot_buf_size = buffsize;
-
- ibuff = *ibuff_ptr;
- switch (rotation)
---
-GitLab
-
-From 69818e2f2d246e6631ac2a2da692c3706b849c38 Mon Sep 17 00:00:00 2001
-From: Su_Laus <sulau@freenet.de>
-Date: Sun, 29 Jan 2023 11:09:26 +0100
-Subject: [PATCH] tiffcrop: Amend rotateImage() not to toggle the input (main)
- image width and length parameters when only cropped image sections are
- rotated. Remove buffptr from region structure because never used.
-
-Closes #492 #493 #494 #495 #499 #518 #519
----
- tools/tiffcrop.c | 59 ++++++++++++++++++++++++++++--------------------
- 1 file changed, 35 insertions(+), 24 deletions(-)
-
-diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
-index ebea7475..519871ec 100644
---- a/tools/tiffcrop.c
-+++ b/tools/tiffcrop.c
-@@ -296,7 +296,6 @@ struct region
- uint32_t width; /* width in pixels */
- uint32_t length; /* length in pixels */
- uint32_t buffsize; /* size of buffer needed to hold the cropped region */
-- unsigned char *buffptr; /* address of start of the region */
- };
-
- /* Cropping parameters from command line and image data
-@@ -577,7 +576,7 @@ static int rotateContigSamples24bits(uint16_t, uint16_t, uint16_t, uint32_t,
- static int rotateContigSamples32bits(uint16_t, uint16_t, uint16_t, uint32_t,
- uint32_t, uint32_t, uint8_t *, uint8_t *);
- static int rotateImage(uint16_t, struct image_data *, uint32_t *, uint32_t *,
-- unsigned char **, size_t *);
-+ unsigned char **, size_t *, int);
- static int mirrorImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
- unsigned char *);
- static int invertImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
-@@ -5782,7 +5781,6 @@ static void initCropMasks(struct crop_mask *cps)
- cps->regionlist[i].width = 0;
- cps->regionlist[i].length = 0;
- cps->regionlist[i].buffsize = 0;
-- cps->regionlist[i].buffptr = NULL;
- cps->zonelist[i].position = 0;
- cps->zonelist[i].total = 0;
- }
-@@ -7266,9 +7264,13 @@ static int correct_orientation(struct image_data *image,
- (uint16_t)(image->adjustments & ROTATE_ANY));
- return (-1);
- }
--
-- if (rotateImage(rotation, image, &image->width, &image->length,
-- work_buff_ptr, NULL))
-+ /* Dummy variable in order not to switch two times the
-+ * image->width,->length within rotateImage(),
-+ * but switch xres, yres there. */
-+ uint32_t width = image->width;
-+ uint32_t length = image->length;
-+ if (rotateImage(rotation, image, &width, &length, work_buff_ptr, NULL,
-+ TRUE))
- {
- TIFFError("correct_orientation", "Unable to rotate image");
- return (-1);
-@@ -7377,7 +7379,6 @@ static int extractCompositeRegions(struct image_data *image,
- /* These should not be needed for composite images */
- crop->regionlist[i].width = crop_width;
- crop->regionlist[i].length = crop_length;
-- crop->regionlist[i].buffptr = crop_buff;
-
- src_rowsize = ((img_width * bps * spp) + 7) / 8;
- dst_rowsize = (((crop_width * bps * count) + 7) / 8);
-@@ -7640,7 +7641,6 @@ static int extractSeparateRegion(struct image_data *image,
-
- crop->regionlist[region].width = crop_width;
- crop->regionlist[region].length = crop_length;
-- crop->regionlist[region].buffptr = crop_buff;
-
- src = read_buff;
- dst = crop_buff;
-@@ -8635,7 +8635,8 @@ static int processCropSelections(struct image_data *image,
- * accordingly. */
- size_t rot_buf_size = 0;
- if (rotateImage(crop->rotation, image, &crop->combined_width,
-- &crop->combined_length, &crop_buff, &rot_buf_size))
-+ &crop->combined_length, &crop_buff, &rot_buf_size,
-+ FALSE))
- {
- TIFFError("processCropSelections",
- "Failed to rotate composite regions by %" PRIu32
-@@ -8759,9 +8760,10 @@ static int processCropSelections(struct image_data *image,
- * its size individually. Therefore, seg_buffs size needs to be
- * updated accordingly. */
- size_t rot_buf_size = 0;
-- if (rotateImage(
-- crop->rotation, image, &crop->regionlist[i].width,
-- &crop->regionlist[i].length, &crop_buff, &rot_buf_size))
-+ if (rotateImage(crop->rotation, image,
-+ &crop->regionlist[i].width,
-+ &crop->regionlist[i].length, &crop_buff,
-+ &rot_buf_size, FALSE))
- {
- TIFFError("processCropSelections",
- "Failed to rotate crop region by %" PRIu16
-@@ -8905,7 +8907,7 @@ static int createCroppedImage(struct image_data *image, struct crop_mask *crop,
- CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
- {
- if (rotateImage(crop->rotation, image, &crop->combined_width,
-- &crop->combined_length, crop_buff_ptr, NULL))
-+ &crop->combined_length, crop_buff_ptr, NULL, TRUE))
- {
- TIFFError("createCroppedImage",
- "Failed to rotate image or cropped selection by %" PRIu16
-@@ -9621,7 +9623,8 @@ static int rotateContigSamples32bits(uint16_t rotation, uint16_t spp,
- /* Rotate an image by a multiple of 90 degrees clockwise */
- static int rotateImage(uint16_t rotation, struct image_data *image,
- uint32_t *img_width, uint32_t *img_length,
-- unsigned char **ibuff_ptr, size_t *rot_buf_size)
-+ unsigned char **ibuff_ptr, size_t *rot_buf_size,
-+ int rot_image_params)
- {
- int shift_width;
- uint32_t bytes_per_pixel, bytes_per_sample;
-@@ -9869,11 +9872,15 @@ static int rotateImage(uint16_t rotation, struct image_data *image,
-
- *img_width = length;
- *img_length = width;
-- image->width = length;
-- image->length = width;
-- res_temp = image->xres;
-- image->xres = image->yres;
-- image->yres = res_temp;
-+ /* Only toggle image parameters if whole input image is rotated. */
-+ if (rot_image_params)
-+ {
-+ image->width = length;
-+ image->length = width;
-+ res_temp = image->xres;
-+ image->xres = image->yres;
-+ image->yres = res_temp;
-+ }
- break;
-
- case 270:
-@@ -9956,11 +9963,15 @@ static int rotateImage(uint16_t rotation, struct image_data *image,
-
- *img_width = length;
- *img_length = width;
-- image->width = length;
-- image->length = width;
-- res_temp = image->xres;
-- image->xres = image->yres;
-- image->yres = res_temp;
-+ /* Only toggle image parameters if whole input image is rotated. */
-+ if (rot_image_params)
-+ {
-+ image->width = length;
-+ image->length = width;
-+ res_temp = image->xres;
-+ image->xres = image->yres;
-+ image->yres = res_temp;
-+ }
- break;
- default:
- break;
---
-GitLab
diff --git a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch b/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch
deleted file mode 100644
index 41fe439f9159..000000000000
--- a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-Index: tiff-4.5.0/tools/tiffcrop.c
-===================================================================
-Upstream commit:
-https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00
-From 82a7fbb1fa7228499ffeb3a57a1d106a9626d57c Mon Sep 17 00:00:00 2001
-From: Su Laus <sulau@freenet.de>
-Date: Sun, 5 Feb 2023 15:53:15 +0000
-Subject: [PATCH] tiffcrop: added check for assumption on composite images
- (fixes #496)
-
-tiffcrop: For composite images with more than one region, the combined_length or combined_width always needs to be equal, respectively. Otherwise, even the first section/region copy action might cause buffer overrun. This is now checked before the first copy action.
-
-Closes #496, #497, #498, #500, #501.
----
- tools/tiffcrop.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++--
- 1 file changed, 66 insertions(+), 2 deletions(-)
-
-diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
-index 84e26ac6..480b927c 100644
---- a/tools/tiffcrop.c
-+++ b/tools/tiffcrop.c
-@@ -5935,18 +5935,40 @@ static int computeInputPixelOffsets(struct crop_mask *crop,
-
- crop->regionlist[i].buffsize = buffsize;
- crop->bufftotal += buffsize;
-+
-+ /* For composite images with more than one region, the
-+ * combined_length or combined_width always needs to be equal,
-+ * respectively.
-+ * Otherwise, even the first section/region copy
-+ * action might cause buffer overrun. */
- if (crop->img_mode == COMPOSITE_IMAGES)
- {
- switch (crop->edge_ref)
- {
- case EDGE_LEFT:
- case EDGE_RIGHT:
-+ if (i > 0 && zlength != crop->combined_length)
-+ {
-+ TIFFError(
-+ "computeInputPixelOffsets",
-+ "Only equal length regions can be combined for "
-+ "-E left or right");
-+ return (-1);
-+ }
- crop->combined_length = zlength;
- crop->combined_width += zwidth;
- break;
- case EDGE_BOTTOM:
- case EDGE_TOP: /* width from left, length from top */
- default:
-+ if (i > 0 && zwidth != crop->combined_width)
-+ {
-+ TIFFError("computeInputPixelOffsets",
-+ "Only equal width regions can be "
-+ "combined for -E "
-+ "top or bottom");
-+ return (-1);
-+ }
- crop->combined_width = zwidth;
- crop->combined_length += zlength;
- break;
-@@ -7301,6 +7323,46 @@ static int extractCompositeRegions(struct image_data *image,
- crop->combined_width = 0;
- crop->combined_length = 0;
-
-+ /* If there is more than one region, check beforehand whether all the width
-+ * and length values of the regions are the same, respectively. */
-+ switch (crop->edge_ref)
-+ {
-+ default:
-+ case EDGE_TOP:
-+ case EDGE_BOTTOM:
-+ for (i = 1; i < crop->selections; i++)
-+ {
-+ uint32_t crop_width0 =
-+ crop->regionlist[i - 1].x2 - crop->regionlist[i - 1].x1 + 1;
-+ uint32_t crop_width1 =
-+ crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1;
-+ if (crop_width0 != crop_width1)
-+ {
-+ TIFFError("extractCompositeRegions",
-+ "Only equal width regions can be combined for -E "
-+ "top or bottom");
-+ return (1);
-+ }
-+ }
-+ break;
-+ case EDGE_LEFT:
-+ case EDGE_RIGHT:
-+ for (i = 1; i < crop->selections; i++)
-+ {
-+ uint32_t crop_length0 =
-+ crop->regionlist[i - 1].y2 - crop->regionlist[i - 1].y1 + 1;
-+ uint32_t crop_length1 =
-+ crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1;
-+ if (crop_length0 != crop_length1)
-+ {
-+ TIFFError("extractCompositeRegions",
-+ "Only equal length regions can be combined for "
-+ "-E left or right");
-+ return (1);
-+ }
-+ }
-+ }
-+
- for (i = 0; i < crop->selections; i++)
- {
- /* rows, columns, width, length are expressed in pixels */
-@@ -7325,7 +7387,8 @@ static int extractCompositeRegions(struct image_data *image,
- default:
- case EDGE_TOP:
- case EDGE_BOTTOM:
-- if ((i > 0) && (crop_width != crop->regionlist[i - 1].width))
-+ if ((crop->selections > i + 1) &&
-+ (crop_width != crop->regionlist[i + 1].width))
- {
- TIFFError("extractCompositeRegions",
- "Only equal width regions can be combined for -E "
-@@ -7418,7 +7481,8 @@ static int extractCompositeRegions(struct image_data *image,
- case EDGE_LEFT: /* splice the pieces of each row together, side by
- side */
- case EDGE_RIGHT:
-- if ((i > 0) && (crop_length != crop->regionlist[i - 1].length))
-+ if ((crop->selections > i + 1) &&
-+ (crop_length != crop->regionlist[i + 1].length))
- {
- TIFFError("extractCompositeRegions",
- "Only equal length regions can be combined for "
---
-GitLab
diff --git a/media-libs/tiff/files/tiff-4.5.0_rc1-skip-tools-tests-multilib.patch b/media-libs/tiff/files/tiff-4.5.0_rc1-skip-tools-tests-multilib.patch
deleted file mode 100644
index 831afd287226..000000000000
--- a/media-libs/tiff/files/tiff-4.5.0_rc1-skip-tools-tests-multilib.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-https://gitlab.com/libtiff/libtiff/-/merge_requests/334
-
-From e7605b93b12c2bf3c864910c23ac976045b5a05a Mon Sep 17 00:00:00 2001
-From: Sam James <sam@gentoo.org>
-Date: Sat, 21 May 2022 01:01:35 +0100
-Subject: [PATCH 1/2] test (autotools): skip script tests if tools aren't built
-
-In Gentoo, we avoid building the tools for multilib (32-bit, x86) builds on
-amd64/x86_64 because we only need the library to keep binary applications working.
-
-This causes a test failure in e.g. tiffcp-thumbnail.sh as the 'thumbnail'
-binary isn't built. Skip it if unavailable.
-
-Fixes: https://gitlab.com/libtiff/libtiff/-/issues/421
---- a/test/Makefile.am
-+++ b/test/Makefile.am
-@@ -55,13 +55,14 @@ XFAIL_TESTS =
- CLEANFILES = test_packbits.tif o-*
-
- if HAVE_JPEG
-+if TIFF_TOOLS
- JPEG_DEPENDENT_CHECK_PROG=raw_decode
- JPEG_DEPENDENT_TESTSCRIPTS=\
- tiff2rgba-quad-tile.jpg.sh \
- tiff2rgba-ojpeg_zackthecat_subsamp22_single_strip.sh \
- tiff2rgba-ojpeg_chewey_subsamp21_multi_strip.sh \
- tiff2rgba-ojpeg_single_strip_no_rowsperstrip.sh
--
-+endif
- else
- JPEG_DEPENDENT_CHECK_PROG=
- JPEG_DEPENDENT_TESTSCRIPTS=
-@@ -76,6 +77,7 @@ check_PROGRAMS = \
- endif
-
- # Test scripts to execute
-+if TIFF_TOOLS
- TESTSCRIPTS = \
- ppm2tiff_pbm.sh \
- ppm2tiff_pgm.sh \
-@@ -156,6 +158,9 @@ TESTSCRIPTS = \
- testfax4.sh \
- testdeflatelaststripextradata.sh \
- $(JPEG_DEPENDENT_TESTSCRIPTS)
-+else
-+TESTSCRIPTS=
-+endif
-
- # This list should contain the references files
- # from the 'refs' subdirectory
---
-GitLab
diff --git a/media-libs/tiff/tiff-4.5.0-r2.ebuild b/media-libs/tiff/tiff-4.5.0-r2.ebuild
deleted file mode 100644
index ddb1a04fda89..000000000000
--- a/media-libs/tiff/tiff-4.5.0-r2.ebuild
+++ /dev/null
@@ -1,92 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-QA_PKGCONFIG_VERSION="$(ver_cut 1-3)"
-
-# Release signer can vary per version but not clear if others will be doing
-# them in future, so gone with Even Rouault for now as he does other geosci
-# stuff too like PROJ, GDAL. Previous release manager of TIFF was
-# GraphicsMagick maintainer Bob Friesenhahn. Please be careful when verifying
-# who made releases.
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rouault.asc
-inherit autotools multilib-minimal verify-sig flag-o-matic
-
-MY_P="${P/_rc/rc}"
-DESCRIPTION="Tag Image File Format (TIFF) library"
-HOMEPAGE="http://libtiff.maptools.org"
-SRC_URI="https://download.osgeo.org/libtiff/${MY_P}.tar.xz"
-SRC_URI+=" verify-sig? ( https://download.osgeo.org/libtiff/${MY_P}.tar.xz.sig )"
-S="${WORKDIR}/${PN}-$(ver_cut 1-3)"
-
-LICENSE="libtiff"
-SLOT="0/6"
-if [[ ${PV} != *_rc* ]] ; then
- KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="+cxx jbig jpeg lzma static-libs test webp zlib zstd"
-RESTRICT="!test? ( test )"
-
-# bug #483132
-REQUIRED_USE="test? ( jpeg )"
-
-RDEPEND="jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
- jpeg? ( media-libs/libjpeg-turbo:=[${MULTILIB_USEDEP}] )
- lzma? ( >=app-arch/xz-utils-5.0.5-r1[${MULTILIB_USEDEP}] )
- webp? ( media-libs/libwebp:=[${MULTILIB_USEDEP}] )
- zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
- zstd? ( >=app-arch/zstd-1.3.7-r1:=[${MULTILIB_USEDEP}] )"
-DEPEND="${RDEPEND}"
-BDEPEND="verify-sig? ( sec-keys/openpgp-keys-evenrouault )"
-
-MULTILIB_WRAPPED_HEADERS=(
- /usr/include/tiffconf.h
-)
-
-PATCHES=(
- "${FILESDIR}"/${PN}-4.5.0_rc1-skip-tools-tests-multilib.patch
- "${FILESDIR}"/${PN}-4.5.0-CVE-2022-48281.patch
- "${FILESDIR}"/${PN}-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch
- "${FILESDIR}"/${PN}-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch
-)
-
-src_prepare() {
- default
-
- # Added to fix cross-compilation
- #elibtoolize
-
- # For skip-tools-tests-multilib.patch
- eautoreconf
-}
-
-multilib_src_configure() {
- append-lfs-flags
-
- local myeconfargs=(
- --disable-sphinx
- --without-x
- --with-docdir="${EPREFIX}"/usr/share/doc/${PF}
- $(use_enable cxx)
- $(use_enable jbig)
- $(use_enable jpeg)
- $(use_enable lzma)
- $(use_enable static-libs static)
- $(use_enable test tests)
- $(use_enable webp)
- $(use_enable zlib)
- $(use_enable zstd)
-
- $(multilib_native_enable docs)
- $(multilib_native_enable contrib)
- $(multilib_native_enable tools)
- )
-
- ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-multilib_src_install_all() {
- find "${ED}" -type f -name '*.la' -delete || die
- rm "${ED}"/usr/share/doc/${PF}/{README*,RELEASE-DATE,TODO,VERSION} || die
-}
diff --git a/media-libs/tiff/tiff-4.5.1.ebuild b/media-libs/tiff/tiff-4.5.1.ebuild
deleted file mode 100644
index 49afb1e4568f..000000000000
--- a/media-libs/tiff/tiff-4.5.1.ebuild
+++ /dev/null
@@ -1,84 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-QA_PKGCONFIG_VERSION="$(ver_cut 1-3)"
-
-# Release signer can vary per version but not clear if others will be doing
-# them in future, so gone with Even Rouault for now as he does other geosci
-# stuff too like PROJ, GDAL. Previous release manager of TIFF was
-# GraphicsMagick maintainer Bob Friesenhahn. Please be careful when verifying
-# who made releases.
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rouault.asc
-inherit libtool multilib-minimal verify-sig flag-o-matic
-
-MY_P="${P/_rc/rc}"
-DESCRIPTION="Tag Image File Format (TIFF) library"
-HOMEPAGE="http://libtiff.maptools.org"
-SRC_URI="https://download.osgeo.org/libtiff/${MY_P}.tar.xz"
-SRC_URI+=" verify-sig? ( https://download.osgeo.org/libtiff/${MY_P}.tar.xz.sig )"
-S="${WORKDIR}/${PN}-$(ver_cut 1-3)"
-
-LICENSE="libtiff"
-SLOT="0/6"
-if [[ ${PV} != *_rc* ]] ; then
- KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="+cxx jbig jpeg lzma static-libs test webp zlib zstd"
-RESTRICT="!test? ( test )"
-
-# bug #483132
-REQUIRED_USE="test? ( jpeg )"
-
-RDEPEND="
- jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
- jpeg? ( media-libs/libjpeg-turbo:=[${MULTILIB_USEDEP}] )
- lzma? ( >=app-arch/xz-utils-5.0.5-r1[${MULTILIB_USEDEP}] )
- webp? ( media-libs/libwebp:=[${MULTILIB_USEDEP}] )
- zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
- zstd? ( >=app-arch/zstd-1.3.7-r1:=[${MULTILIB_USEDEP}] )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="verify-sig? ( sec-keys/openpgp-keys-evenrouault )"
-
-MULTILIB_WRAPPED_HEADERS=(
- /usr/include/tiffconf.h
-)
-
-src_prepare() {
- default
-
- # Added to fix cross-compilation
- elibtoolize
-}
-
-multilib_src_configure() {
- append-lfs-flags
-
- local myeconfargs=(
- --disable-sphinx
- --without-x
- --with-docdir="${EPREFIX}"/usr/share/doc/${PF}
- $(use_enable cxx)
- $(use_enable jbig)
- $(use_enable jpeg)
- $(use_enable lzma)
- $(use_enable static-libs static)
- $(use_enable test tests)
- $(use_enable webp)
- $(use_enable zlib)
- $(use_enable zstd)
-
- $(multilib_native_enable docs)
- $(multilib_native_enable contrib)
- $(multilib_native_enable tools)
- )
-
- ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-multilib_src_install_all() {
- find "${ED}" -type f -name '*.la' -delete || die
- rm "${ED}"/usr/share/doc/${PF}/{README*,RELEASE-DATE,TODO,VERSION} || die
-}
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2024-11-19 21:59 Andreas K. Hüttel
0 siblings, 0 replies; 14+ messages in thread
From: Andreas K. Hüttel @ 2024-11-19 21:59 UTC (permalink / raw
To: gentoo-commits
commit: 883b6568ba687b503bcf2e709bdfddc94efef9ce
Author: Andreas K. Hüttel <dilfridge <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 19 21:59:04 2024 +0000
Commit: Andreas K. Hüttel <dilfridge <AT> gentoo <DOT> org>
CommitDate: Tue Nov 19 21:59:04 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=883b6568
Revert "media-libs/tiff: drop 4.5.0-r2, 4.5.1"
This reverts commit 65658e69ca2fbab2b6b762bf7631f638f676479f.
Signed-off-by: Andreas K. Hüttel <dilfridge <AT> gentoo.org>
media-libs/tiff/Manifest | 4 +
.../tiff/files/tiff-4.5.0-CVE-2022-48281.patch | 14 +
...CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch | 287 +++++++++++++++++++++
...CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch | 131 ++++++++++
.../tiff-4.5.0_rc1-skip-tools-tests-multilib.patch | 52 ++++
media-libs/tiff/tiff-4.5.0-r2.ebuild | 92 +++++++
media-libs/tiff/tiff-4.5.1.ebuild | 84 ++++++
7 files changed, 664 insertions(+)
diff --git a/media-libs/tiff/Manifest b/media-libs/tiff/Manifest
index 4a09898bc72a..b9ee3c2b77a6 100644
--- a/media-libs/tiff/Manifest
+++ b/media-libs/tiff/Manifest
@@ -1,3 +1,7 @@
+DIST tiff-4.5.0.tar.xz 2320900 BLAKE2B c69801ba9d55b1ed27a92d31d8cd16937fe69299fbf5450efb4a6caa60245b72ddade110daae78f2198613640383623f76ec2265ba785375d0a85c7909b73fe9 SHA512 c6c866064c2dd5d1711c6ece7bafe5f011f5ce26c0aeaecbff79c05b5671f44150324bea95a0665cc43331883114de855ee1cd87ed733bff0f4d0814515b9f10
+DIST tiff-4.5.0.tar.xz.sig 310 BLAKE2B bbe7f9600061416227276424eb220714a1375d3e295cb0c5b7f76074324c1a2698a5029dde3e734331e9caf02d8a086273ded2ab09285857dbbfe3ad83506912 SHA512 8cef09755f4efe68db69591967e495852cf63c2d8113a877a2254f536d38c60b6dc864c07089249cd8109a8408672a297ae9e59d8233687bc2796dc158ccfb32
+DIST tiff-4.5.1.tar.xz 2228040 BLAKE2B 793c03593c46d6f804f622f5ff7e799751ee79e87ec1575801d2238fbcd2e89ed657a5081d3651e337f1bb14603ff94a15aad878e7fdf2cf75ada38eed64d9d2 SHA512 fc6af93d36598527480c517ddc4f19fe72e9f07ef4997e5731604253c8db0b9bae816ba7a56985bf22fbbb48db1fab5ed4c2b32a5145bc9477ef24b221a61179
+DIST tiff-4.5.1.tar.xz.sig 310 BLAKE2B fd5e3ff9c55790777b9d2587910cfb47953a27925bdf8610fc5b9db05a5662b534df542e3658db7b897c8de510479d0a7f0773092ac2f71e3c7bcb4beb14594f SHA512 10e434de0140bbd7e3830860bb611796b65fff5e718a2d5fb2857959ff63149d73b4e1f3f7c4be2c27f8ca863b0e4b7731332544eba948ce10097552e1779aee
DIST tiff-4.6.0.tar.xz 2124388 BLAKE2B 3b508b02b0a536c5bc8e67fe4c1b09ae9c830252786ef4764202c14d673d1ef9634694de7a5893a3551dec684d00bad9d0442c7fea7bcd09238b9960d443cf62 SHA512 4cd9bb485bcac9c5efdd0c4814f2a38a762a3b69e70d909c05a24e2e9d2bd27357b9814e0cb1cee3898355d6ccfcf1615f715125c8ab8c651db474073734ab03
DIST tiff-4.6.0.tar.xz.sig 310 BLAKE2B 9f159a5839dd41bda34eceeed6e451455fbcfec5d51ebb097038e3977a391a751e91a9f683375593f45af0f9c8f0dbe55a0cc437fe4512537b30d513adfdb2c0 SHA512 da87b4294e17d49cf60e81ec5285f503291532423330552e41dddfb672c0636e95b8a80d603c3095abbee469cb7dce63c2df0c22b751a3bf8541550f97f78b49
DIST tiff-4.7.0.tar.xz 2286220 BLAKE2B a5df7f3ae71821a13ff5a31db012191dd1b022b1c87fe81f90fd4b4a1349b7aa15d7b336d5fa8ac9e84edcfac5fe46214d9ea54790cb037438c6a5334980c11e SHA512 4234bc3d1a4de38587e21eb7d5785d6e11bc5f73c3d412dd44b9f7bcc42122d940ad017450a949dce5c3b270018829593202bff815a02d23268d9b9723266fe0
diff --git a/media-libs/tiff/files/tiff-4.5.0-CVE-2022-48281.patch b/media-libs/tiff/files/tiff-4.5.0-CVE-2022-48281.patch
new file mode 100644
index 000000000000..e38d17df9cc2
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.5.0-CVE-2022-48281.patch
@@ -0,0 +1,14 @@
+https://gitlab.com/libtiff/libtiff/-/issues/488
+https://bugs.gentoo.org/891839
+--- a/tools/tiffcrop.c
++++ b/tools/tiffcrop.c
+@@ -8591,7 +8591,7 @@ static int processCropSelections(struct
+ cropsize + NUM_BUFF_OVERSIZE_BYTES);
+ else
+ {
+- prev_cropsize = seg_buffs[0].size;
++ prev_cropsize = seg_buffs[i].size;
+ if (prev_cropsize < cropsize)
+ {
+ next_buff = _TIFFrealloc(
+
diff --git a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch b/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch
new file mode 100644
index 000000000000..70a9b8269ec5
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch
@@ -0,0 +1,287 @@
+Index: tiff-4.5.0/tools/tiffcrop.c
+===================================================================
+Upstream commits:
+https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68
+https://gitlab.com/libtiff/libtiff/-/commit/9c22495e5eeeae9e00a1596720c969656bb8d678
+From 9c22495e5eeeae9e00a1596720c969656bb8d678 Mon Sep 17 00:00:00 2001
+From: Su_Laus <sulau@freenet.de>
+Date: Fri, 3 Feb 2023 15:31:31 +0100
+Subject: [PATCH] tiffcrop correctly update buffersize after rotateImage()
+ fix#520 rotateImage() set up a new buffer and calculates its size
+ individually. Therefore, seg_buffs[] size needs to be updated accordingly.
+ Before this fix, the seg_buffs buffer size was calculated with a different
+ formula than within rotateImage().
+
+Closes #520.
+---
+ tools/tiffcrop.c | 36 ++++++++++++++++++++----------------
+ 1 file changed, 20 insertions(+), 16 deletions(-)
+
+diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
+index 7db69883..f8b66188 100644
+--- a/tools/tiffcrop.c
++++ b/tools/tiffcrop.c
+@@ -577,7 +577,7 @@ static int rotateContigSamples24bits(uint16_t, uint16_t, uint16_t, uint32_t,
+ static int rotateContigSamples32bits(uint16_t, uint16_t, uint16_t, uint32_t,
+ uint32_t, uint32_t, uint8_t *, uint8_t *);
+ static int rotateImage(uint16_t, struct image_data *, uint32_t *, uint32_t *,
+- unsigned char **);
++ unsigned char **, size_t *);
+ static int mirrorImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
+ unsigned char *);
+ static int invertImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
+@@ -7243,7 +7243,7 @@ static int correct_orientation(struct image_data *image,
+ }
+
+ if (rotateImage(rotation, image, &image->width, &image->length,
+- work_buff_ptr))
++ work_buff_ptr, NULL))
+ {
+ TIFFError("correct_orientation", "Unable to rotate image");
+ return (-1);
+@@ -8563,8 +8563,12 @@ static int processCropSelections(struct image_data *image,
+ if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can
+ reallocate the buffer */
+ {
++ /* rotateImage() set up a new buffer and calculates its size
++ * individually. Therefore, seg_buffs size needs to be updated
++ * accordingly. */
++ size_t rot_buf_size = 0;
+ if (rotateImage(crop->rotation, image, &crop->combined_width,
+- &crop->combined_length, &crop_buff))
++ &crop->combined_length, &crop_buff, &rot_buf_size))
+ {
+ TIFFError("processCropSelections",
+ "Failed to rotate composite regions by %" PRIu32
+@@ -8573,9 +8577,7 @@ static int processCropSelections(struct image_data *image,
+ return (-1);
+ }
+ seg_buffs[0].buffer = crop_buff;
+- seg_buffs[0].size =
+- (((crop->combined_width * image->bps + 7) / 8) * image->spp) *
+- crop->combined_length;
++ seg_buffs[0].size = rot_buf_size;
+ }
+ }
+ else /* Separated Images */
+@@ -8686,10 +8688,13 @@ static int processCropSelections(struct image_data *image,
+ * ->yres, what it schouldn't do here, when more than one
+ * section is processed. ToDo: Therefore rotateImage() and its
+ * usage has to be reworked (e.g. like mirrorImage()) !!
+- */
+- if (rotateImage(crop->rotation, image,
+- &crop->regionlist[i].width,
+- &crop->regionlist[i].length, &crop_buff))
++ * Furthermore, rotateImage() set up a new buffer and calculates
++ * its size individually. Therefore, seg_buffs size needs to be
++ * updated accordingly. */
++ size_t rot_buf_size = 0;
++ if (rotateImage(
++ crop->rotation, image, &crop->regionlist[i].width,
++ &crop->regionlist[i].length, &crop_buff, &rot_buf_size))
+ {
+ TIFFError("processCropSelections",
+ "Failed to rotate crop region by %" PRIu16
+@@ -8702,10 +8707,7 @@ static int processCropSelections(struct image_data *image,
+ crop->combined_width = total_width;
+ crop->combined_length = total_length;
+ seg_buffs[i].buffer = crop_buff;
+- seg_buffs[i].size =
+- (((crop->regionlist[i].width * image->bps + 7) / 8) *
+- image->spp) *
+- crop->regionlist[i].length;
++ seg_buffs[i].size = rot_buf_size;
+ }
+ } /* for crop->selections loop */
+ } /* Separated Images (else case) */
+@@ -8836,7 +8838,7 @@ static int createCroppedImage(struct image_data *image, struct crop_mask *crop,
+ CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
+ {
+ if (rotateImage(crop->rotation, image, &crop->combined_width,
+- &crop->combined_length, crop_buff_ptr))
++ &crop->combined_length, crop_buff_ptr, NULL))
+ {
+ TIFFError("createCroppedImage",
+ "Failed to rotate image or cropped selection by %" PRIu16
+@@ -9552,7 +9554,7 @@ static int rotateContigSamples32bits(uint16_t rotation, uint16_t spp,
+ /* Rotate an image by a multiple of 90 degrees clockwise */
+ static int rotateImage(uint16_t rotation, struct image_data *image,
+ uint32_t *img_width, uint32_t *img_length,
+- unsigned char **ibuff_ptr)
++ unsigned char **ibuff_ptr, size_t *rot_buf_size)
+ {
+ int shift_width;
+ uint32_t bytes_per_pixel, bytes_per_sample;
+@@ -9610,6 +9612,8 @@ static int rotateImage(uint16_t rotation, struct image_data *image,
+ return (-1);
+ }
+ _TIFFmemset(rbuff, '\0', buffsize + NUM_BUFF_OVERSIZE_BYTES);
++ if (rot_buf_size != NULL)
++ *rot_buf_size = buffsize;
+
+ ibuff = *ibuff_ptr;
+ switch (rotation)
+--
+GitLab
+
+From 69818e2f2d246e6631ac2a2da692c3706b849c38 Mon Sep 17 00:00:00 2001
+From: Su_Laus <sulau@freenet.de>
+Date: Sun, 29 Jan 2023 11:09:26 +0100
+Subject: [PATCH] tiffcrop: Amend rotateImage() not to toggle the input (main)
+ image width and length parameters when only cropped image sections are
+ rotated. Remove buffptr from region structure because never used.
+
+Closes #492 #493 #494 #495 #499 #518 #519
+---
+ tools/tiffcrop.c | 59 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 35 insertions(+), 24 deletions(-)
+
+diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
+index ebea7475..519871ec 100644
+--- a/tools/tiffcrop.c
++++ b/tools/tiffcrop.c
+@@ -296,7 +296,6 @@ struct region
+ uint32_t width; /* width in pixels */
+ uint32_t length; /* length in pixels */
+ uint32_t buffsize; /* size of buffer needed to hold the cropped region */
+- unsigned char *buffptr; /* address of start of the region */
+ };
+
+ /* Cropping parameters from command line and image data
+@@ -577,7 +576,7 @@ static int rotateContigSamples24bits(uint16_t, uint16_t, uint16_t, uint32_t,
+ static int rotateContigSamples32bits(uint16_t, uint16_t, uint16_t, uint32_t,
+ uint32_t, uint32_t, uint8_t *, uint8_t *);
+ static int rotateImage(uint16_t, struct image_data *, uint32_t *, uint32_t *,
+- unsigned char **, size_t *);
++ unsigned char **, size_t *, int);
+ static int mirrorImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
+ unsigned char *);
+ static int invertImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
+@@ -5782,7 +5781,6 @@ static void initCropMasks(struct crop_mask *cps)
+ cps->regionlist[i].width = 0;
+ cps->regionlist[i].length = 0;
+ cps->regionlist[i].buffsize = 0;
+- cps->regionlist[i].buffptr = NULL;
+ cps->zonelist[i].position = 0;
+ cps->zonelist[i].total = 0;
+ }
+@@ -7266,9 +7264,13 @@ static int correct_orientation(struct image_data *image,
+ (uint16_t)(image->adjustments & ROTATE_ANY));
+ return (-1);
+ }
+-
+- if (rotateImage(rotation, image, &image->width, &image->length,
+- work_buff_ptr, NULL))
++ /* Dummy variable in order not to switch two times the
++ * image->width,->length within rotateImage(),
++ * but switch xres, yres there. */
++ uint32_t width = image->width;
++ uint32_t length = image->length;
++ if (rotateImage(rotation, image, &width, &length, work_buff_ptr, NULL,
++ TRUE))
+ {
+ TIFFError("correct_orientation", "Unable to rotate image");
+ return (-1);
+@@ -7377,7 +7379,6 @@ static int extractCompositeRegions(struct image_data *image,
+ /* These should not be needed for composite images */
+ crop->regionlist[i].width = crop_width;
+ crop->regionlist[i].length = crop_length;
+- crop->regionlist[i].buffptr = crop_buff;
+
+ src_rowsize = ((img_width * bps * spp) + 7) / 8;
+ dst_rowsize = (((crop_width * bps * count) + 7) / 8);
+@@ -7640,7 +7641,6 @@ static int extractSeparateRegion(struct image_data *image,
+
+ crop->regionlist[region].width = crop_width;
+ crop->regionlist[region].length = crop_length;
+- crop->regionlist[region].buffptr = crop_buff;
+
+ src = read_buff;
+ dst = crop_buff;
+@@ -8635,7 +8635,8 @@ static int processCropSelections(struct image_data *image,
+ * accordingly. */
+ size_t rot_buf_size = 0;
+ if (rotateImage(crop->rotation, image, &crop->combined_width,
+- &crop->combined_length, &crop_buff, &rot_buf_size))
++ &crop->combined_length, &crop_buff, &rot_buf_size,
++ FALSE))
+ {
+ TIFFError("processCropSelections",
+ "Failed to rotate composite regions by %" PRIu32
+@@ -8759,9 +8760,10 @@ static int processCropSelections(struct image_data *image,
+ * its size individually. Therefore, seg_buffs size needs to be
+ * updated accordingly. */
+ size_t rot_buf_size = 0;
+- if (rotateImage(
+- crop->rotation, image, &crop->regionlist[i].width,
+- &crop->regionlist[i].length, &crop_buff, &rot_buf_size))
++ if (rotateImage(crop->rotation, image,
++ &crop->regionlist[i].width,
++ &crop->regionlist[i].length, &crop_buff,
++ &rot_buf_size, FALSE))
+ {
+ TIFFError("processCropSelections",
+ "Failed to rotate crop region by %" PRIu16
+@@ -8905,7 +8907,7 @@ static int createCroppedImage(struct image_data *image, struct crop_mask *crop,
+ CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
+ {
+ if (rotateImage(crop->rotation, image, &crop->combined_width,
+- &crop->combined_length, crop_buff_ptr, NULL))
++ &crop->combined_length, crop_buff_ptr, NULL, TRUE))
+ {
+ TIFFError("createCroppedImage",
+ "Failed to rotate image or cropped selection by %" PRIu16
+@@ -9621,7 +9623,8 @@ static int rotateContigSamples32bits(uint16_t rotation, uint16_t spp,
+ /* Rotate an image by a multiple of 90 degrees clockwise */
+ static int rotateImage(uint16_t rotation, struct image_data *image,
+ uint32_t *img_width, uint32_t *img_length,
+- unsigned char **ibuff_ptr, size_t *rot_buf_size)
++ unsigned char **ibuff_ptr, size_t *rot_buf_size,
++ int rot_image_params)
+ {
+ int shift_width;
+ uint32_t bytes_per_pixel, bytes_per_sample;
+@@ -9869,11 +9872,15 @@ static int rotateImage(uint16_t rotation, struct image_data *image,
+
+ *img_width = length;
+ *img_length = width;
+- image->width = length;
+- image->length = width;
+- res_temp = image->xres;
+- image->xres = image->yres;
+- image->yres = res_temp;
++ /* Only toggle image parameters if whole input image is rotated. */
++ if (rot_image_params)
++ {
++ image->width = length;
++ image->length = width;
++ res_temp = image->xres;
++ image->xres = image->yres;
++ image->yres = res_temp;
++ }
+ break;
+
+ case 270:
+@@ -9956,11 +9963,15 @@ static int rotateImage(uint16_t rotation, struct image_data *image,
+
+ *img_width = length;
+ *img_length = width;
+- image->width = length;
+- image->length = width;
+- res_temp = image->xres;
+- image->xres = image->yres;
+- image->yres = res_temp;
++ /* Only toggle image parameters if whole input image is rotated. */
++ if (rot_image_params)
++ {
++ image->width = length;
++ image->length = width;
++ res_temp = image->xres;
++ image->xres = image->yres;
++ image->yres = res_temp;
++ }
+ break;
+ default:
+ break;
+--
+GitLab
diff --git a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch b/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch
new file mode 100644
index 000000000000..41fe439f9159
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch
@@ -0,0 +1,131 @@
+Index: tiff-4.5.0/tools/tiffcrop.c
+===================================================================
+Upstream commit:
+https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00
+From 82a7fbb1fa7228499ffeb3a57a1d106a9626d57c Mon Sep 17 00:00:00 2001
+From: Su Laus <sulau@freenet.de>
+Date: Sun, 5 Feb 2023 15:53:15 +0000
+Subject: [PATCH] tiffcrop: added check for assumption on composite images
+ (fixes #496)
+
+tiffcrop: For composite images with more than one region, the combined_length or combined_width always needs to be equal, respectively. Otherwise, even the first section/region copy action might cause buffer overrun. This is now checked before the first copy action.
+
+Closes #496, #497, #498, #500, #501.
+---
+ tools/tiffcrop.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 66 insertions(+), 2 deletions(-)
+
+diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
+index 84e26ac6..480b927c 100644
+--- a/tools/tiffcrop.c
++++ b/tools/tiffcrop.c
+@@ -5935,18 +5935,40 @@ static int computeInputPixelOffsets(struct crop_mask *crop,
+
+ crop->regionlist[i].buffsize = buffsize;
+ crop->bufftotal += buffsize;
++
++ /* For composite images with more than one region, the
++ * combined_length or combined_width always needs to be equal,
++ * respectively.
++ * Otherwise, even the first section/region copy
++ * action might cause buffer overrun. */
+ if (crop->img_mode == COMPOSITE_IMAGES)
+ {
+ switch (crop->edge_ref)
+ {
+ case EDGE_LEFT:
+ case EDGE_RIGHT:
++ if (i > 0 && zlength != crop->combined_length)
++ {
++ TIFFError(
++ "computeInputPixelOffsets",
++ "Only equal length regions can be combined for "
++ "-E left or right");
++ return (-1);
++ }
+ crop->combined_length = zlength;
+ crop->combined_width += zwidth;
+ break;
+ case EDGE_BOTTOM:
+ case EDGE_TOP: /* width from left, length from top */
+ default:
++ if (i > 0 && zwidth != crop->combined_width)
++ {
++ TIFFError("computeInputPixelOffsets",
++ "Only equal width regions can be "
++ "combined for -E "
++ "top or bottom");
++ return (-1);
++ }
+ crop->combined_width = zwidth;
+ crop->combined_length += zlength;
+ break;
+@@ -7301,6 +7323,46 @@ static int extractCompositeRegions(struct image_data *image,
+ crop->combined_width = 0;
+ crop->combined_length = 0;
+
++ /* If there is more than one region, check beforehand whether all the width
++ * and length values of the regions are the same, respectively. */
++ switch (crop->edge_ref)
++ {
++ default:
++ case EDGE_TOP:
++ case EDGE_BOTTOM:
++ for (i = 1; i < crop->selections; i++)
++ {
++ uint32_t crop_width0 =
++ crop->regionlist[i - 1].x2 - crop->regionlist[i - 1].x1 + 1;
++ uint32_t crop_width1 =
++ crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1;
++ if (crop_width0 != crop_width1)
++ {
++ TIFFError("extractCompositeRegions",
++ "Only equal width regions can be combined for -E "
++ "top or bottom");
++ return (1);
++ }
++ }
++ break;
++ case EDGE_LEFT:
++ case EDGE_RIGHT:
++ for (i = 1; i < crop->selections; i++)
++ {
++ uint32_t crop_length0 =
++ crop->regionlist[i - 1].y2 - crop->regionlist[i - 1].y1 + 1;
++ uint32_t crop_length1 =
++ crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1;
++ if (crop_length0 != crop_length1)
++ {
++ TIFFError("extractCompositeRegions",
++ "Only equal length regions can be combined for "
++ "-E left or right");
++ return (1);
++ }
++ }
++ }
++
+ for (i = 0; i < crop->selections; i++)
+ {
+ /* rows, columns, width, length are expressed in pixels */
+@@ -7325,7 +7387,8 @@ static int extractCompositeRegions(struct image_data *image,
+ default:
+ case EDGE_TOP:
+ case EDGE_BOTTOM:
+- if ((i > 0) && (crop_width != crop->regionlist[i - 1].width))
++ if ((crop->selections > i + 1) &&
++ (crop_width != crop->regionlist[i + 1].width))
+ {
+ TIFFError("extractCompositeRegions",
+ "Only equal width regions can be combined for -E "
+@@ -7418,7 +7481,8 @@ static int extractCompositeRegions(struct image_data *image,
+ case EDGE_LEFT: /* splice the pieces of each row together, side by
+ side */
+ case EDGE_RIGHT:
+- if ((i > 0) && (crop_length != crop->regionlist[i - 1].length))
++ if ((crop->selections > i + 1) &&
++ (crop_length != crop->regionlist[i + 1].length))
+ {
+ TIFFError("extractCompositeRegions",
+ "Only equal length regions can be combined for "
+--
+GitLab
diff --git a/media-libs/tiff/files/tiff-4.5.0_rc1-skip-tools-tests-multilib.patch b/media-libs/tiff/files/tiff-4.5.0_rc1-skip-tools-tests-multilib.patch
new file mode 100644
index 000000000000..831afd287226
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.5.0_rc1-skip-tools-tests-multilib.patch
@@ -0,0 +1,52 @@
+https://gitlab.com/libtiff/libtiff/-/merge_requests/334
+
+From e7605b93b12c2bf3c864910c23ac976045b5a05a Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Sat, 21 May 2022 01:01:35 +0100
+Subject: [PATCH 1/2] test (autotools): skip script tests if tools aren't built
+
+In Gentoo, we avoid building the tools for multilib (32-bit, x86) builds on
+amd64/x86_64 because we only need the library to keep binary applications working.
+
+This causes a test failure in e.g. tiffcp-thumbnail.sh as the 'thumbnail'
+binary isn't built. Skip it if unavailable.
+
+Fixes: https://gitlab.com/libtiff/libtiff/-/issues/421
+--- a/test/Makefile.am
++++ b/test/Makefile.am
+@@ -55,13 +55,14 @@ XFAIL_TESTS =
+ CLEANFILES = test_packbits.tif o-*
+
+ if HAVE_JPEG
++if TIFF_TOOLS
+ JPEG_DEPENDENT_CHECK_PROG=raw_decode
+ JPEG_DEPENDENT_TESTSCRIPTS=\
+ tiff2rgba-quad-tile.jpg.sh \
+ tiff2rgba-ojpeg_zackthecat_subsamp22_single_strip.sh \
+ tiff2rgba-ojpeg_chewey_subsamp21_multi_strip.sh \
+ tiff2rgba-ojpeg_single_strip_no_rowsperstrip.sh
+-
++endif
+ else
+ JPEG_DEPENDENT_CHECK_PROG=
+ JPEG_DEPENDENT_TESTSCRIPTS=
+@@ -76,6 +77,7 @@ check_PROGRAMS = \
+ endif
+
+ # Test scripts to execute
++if TIFF_TOOLS
+ TESTSCRIPTS = \
+ ppm2tiff_pbm.sh \
+ ppm2tiff_pgm.sh \
+@@ -156,6 +158,9 @@ TESTSCRIPTS = \
+ testfax4.sh \
+ testdeflatelaststripextradata.sh \
+ $(JPEG_DEPENDENT_TESTSCRIPTS)
++else
++TESTSCRIPTS=
++endif
+
+ # This list should contain the references files
+ # from the 'refs' subdirectory
+--
+GitLab
diff --git a/media-libs/tiff/tiff-4.5.0-r2.ebuild b/media-libs/tiff/tiff-4.5.0-r2.ebuild
new file mode 100644
index 000000000000..ddb1a04fda89
--- /dev/null
+++ b/media-libs/tiff/tiff-4.5.0-r2.ebuild
@@ -0,0 +1,92 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+QA_PKGCONFIG_VERSION="$(ver_cut 1-3)"
+
+# Release signer can vary per version but not clear if others will be doing
+# them in future, so gone with Even Rouault for now as he does other geosci
+# stuff too like PROJ, GDAL. Previous release manager of TIFF was
+# GraphicsMagick maintainer Bob Friesenhahn. Please be careful when verifying
+# who made releases.
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rouault.asc
+inherit autotools multilib-minimal verify-sig flag-o-matic
+
+MY_P="${P/_rc/rc}"
+DESCRIPTION="Tag Image File Format (TIFF) library"
+HOMEPAGE="http://libtiff.maptools.org"
+SRC_URI="https://download.osgeo.org/libtiff/${MY_P}.tar.xz"
+SRC_URI+=" verify-sig? ( https://download.osgeo.org/libtiff/${MY_P}.tar.xz.sig )"
+S="${WORKDIR}/${PN}-$(ver_cut 1-3)"
+
+LICENSE="libtiff"
+SLOT="0/6"
+if [[ ${PV} != *_rc* ]] ; then
+ KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="+cxx jbig jpeg lzma static-libs test webp zlib zstd"
+RESTRICT="!test? ( test )"
+
+# bug #483132
+REQUIRED_USE="test? ( jpeg )"
+
+RDEPEND="jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
+ jpeg? ( media-libs/libjpeg-turbo:=[${MULTILIB_USEDEP}] )
+ lzma? ( >=app-arch/xz-utils-5.0.5-r1[${MULTILIB_USEDEP}] )
+ webp? ( media-libs/libwebp:=[${MULTILIB_USEDEP}] )
+ zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
+ zstd? ( >=app-arch/zstd-1.3.7-r1:=[${MULTILIB_USEDEP}] )"
+DEPEND="${RDEPEND}"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-evenrouault )"
+
+MULTILIB_WRAPPED_HEADERS=(
+ /usr/include/tiffconf.h
+)
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-4.5.0_rc1-skip-tools-tests-multilib.patch
+ "${FILESDIR}"/${PN}-4.5.0-CVE-2022-48281.patch
+ "${FILESDIR}"/${PN}-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch
+ "${FILESDIR}"/${PN}-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch
+)
+
+src_prepare() {
+ default
+
+ # Added to fix cross-compilation
+ #elibtoolize
+
+ # For skip-tools-tests-multilib.patch
+ eautoreconf
+}
+
+multilib_src_configure() {
+ append-lfs-flags
+
+ local myeconfargs=(
+ --disable-sphinx
+ --without-x
+ --with-docdir="${EPREFIX}"/usr/share/doc/${PF}
+ $(use_enable cxx)
+ $(use_enable jbig)
+ $(use_enable jpeg)
+ $(use_enable lzma)
+ $(use_enable static-libs static)
+ $(use_enable test tests)
+ $(use_enable webp)
+ $(use_enable zlib)
+ $(use_enable zstd)
+
+ $(multilib_native_enable docs)
+ $(multilib_native_enable contrib)
+ $(multilib_native_enable tools)
+ )
+
+ ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+ find "${ED}" -type f -name '*.la' -delete || die
+ rm "${ED}"/usr/share/doc/${PF}/{README*,RELEASE-DATE,TODO,VERSION} || die
+}
diff --git a/media-libs/tiff/tiff-4.5.1.ebuild b/media-libs/tiff/tiff-4.5.1.ebuild
new file mode 100644
index 000000000000..49afb1e4568f
--- /dev/null
+++ b/media-libs/tiff/tiff-4.5.1.ebuild
@@ -0,0 +1,84 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+QA_PKGCONFIG_VERSION="$(ver_cut 1-3)"
+
+# Release signer can vary per version but not clear if others will be doing
+# them in future, so gone with Even Rouault for now as he does other geosci
+# stuff too like PROJ, GDAL. Previous release manager of TIFF was
+# GraphicsMagick maintainer Bob Friesenhahn. Please be careful when verifying
+# who made releases.
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rouault.asc
+inherit libtool multilib-minimal verify-sig flag-o-matic
+
+MY_P="${P/_rc/rc}"
+DESCRIPTION="Tag Image File Format (TIFF) library"
+HOMEPAGE="http://libtiff.maptools.org"
+SRC_URI="https://download.osgeo.org/libtiff/${MY_P}.tar.xz"
+SRC_URI+=" verify-sig? ( https://download.osgeo.org/libtiff/${MY_P}.tar.xz.sig )"
+S="${WORKDIR}/${PN}-$(ver_cut 1-3)"
+
+LICENSE="libtiff"
+SLOT="0/6"
+if [[ ${PV} != *_rc* ]] ; then
+ KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="+cxx jbig jpeg lzma static-libs test webp zlib zstd"
+RESTRICT="!test? ( test )"
+
+# bug #483132
+REQUIRED_USE="test? ( jpeg )"
+
+RDEPEND="
+ jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
+ jpeg? ( media-libs/libjpeg-turbo:=[${MULTILIB_USEDEP}] )
+ lzma? ( >=app-arch/xz-utils-5.0.5-r1[${MULTILIB_USEDEP}] )
+ webp? ( media-libs/libwebp:=[${MULTILIB_USEDEP}] )
+ zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
+ zstd? ( >=app-arch/zstd-1.3.7-r1:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-evenrouault )"
+
+MULTILIB_WRAPPED_HEADERS=(
+ /usr/include/tiffconf.h
+)
+
+src_prepare() {
+ default
+
+ # Added to fix cross-compilation
+ elibtoolize
+}
+
+multilib_src_configure() {
+ append-lfs-flags
+
+ local myeconfargs=(
+ --disable-sphinx
+ --without-x
+ --with-docdir="${EPREFIX}"/usr/share/doc/${PF}
+ $(use_enable cxx)
+ $(use_enable jbig)
+ $(use_enable jpeg)
+ $(use_enable lzma)
+ $(use_enable static-libs static)
+ $(use_enable test tests)
+ $(use_enable webp)
+ $(use_enable zlib)
+ $(use_enable zstd)
+
+ $(multilib_native_enable docs)
+ $(multilib_native_enable contrib)
+ $(multilib_native_enable tools)
+ )
+
+ ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+ find "${ED}" -type f -name '*.la' -delete || die
+ rm "${ED}"/usr/share/doc/${PF}/{README*,RELEASE-DATE,TODO,VERSION} || die
+}
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2025-02-27 2:56 Sam James
0 siblings, 0 replies; 14+ messages in thread
From: Sam James @ 2025-02-27 2:56 UTC (permalink / raw
To: gentoo-commits
commit: 9a61d8e9f3e5b6d2e00a081e54b93572268468b6
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Thu Feb 27 02:55:26 2025 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Thu Feb 27 02:55:26 2025 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9a61d8e9
media-libs/tiff: fix tests on big-endian
Bug: https://bugs.gentoo.org/936572
Bug: https://bugs.gentoo.org/950284
Signed-off-by: Sam James <sam <AT> gentoo.org>
.../tiff-4.7.0-test-directory-big-endian.patch | 328 +++++++++++++++++++++
media-libs/tiff/tiff-4.7.0-r1.ebuild | 5 +-
2 files changed, 332 insertions(+), 1 deletion(-)
diff --git a/media-libs/tiff/files/tiff-4.7.0-test-directory-big-endian.patch b/media-libs/tiff/files/tiff-4.7.0-test-directory-big-endian.patch
new file mode 100644
index 000000000000..0eca0b69954f
--- /dev/null
+++ b/media-libs/tiff/files/tiff-4.7.0-test-directory-big-endian.patch
@@ -0,0 +1,328 @@
+https://gitlab.com/libtiff/libtiff/-/issues/652
+https://gitlab.com/libtiff/libtiff/-/issues/656
+https://gitlab.com/libtiff/libtiff/-/merge_requests/673
+
+From 388be62f9e2167ea076579e2605ff8eb91117ad6 Mon Sep 17 00:00:00 2001
+From: Su_Laus <sulau@freenet.de>
+Date: Wed, 30 Oct 2024 21:03:17 +0100
+Subject: [PATCH 1/3] Update test/test_directory.c not to fail on big-endian
+ machines.
+
+Closes #652
+--- a/test/test_directory.c
++++ b/test/test_directory.c
+@@ -1986,9 +1986,12 @@ int test_current_dirnum_incrementing(int testcase, unsigned int openMode)
+ #define TIFFSeekFile_M(tif, off, whence) \
+ ((*TIFFGetSeekProc(tif))(TIFFClientdata(tif), (off), (whence)));
+
+- /* Code below does only handle Classic-TIFF without swapping". */
++ /* Code below does only handle Classic-TIFF without swapping. */
+ if (!(TIFFIsByteSwapped(tif) || TIFFIsBigTIFF(tif)))
+ {
++ /* Patch nextIFDOffset of IFD2, which is 0, with offset to itself.
++ * This generates an IFD3 without any elements at the end of file.
++ * Reading IFD3 should provoke reading error. */
+ uint64_t ss = TIFFSeekFile_M(tif, offsetBase[2], 0);
+ uint16_t cnt = 0;
+ uint64_t rr = TIFFReadFile_M(tif, &cnt, 2);
+@@ -1998,43 +2001,84 @@ int test_current_dirnum_incrementing(int testcase, unsigned int openMode)
+ (void)rr;
+
+ /* Now there are offsets to four IFDs in the file, where the last one is
+- * not existing and has a non-valid dircount and entries behind EOF. */
++ * not existing and has a non-valid dircount and entries behind EOF.
++ * For LE-machines dircount is 458 (as offset) and for BE-machines
++ * dircount is zero. */
++#ifdef WORDS_BIGENDIAN
++ fprintf(stderr, "----- Expect error messages about 'Error fetching "
++ "directory count.' -----\n");
++#else
+ fprintf(stderr, "----- Expect error messages about 'Error fetching "
+ "directory link.' -----\n");
++#endif
+ /* TIFFNumberOfDirectories() returns 3 */
+ lastdir = TIFFNumberOfDirectories(tif);
+ TIFFSetDirectory(tif, 0);
+ CHECKCURDIRNUM_M(tif, 0, __LINE__);
++
++ /* TIFFSetDirectory(3) fails with error messages:
++ * TIFFFetchDirectory: test_current_dirnum_incrementing_wl.tif:
++ * Can not read TIFF directory.
++ * TIFFReadDirectory: Failed to read directory at offset 458. */
+ fprintf(stderr, "----- Expect error messages about 'Cannot read TIFF "
+ "directory.' -----\n");
+ if (TIFFSetDirectory(tif, 3))
+ {
+ fprintf(stderr,
+- "TIFFSetDirectory(3) for IFD4 was expected to fail but "
++ "TIFFSetDirectory(3) for IFD3 was expected to fail but "
+ "succeeded for %s "
+ "at %d\n",
+ filename, __LINE__);
+ goto failure;
+ }
++
+ /* Fails in 4.6.0 */
+ CHECKCURDIRNUM_M(tif, (tdir_t)(-1), __LINE__);
+ offsetBase[3] = TIFFCurrentDirOffset(tif);
+
+- /* Point IFD3 to a location within the file, where it has now a
+- * non-valid dircount=0. */
++ /* Point IFD3 to a location within the file, where it has now:
++ * - for LE-machines a non-valid dircount=0.
++ * - for BE-machines a dircount!=0 and dir is read with errors. */
+ ss = TIFFSeekFile_M(tif, offsetBase[2] + cnt * 12 + 2, 0);
+ wt = (uint32_t)(offsetBase[1] + 8);
+ rr = TIFFWriteFile_M(tif, &wt, 4);
++
++#ifdef WORDS_BIGENDIAN
++ fprintf(stderr, "----- Expect error messages about 'Error fetching "
++ "directory count.' -----\n");
++#else
+ fprintf(stderr, "----- Expect error messages about 'Error fetching "
+ "directory link.' -----\n");
++#endif
+ /* TIFFNumberOfDirectories() returns now 4 */
+ lastdir = TIFFNumberOfDirectories(tif);
+ TIFFSetDirectory(tif, 0);
+ CHECKCURDIRNUM_M(tif, 0, __LINE__);
++
++ /* For LE-machines the next TIFFSetDirectory(3) fails with error
++ * messages:
++ * test_current_dirnum_incrementing_wl.tif: Failed to allocate
++ * memory for to read TIFF directory (0 elements of 12 bytes each).
++ * TIFFReadDirectory: Failed to read directory at offset 178.
++ *
++ * For BE-machines, next TIFFSetDirectory(3) results in an error
++ * but that TIFFSetDirectory(3) sets the IFD active. Warning messages:
++ * TIFFReadDirectory: Warning, Unknown field with tag 1 (0x1)
++ * encountered.
++ * MissingRequired: TIFF directory is missing required
++ * "ImageLength" field.
++ */
++#ifdef WORDS_BIGENDIAN
++ fprintf(stderr,
++ "----- Expect error messages about ' Unknown field with tag 1 "
++ "(0x1) encountered.' AND 'MissingRequired: TIFF directory is "
++ "missing required ImageLength field.' -----\n");
++#else
+ fprintf(stderr,
+ "----- Expect error messages about 'Failed to allocate "
+ "memory for to read TIFF directory.' AND 'Failed to read "
+ "directory ..' -----\n");
++#endif
+ if (TIFFSetDirectory(tif, 3))
+ {
+ fprintf(stderr,
+@@ -2044,8 +2088,13 @@ int test_current_dirnum_incrementing(int testcase, unsigned int openMode)
+ filename, __LINE__);
+ goto failure;
+ }
++
+ /* Fails in 4.6.0 */
++#ifdef WORDS_BIGENDIAN
++ CHECKCURDIRNUM_M(tif, (tdir_t)(3), __LINE__);
++#else
+ CHECKCURDIRNUM_M(tif, (tdir_t)(-1), __LINE__);
++#endif
+ }
+
+ unlink(filename);
+--
+GitLab
+
+
+From e201cd9d944fb18afdb385668008b0eb9d84cc80 Mon Sep 17 00:00:00 2001
+From: Su_Laus <sulau@freenet.de>
+Date: Sat, 16 Nov 2024 10:33:04 +0100
+Subject: [PATCH 2/3] Replace "#ifdef WORDS_BIGENDIAN" by restricting test on
+ little-endian TIFF files with swapping of patch data for BE-machines.
+
+--- a/test/test_directory.c
++++ b/test/test_directory.c
+@@ -1977,8 +1977,8 @@ int test_current_dirnum_incrementing(int testcase, unsigned int openMode)
+ TIFFSetSubDirectory(tif, 0);
+ CHECKCURDIRNUM_M(tif, (tdir_t)(-1), __LINE__);
+
+-/*-- Patch offset of IFD2 to not existing IFD3 without entries.
+- * Thus TIFFFetchDirectory() will fail. --*/
++ /*-- Patch offset of IFD2 to not existing IFD3 without entries.
++ * Thus TIFFFetchDirectory() will fail. --*/
+ #define TIFFReadFile_M(tif, buf, size) \
+ ((*TIFFGetReadProc(tif))(TIFFClientdata(tif), (buf), (size)));
+ #define TIFFWriteFile_M(tif, buf, size) \
+@@ -1986,8 +1986,15 @@ int test_current_dirnum_incrementing(int testcase, unsigned int openMode)
+ #define TIFFSeekFile_M(tif, off, whence) \
+ ((*TIFFGetSeekProc(tif))(TIFFClientdata(tif), (off), (whence)));
+
+- /* Code below does only handle Classic-TIFF without swapping. */
+- if (!(TIFFIsByteSwapped(tif) || TIFFIsBigTIFF(tif)))
++ /* ---------------------------------------------------------------------
++ * Test IFD index incrementing in case the functions return with certain
++ * errors. To provoke that errors, the file is patched by writing bytes
++ * directly into the file. Therefore, code below does only handle
++ * Classic-TIFF and little-endian files.
++ * The code works also on big endian machines, which have to swap some
++ * directly read/written values.
++ * --------------------------------------------------------------------- */
++ if (!(TIFFIsBigEndian(tif) || TIFFIsBigTIFF(tif)))
+ {
+ /* Patch nextIFDOffset of IFD2, which is 0, with offset to itself.
+ * This generates an IFD3 without any elements at the end of file.
+@@ -1995,23 +2002,22 @@ int test_current_dirnum_incrementing(int testcase, unsigned int openMode)
+ uint64_t ss = TIFFSeekFile_M(tif, offsetBase[2], 0);
+ uint16_t cnt = 0;
+ uint64_t rr = TIFFReadFile_M(tif, &cnt, 2);
++ if (TIFFIsByteSwapped(tif))
++ TIFFSwabShort(&cnt);
+ ss = TIFFSeekFile_M(tif, offsetBase[2] + cnt * 12 + 2, 0);
+ uint32_t wt = (uint32_t)ss;
++ if (TIFFIsByteSwapped(tif))
++ TIFFSwabLong(&wt);
+ rr = TIFFWriteFile_M(tif, &wt, 4);
+ (void)rr;
+
+ /* Now there are offsets to four IFDs in the file, where the last one is
+ * not existing and has a non-valid dircount and entries behind EOF.
+- * For LE-machines dircount is 458 (as offset) and for BE-machines
+- * dircount is zero. */
+-#ifdef WORDS_BIGENDIAN
+- fprintf(stderr, "----- Expect error messages about 'Error fetching "
+- "directory count.' -----\n");
+-#else
++ * (dircount is 458 (as offset) */
+ fprintf(stderr, "----- Expect error messages about 'Error fetching "
+ "directory link.' -----\n");
+-#endif
+- /* TIFFNumberOfDirectories() returns 3 */
++ /* TIFFNumberOfDirectories() returns 3 and omits the invalid fourth IFD.
++ */
+ lastdir = TIFFNumberOfDirectories(tif);
+ TIFFSetDirectory(tif, 0);
+ CHECKCURDIRNUM_M(tif, 0, __LINE__);
+@@ -2033,52 +2039,41 @@ int test_current_dirnum_incrementing(int testcase, unsigned int openMode)
+ }
+
+ /* Fails in 4.6.0 */
++ /* Reading invalid IFD 3 leads to an error and was not read in.
++ * Therefore, curdir shall be 65535 (non-existing directory) */
+ CHECKCURDIRNUM_M(tif, (tdir_t)(-1), __LINE__);
+ offsetBase[3] = TIFFCurrentDirOffset(tif);
+
+- /* Point IFD3 to a location within the file, where it has now:
+- * - for LE-machines a non-valid dircount=0.
+- * - for BE-machines a dircount!=0 and dir is read with errors. */
++ /* Point IFD3 to a location within the file, where it has now for
++ * little-endian TIFF files a non-valid dircount=0, which leads also to
++ * an error and the IFD is not read in. */
+ ss = TIFFSeekFile_M(tif, offsetBase[2] + cnt * 12 + 2, 0);
+ wt = (uint32_t)(offsetBase[1] + 8);
++ // wt = (uint32_t)(ss + 400);
++ if (TIFFIsByteSwapped(tif))
++ TIFFSwabLong(&wt);
+ rr = TIFFWriteFile_M(tif, &wt, 4);
+
+-#ifdef WORDS_BIGENDIAN
+- fprintf(stderr, "----- Expect error messages about 'Error fetching "
+- "directory count.' -----\n");
+-#else
+ fprintf(stderr, "----- Expect error messages about 'Error fetching "
+ "directory link.' -----\n");
+-#endif
+- /* TIFFNumberOfDirectories() returns now 4 */
++ /* TIFFNumberOfDirectories() returns now 4, because for an IFD linked
++ * list dircount=0 is not treated as an error and there is an offset
++ * (=1) to a next IFD. Then, at the fifth IFD a link error occurs. */
+ lastdir = TIFFNumberOfDirectories(tif);
+ TIFFSetDirectory(tif, 0);
+ CHECKCURDIRNUM_M(tif, 0, __LINE__);
+
+- /* For LE-machines the next TIFFSetDirectory(3) fails with error
+- * messages:
++ /* TIFFSetDirectory(3) fails with error messages:
+ * test_current_dirnum_incrementing_wl.tif: Failed to allocate
+ * memory for to read TIFF directory (0 elements of 12 bytes each).
+ * TIFFReadDirectory: Failed to read directory at offset 178.
+- *
+- * For BE-machines, next TIFFSetDirectory(3) results in an error
+- * but that TIFFSetDirectory(3) sets the IFD active. Warning messages:
+- * TIFFReadDirectory: Warning, Unknown field with tag 1 (0x1)
+- * encountered.
+- * MissingRequired: TIFF directory is missing required
+- * "ImageLength" field.
++ * The IFD 3 is not read in and curdir is set to 65535 (non-existing
++ * directory).
+ */
+-#ifdef WORDS_BIGENDIAN
+- fprintf(stderr,
+- "----- Expect error messages about ' Unknown field with tag 1 "
+- "(0x1) encountered.' AND 'MissingRequired: TIFF directory is "
+- "missing required ImageLength field.' -----\n");
+-#else
+ fprintf(stderr,
+ "----- Expect error messages about 'Failed to allocate "
+ "memory for to read TIFF directory.' AND 'Failed to read "
+ "directory ..' -----\n");
+-#endif
+ if (TIFFSetDirectory(tif, 3))
+ {
+ fprintf(stderr,
+@@ -2090,11 +2085,7 @@ int test_current_dirnum_incrementing(int testcase, unsigned int openMode)
+ }
+
+ /* Fails in 4.6.0 */
+-#ifdef WORDS_BIGENDIAN
+- CHECKCURDIRNUM_M(tif, (tdir_t)(3), __LINE__);
+-#else
+ CHECKCURDIRNUM_M(tif, (tdir_t)(-1), __LINE__);
+-#endif
+ }
+
+ unlink(filename);
+--
+GitLab
+
+
+From b470af83d549e890e4ace55620405d06cff20ae5 Mon Sep 17 00:00:00 2001
+From: Su_Laus <sulau@freenet.de>
+Date: Mon, 18 Nov 2024 19:52:26 +0100
+Subject: [PATCH 3/3] Add two missing TIFFClose() in order to avoid memory
+ leaks. Closes #656
+
+--- a/test/test_directory.c
++++ b/test/test_directory.c
+@@ -1365,6 +1365,7 @@ int test_rewrite_lastdir_offset(unsigned int openMode)
+ filename, N_DIRECTORIES, count);
+ goto failure;
+ }
++ /* hint: file was closed by count_directories() */
+ unlink(filename);
+ return 0;
+
+@@ -1511,6 +1512,8 @@ int test_lastdir_offset(unsigned int openMode)
+ }
+ }
+ }
++ /* hint: files are always closed by count_directories() and
++ * get_dir_offsets() */
+ unlink(filename_optimized);
+ unlink(filename_non_optimized);
+ return 0;
+@@ -2088,6 +2091,7 @@ int test_current_dirnum_incrementing(int testcase, unsigned int openMode)
+ CHECKCURDIRNUM_M(tif, (tdir_t)(-1), __LINE__);
+ }
+
++ TIFFClose(tif);
+ unlink(filename);
+ return 0;
+
+@@ -2176,6 +2180,7 @@ int test_curdircount_setting(unsigned int openMode)
+ CHECKCURDIRNUM_M(tif, (tdir_t)(-1), __LINE__);
+ }
+
++ TIFFClose(tif);
+ unlink(filename);
+ return 0;
+
+--
+GitLab
diff --git a/media-libs/tiff/tiff-4.7.0-r1.ebuild b/media-libs/tiff/tiff-4.7.0-r1.ebuild
index 594d624584af..f2dfdbb95f6b 100644
--- a/media-libs/tiff/tiff-4.7.0-r1.ebuild
+++ b/media-libs/tiff/tiff-4.7.0-r1.ebuild
@@ -50,7 +50,10 @@ MULTILIB_WRAPPED_HEADERS=(
/usr/include/tiffconf.h
)
-PATCHES=( "${FILESDIR}"/${P}-fix-test-race.patch ) # bug#943020
+PATCHES=(
+ "${FILESDIR}"/${P}-fix-test-race.patch # bug#943020
+ "${FILESDIR}"/${P}-test-directory-big-endian.patch
+)
src_prepare() {
default
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/
@ 2025-03-01 16:33 Andreas Sturmlechner
0 siblings, 0 replies; 14+ messages in thread
From: Andreas Sturmlechner @ 2025-03-01 16:33 UTC (permalink / raw
To: gentoo-commits
commit: aff7697335d35e4f0e1079039a084c483ac8cdd8
Author: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 1 14:29:59 2025 +0000
Commit: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org>
CommitDate: Sat Mar 1 16:33:22 2025 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=aff76973
media-libs/tiff: drop 4.5.0-r2
Signed-off-by: Andreas Sturmlechner <asturm <AT> gentoo.org>
media-libs/tiff/Manifest | 2 -
.../tiff/files/tiff-4.5.0-CVE-2022-48281.patch | 14 -
...CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch | 287 ---------------------
...CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch | 131 ----------
.../tiff-4.5.0_rc1-skip-tools-tests-multilib.patch | 52 ----
media-libs/tiff/tiff-4.5.0-r2.ebuild | 92 -------
6 files changed, 578 deletions(-)
diff --git a/media-libs/tiff/Manifest b/media-libs/tiff/Manifest
index b9ee3c2b77a6..0149c6961634 100644
--- a/media-libs/tiff/Manifest
+++ b/media-libs/tiff/Manifest
@@ -1,5 +1,3 @@
-DIST tiff-4.5.0.tar.xz 2320900 BLAKE2B c69801ba9d55b1ed27a92d31d8cd16937fe69299fbf5450efb4a6caa60245b72ddade110daae78f2198613640383623f76ec2265ba785375d0a85c7909b73fe9 SHA512 c6c866064c2dd5d1711c6ece7bafe5f011f5ce26c0aeaecbff79c05b5671f44150324bea95a0665cc43331883114de855ee1cd87ed733bff0f4d0814515b9f10
-DIST tiff-4.5.0.tar.xz.sig 310 BLAKE2B bbe7f9600061416227276424eb220714a1375d3e295cb0c5b7f76074324c1a2698a5029dde3e734331e9caf02d8a086273ded2ab09285857dbbfe3ad83506912 SHA512 8cef09755f4efe68db69591967e495852cf63c2d8113a877a2254f536d38c60b6dc864c07089249cd8109a8408672a297ae9e59d8233687bc2796dc158ccfb32
DIST tiff-4.5.1.tar.xz 2228040 BLAKE2B 793c03593c46d6f804f622f5ff7e799751ee79e87ec1575801d2238fbcd2e89ed657a5081d3651e337f1bb14603ff94a15aad878e7fdf2cf75ada38eed64d9d2 SHA512 fc6af93d36598527480c517ddc4f19fe72e9f07ef4997e5731604253c8db0b9bae816ba7a56985bf22fbbb48db1fab5ed4c2b32a5145bc9477ef24b221a61179
DIST tiff-4.5.1.tar.xz.sig 310 BLAKE2B fd5e3ff9c55790777b9d2587910cfb47953a27925bdf8610fc5b9db05a5662b534df542e3658db7b897c8de510479d0a7f0773092ac2f71e3c7bcb4beb14594f SHA512 10e434de0140bbd7e3830860bb611796b65fff5e718a2d5fb2857959ff63149d73b4e1f3f7c4be2c27f8ca863b0e4b7731332544eba948ce10097552e1779aee
DIST tiff-4.6.0.tar.xz 2124388 BLAKE2B 3b508b02b0a536c5bc8e67fe4c1b09ae9c830252786ef4764202c14d673d1ef9634694de7a5893a3551dec684d00bad9d0442c7fea7bcd09238b9960d443cf62 SHA512 4cd9bb485bcac9c5efdd0c4814f2a38a762a3b69e70d909c05a24e2e9d2bd27357b9814e0cb1cee3898355d6ccfcf1615f715125c8ab8c651db474073734ab03
diff --git a/media-libs/tiff/files/tiff-4.5.0-CVE-2022-48281.patch b/media-libs/tiff/files/tiff-4.5.0-CVE-2022-48281.patch
deleted file mode 100644
index e38d17df9cc2..000000000000
--- a/media-libs/tiff/files/tiff-4.5.0-CVE-2022-48281.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-https://gitlab.com/libtiff/libtiff/-/issues/488
-https://bugs.gentoo.org/891839
---- a/tools/tiffcrop.c
-+++ b/tools/tiffcrop.c
-@@ -8591,7 +8591,7 @@ static int processCropSelections(struct
- cropsize + NUM_BUFF_OVERSIZE_BYTES);
- else
- {
-- prev_cropsize = seg_buffs[0].size;
-+ prev_cropsize = seg_buffs[i].size;
- if (prev_cropsize < cropsize)
- {
- next_buff = _TIFFrealloc(
-
diff --git a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch b/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch
deleted file mode 100644
index 70a9b8269ec5..000000000000
--- a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch
+++ /dev/null
@@ -1,287 +0,0 @@
-Index: tiff-4.5.0/tools/tiffcrop.c
-===================================================================
-Upstream commits:
-https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68
-https://gitlab.com/libtiff/libtiff/-/commit/9c22495e5eeeae9e00a1596720c969656bb8d678
-From 9c22495e5eeeae9e00a1596720c969656bb8d678 Mon Sep 17 00:00:00 2001
-From: Su_Laus <sulau@freenet.de>
-Date: Fri, 3 Feb 2023 15:31:31 +0100
-Subject: [PATCH] tiffcrop correctly update buffersize after rotateImage()
- fix#520 rotateImage() set up a new buffer and calculates its size
- individually. Therefore, seg_buffs[] size needs to be updated accordingly.
- Before this fix, the seg_buffs buffer size was calculated with a different
- formula than within rotateImage().
-
-Closes #520.
----
- tools/tiffcrop.c | 36 ++++++++++++++++++++----------------
- 1 file changed, 20 insertions(+), 16 deletions(-)
-
-diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
-index 7db69883..f8b66188 100644
---- a/tools/tiffcrop.c
-+++ b/tools/tiffcrop.c
-@@ -577,7 +577,7 @@ static int rotateContigSamples24bits(uint16_t, uint16_t, uint16_t, uint32_t,
- static int rotateContigSamples32bits(uint16_t, uint16_t, uint16_t, uint32_t,
- uint32_t, uint32_t, uint8_t *, uint8_t *);
- static int rotateImage(uint16_t, struct image_data *, uint32_t *, uint32_t *,
-- unsigned char **);
-+ unsigned char **, size_t *);
- static int mirrorImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
- unsigned char *);
- static int invertImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
-@@ -7243,7 +7243,7 @@ static int correct_orientation(struct image_data *image,
- }
-
- if (rotateImage(rotation, image, &image->width, &image->length,
-- work_buff_ptr))
-+ work_buff_ptr, NULL))
- {
- TIFFError("correct_orientation", "Unable to rotate image");
- return (-1);
-@@ -8563,8 +8563,12 @@ static int processCropSelections(struct image_data *image,
- if (crop->crop_mode & CROP_ROTATE) /* rotate should be last as it can
- reallocate the buffer */
- {
-+ /* rotateImage() set up a new buffer and calculates its size
-+ * individually. Therefore, seg_buffs size needs to be updated
-+ * accordingly. */
-+ size_t rot_buf_size = 0;
- if (rotateImage(crop->rotation, image, &crop->combined_width,
-- &crop->combined_length, &crop_buff))
-+ &crop->combined_length, &crop_buff, &rot_buf_size))
- {
- TIFFError("processCropSelections",
- "Failed to rotate composite regions by %" PRIu32
-@@ -8573,9 +8577,7 @@ static int processCropSelections(struct image_data *image,
- return (-1);
- }
- seg_buffs[0].buffer = crop_buff;
-- seg_buffs[0].size =
-- (((crop->combined_width * image->bps + 7) / 8) * image->spp) *
-- crop->combined_length;
-+ seg_buffs[0].size = rot_buf_size;
- }
- }
- else /* Separated Images */
-@@ -8686,10 +8688,13 @@ static int processCropSelections(struct image_data *image,
- * ->yres, what it schouldn't do here, when more than one
- * section is processed. ToDo: Therefore rotateImage() and its
- * usage has to be reworked (e.g. like mirrorImage()) !!
-- */
-- if (rotateImage(crop->rotation, image,
-- &crop->regionlist[i].width,
-- &crop->regionlist[i].length, &crop_buff))
-+ * Furthermore, rotateImage() set up a new buffer and calculates
-+ * its size individually. Therefore, seg_buffs size needs to be
-+ * updated accordingly. */
-+ size_t rot_buf_size = 0;
-+ if (rotateImage(
-+ crop->rotation, image, &crop->regionlist[i].width,
-+ &crop->regionlist[i].length, &crop_buff, &rot_buf_size))
- {
- TIFFError("processCropSelections",
- "Failed to rotate crop region by %" PRIu16
-@@ -8702,10 +8707,7 @@ static int processCropSelections(struct image_data *image,
- crop->combined_width = total_width;
- crop->combined_length = total_length;
- seg_buffs[i].buffer = crop_buff;
-- seg_buffs[i].size =
-- (((crop->regionlist[i].width * image->bps + 7) / 8) *
-- image->spp) *
-- crop->regionlist[i].length;
-+ seg_buffs[i].size = rot_buf_size;
- }
- } /* for crop->selections loop */
- } /* Separated Images (else case) */
-@@ -8836,7 +8838,7 @@ static int createCroppedImage(struct image_data *image, struct crop_mask *crop,
- CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
- {
- if (rotateImage(crop->rotation, image, &crop->combined_width,
-- &crop->combined_length, crop_buff_ptr))
-+ &crop->combined_length, crop_buff_ptr, NULL))
- {
- TIFFError("createCroppedImage",
- "Failed to rotate image or cropped selection by %" PRIu16
-@@ -9552,7 +9554,7 @@ static int rotateContigSamples32bits(uint16_t rotation, uint16_t spp,
- /* Rotate an image by a multiple of 90 degrees clockwise */
- static int rotateImage(uint16_t rotation, struct image_data *image,
- uint32_t *img_width, uint32_t *img_length,
-- unsigned char **ibuff_ptr)
-+ unsigned char **ibuff_ptr, size_t *rot_buf_size)
- {
- int shift_width;
- uint32_t bytes_per_pixel, bytes_per_sample;
-@@ -9610,6 +9612,8 @@ static int rotateImage(uint16_t rotation, struct image_data *image,
- return (-1);
- }
- _TIFFmemset(rbuff, '\0', buffsize + NUM_BUFF_OVERSIZE_BYTES);
-+ if (rot_buf_size != NULL)
-+ *rot_buf_size = buffsize;
-
- ibuff = *ibuff_ptr;
- switch (rotation)
---
-GitLab
-
-From 69818e2f2d246e6631ac2a2da692c3706b849c38 Mon Sep 17 00:00:00 2001
-From: Su_Laus <sulau@freenet.de>
-Date: Sun, 29 Jan 2023 11:09:26 +0100
-Subject: [PATCH] tiffcrop: Amend rotateImage() not to toggle the input (main)
- image width and length parameters when only cropped image sections are
- rotated. Remove buffptr from region structure because never used.
-
-Closes #492 #493 #494 #495 #499 #518 #519
----
- tools/tiffcrop.c | 59 ++++++++++++++++++++++++++++--------------------
- 1 file changed, 35 insertions(+), 24 deletions(-)
-
-diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
-index ebea7475..519871ec 100644
---- a/tools/tiffcrop.c
-+++ b/tools/tiffcrop.c
-@@ -296,7 +296,6 @@ struct region
- uint32_t width; /* width in pixels */
- uint32_t length; /* length in pixels */
- uint32_t buffsize; /* size of buffer needed to hold the cropped region */
-- unsigned char *buffptr; /* address of start of the region */
- };
-
- /* Cropping parameters from command line and image data
-@@ -577,7 +576,7 @@ static int rotateContigSamples24bits(uint16_t, uint16_t, uint16_t, uint32_t,
- static int rotateContigSamples32bits(uint16_t, uint16_t, uint16_t, uint32_t,
- uint32_t, uint32_t, uint8_t *, uint8_t *);
- static int rotateImage(uint16_t, struct image_data *, uint32_t *, uint32_t *,
-- unsigned char **, size_t *);
-+ unsigned char **, size_t *, int);
- static int mirrorImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
- unsigned char *);
- static int invertImage(uint16_t, uint16_t, uint16_t, uint32_t, uint32_t,
-@@ -5782,7 +5781,6 @@ static void initCropMasks(struct crop_mask *cps)
- cps->regionlist[i].width = 0;
- cps->regionlist[i].length = 0;
- cps->regionlist[i].buffsize = 0;
-- cps->regionlist[i].buffptr = NULL;
- cps->zonelist[i].position = 0;
- cps->zonelist[i].total = 0;
- }
-@@ -7266,9 +7264,13 @@ static int correct_orientation(struct image_data *image,
- (uint16_t)(image->adjustments & ROTATE_ANY));
- return (-1);
- }
--
-- if (rotateImage(rotation, image, &image->width, &image->length,
-- work_buff_ptr, NULL))
-+ /* Dummy variable in order not to switch two times the
-+ * image->width,->length within rotateImage(),
-+ * but switch xres, yres there. */
-+ uint32_t width = image->width;
-+ uint32_t length = image->length;
-+ if (rotateImage(rotation, image, &width, &length, work_buff_ptr, NULL,
-+ TRUE))
- {
- TIFFError("correct_orientation", "Unable to rotate image");
- return (-1);
-@@ -7377,7 +7379,6 @@ static int extractCompositeRegions(struct image_data *image,
- /* These should not be needed for composite images */
- crop->regionlist[i].width = crop_width;
- crop->regionlist[i].length = crop_length;
-- crop->regionlist[i].buffptr = crop_buff;
-
- src_rowsize = ((img_width * bps * spp) + 7) / 8;
- dst_rowsize = (((crop_width * bps * count) + 7) / 8);
-@@ -7640,7 +7641,6 @@ static int extractSeparateRegion(struct image_data *image,
-
- crop->regionlist[region].width = crop_width;
- crop->regionlist[region].length = crop_length;
-- crop->regionlist[region].buffptr = crop_buff;
-
- src = read_buff;
- dst = crop_buff;
-@@ -8635,7 +8635,8 @@ static int processCropSelections(struct image_data *image,
- * accordingly. */
- size_t rot_buf_size = 0;
- if (rotateImage(crop->rotation, image, &crop->combined_width,
-- &crop->combined_length, &crop_buff, &rot_buf_size))
-+ &crop->combined_length, &crop_buff, &rot_buf_size,
-+ FALSE))
- {
- TIFFError("processCropSelections",
- "Failed to rotate composite regions by %" PRIu32
-@@ -8759,9 +8760,10 @@ static int processCropSelections(struct image_data *image,
- * its size individually. Therefore, seg_buffs size needs to be
- * updated accordingly. */
- size_t rot_buf_size = 0;
-- if (rotateImage(
-- crop->rotation, image, &crop->regionlist[i].width,
-- &crop->regionlist[i].length, &crop_buff, &rot_buf_size))
-+ if (rotateImage(crop->rotation, image,
-+ &crop->regionlist[i].width,
-+ &crop->regionlist[i].length, &crop_buff,
-+ &rot_buf_size, FALSE))
- {
- TIFFError("processCropSelections",
- "Failed to rotate crop region by %" PRIu16
-@@ -8905,7 +8907,7 @@ static int createCroppedImage(struct image_data *image, struct crop_mask *crop,
- CROP_ROTATE) /* rotate should be last as it can reallocate the buffer */
- {
- if (rotateImage(crop->rotation, image, &crop->combined_width,
-- &crop->combined_length, crop_buff_ptr, NULL))
-+ &crop->combined_length, crop_buff_ptr, NULL, TRUE))
- {
- TIFFError("createCroppedImage",
- "Failed to rotate image or cropped selection by %" PRIu16
-@@ -9621,7 +9623,8 @@ static int rotateContigSamples32bits(uint16_t rotation, uint16_t spp,
- /* Rotate an image by a multiple of 90 degrees clockwise */
- static int rotateImage(uint16_t rotation, struct image_data *image,
- uint32_t *img_width, uint32_t *img_length,
-- unsigned char **ibuff_ptr, size_t *rot_buf_size)
-+ unsigned char **ibuff_ptr, size_t *rot_buf_size,
-+ int rot_image_params)
- {
- int shift_width;
- uint32_t bytes_per_pixel, bytes_per_sample;
-@@ -9869,11 +9872,15 @@ static int rotateImage(uint16_t rotation, struct image_data *image,
-
- *img_width = length;
- *img_length = width;
-- image->width = length;
-- image->length = width;
-- res_temp = image->xres;
-- image->xres = image->yres;
-- image->yres = res_temp;
-+ /* Only toggle image parameters if whole input image is rotated. */
-+ if (rot_image_params)
-+ {
-+ image->width = length;
-+ image->length = width;
-+ res_temp = image->xres;
-+ image->xres = image->yres;
-+ image->yres = res_temp;
-+ }
- break;
-
- case 270:
-@@ -9956,11 +9963,15 @@ static int rotateImage(uint16_t rotation, struct image_data *image,
-
- *img_width = length;
- *img_length = width;
-- image->width = length;
-- image->length = width;
-- res_temp = image->xres;
-- image->xres = image->yres;
-- image->yres = res_temp;
-+ /* Only toggle image parameters if whole input image is rotated. */
-+ if (rot_image_params)
-+ {
-+ image->width = length;
-+ image->length = width;
-+ res_temp = image->xres;
-+ image->xres = image->yres;
-+ image->yres = res_temp;
-+ }
- break;
- default:
- break;
---
-GitLab
diff --git a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch b/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch
deleted file mode 100644
index 41fe439f9159..000000000000
--- a/media-libs/tiff/files/tiff-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-Index: tiff-4.5.0/tools/tiffcrop.c
-===================================================================
-Upstream commit:
-https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00
-From 82a7fbb1fa7228499ffeb3a57a1d106a9626d57c Mon Sep 17 00:00:00 2001
-From: Su Laus <sulau@freenet.de>
-Date: Sun, 5 Feb 2023 15:53:15 +0000
-Subject: [PATCH] tiffcrop: added check for assumption on composite images
- (fixes #496)
-
-tiffcrop: For composite images with more than one region, the combined_length or combined_width always needs to be equal, respectively. Otherwise, even the first section/region copy action might cause buffer overrun. This is now checked before the first copy action.
-
-Closes #496, #497, #498, #500, #501.
----
- tools/tiffcrop.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++--
- 1 file changed, 66 insertions(+), 2 deletions(-)
-
-diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
-index 84e26ac6..480b927c 100644
---- a/tools/tiffcrop.c
-+++ b/tools/tiffcrop.c
-@@ -5935,18 +5935,40 @@ static int computeInputPixelOffsets(struct crop_mask *crop,
-
- crop->regionlist[i].buffsize = buffsize;
- crop->bufftotal += buffsize;
-+
-+ /* For composite images with more than one region, the
-+ * combined_length or combined_width always needs to be equal,
-+ * respectively.
-+ * Otherwise, even the first section/region copy
-+ * action might cause buffer overrun. */
- if (crop->img_mode == COMPOSITE_IMAGES)
- {
- switch (crop->edge_ref)
- {
- case EDGE_LEFT:
- case EDGE_RIGHT:
-+ if (i > 0 && zlength != crop->combined_length)
-+ {
-+ TIFFError(
-+ "computeInputPixelOffsets",
-+ "Only equal length regions can be combined for "
-+ "-E left or right");
-+ return (-1);
-+ }
- crop->combined_length = zlength;
- crop->combined_width += zwidth;
- break;
- case EDGE_BOTTOM:
- case EDGE_TOP: /* width from left, length from top */
- default:
-+ if (i > 0 && zwidth != crop->combined_width)
-+ {
-+ TIFFError("computeInputPixelOffsets",
-+ "Only equal width regions can be "
-+ "combined for -E "
-+ "top or bottom");
-+ return (-1);
-+ }
- crop->combined_width = zwidth;
- crop->combined_length += zlength;
- break;
-@@ -7301,6 +7323,46 @@ static int extractCompositeRegions(struct image_data *image,
- crop->combined_width = 0;
- crop->combined_length = 0;
-
-+ /* If there is more than one region, check beforehand whether all the width
-+ * and length values of the regions are the same, respectively. */
-+ switch (crop->edge_ref)
-+ {
-+ default:
-+ case EDGE_TOP:
-+ case EDGE_BOTTOM:
-+ for (i = 1; i < crop->selections; i++)
-+ {
-+ uint32_t crop_width0 =
-+ crop->regionlist[i - 1].x2 - crop->regionlist[i - 1].x1 + 1;
-+ uint32_t crop_width1 =
-+ crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1;
-+ if (crop_width0 != crop_width1)
-+ {
-+ TIFFError("extractCompositeRegions",
-+ "Only equal width regions can be combined for -E "
-+ "top or bottom");
-+ return (1);
-+ }
-+ }
-+ break;
-+ case EDGE_LEFT:
-+ case EDGE_RIGHT:
-+ for (i = 1; i < crop->selections; i++)
-+ {
-+ uint32_t crop_length0 =
-+ crop->regionlist[i - 1].y2 - crop->regionlist[i - 1].y1 + 1;
-+ uint32_t crop_length1 =
-+ crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1;
-+ if (crop_length0 != crop_length1)
-+ {
-+ TIFFError("extractCompositeRegions",
-+ "Only equal length regions can be combined for "
-+ "-E left or right");
-+ return (1);
-+ }
-+ }
-+ }
-+
- for (i = 0; i < crop->selections; i++)
- {
- /* rows, columns, width, length are expressed in pixels */
-@@ -7325,7 +7387,8 @@ static int extractCompositeRegions(struct image_data *image,
- default:
- case EDGE_TOP:
- case EDGE_BOTTOM:
-- if ((i > 0) && (crop_width != crop->regionlist[i - 1].width))
-+ if ((crop->selections > i + 1) &&
-+ (crop_width != crop->regionlist[i + 1].width))
- {
- TIFFError("extractCompositeRegions",
- "Only equal width regions can be combined for -E "
-@@ -7418,7 +7481,8 @@ static int extractCompositeRegions(struct image_data *image,
- case EDGE_LEFT: /* splice the pieces of each row together, side by
- side */
- case EDGE_RIGHT:
-- if ((i > 0) && (crop_length != crop->regionlist[i - 1].length))
-+ if ((crop->selections > i + 1) &&
-+ (crop_length != crop->regionlist[i + 1].length))
- {
- TIFFError("extractCompositeRegions",
- "Only equal length regions can be combined for "
---
-GitLab
diff --git a/media-libs/tiff/files/tiff-4.5.0_rc1-skip-tools-tests-multilib.patch b/media-libs/tiff/files/tiff-4.5.0_rc1-skip-tools-tests-multilib.patch
deleted file mode 100644
index 831afd287226..000000000000
--- a/media-libs/tiff/files/tiff-4.5.0_rc1-skip-tools-tests-multilib.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-https://gitlab.com/libtiff/libtiff/-/merge_requests/334
-
-From e7605b93b12c2bf3c864910c23ac976045b5a05a Mon Sep 17 00:00:00 2001
-From: Sam James <sam@gentoo.org>
-Date: Sat, 21 May 2022 01:01:35 +0100
-Subject: [PATCH 1/2] test (autotools): skip script tests if tools aren't built
-
-In Gentoo, we avoid building the tools for multilib (32-bit, x86) builds on
-amd64/x86_64 because we only need the library to keep binary applications working.
-
-This causes a test failure in e.g. tiffcp-thumbnail.sh as the 'thumbnail'
-binary isn't built. Skip it if unavailable.
-
-Fixes: https://gitlab.com/libtiff/libtiff/-/issues/421
---- a/test/Makefile.am
-+++ b/test/Makefile.am
-@@ -55,13 +55,14 @@ XFAIL_TESTS =
- CLEANFILES = test_packbits.tif o-*
-
- if HAVE_JPEG
-+if TIFF_TOOLS
- JPEG_DEPENDENT_CHECK_PROG=raw_decode
- JPEG_DEPENDENT_TESTSCRIPTS=\
- tiff2rgba-quad-tile.jpg.sh \
- tiff2rgba-ojpeg_zackthecat_subsamp22_single_strip.sh \
- tiff2rgba-ojpeg_chewey_subsamp21_multi_strip.sh \
- tiff2rgba-ojpeg_single_strip_no_rowsperstrip.sh
--
-+endif
- else
- JPEG_DEPENDENT_CHECK_PROG=
- JPEG_DEPENDENT_TESTSCRIPTS=
-@@ -76,6 +77,7 @@ check_PROGRAMS = \
- endif
-
- # Test scripts to execute
-+if TIFF_TOOLS
- TESTSCRIPTS = \
- ppm2tiff_pbm.sh \
- ppm2tiff_pgm.sh \
-@@ -156,6 +158,9 @@ TESTSCRIPTS = \
- testfax4.sh \
- testdeflatelaststripextradata.sh \
- $(JPEG_DEPENDENT_TESTSCRIPTS)
-+else
-+TESTSCRIPTS=
-+endif
-
- # This list should contain the references files
- # from the 'refs' subdirectory
---
-GitLab
diff --git a/media-libs/tiff/tiff-4.5.0-r2.ebuild b/media-libs/tiff/tiff-4.5.0-r2.ebuild
deleted file mode 100644
index ddb1a04fda89..000000000000
--- a/media-libs/tiff/tiff-4.5.0-r2.ebuild
+++ /dev/null
@@ -1,92 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-QA_PKGCONFIG_VERSION="$(ver_cut 1-3)"
-
-# Release signer can vary per version but not clear if others will be doing
-# them in future, so gone with Even Rouault for now as he does other geosci
-# stuff too like PROJ, GDAL. Previous release manager of TIFF was
-# GraphicsMagick maintainer Bob Friesenhahn. Please be careful when verifying
-# who made releases.
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rouault.asc
-inherit autotools multilib-minimal verify-sig flag-o-matic
-
-MY_P="${P/_rc/rc}"
-DESCRIPTION="Tag Image File Format (TIFF) library"
-HOMEPAGE="http://libtiff.maptools.org"
-SRC_URI="https://download.osgeo.org/libtiff/${MY_P}.tar.xz"
-SRC_URI+=" verify-sig? ( https://download.osgeo.org/libtiff/${MY_P}.tar.xz.sig )"
-S="${WORKDIR}/${PN}-$(ver_cut 1-3)"
-
-LICENSE="libtiff"
-SLOT="0/6"
-if [[ ${PV} != *_rc* ]] ; then
- KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="+cxx jbig jpeg lzma static-libs test webp zlib zstd"
-RESTRICT="!test? ( test )"
-
-# bug #483132
-REQUIRED_USE="test? ( jpeg )"
-
-RDEPEND="jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] )
- jpeg? ( media-libs/libjpeg-turbo:=[${MULTILIB_USEDEP}] )
- lzma? ( >=app-arch/xz-utils-5.0.5-r1[${MULTILIB_USEDEP}] )
- webp? ( media-libs/libwebp:=[${MULTILIB_USEDEP}] )
- zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
- zstd? ( >=app-arch/zstd-1.3.7-r1:=[${MULTILIB_USEDEP}] )"
-DEPEND="${RDEPEND}"
-BDEPEND="verify-sig? ( sec-keys/openpgp-keys-evenrouault )"
-
-MULTILIB_WRAPPED_HEADERS=(
- /usr/include/tiffconf.h
-)
-
-PATCHES=(
- "${FILESDIR}"/${PN}-4.5.0_rc1-skip-tools-tests-multilib.patch
- "${FILESDIR}"/${PN}-4.5.0-CVE-2022-48281.patch
- "${FILESDIR}"/${PN}-4.5.0-CVE-2023-0795-CVE-2023-0796-CVE-2023-0797-CVE-2023-0798-CVE-2023-0799.patch
- "${FILESDIR}"/${PN}-4.5.0-CVE-2023-0800-CVE-2023-0801-CVE-2023-0802-CVE-2023-0803-CVE-2023-0804.patch
-)
-
-src_prepare() {
- default
-
- # Added to fix cross-compilation
- #elibtoolize
-
- # For skip-tools-tests-multilib.patch
- eautoreconf
-}
-
-multilib_src_configure() {
- append-lfs-flags
-
- local myeconfargs=(
- --disable-sphinx
- --without-x
- --with-docdir="${EPREFIX}"/usr/share/doc/${PF}
- $(use_enable cxx)
- $(use_enable jbig)
- $(use_enable jpeg)
- $(use_enable lzma)
- $(use_enable static-libs static)
- $(use_enable test tests)
- $(use_enable webp)
- $(use_enable zlib)
- $(use_enable zstd)
-
- $(multilib_native_enable docs)
- $(multilib_native_enable contrib)
- $(multilib_native_enable tools)
- )
-
- ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-multilib_src_install_all() {
- find "${ED}" -type f -name '*.la' -delete || die
- rm "${ED}"/usr/share/doc/${PF}/{README*,RELEASE-DATE,TODO,VERSION} || die
-}
^ permalink raw reply related [flat|nested] 14+ messages in thread
end of thread, other threads:[~2025-03-01 16:33 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-02-27 2:56 [gentoo-commits] repo/gentoo:master commit in: media-libs/tiff/files/, media-libs/tiff/ Sam James
-- strict thread matches above, loose matches on Subject: below --
2025-03-01 16:33 Andreas Sturmlechner
2024-11-19 21:59 Andreas K. Hüttel
2024-11-19 20:59 Andreas K. Hüttel
2023-02-22 16:23 Sam James
2023-02-07 4:30 Sam James
2023-01-24 16:12 Andreas Sturmlechner
2022-05-21 0:10 Sam James
2020-01-29 21:44 Andreas Sturmlechner
2018-02-16 15:30 Lars Wendler
2018-01-26 22:25 Mike Frysinger
2017-03-31 3:43 Mike Frysinger
2017-03-31 3:36 Mike Frysinger
2016-08-03 13:38 Lars Wendler
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox