Pisilinux/main
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #4615 from Rmys/master

Browse Source 
tiff-4.0.8:ver.bump
This commit is contained in:
Rmys
2018-03-21 22:46:11 +03:00
committed by GitHub
parent 0aa5f6c08e e401e81ed2
commit a46b049a7f
9 changed files with 317 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
multimedia/graphics/tiff/files/gentoo/tiff-4.0.7-pdfium-0005-Leak-TIFFFetchStripThing.patch
+20
View File
@@ -0,0 +1,20 @@
https://codereview.chromium.org/2204793002
https://crbug.com/633387
https://pdfium.googlesource.com/pdfium/+/master/libtiff/
Author: thestig <thestig@chromium.org>
Date: Mon Aug 1 19:36:27 2016 -0700
Fix a memory leak in libtiff.
--- a/libtiff/tif_dirread.c
+++ b/libtiff/tif_dirread.c
@@ -5372,6 +5372,8 @@ TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
static const char module[] = "TIFFFetchStripThing";
enum TIFFReadDirEntryErr err;
uint64* data;
+ _TIFFfree(*lpp);
+ *lpp = 0;
err=TIFFReadDirEntryLong8Array(tif,dir,&data);
if (err!=TIFFReadDirEntryErrOk)
{
multimedia/graphics/tiff/files/gentoo/tiff-4.0.7-pdfium-0006-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch
+33
View File
@@ -0,0 +1,33 @@
https://codereview.chromium.org/2284063002
https://crbug.com/618267
https://pdfium.googlesource.com/pdfium/+/master/libtiff/
Author: tracy_jiang <tracy_jiang@foxitsoftware.com>
Date: Mon Aug 29 13:42:56 2016 -0700
Fix for #618267. Adding a method to determine if multiplication has
overflow.
--- a/libtiff/tif_aux.c
+++ b/libtiff/tif_aux.c
@@ -69,7 +69,7 @@ _TIFFCheckRealloc(TIFF* tif, void* buffer,
/*
* XXX: Check for integer overflow.
*/
- if (nmemb && elem_size && bytes / elem_size == nmemb)
+ if (nmemb && elem_size && !_TIFFIfMultiplicationOverflow(nmemb, elem_size))
cp = _TIFFrealloc(buffer, bytes);
if (cp == NULL) {
--- a/libtiff/tiffiop.h
+++ b/libtiff/tiffiop.h
@@ -315,6 +315,9 @@ typedef size_t TIFFIOSize_t;
#define _TIFF_off_t off_t
#endif
+#include <limits.h>
+#define _TIFFIfMultiplicationOverflow(op1, op2) ((op1) > SSIZE_MAX / (op2))
+
#if defined(__cplusplus)
extern "C" {
#endif
multimedia/graphics/tiff/files/gentoo/tiff-4.0.7-pdfium-0007-uninitialized-value.patch
+26
View File
@@ -0,0 +1,26 @@
https://codereview.chromium.org/2389993002
https://crbug.com/651632
https://pdfium.googlesource.com/pdfium/+/master/libtiff/
Author: dsinclair <dsinclair@chromium.org>
Date: Mon Oct 3 13:59:57 2016 -0700
Fix potentially uninitialized value.
Depending on what ReadOK does it's possible for |dircount16| to be used without
being initialized. The read code calls back into PDFium specific code which then
calls into the stream reading code.
Initialize the value to be sure it is set.
--- a/libtiff/tif_dirread.c
+++ b/libtiff/tif_dirread.c
@@ -4443,7 +4443,7 @@ TIFFFetchDirectory(TIFF* tif, uint64 diroff, TIFFDirEntry** pdir,
static const char module[] = "TIFFFetchDirectory";
void* origdir;
- uint16 dircount16;
+ uint16 dircount16 = 0;
uint32 dirsize;
TIFFDirEntry* dir;
uint8* ma;
multimedia/graphics/tiff/files/gentoo/tiff-4.0.7-pdfium-0008-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch
+26
View File
@@ -0,0 +1,26 @@
https://codereview.chromium.org/2405693002
https://crbug.com/654169
https://pdfium.googlesource.com/pdfium/+/master/libtiff/
Author: stackexploit <stackexploit@gmail.com>
Date: Mon Oct 10 10:58:25 2016 -0700
libtiff: Prevent a buffer overflow in function ChopUpSingleUncompressedStrip.
The patch (https://codereview.chromium.org/2284063002) for Issue 618267
was insufficient. The integer overflow still could be triggered and could
lead to heap buffer overflow.
This CL strengthens integer overflow check in function _TIFFCheckRealloc.
--- a/libtiff/tif_aux.c
+++ b/libtiff/tif_aux.c
@@ -69,7 +69,7 @@ _TIFFCheckRealloc(TIFF* tif, void* buffer,
/*
* XXX: Check for integer overflow.
*/
- if (nmemb && elem_size && !_TIFFIfMultiplicationOverflow(nmemb, elem_size))
+ if (nmemb > 0 && elem_size > 0 && !_TIFFIfMultiplicationOverflow(nmemb, elem_size))
cp = _TIFFrealloc(buffer, bytes);
if (cp == NULL) {
multimedia/graphics/tiff/files/gentoo/tiff-4.0.7-pdfium-0013-validate-refblackwhite.patch
+42
View File
@@ -0,0 +1,42 @@
https://pdfium-review.googlesource.com/2151
https://crbug.com/632883
https://pdfium.googlesource.com/pdfium/+/master/libtiff/
Author: Dan Sinclair <dsinclair@chromium.org>
Date: Mon Jan 9 09:50:50 2017 -0500
[libtiff] Validate refblackwhite values
The td_refblackwhite value is currently assigned without validation. This
may pose an issue as the image can specify the value as nan. This will cause
problems later when we use the nan in calcluations.
This CL validates each of the float values are not nan and if they are sets
them to the default provided by the TIFF spec v6.
--- a/libtiff/tif_dir.c
+++ b/libtiff/tif_dir.c
@@ -31,6 +31,7 @@
* (and also some miscellaneous stuff)
*/
#include "tiffiop.h"
+#include <math.h>
#include <float.h>
/*
@@ -426,6 +426,15 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
case TIFFTAG_REFERENCEBLACKWHITE:
/* XXX should check for null range */
_TIFFsetFloatArray(&td->td_refblackwhite, va_arg(ap, float*), 6);
+ int i;
+ for (i = 0; i < 6; i++) {
+ if (isnan(td->td_refblackwhite[i])) {
+ if (i % 2 == 0)
+ td->td_refblackwhite[i] = 0;
+ else
+ td->td_refblackwhite[i] = pow(2, td->td_bitspersample) - 1;
+ }
+ }
break;
case TIFFTAG_INKNAMES:
v = (uint16) va_arg(ap, uint16_vap);
multimedia/graphics/tiff/files/gentoo/tiff-4.0.7-pdfium-0017-safe_skews_in_gtTileContig.patch
+97
View File
@@ -0,0 +1,97 @@
https://pdfium-review.googlesource.com/2355
https://crbug.com/681300
https://pdfium.googlesource.com/pdfium/+/master/libtiff/
Author: Nicolas Pena <npm@chromium.org>
Date: Wed Jan 25 10:41:06 2017 -0500
Prevent skew overflows in gtTileContig
Using int64 to check whether uint32 operations have overflowed.
--- a/libtiff/tif_getimage.c
+++ b/libtiff/tif_getimage.c
@@ -31,6 +31,7 @@
*/
#include "tiffiop.h"
#include <stdio.h>
+#include <limits.h>
static int gtTileContig(TIFFRGBAImage*, uint32*, uint32, uint32);
static int gtTileSeparate(TIFFRGBAImage*, uint32*, uint32, uint32);
@@ -629,6 +628,7 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
uint32 tw, th;
unsigned char* buf;
int32 fromskew, toskew;
+ int64 safeskew;
uint32 nrow;
int ret = 1, flip;
uint32 this_tw, tocol;
@@ -649,19 +647,37 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
flip = setorientation(img);
if (flip & FLIP_VERTICALLY) {
y = h - 1;
- toskew = -(int32)(tw + w);
+ safeskew = 0;
+ safeskew -= tw;
+ safeskew -= w;
}
else {
y = 0;
- toskew = -(int32)(tw - w);
+ safeskew = 0;
+ safeskew -= tw;
+ safeskew +=w;
}
+ if(safeskew > INT_MAX || safeskew < INT_MIN){
+ _TIFFfree(buf);
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "Invalid skew");
+ return (0);
+ }
+ toskew = safeskew;
+
/*
* Leftmost tile is clipped on left side if col_offset > 0.
*/
leftmost_fromskew = img->col_offset % tw;
leftmost_tw = tw - leftmost_fromskew;
- leftmost_toskew = toskew + leftmost_fromskew;
+ safeskew = toskew;
+ safeskew += leftmost_fromskew;
+ if(safeskew > INT_MAX || safeskew < INT_MIN){
+ _TIFFfree(buf);
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "Invalid skew");
+ return (0);
+ }
+ leftmost_toskew = safeskew;
for (row = 0; row < h; row += nrow)
{
rowstoread = th - (row + img->row_offset) % th;
@@ -704,9 +684,24 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
/*
* Rightmost tile is clipped on right side.
*/
- fromskew = tw - (w - tocol);
+ safeskew = tw;
+ safeskew -= w;
+ safeskew += tocol;
+ if(safeskew > INT_MAX || safeskew < INT_MIN){
+ _TIFFfree(buf);
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "Invalid skew");
+ return (0);
+ }
+ fromskew = safeskew;
this_tw = tw - fromskew;
- this_toskew = toskew + fromskew;
+ safeskew = toskew;
+ safeskew += fromskew;
+ if(safeskew > INT_MAX || safeskew < INT_MIN){
+ _TIFFfree(buf);
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "Invalid skew");
+ return (0);
+ }
+ this_toskew = safeskew;
}
(*put)(img, raster+y*w+tocol, tocol, y, this_tw, nrow, fromskew, this_toskew, buf + pos);
tocol += this_tw;
multimedia/graphics/tiff/files/gentoo/tiff-4.0.7-pdfium-0018-fix-leak-in-PredictorSetupDecode.patch
+27
View File
@@ -0,0 +1,27 @@
https://pdfium-review.googlesource.com/2432
https://crbug.com/683834
https://pdfium.googlesource.com/pdfium/+/master/libtiff/
Author: Nicolas Pena <npm@chromium.org>
Date: Thu Jan 26 15:45:02 2017 -0500
Fix leak in PredictorSetupDecode by calling tif_cleanup on failure
tif_data and tif_cleanup are both set on the TIFFInit methods, see for
instance TIFFInitPixarLog. If PredictorSetupDecode fails, whatever was
filled on tif_data should be cleaned up. The previous leak fix from
PixarLogSetupDecode is no longer necessary.
--- a/libtiff/tif_predict.c
+++ b/libtiff/tif_predict.c
@@ -118,7 +118,10 @@ PredictorSetupDecode(TIFF* tif)
TIFFDirectory* td = &tif->tif_dir;
if (!(*sp->setupdecode)(tif) || !PredictorSetup(tif))
+ {
+ (*tif->tif_cleanup)(tif);
return 0;
+ }
if (sp->predictor == 2) {
switch (td->td_bitspersample) {
multimedia/graphics/tiff/files/gentoo/tiff-4.0.7-pdfium-0021-oom-TIFFFillStrip.patch
+29
View File
@@ -0,0 +1,29 @@
https://pdfium-review.googlesource.com/3811
https://crbug.com/707431
https://pdfium.googlesource.com/pdfium/+/master/libtiff/
Author: Nicolas Pena <npm@chromium.org>
Date: Wed Apr 5 15:50:53 2017 -0400
Libtiff: Prevent OOM in TIFFFillStrip
In TIFFFillStrip, calls to TIFFReadBufferSetup may allocate large amounts of
memory. In this CL we do sanity checks on the claimed size of the raw strip
data before that happens, to prevent out-of-memory.
--- a/libtiff/tif_read.c
+++ b/libtiff/tif_read.c
@@ -616,6 +616,13 @@ TIFFFillStrip(TIFF* tif, uint32 strip)
TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
return(0);
}
+ const tmsize_t size=isMapped(tif)? tif->tif_size : (tmsize_t)TIFFGetFileSize(tif);
+ if (bytecountm > size) {
+ TIFFErrorExt(tif->tif_clientdata, module,
+ "Requested read strip size %lu is too large",
+ (unsigned long) strip);
+ return (0);
+ }
if (bytecountm > tif->tif_rawdatasize) {
tif->tif_curstrip = NOSTRIP;
if ((tif->tif_flags & TIFF_MYBUFFER) == 0) {
multimedia/graphics/tiff/pspec.xml
+17 -2
View File
@@ -12,13 +12,21 @@
<IsA>library</IsA>
<Summary>Library for manipulation of TIFF (Tag Image File Format) images</Summary>
<Description>This software provides support for the Tag Image File Format (TIFF), a widely used format for storing image data.</Description>
<Archive sha1sum="2c1b64478e88f93522a42dd5271214a0e5eae648" type="targz">http://download.osgeo.org/libtiff/tiff-4.0.7.tar.gz</Archive>
<Archive sha1sum="88717c97480a7976c94d23b6d9ed4ac74715267f" type="targz">http://download.osgeo.org/libtiff/tiff-4.0.8.tar.gz</Archive>
<BuildDependencies>
<Dependency>libjpeg-turbo-devel</Dependency>
<Dependency>jbigkit-devel</Dependency>
</BuildDependencies>
<Patches>
<Patch level="1">fix-hylafax.patch</Patch>
<!-- <Patch level="1">fix-hylafax.patch</Patch> -->
<Patch level="1">gentoo/tiff-4.0.7-pdfium-0005-Leak-TIFFFetchStripThing.patch</Patch>
<Patch level="1">gentoo/tiff-4.0.7-pdfium-0006-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch</Patch>
<Patch level="1">gentoo/tiff-4.0.7-pdfium-0007-uninitialized-value.patch</Patch>
<Patch level="1">gentoo/tiff-4.0.7-pdfium-0008-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch</Patch>
<Patch level="1">gentoo/tiff-4.0.7-pdfium-0013-validate-refblackwhite.patch</Patch>
<Patch level="1">gentoo/tiff-4.0.7-pdfium-0017-safe_skews_in_gtTileContig.patch</Patch>
<Patch level="1">gentoo/tiff-4.0.7-pdfium-0018-fix-leak-in-PredictorSetupDecode.patch</Patch>
<Patch level="1">gentoo/tiff-4.0.7-pdfium-0021-oom-TIFFFillStrip.patch</Patch>
</Patches>
</Source>
@@ -77,6 +85,13 @@
</Files>
</Package>
<History>
<Update release="5">
<Date>2018-03-21</Date>
<Version>4.0.8</Version>
<Comment>Version Bump</Comment>
<Name>Pisi Linux Community</Name>
<Email>admin@pisilinux.org</Email>
</Update>
<Update release="4">
<Date>2017-01-25</Date>
<Version>4.0.7</Version>