diff --git a/backport-CVE-2023-38288.patch b/backport-CVE-2023-38288.patch deleted file mode 100644 index 2f91966..0000000 --- a/backport-CVE-2023-38288.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 4fc16f649fa2875d5c388cf2edc295510a247ee5 Mon Sep 17 00:00:00 2001 -From: Arie Haenel -Date: Wed, 19 Jul 2023 19:34:25 +0000 -Subject: [PATCH] tiffcp: fix memory corruption (overflow) on hostile images - (fixes #591) - ---- - tools/tiffcp.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/tools/tiffcp.c b/tools/tiffcp.c -index 3b2d1ddac..80b39829a 100644 ---- a/tools/tiffcp.c -+++ b/tools/tiffcp.c -@@ -1754,6 +1754,13 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer) - "Width * Samples/Pixel)"); - return 0; - } -+ -+ if ( (imagew - tilew * spp) > INT_MAX ){ -+ TIFFError(TIFFFileName(in), -+ "Error, image raster scan line size is too large"); -+ return 0; -+ } -+ - iskew = imagew - tilew * spp; - tilebuf = limitMalloc(tilesize); - if (tilebuf == 0) --- -GitLab - diff --git a/backport-CVE-2023-38289.patch b/backport-CVE-2023-38289.patch deleted file mode 100644 index 358b92a..0000000 --- a/backport-CVE-2023-38289.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 6e2dac5f904496d127c92ddc4e56eccfca25c2ee Mon Sep 17 00:00:00 2001 -From: Arie Haenel -Date: Wed, 19 Jul 2023 19:40:01 +0000 -Subject: [PATCH] raw2tiff: fix integer overflow and bypass of the check (fixes - #592) - ---- - tools/raw2tiff.c | 28 ++++++++++++++++++++++++++++ - 1 file changed, 28 insertions(+) - -diff --git a/tools/raw2tiff.c b/tools/raw2tiff.c -index 4ee59e5d7..0d6b0b664 100644 ---- a/tools/raw2tiff.c -+++ b/tools/raw2tiff.c -@@ -101,6 +101,7 @@ int main(int argc, char *argv[]) - int fd; - char *outfilename = NULL; - TIFF *out; -+ uint32_t temp_limit_check = 0; /* temp for integer overflow checking*/ - - uint32_t row, col, band; - int c; -@@ -221,6 +222,33 @@ int main(int argc, char *argv[]) - if (guessSize(fd, dtype, hdr_size, nbands, swab, &width, &length) < 0) - return EXIT_FAILURE; - -+ /* check for integer overflow in */ -+ /* hdr_size + (*width) * (*length) * nbands * depth */ -+ -+ if ((width == 0) || (length == 0) ){ -+ fprintf(stderr, "Too large nbands value specified.\n"); -+ return (EXIT_FAILURE); -+ } -+ -+ temp_limit_check = nbands * depth; -+ -+ if ( !temp_limit_check || length > ( UINT_MAX / temp_limit_check ) ) { -+ fprintf(stderr, "Too large length size specified.\n"); -+ return (EXIT_FAILURE); -+ } -+ temp_limit_check = temp_limit_check * length; -+ -+ if ( !temp_limit_check || width > ( UINT_MAX / temp_limit_check ) ) { -+ fprintf(stderr, "Too large width size specified.\n"); -+ return (EXIT_FAILURE); -+ } -+ temp_limit_check = temp_limit_check * width; -+ -+ if ( !temp_limit_check || hdr_size > ( UINT_MAX - temp_limit_check ) ) { -+ fprintf(stderr, "Too large header size specified.\n"); -+ return (EXIT_FAILURE); -+ } -+ - if (outfilename == NULL) - outfilename = argv[optind + 1]; - out = TIFFOpen(outfilename, "w"); --- -GitLab - diff --git a/libtiff.spec b/libtiff.spec index 3237055..71b50a2 100644 --- a/libtiff.spec +++ b/libtiff.spec @@ -1,17 +1,15 @@ Name: libtiff -Version: 4.5.1 -Release: 4 +Version: 4.6.0 +Release: 1 Summary: TIFF Library and Utilities License: libtiff -URL: https://www.simplesystems.org/libtiff/ +URL: https://libtiff.gitlab.io/libtiff/ Source0: https://download.osgeo.org/libtiff/tiff-%{version}.tar.gz -Patch6000: backport-CVE-2023-38288.patch -Patch6001: backport-CVE-2023-38289.patch -Patch6002: backport-CVE-2023-6228.patch -Patch6003: backport-0001-CVE-2023-6277.patch -Patch6004: backport-0002-CVE-2023-6277.patch -Patch6005: backport-0003-CVE-2023-6277.patch +Patch6000: backport-CVE-2023-6228.patch +Patch6001: backport-0001-CVE-2023-6277.patch +Patch6002: backport-0002-CVE-2023-6277.patch +Patch6003: backport-0003-CVE-2023-6277.patch BuildRequires: gcc gcc-c++ zlib-devel libjpeg-devel jbigkit-devel BuildRequires: libtool automake autoconf pkgconfig @@ -131,6 +129,9 @@ find doc -name 'Makefile*' | xargs rm %exclude %{_mandir}/man1/* %changelog +* Wed Dec 27 2023 lvgenggeng - 4.6.0-1 +- bump to 4.6.0 + * Wed Nov 29 2023 liningjie - 4.5.1-4 - backport patch for fix CVE-2023-6277 issue diff --git a/tiff-4.5.1.tar.gz b/tiff-4.5.1.tar.gz deleted file mode 100644 index 235b81a..0000000 Binary files a/tiff-4.5.1.tar.gz and /dev/null differ diff --git a/tiff-4.6.0.tar.gz b/tiff-4.6.0.tar.gz new file mode 100644 index 0000000..97d12cf Binary files /dev/null and b/tiff-4.6.0.tar.gz differ