!238 升级到最新版4.6.0

From: @lvgenggeng 
Reviewed-by: @paulthomas100199, @open-bot 
Signed-off-by: @paulthomas100199, @open-bot

backport-CVE-2023-38288.patch

@@ -1,31 +0,0 @@
-From 4fc16f649fa2875d5c388cf2edc295510a247ee5 Mon Sep 17 00:00:00 2001
-From: Arie Haenel <arie.haenel@jct.ac.il>
-Date: Wed, 19 Jul 2023 19:34:25 +0000
-Subject: [PATCH] tiffcp: fix memory corruption (overflow) on hostile images
- (fixes #591)
-
----
- tools/tiffcp.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/tools/tiffcp.c b/tools/tiffcp.c
-index 3b2d1ddac..80b39829a 100644
---- a/tools/tiffcp.c
-+++ b/tools/tiffcp.c
-@@ -1754,6 +1754,13 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
-                   "Width * Samples/Pixel)");
-         return 0;
-     }
-+
-+    if ( (imagew - tilew * spp) > INT_MAX ){
-+        TIFFError(TIFFFileName(in),
-+                  "Error, image raster scan line size is too large");
-+        return 0;       
-+    }   
-+
-     iskew = imagew - tilew * spp;
-     tilebuf = limitMalloc(tilesize);
-     if (tilebuf == 0)
--- 
-GitLab
-

backport-CVE-2023-38289.patch

@@ -1,59 +0,0 @@
-From 6e2dac5f904496d127c92ddc4e56eccfca25c2ee Mon Sep 17 00:00:00 2001
-From: Arie Haenel <arie.haenel@jct.ac.il>
-Date: Wed, 19 Jul 2023 19:40:01 +0000
-Subject: [PATCH] raw2tiff: fix integer overflow and bypass of the check (fixes
- #592)
-
----
- tools/raw2tiff.c | 28 ++++++++++++++++++++++++++++
- 1 file changed, 28 insertions(+)
-
-diff --git a/tools/raw2tiff.c b/tools/raw2tiff.c
-index 4ee59e5d7..0d6b0b664 100644
---- a/tools/raw2tiff.c
-+++ b/tools/raw2tiff.c
-@@ -101,6 +101,7 @@ int main(int argc, char *argv[])
-     int fd;
-     char *outfilename = NULL;
-     TIFF *out;
-+    uint32_t temp_limit_check = 0;     /* temp for integer overflow checking*/
- 
-     uint32_t row, col, band;
-     int c;
-@@ -221,6 +222,33 @@ int main(int argc, char *argv[])
-     if (guessSize(fd, dtype, hdr_size, nbands, swab, &width, &length) < 0)
-         return EXIT_FAILURE;
- 
-+    /* check for integer overflow in */
-+    /* hdr_size + (*width) * (*length) * nbands * depth */
-+
-+    if ((width == 0) || (length == 0) ){
-+        fprintf(stderr, "Too large nbands value specified.\n");
-+        return (EXIT_FAILURE);
-+    }
-+    
-+    temp_limit_check = nbands * depth;
-+
-+    if ( !temp_limit_check || length > ( UINT_MAX / temp_limit_check ) )  {
-+        fprintf(stderr, "Too large length size specified.\n");
-+        return (EXIT_FAILURE);
-+    }
-+    temp_limit_check = temp_limit_check * length;
-+
-+    if ( !temp_limit_check || width > ( UINT_MAX / temp_limit_check ) )  {
-+        fprintf(stderr, "Too large width size specified.\n");
-+        return (EXIT_FAILURE);
-+    }
-+    temp_limit_check = temp_limit_check * width;
-+
-+    if ( !temp_limit_check || hdr_size > ( UINT_MAX - temp_limit_check ) )  {
-+        fprintf(stderr, "Too large header size specified.\n");
-+        return (EXIT_FAILURE);
-+    }
-+
-     if (outfilename == NULL)
-         outfilename = argv[optind + 1];
-     out = TIFFOpen(outfilename, "w");
--- 
-GitLab
-

libtiff.spec

@@ -1,17 +1,15 @@
 Name:           libtiff
-Version:        4.5.1
+Version:        4.6.0
-Release:        4
+Release:        1
 Summary:        TIFF Library and Utilities
 License:        libtiff
-URL:            https://www.simplesystems.org/libtiff/
+URL:            https://libtiff.gitlab.io/libtiff/
 Source0:        https://download.osgeo.org/libtiff/tiff-%{version}.tar.gz
 
-Patch6000:      backport-CVE-2023-38288.patch
+Patch6000:      backport-CVE-2023-6228.patch
-Patch6001:      backport-CVE-2023-38289.patch
+Patch6001:      backport-0001-CVE-2023-6277.patch
-Patch6002:      backport-CVE-2023-6228.patch
+Patch6002:      backport-0002-CVE-2023-6277.patch
-Patch6003:      backport-0001-CVE-2023-6277.patch
+Patch6003:      backport-0003-CVE-2023-6277.patch
-Patch6004:      backport-0002-CVE-2023-6277.patch
-Patch6005:      backport-0003-CVE-2023-6277.patch
 
 BuildRequires:  gcc gcc-c++ zlib-devel libjpeg-devel jbigkit-devel
 BuildRequires:  libtool automake autoconf pkgconfig
@@ -131,6 +129,9 @@ find doc -name 'Makefile*' | xargs rm
 %exclude %{_mandir}/man1/*
 
 %changelog
+* Wed Dec 27 2023 lvgenggeng <lvgenggeng@uniontech.com> - 4.6.0-1
+- bump to 4.6.0
+
 * Wed Nov 29 2023 liningjie <liningjie@xfusion.com> - 4.5.1-4
 - backport patch for fix CVE-2023-6277 issue