From d56d2ec81ea8a6bc0a1623a0e997f6a22fef509e Mon Sep 17 00:00:00 2001 From: Alexey Pavlov Date: Fri, 16 Nov 2018 14:18:47 +0300 Subject: [PATCH] libtiff: Update to 4.0.10 --- mingw-w64-libtiff/CVE-2017-18013.patch | 22 ----- mingw-w64-libtiff/CVE-2018-10963.patch | 18 ----- mingw-w64-libtiff/CVE-2018-5784.patch | 105 ------------------------ mingw-w64-libtiff/CVE-2018-7456.patch | 107 ------------------------- mingw-w64-libtiff/CVE-2018-8905.patch | 37 --------- mingw-w64-libtiff/PKGBUILD | 33 +++----- 6 files changed, 10 insertions(+), 312 deletions(-) delete mode 100644 mingw-w64-libtiff/CVE-2017-18013.patch delete mode 100644 mingw-w64-libtiff/CVE-2018-10963.patch delete mode 100644 mingw-w64-libtiff/CVE-2018-5784.patch delete mode 100644 mingw-w64-libtiff/CVE-2018-7456.patch delete mode 100644 mingw-w64-libtiff/CVE-2018-8905.patch diff --git a/mingw-w64-libtiff/CVE-2017-18013.patch b/mingw-w64-libtiff/CVE-2017-18013.patch deleted file mode 100644 index 77d3ab08a5..0000000000 --- a/mingw-w64-libtiff/CVE-2017-18013.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff --git a/libtiff/tif_print.c b/libtiff/tif_print.c -index 9959d353b1f978f049f0bffb7db97ca114582a68..8deceb2b054d77d2e46596edc616a44bed67a172 100644 ---- a/libtiff/tif_print.c -+++ b/libtiff/tif_print.c -@@ -665,13 +665,13 @@ TIFFPrintDirectory(TIFF* tif, FILE* fd, long flags) - #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) - fprintf(fd, " %3lu: [%8I64u, %8I64u]\n", - (unsigned long) s, -- (unsigned __int64) td->td_stripoffset[s], -- (unsigned __int64) td->td_stripbytecount[s]); -+ td->td_stripoffset ? (unsigned __int64) td->td_stripoffset[s] : 0, -+ td->td_stripbytecount ? (unsigned __int64) td->td_stripbytecount[s] : 0); - #else - fprintf(fd, " %3lu: [%8llu, %8llu]\n", - (unsigned long) s, -- (unsigned long long) td->td_stripoffset[s], -- (unsigned long long) td->td_stripbytecount[s]); -+ td->td_stripoffset ? (unsigned long long) td->td_stripoffset[s] : 0, -+ td->td_stripbytecount ? (unsigned long long) td->td_stripbytecount[s] : 0); - #endif - } - } diff --git a/mingw-w64-libtiff/CVE-2018-10963.patch b/mingw-w64-libtiff/CVE-2018-10963.patch deleted file mode 100644 index 63bc107502..0000000000 --- a/mingw-w64-libtiff/CVE-2018-10963.patch +++ /dev/null @@ -1,18 +0,0 @@ -diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c -index 2430de6d0c0dacf2cb3d228573972cc3ea3a153d..c15a28dbd8fcb99b81fa5a1d44fcbcda881f42a7 100644 ---- a/libtiff/tif_dirwrite.c -+++ b/libtiff/tif_dirwrite.c -@@ -695,8 +695,11 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff) - } - break; - default: -- assert(0); /* we should never get here */ -- break; -+ TIFFErrorExt(tif->tif_clientdata,module, -+ "Cannot write tag %d (%s)", -+ TIFFFieldTag(o), -+ o->field_name ? o->field_name : "unknown"); -+ goto bad; - } - } - } diff --git a/mingw-w64-libtiff/CVE-2018-5784.patch b/mingw-w64-libtiff/CVE-2018-5784.patch deleted file mode 100644 index 950a62b91d..0000000000 --- a/mingw-w64-libtiff/CVE-2018-5784.patch +++ /dev/null @@ -1,105 +0,0 @@ -diff --git a/contrib/addtiffo/tif_overview.c b/contrib/addtiffo/tif_overview.c -index c61ffbb8ceb90ccad3ca064af91839b525975b99..03b357334aa99b4b0b2bacb1c0e7c8cc7226bee5 100644 ---- a/contrib/addtiffo/tif_overview.c -+++ b/contrib/addtiffo/tif_overview.c -@@ -65,6 +65,8 @@ - # define MAX(a,b) ((a>b) ? a : b) - #endif - -+#define TIFF_DIR_MAX 65534 -+ - void TIFFBuildOverviews( TIFF *, int, int *, int, const char *, - int (*)(double,void*), void * ); - -@@ -91,6 +93,7 @@ uint32 TIFF_WriteOverview( TIFF *hTIFF, uint32 nXSize, uint32 nYSize, - { - toff_t nBaseDirOffset; - toff_t nOffset; -+ tdir_t iNumDir; - - (void) bUseSubIFDs; - -@@ -147,7 +150,16 @@ uint32 TIFF_WriteOverview( TIFF *hTIFF, uint32 nXSize, uint32 nYSize, - return 0; - - TIFFWriteDirectory( hTIFF ); -- TIFFSetDirectory( hTIFF, (tdir_t) (TIFFNumberOfDirectories(hTIFF)-1) ); -+ iNumDir = TIFFNumberOfDirectories(hTIFF); -+ if( iNumDir > TIFF_DIR_MAX ) -+ { -+ TIFFErrorExt( TIFFClientdata(hTIFF), -+ "TIFF_WriteOverview", -+ "File `%s' has too many directories.\n", -+ TIFFFileName(hTIFF) ); -+ exit(-1); -+ } -+ TIFFSetDirectory( hTIFF, (tdir_t) (iNumDir - 1) ); - - nOffset = TIFFCurrentDirOffset( hTIFF ); - -diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c -index 984ef654b6c94a12b9ba91a0da20bc8d34a8b288..832a2475954dccb099c03f7ced2f4297e06b96f0 100644 ---- a/tools/tiff2pdf.c -+++ b/tools/tiff2pdf.c -@@ -68,6 +68,8 @@ extern int getopt(int, char**, char*); - - #define PS_UNIT_SIZE 72.0F - -+#define TIFF_DIR_MAX 65534 -+ - /* This type is of PDF color spaces. */ - typedef enum { - T2P_CS_BILEVEL = 0x01, /* Bilevel, black and white */ -@@ -1051,6 +1053,14 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){ - uint16* tiff_transferfunction[3]; - - directorycount=TIFFNumberOfDirectories(input); -+ if(directorycount > TIFF_DIR_MAX) { -+ TIFFError( -+ TIFF2PDF_MODULE, -+ "TIFF contains too many directories, %s", -+ TIFFFileName(input)); -+ t2p->t2p_error = T2P_ERR_ERROR; -+ return; -+ } - t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE))); - if(t2p->tiff_pages==NULL){ - TIFFError( -diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c -index 91a38f67dbbf5238e967e7deb79126c33efb752e..e466dae6582fbcf4af281734034db829ba3b8353 100644 ---- a/tools/tiffcrop.c -+++ b/tools/tiffcrop.c -@@ -215,6 +215,8 @@ extern int getopt(int argc, char * const argv[], const char *optstring); - #define DUMP_TEXT 1 - #define DUMP_RAW 2 - -+#define TIFF_DIR_MAX 65534 -+ - /* Offsets into buffer for margins and fixed width and length segments */ - struct offset { - uint32 tmargin; -@@ -2232,7 +2234,7 @@ main(int argc, char* argv[]) - pageNum = -1; - else - total_images = 0; -- /* read multiple input files and write to output file(s) */ -+ /* Read multiple input files and write to output file(s) */ - while (optind < argc - 1) - { - in = TIFFOpen (argv[optind], "r"); -@@ -2240,7 +2242,14 @@ main(int argc, char* argv[]) - return (-3); - - /* If only one input file is specified, we can use directory count */ -- total_images = TIFFNumberOfDirectories(in); -+ total_images = TIFFNumberOfDirectories(in); -+ if (total_images > TIFF_DIR_MAX) -+ { -+ TIFFError (TIFFFileName(in), "File contains too many directories"); -+ if (out != NULL) -+ (void) TIFFClose(out); -+ return (1); -+ } - if (image_count == 0) - { - dirnum = 0; diff --git a/mingw-w64-libtiff/CVE-2018-7456.patch b/mingw-w64-libtiff/CVE-2018-7456.patch deleted file mode 100644 index 428dee9466..0000000000 --- a/mingw-w64-libtiff/CVE-2018-7456.patch +++ /dev/null @@ -1,107 +0,0 @@ -diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c -index 6baa7b31da609fcf6521d3dbb2113025670be208..af5b84a7268fd2b3d7ba8e808d717030a5a8a0b9 100644 ---- a/libtiff/tif_dirread.c -+++ b/libtiff/tif_dirread.c -@@ -165,6 +165,7 @@ static int TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uin - static int TIFFFetchSubjectDistance(TIFF*, TIFFDirEntry*); - static void ChopUpSingleUncompressedStrip(TIFF*); - static uint64 TIFFReadUInt64(const uint8 *value); -+static int _TIFFGetMaxColorChannels(uint16 photometric); - - static int _TIFFFillStrilesInternal( TIFF *tif, int loadStripByteCount ); - -@@ -3504,6 +3505,35 @@ static void TIFFReadDirEntryOutputErr(TIFF* tif, enum TIFFReadDirEntryErr err, c - } - } - -+/* -+ * Return the maximum number of color channels specified for a given photometric -+ * type. 0 is returned if photometric type isn't supported or no default value -+ * is defined by the specification. -+ */ -+static int _TIFFGetMaxColorChannels( uint16 photometric ) -+{ -+ switch (photometric) { -+ case PHOTOMETRIC_PALETTE: -+ case PHOTOMETRIC_MINISWHITE: -+ case PHOTOMETRIC_MINISBLACK: -+ return 1; -+ case PHOTOMETRIC_YCBCR: -+ case PHOTOMETRIC_RGB: -+ case PHOTOMETRIC_CIELAB: -+ return 3; -+ case PHOTOMETRIC_SEPARATED: -+ case PHOTOMETRIC_MASK: -+ return 4; -+ case PHOTOMETRIC_LOGL: -+ case PHOTOMETRIC_LOGLUV: -+ case PHOTOMETRIC_CFA: -+ case PHOTOMETRIC_ITULAB: -+ case PHOTOMETRIC_ICCLAB: -+ default: -+ return 0; -+ } -+} -+ - /* - * Read the next TIFF directory from a file and convert it to the internal - * format. We read directories sequentially. -@@ -3520,6 +3550,7 @@ TIFFReadDirectory(TIFF* tif) - uint32 fii=FAILED_FII; - toff_t nextdiroff; - int bitspersample_read = FALSE; -+ int color_channels; - - tif->tif_diroff=tif->tif_nextdiroff; - if (!TIFFCheckDirOffset(tif,tif->tif_nextdiroff)) -@@ -4024,6 +4055,37 @@ TIFFReadDirectory(TIFF* tif) - } - } - } -+ -+ /* -+ * Make sure all non-color channels are extrasamples. -+ * If it's not the case, define them as such. -+ */ -+ color_channels = _TIFFGetMaxColorChannels(tif->tif_dir.td_photometric); -+ if (color_channels && tif->tif_dir.td_samplesperpixel - tif->tif_dir.td_extrasamples > color_channels) { -+ uint16 old_extrasamples; -+ uint16 *new_sampleinfo; -+ -+ TIFFWarningExt(tif->tif_clientdata,module, "Sum of Photometric type-related " -+ "color channels and ExtraSamples doesn't match SamplesPerPixel. " -+ "Defining non-color channels as ExtraSamples."); -+ -+ old_extrasamples = tif->tif_dir.td_extrasamples; -+ tif->tif_dir.td_extrasamples = (tif->tif_dir.td_samplesperpixel - color_channels); -+ -+ // sampleinfo should contain information relative to these new extra samples -+ new_sampleinfo = (uint16*) _TIFFcalloc(tif->tif_dir.td_extrasamples, sizeof(uint16)); -+ if (!new_sampleinfo) { -+ TIFFErrorExt(tif->tif_clientdata, module, "Failed to allocate memory for " -+ "temporary new sampleinfo array (%d 16 bit elements)", -+ tif->tif_dir.td_extrasamples); -+ goto bad; -+ } -+ -+ memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, old_extrasamples * sizeof(uint16)); -+ _TIFFsetShortArray(&tif->tif_dir.td_sampleinfo, new_sampleinfo, tif->tif_dir.td_extrasamples); -+ _TIFFfree(new_sampleinfo); -+ } -+ - /* - * Verify Palette image has a Colormap. - */ -diff --git a/libtiff/tif_print.c b/libtiff/tif_print.c -index 8deceb2b054d77d2e46596edc616a44bed67a172..1d86adbf0519b6395d888f4761f8665149fcead9 100644 ---- a/libtiff/tif_print.c -+++ b/libtiff/tif_print.c -@@ -544,7 +544,7 @@ TIFFPrintDirectory(TIFF* tif, FILE* fd, long flags) - uint16 i; - fprintf(fd, " %2ld: %5u", - l, td->td_transferfunction[0][l]); -- for (i = 1; i < td->td_samplesperpixel; i++) -+ for (i = 1; i < td->td_samplesperpixel - td->td_extrasamples && i < 3; i++) - fprintf(fd, " %5u", - td->td_transferfunction[i][l]); - fputc('\n', fd); diff --git a/mingw-w64-libtiff/CVE-2018-8905.patch b/mingw-w64-libtiff/CVE-2018-8905.patch deleted file mode 100644 index dcd8d616bc..0000000000 --- a/mingw-w64-libtiff/CVE-2018-8905.patch +++ /dev/null @@ -1,37 +0,0 @@ -diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c -index 4ccb443c85200ae84886c4eaca6c864029e50aa7..94d85e38b71b418edfc1946a5cc4c326b257a1f9 100644 ---- a/libtiff/tif_lzw.c -+++ b/libtiff/tif_lzw.c -@@ -602,6 +602,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s) - char *tp; - unsigned char *bp; - int code, nbits; -+ int len; - long nextbits, nextdata, nbitsmask; - code_t *codep, *free_entp, *maxcodep, *oldcodep; - -@@ -753,13 +754,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s) - } while (--occ); - break; - } -- assert(occ >= codep->length); -- op += codep->length; -- occ -= codep->length; -- tp = op; -+ len = codep->length; -+ tp = op + len; - do { -- *--tp = codep->value; -- } while( (codep = codep->next) != NULL ); -+ int t; -+ --tp; -+ t = codep->value; -+ codep = codep->next; -+ *tp = (char)t; -+ } while (codep && tp > op); -+ assert(occ >= len); -+ op += len; -+ occ -= len; - } else { - *op++ = (char)code; - occ--; diff --git a/mingw-w64-libtiff/PKGBUILD b/mingw-w64-libtiff/PKGBUILD index 7038454048..07d057bfed 100644 --- a/mingw-w64-libtiff/PKGBUILD +++ b/mingw-w64-libtiff/PKGBUILD @@ -4,40 +4,26 @@ _realname=libtiff pkgbase=mingw-w64-${_realname} pkgname="${MINGW_PACKAGE_PREFIX}-${_realname}" -pkgver=4.0.9 -pkgrel=2 +pkgver=4.0.10 +pkgrel=1 pkgdesc="Library for manipulation of TIFF images (mingw-w64)" arch=('any') url="http://www.simplesystems.org/libtiff/" license=(MIT) depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs" -# "${MINGW_PACKAGE_PREFIX}-jbigkit" + #"${MINGW_PACKAGE_PREFIX}-jbigkit" "${MINGW_PACKAGE_PREFIX}-libjpeg-turbo" + #"${MINGW_PACKAGE_PREFIX}-webp" "${MINGW_PACKAGE_PREFIX}-xz" - "${MINGW_PACKAGE_PREFIX}-zlib") + "${MINGW_PACKAGE_PREFIX}-zlib" + "${MINGW_PACKAGE_PREFIX}-zstd") makedepends=("${MINGW_PACKAGE_PREFIX}-gcc") options=('staticlibs' 'strip') -source=(http://download.osgeo.org/libtiff/tiff-${pkgver}.tar.gz - CVE-2017-18013.patch - CVE-2018-5784.patch - CVE-2018-7456.patch - CVE-2018-8905.patch - CVE-2018-10963.patch) -sha256sums=('6e7bdeec2c310734e734d19aae3a71ebe37a4d842e0e23dbb1b8921c0026cfcd' - 'ea49366f085d324073bdbcc183db9b190e7ff4178649daf158e91ea1cfb12fef' - 'b93ff957acc1236481e9c5f33844334c62f3636d575f5f2cc418491349ebe7a5' - '2e00f46633e205fb6ed04957f07c5b13e3cc527876076c3cbda80f3894220909' - '8aed7c35dd2fb79af16a704a95cddff2852f85dbb019e9e9cdb54638b529935b' - 'f3c46de22050adad6da91498c549562af833d48e84028f36da5ec0387534e8af') +source=(http://download.osgeo.org/libtiff/tiff-${pkgver}.tar.gz) +sha256sums=('2c52d11ccaf767457db0c46795d9c7d1a8d8f76f68b0b800a3dfe45786b996e4') prepare() { - cd tiff-$pkgver -# Security fixes - patch -p1 -i ../CVE-2017-18013.patch - patch -p1 -i ../CVE-2018-5784.patch - patch -p1 -i ../CVE-2018-7456.patch - patch -p1 -i ../CVE-2018-8905.patch - patch -p1 -i ../CVE-2018-10963.patch + cd tiff-${pkgver} } build() { @@ -56,6 +42,7 @@ build() { --enable-shared \ --enable-cxx \ --disable-jbig \ + --disable-webp \ --without-x make