CVS commit: pkgsrc/graphics/tiff

["Havard Eidnes" <he%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   he
Date:           Sat May  6 21:37:16 UTC 2017

Modified Files:
        pkgsrc/graphics/tiff: Makefile distinfo
        pkgsrc/graphics/tiff/patches: patch-tools_tiffcp.c

Log Message:
Fix CVE-2016-10268, ref.
http://bugzilla.maptools.org/show_bug.cgi?id=2598
https://github.com/vadz/libtiff/commit/5397a417e61258c69209904e652a1f409ec3b9df
Bump PKGREVISION.


To generate a diff of this commit:
cvs rdiff -u -r1.132 -r1.133 pkgsrc/graphics/tiff/Makefile
cvs rdiff -u -r1.78 -r1.79 pkgsrc/graphics/tiff/distinfo
cvs rdiff -u -r1.2 -r1.3 pkgsrc/graphics/tiff/patches/patch-tools_tiffcp.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/tiff/Makefile
diff -u pkgsrc/graphics/tiff/Makefile:1.132 pkgsrc/graphics/tiff/Makefile:1.133
--- pkgsrc/graphics/tiff/Makefile:1.132 Sat May  6 21:29:16 2017
+++ pkgsrc/graphics/tiff/Makefile       Sat May  6 21:37:16 2017
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.132 2017/05/06 21:29:16 he Exp $
+# $NetBSD: Makefile,v 1.133 2017/05/06 21:37:16 he Exp $
 
 DISTNAME=      tiff-4.0.7
-PKGREVISION=   8
+PKGREVISION=   9
 CATEGORIES=    graphics
 MASTER_SITES=  ftp://download.osgeo.org/libtiff/
 

Index: pkgsrc/graphics/tiff/distinfo
diff -u pkgsrc/graphics/tiff/distinfo:1.78 pkgsrc/graphics/tiff/distinfo:1.79
--- pkgsrc/graphics/tiff/distinfo:1.78  Sat May  6 21:29:16 2017
+++ pkgsrc/graphics/tiff/distinfo       Sat May  6 21:37:16 2017
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.78 2017/05/06 21:29:16 he Exp $
+$NetBSD: distinfo,v 1.79 2017/05/06 21:37:16 he Exp $
 
 SHA1 (tiff-4.0.7.tar.gz) = 2c1b64478e88f93522a42dd5271214a0e5eae648
 RMD160 (tiff-4.0.7.tar.gz) = 582e19c31e7f29d9ed36995dcad7ad68802cbadb
@@ -21,5 +21,5 @@ SHA1 (patch-libtiff_tif_win32.c) = 1ea9d
 SHA1 (patch-libtiff_tiffio.h) = e0efa9e1246e07dbb3a69d626988a18f12ba9d3c
 SHA1 (patch-man_Makefile.in) = ff073529c9d3ab98a03efa7d98c3263c1782482f
 SHA1 (patch-tools_tiff2pdf.c) = ce7a3e77c27ad3cabaa33b5da61cbd1b27f187d1
-SHA1 (patch-tools_tiffcp.c) = 42573d15fc66655a09e9227213b0929238f7e651
+SHA1 (patch-tools_tiffcp.c) = bd6abd9dc6e044ff04d761d999fabfb0919ba0db
 SHA1 (patch-tools_tiffcrop.c) = 1d729028fb8c05de958424234d5cc2808acc9b25

Index: pkgsrc/graphics/tiff/patches/patch-tools_tiffcp.c
diff -u pkgsrc/graphics/tiff/patches/patch-tools_tiffcp.c:1.2 pkgsrc/graphics/tiff/patches/patch-tools_tiffcp.c:1.3
--- pkgsrc/graphics/tiff/patches/patch-tools_tiffcp.c:1.2       Fri May  5 20:06:03 2017
+++ pkgsrc/graphics/tiff/patches/patch-tools_tiffcp.c   Sat May  6 21:37:16 2017
@@ -1,4 +1,4 @@
-$NetBSD: patch-tools_tiffcp.c,v 1.2 2017/05/05 20:06:03 he Exp $
+$NetBSD: patch-tools_tiffcp.c,v 1.3 2017/05/06 21:37:16 he Exp $
 
 CVE-2017-5225
 http://bugzilla.maptools.org/show_bug.cgi?id=2656
@@ -11,6 +11,12 @@ CVE-2016-10093
 http://bugzilla.maptools.org/show_bug.cgi?id=2610
 https://github.com/vadz/libtiff/commit/787c0ee906430b772f33ca50b97b8b5ca070faec
 
+and
+
+CVE-2016-10268
+http://bugzilla.maptools.org/show_bug.cgi?id=2598
+https://github.com/vadz/libtiff/commit/5397a417e61258c69209904e652a1f409ec3b9df
+
 --- tools/tiffcp.c.orig        2016-10-12 01:45:17.000000000 +0000
 +++ tools/tiffcp.c
 @@ -592,7 +592,7 @@ static     copyFunc pickCopyFunc(TIFF*, TIFF
@@ -22,6 +28,15 @@ https://github.com/vadz/libtiff/commit/7
        uint16 input_compression, input_photometric = PHOTOMETRIC_MINISBLACK;
        copyFunc cf;
        uint32 width, length;
+@@ -985,7 +985,7 @@ DECLAREcpFunc(cpDecodedStrips)
+               tstrip_t s, ns = TIFFNumberOfStrips(in);
+               uint32 row = 0;
+               _TIFFmemset(buf, 0, stripsize);
+-              for (s = 0; s < ns; s++) {
++              for (s = 0; s < ns && row < imagelength; s++) {
+                       tsize_t cc = (row + rowsperstrip > imagelength) ?
+                           TIFFVStripSize(in, imagelength - row) : stripsize;
+                       if (TIFFReadEncodedStrip(in, s, buf, cc) < 0
 @@ -1068,6 +1068,16 @@ DECLAREcpFunc(cpContig2SeparateByRow)
        register uint32 n;
        uint32 row;