CVS commit: pkgsrc/graphics/tiff

["Havard Eidnes" <he%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   he
Date:           Fri May  5 20:06:03 UTC 2017

Modified Files:
        pkgsrc/graphics/tiff: Makefile distinfo
        pkgsrc/graphics/tiff/patches: patch-tools_tiffcp.c

Log Message:
Apply fix for CVE-2016-10093
http://bugzilla.maptools.org/show_bug.cgi?id=2610
https://github.com/vadz/libtiff/commit/787c0ee906430b772f33ca50b97b8b5ca070faec
Bump PKGREVISION.


To generate a diff of this commit:
cvs rdiff -u -r1.127 -r1.128 pkgsrc/graphics/tiff/Makefile
cvs rdiff -u -r1.73 -r1.74 pkgsrc/graphics/tiff/distinfo
cvs rdiff -u -r1.1 -r1.2 pkgsrc/graphics/tiff/patches/patch-tools_tiffcp.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/tiff/Makefile
diff -u pkgsrc/graphics/tiff/Makefile:1.127 pkgsrc/graphics/tiff/Makefile:1.128
--- pkgsrc/graphics/tiff/Makefile:1.127 Fri May  5 19:16:57 2017
+++ pkgsrc/graphics/tiff/Makefile       Fri May  5 20:06:02 2017
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.127 2017/05/05 19:16:57 he Exp $
+# $NetBSD: Makefile,v 1.128 2017/05/05 20:06:02 he Exp $
 
 DISTNAME=      tiff-4.0.7
-PKGREVISION=   3
+PKGREVISION=   4
 CATEGORIES=    graphics
 MASTER_SITES=  ftp://download.osgeo.org/libtiff/
 

Index: pkgsrc/graphics/tiff/distinfo
diff -u pkgsrc/graphics/tiff/distinfo:1.73 pkgsrc/graphics/tiff/distinfo:1.74
--- pkgsrc/graphics/tiff/distinfo:1.73  Fri May  5 19:28:23 2017
+++ pkgsrc/graphics/tiff/distinfo       Fri May  5 20:06:02 2017
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.73 2017/05/05 19:28:23 he Exp $
+$NetBSD: distinfo,v 1.74 2017/05/05 20:06:02 he Exp $
 
 SHA1 (tiff-4.0.7.tar.gz) = 2c1b64478e88f93522a42dd5271214a0e5eae648
 RMD160 (tiff-4.0.7.tar.gz) = 582e19c31e7f29d9ed36995dcad7ad68802cbadb
@@ -15,5 +15,5 @@ SHA1 (patch-libtiff_tif_unix.c) = c83127
 SHA1 (patch-libtiff_tif_win32.c) = 1ea9dcb6618c40b9de3e8d2a81914355f2111fdc
 SHA1 (patch-libtiff_tiffio.h) = e0efa9e1246e07dbb3a69d626988a18f12ba9d3c
 SHA1 (patch-man_Makefile.in) = ff073529c9d3ab98a03efa7d98c3263c1782482f
-SHA1 (patch-tools_tiffcp.c) = fa4846cfb5a52eedfb6dc4ed1306f45e3988ddc3
+SHA1 (patch-tools_tiffcp.c) = 42573d15fc66655a09e9227213b0929238f7e651
 SHA1 (patch-tools_tiffcrop.c) = 68ccbde2dc447dfbfb3e15a5c9cfaf2538f27e60

Index: pkgsrc/graphics/tiff/patches/patch-tools_tiffcp.c
diff -u pkgsrc/graphics/tiff/patches/patch-tools_tiffcp.c:1.1 pkgsrc/graphics/tiff/patches/patch-tools_tiffcp.c:1.2
--- pkgsrc/graphics/tiff/patches/patch-tools_tiffcp.c:1.1       Wed May  3 23:00:59 2017
+++ pkgsrc/graphics/tiff/patches/patch-tools_tiffcp.c   Fri May  5 20:06:03 2017
@@ -1,10 +1,16 @@
-$NetBSD: patch-tools_tiffcp.c,v 1.1 2017/05/03 23:00:59 sevan Exp $
+$NetBSD: patch-tools_tiffcp.c,v 1.2 2017/05/05 20:06:03 he Exp $
 
 CVE-2017-5225
 http://bugzilla.maptools.org/show_bug.cgi?id=2656
 http://bugzilla.maptools.org/show_bug.cgi?id=2657
 https://github.com/vadz/libtiff/commit/5c080298d59efa53264d7248bbe3a04660db6ef7
 
+and
+
+CVE-2016-10093
+http://bugzilla.maptools.org/show_bug.cgi?id=2610
+https://github.com/vadz/libtiff/commit/787c0ee906430b772f33ca50b97b8b5ca070faec
+
 --- tools/tiffcp.c.orig        2016-10-12 01:45:17.000000000 +0000
 +++ tools/tiffcp.c
 @@ -592,7 +592,7 @@ static     copyFunc pickCopyFunc(TIFF*, TIFF
@@ -50,6 +56,33 @@ https://github.com/vadz/libtiff/commit/5
  
        inbuf = _TIFFmalloc(scanlinesizein);
        outbuf = _TIFFmalloc(scanlinesizeout);
+@@ -1163,7 +1183,7 @@ bad:
+ 
+ static void
+ cpStripToTile(uint8* out, uint8* in,
+-    uint32 rows, uint32 cols, int outskew, int inskew)
++    uint32 rows, uint32 cols, int outskew, int64 inskew)
+ {
+       while (rows-- > 0) {
+               uint32 j = cols;
+@@ -1320,7 +1340,7 @@ DECLAREreadFunc(readContigTilesIntoBuffe
+       tdata_t tilebuf;
+       uint32 imagew = TIFFScanlineSize(in);
+       uint32 tilew  = TIFFTileRowSize(in);
+-      int iskew = imagew - tilew;
++      int64 iskew = (int64)imagew - (int64)tilew;
+       uint8* bufp = (uint8*) buf;
+       uint32 tw, tl;
+       uint32 row;
+@@ -1348,7 +1368,7 @@ DECLAREreadFunc(readContigTilesIntoBuffe
+                               status = 0;
+                               goto done;
+                       }
+-                      if (colb + tilew > imagew) {
++                      if (colb > iskew) {
+                               uint32 width = imagew - colb;
+                               uint32 oskew = tilew - width;
+                               cpStripToTile(bufp + colb,
 @@ -1763,7 +1783,7 @@ pickCopyFunc(TIFF* in, TIFF* out, uint16
        uint32 w, l, tw, tl;
        int bychunk;