libs/tiff/patches/105-CVE.patch

   1 commit 4307dad7fc153baefeb6bb677060e9c5157e5d42
   2 Author: erouault <erouault>
   3 Date:   Sat Dec 3 11:35:56 2016 +0000
   4
   5     * tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so
   6     that the output buffer is correctly incremented to avoid write outside bounds.
   7     Reported by Agostino Sarubbo.
   8     Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620
   9
  10 diff --git a/ChangeLog b/ChangeLog
  11 index 5b23665..d6a416b 100644
  12 --- a/ChangeLog
  13 +++ b/ChangeLog
  14 @@ -1,5 +1,12 @@
  15  2016-12-03 Even Rouault <even.rouault at spatialys.com>
  16
  17 +       * tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so
  18 +       that the output buffer is correctly incremented to avoid write outside bounds.
  19 +       Reported by Agostino Sarubbo.
  20 +       Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620
  21 +
  22 +2016-12-03 Even Rouault <even.rouault at spatialys.com>
  23 +
  24         * libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of failure in
  25         OJPEGPreDecode(). This will avoid a divide by zero, and potential other issues.
  26         Reported by Agostino Sarubbo.
  27 diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
  28 index 722b132..bdcbd63 100644
  29 --- a/tools/tiffcrop.c
  30 +++ b/tools/tiffcrop.c
  31 @@ -1,4 +1,4 @@
  32 -/* $Id: tiffcrop.c,v 1.46 2016-11-18 14:58:46 erouault Exp $ */
  33 +/* $Id: tiffcrop.c,v 1.47 2016-12-03 11:35:56 erouault Exp $ */
  34
  35  /* tiffcrop.c -- a port of tiffcp.c extended to include manipulations of
  36   * the image data through additional options listed below
  37 @@ -3698,7 +3698,7 @@ static int readContigStripsIntoBuffer (TIFF* in, uint8* buf)
  38                                    (unsigned long) strip, (unsigned long)rows);
  39                          return 0;
  40                  }
  41 -                bufp += bytes_read;
  42 +                bufp += stripsize;
  43          }
  44
  45          return 1;