libs/tiff/patches/122-CVE-2017-7592.patch

   1 From 48780b4fcc425cddc4ef8ffdf536f96a0d1b313b Mon Sep 17 00:00:00 2001
   2 From: erouault <erouault>
   3 Date: Wed, 11 Jan 2017 16:38:26 +0000
   4 Subject: [PATCH] =?UTF-8?q?*=20libtiff/tif=5Fgetimage.c:=20add=20explicit?=
   5  =?UTF-8?q?=20uint32=20cast=20in=20putagreytile=20to=20avoid=20UndefinedBe?=
   6  =?UTF-8?q?haviorSanitizer=20warning.=20Patch=20by=20Nicol=C3=A1s=20Pe?=
   7  =?UTF-8?q?=C3=B1a.=20Fixes=20http://bugzilla.maptools.org/show=5Fbug.cgi?=
   8  =?UTF-8?q?=3Fid=3D2658?=
   9 MIME-Version: 1.0
  10 Content-Type: text/plain; charset=UTF-8
  11 Content-Transfer-Encoding: 8bit
  12
  13 ---
  14  ChangeLog              | 7 +++++++
  15  libtiff/tif_getimage.c | 2 +-
  16  2 files changed, 8 insertions(+), 1 deletion(-)
  17
  18 diff --git a/ChangeLog b/ChangeLog
  19 index 3e31464..6a342e5 100644
  20 --- a/ChangeLog
  21 +++ b/ChangeLog
  22 @@ -1,5 +1,12 @@
  23  2017-01-11 Even Rouault <even.rouault at spatialys.com>
  24
  25 +       * libtiff/tif_getimage.c: add explicit uint32 cast in putagreytile to
  26 +       avoid UndefinedBehaviorSanitizer warning.
  27 +       Patch by Nicolás Peña.
  28 +       Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2658
  29 +
  30 +2017-01-11 Even Rouault <even.rouault at spatialys.com>
  31 +
  32         * libtiff/tif_read.c: avoid potential undefined behaviour on signed integer
  33         addition in TIFFReadRawStrip1() in isMapped() case.
  34         Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2650
  35 diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
  36 index fed31f1..2fa1775 100644
  37 --- a/libtiff/tif_getimage.c
  38 +++ b/libtiff/tif_getimage.c
  39 @@ -1305,7 +1305,7 @@ DECLAREContigPutFunc(putagreytile)
  40      while (h-- > 0) {
  41         for (x = w; x-- > 0;)
  42          {
  43 -            *cp++ = BWmap[*pp][0] & (*(pp+1) << 24 | ~A1);
  44 +            *cp++ = BWmap[*pp][0] & ((uint32)*(pp+1) << 24 | ~A1);
  45              pp += samplesperpixel;
  46          }
  47         cp += toskew;