[Midnightbsd-cvs] mports [21960] trunk/graphics/tiff: security patches.

[laffer1 at midnightbsd.org]

Revision: 21960
          http://svnweb.midnightbsd.org/mports/?rev=21960
Author:   laffer1
Date:     2016-09-29 17:10:30 -0400 (Thu, 29 Sep 2016)
Log Message:
-----------
security patches.

Modified Paths:
--------------
    trunk/graphics/tiff/Makefile

Added Paths:
-----------
    trunk/graphics/tiff/files/patch-libtiff_tif__pixarlog.c
    trunk/graphics/tiff/files/patch-tools_gif2tiff.c

Modified: trunk/graphics/tiff/Makefile
===================================================================
--- trunk/graphics/tiff/Makefile	2016-09-29 21:08:20 UTC (rev 21959)
+++ trunk/graphics/tiff/Makefile	2016-09-29 21:10:30 UTC (rev 21960)
@@ -2,7 +2,7 @@
 
 PORTNAME=	tiff
 DISTVERSION=	4.0.6
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	graphics
 MASTER_SITES=	ftp://ftp.remotesensing.org/pub/libtiff/ \
 		http://download.osgeo.org/libtiff/
@@ -13,10 +13,9 @@
 LICENSE=	bsd3
 LICENSE_FILE=	${WRKSRC}/COPYRIGHT
 
-LIB_DEPENDS=	libjpeg.so:${PORTSDIR}/graphics/jpeg \
-		libjbig.so:${PORTSDIR}/graphics/jbigkit
+LIB_DEPENDS=	libjbig.so:${PORTSDIR}/graphics/jbigkit
 
-USES=		cpe libtool
+USES=		cpe libtool jpeg
 CPE_PRODUCT=	libtiff
 CPE_VERSION=	${DISTVERSION:C/[a-z]+//}
 CPE_UPDATE=	${DISTVERSION:C/[0-9.]+//}

Added: trunk/graphics/tiff/files/patch-libtiff_tif__pixarlog.c
===================================================================
--- trunk/graphics/tiff/files/patch-libtiff_tif__pixarlog.c	                        (rev 0)
+++ trunk/graphics/tiff/files/patch-libtiff_tif__pixarlog.c	2016-09-29 21:10:30 UTC (rev 21960)
@@ -0,0 +1,34 @@
+CVE-2016-5875(, dup?)
+https://marc.info/?l=oss-security&m=146720235906569&w=2
+
+--- libtiff/tif_pixarlog.c.orig	Sat Aug 29 00:16:22 2015
++++ libtiff/tif_pixarlog.c	Fri Jul  1 13:04:52 2016
+@@ -457,6 +457,7 @@ horizontalAccumulate8abgr(uint16 *wp, int n, int strid
+ typedef	struct {
+ 	TIFFPredictorState	predict;
+ 	z_stream		stream;
++	tmsize_t		tbuf_size; /* only set/used on reading for now */
+ 	uint16			*tbuf; 
+ 	uint16			stride;
+ 	int			state;
+@@ -692,6 +693,7 @@ PixarLogSetupDecode(TIFF* tif)
+ 	sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size);
+ 	if (sp->tbuf == NULL)
+ 		return (0);
++	sp->tbuf_size = tbuf_size;
+ 	if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN)
+ 		sp->user_datafmt = PixarLogGuessDataFmt(td);
+ 	if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN) {
+@@ -779,6 +781,12 @@ PixarLogDecode(TIFF* tif, uint8* op, tmsize_t occ, uin
+ 	if (sp->stream.avail_out != nsamples * sizeof(uint16))
+ 	{
+ 		TIFFErrorExt(tif->tif_clientdata, module, "ZLib cannot deal with buffers this size");
++		return (0);
++	}
++	/* Check that we will not fill more than what was allocated */
++	if (sp->stream.avail_out > sp->tbuf_size)
++	{
++		TIFFErrorExt(tif->tif_clientdata, module, "sp->stream.avail_out > sp->tbuf_size");
+ 		return (0);
+ 	}
+ 	do {


Property changes on: trunk/graphics/tiff/files/patch-libtiff_tif__pixarlog.c
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/graphics/tiff/files/patch-tools_gif2tiff.c
===================================================================
--- trunk/graphics/tiff/files/patch-tools_gif2tiff.c	                        (rev 0)
+++ trunk/graphics/tiff/files/patch-tools_gif2tiff.c	2016-09-29 21:10:30 UTC (rev 21960)
@@ -0,0 +1,14 @@
+CVE-2016-3186, patch from:
+https://bugzilla.redhat.com/show_bug.cgi?id=1319666
+
+--- tools/gif2tiff.c.orig	Fri Jul  1 13:11:43 2016
++++ tools/gif2tiff.c	Fri Jul  1 13:12:07 2016
+@@ -349,7 +349,7 @@ readextension(void)
+     int status = 1;
+ 
+     (void) getc(infile);
+-    while ((count = getc(infile)) && count <= 255)
++    while ((count = getc(infile)) && count >= 0 && count <= 255)
+         if (fread(buf, 1, count, infile) != (size_t) count) {
+             fprintf(stderr, "short read from file %s (%s)\n",
+                     filename, strerror(errno));


Property changes on: trunk/graphics/tiff/files/patch-tools_gif2tiff.c
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property