graphics/tiff: update to 4.2.0

See http://www.simplesystems.org/libtiff/v4.2.0.html

bumped minor for 4 method addition.

Fixes CVE-2020-35523 and CVE-2020-35524.

commits are here if someone dares backporting them to 4.1.0 in stable..
c8d613ef49
7be2e452dd

ok sthen@ naddy@
This commit is contained in:
landry 2021-03-16 15:34:23 +00:00
parent dc87471400
commit 8fa85d6efc
12 changed files with 47 additions and 119 deletions

View File

@ -1,10 +1,10 @@
# $OpenBSD: Makefile,v 1.90 2019/11/29 16:43:01 naddy Exp $
# $OpenBSD: Makefile,v 1.91 2021/03/16 15:34:23 landry Exp $
COMMENT= tools and library routines for working with TIFF images
DISTNAME= tiff-4.1.0
SHARED_LIBS= tiff 40.4 # 10.0
SHARED_LIBS+= tiffxx 40.2 # 10.0
DISTNAME= tiff-4.2.0
SHARED_LIBS= tiff 40.5 # 11.0
SHARED_LIBS+= tiffxx 40.2 # 11.0
CATEGORIES= graphics
MASTER_SITES= https://download.osgeo.org/libtiff/
@ -23,6 +23,7 @@ PERMIT_PACKAGE= Yes
CONFIGURE_STYLE=gnu
CONFIGURE_ARGS= --disable-jbig \
--disable-libdeflate \
--disable-webp \
--with-docdir="${PREFIX}/share/doc/tiff" \
--with-jpeg-include-dir="${LOCALBASE}/include" \

View File

@ -1,2 +1,2 @@
SHA256 (tiff-4.1.0.tar.gz) = XSnzJRfa22280SVepbvJOitUuU+/g2U7TWXH1ndbhjQ=
SIZE (tiff-4.1.0.tar.gz) = 2421581
SHA256 (tiff-4.2.0.tar.gz) = 6wSE5Wjq2PojtRPpsAQd9+Mn9O4tIttaUzkp38GWM8s=
SIZE (tiff-4.2.0.tar.gz) = 2809373

View File

@ -1,4 +1,4 @@
$OpenBSD: patch-libtiff_tif_getimage_c,v 1.13 2018/12/05 20:35:25 naddy Exp $
$OpenBSD: patch-libtiff_tif_getimage_c,v 1.14 2021/03/16 15:34:23 landry Exp $
This one is slightly problematic. If an application allocates less
room for its error buffer than the recommended 1024, the error message
@ -7,7 +7,7 @@ buffer will still overflow.
Index: libtiff/tif_getimage.c
--- libtiff/tif_getimage.c.orig
+++ libtiff/tif_getimage.c
@@ -78,7 +78,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
@@ -79,7 +79,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
int colorchannels;
if (!tif->tif_decodestatus) {
@ -16,7 +16,7 @@ Index: libtiff/tif_getimage.c
return (0);
}
switch (td->td_bitspersample) {
@@ -89,12 +89,12 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
@@ -90,12 +90,12 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
case 16:
break;
default:
@ -31,7 +31,7 @@ Index: libtiff/tif_getimage.c
return (0);
}
colorchannels = td->td_samplesperpixel - td->td_extrasamples;
@@ -107,7 +107,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
@@ -108,7 +108,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
photometric = PHOTOMETRIC_RGB;
break;
default:
@ -40,7 +40,7 @@ Index: libtiff/tif_getimage.c
return (0);
}
}
@@ -118,7 +118,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
@@ -119,7 +119,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
if (td->td_planarconfig == PLANARCONFIG_CONTIG
&& td->td_samplesperpixel != 1
&& td->td_bitspersample < 8 ) {
@ -49,7 +49,7 @@ Index: libtiff/tif_getimage.c
"Sorry, can not handle contiguous data with %s=%d, "
"and %s=%d and Bits/Sample=%d",
photoTag, photometric,
@@ -142,7 +142,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
@@ -143,7 +143,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
break;
case PHOTOMETRIC_RGB:
if (colorchannels < 3) {
@ -58,7 +58,7 @@ Index: libtiff/tif_getimage.c
"Color channels", colorchannels);
return (0);
}
@@ -152,13 +152,13 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
@@ -153,13 +153,13 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
uint16 inkset;
TIFFGetFieldDefaulted(tif, TIFFTAG_INKSET, &inkset);
if (inkset != INKSET_CMYK) {
@ -74,7 +74,7 @@ Index: libtiff/tif_getimage.c
"Sorry, can not handle separated image with %s=%d",
"Samples/pixel", td->td_samplesperpixel);
return 0;
@@ -167,7 +167,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
@@ -168,7 +168,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
}
case PHOTOMETRIC_LOGL:
if (td->td_compression != COMPRESSION_SGILOG) {
@ -83,7 +83,7 @@ Index: libtiff/tif_getimage.c
"Compression", COMPRESSION_SGILOG);
return (0);
}
@@ -175,17 +175,17 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
@@ -176,17 +176,17 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
case PHOTOMETRIC_LOGLUV:
if (td->td_compression != COMPRESSION_SGILOG &&
td->td_compression != COMPRESSION_SGILOG24) {
@ -104,7 +104,7 @@ Index: libtiff/tif_getimage.c
"Sorry, can not handle image with %s=%d, %s=%d",
"Samples/pixel", td->td_samplesperpixel,
"colorchannels", colorchannels);
@@ -194,7 +194,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
@@ -195,7 +195,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
break;
case PHOTOMETRIC_CIELAB:
if ( td->td_samplesperpixel != 3 || colorchannels != 3 || td->td_bitspersample != 8 ) {
@ -113,7 +113,7 @@ Index: libtiff/tif_getimage.c
"Sorry, can not handle image with %s=%d, %s=%d and %s=%d",
"Samples/pixel", td->td_samplesperpixel,
"colorchannels", colorchannels,
@@ -203,7 +203,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
@@ -204,7 +204,7 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
}
break;
default:
@ -122,7 +122,7 @@ Index: libtiff/tif_getimage.c
photoTag, photometric);
return (0);
}
@@ -301,7 +301,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
@@ -302,7 +302,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
case 16:
break;
default:
@ -131,7 +131,7 @@ Index: libtiff/tif_getimage.c
img->bitspersample);
goto fail_return;
}
@@ -351,7 +351,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
@@ -352,7 +352,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
img->photometric = PHOTOMETRIC_RGB;
break;
default:
@ -140,7 +140,7 @@ Index: libtiff/tif_getimage.c
goto fail_return;
}
}
@@ -359,7 +359,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
@@ -360,7 +360,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
case PHOTOMETRIC_PALETTE:
if (!TIFFGetField(tif, TIFFTAG_COLORMAP,
&red_orig, &green_orig, &blue_orig)) {
@ -149,7 +149,7 @@ Index: libtiff/tif_getimage.c
goto fail_return;
}
@@ -369,7 +369,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
@@ -370,7 +370,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
img->greencmap = (uint16 *) _TIFFmalloc(sizeof(uint16)*n_color);
img->bluecmap = (uint16 *) _TIFFmalloc(sizeof(uint16)*n_color);
if( !img->redcmap || !img->greencmap || !img->bluecmap ) {
@ -158,7 +158,7 @@ Index: libtiff/tif_getimage.c
goto fail_return;
}
@@ -383,7 +383,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
@@ -384,7 +384,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
if (planarconfig == PLANARCONFIG_CONTIG
&& img->samplesperpixel != 1
&& img->bitspersample < 8 ) {
@ -167,7 +167,7 @@ Index: libtiff/tif_getimage.c
"Sorry, can not handle contiguous data with %s=%d, "
"and %s=%d and Bits/Sample=%d",
photoTag, img->photometric,
@@ -420,7 +420,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
@@ -421,7 +421,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
break;
case PHOTOMETRIC_RGB:
if (colorchannels < 3) {
@ -176,7 +176,7 @@ Index: libtiff/tif_getimage.c
"Color channels", colorchannels);
goto fail_return;
}
@@ -430,12 +430,12 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
@@ -431,12 +431,12 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
uint16 inkset;
TIFFGetFieldDefaulted(tif, TIFFTAG_INKSET, &inkset);
if (inkset != INKSET_CMYK) {
@ -191,7 +191,7 @@ Index: libtiff/tif_getimage.c
"Samples/pixel", img->samplesperpixel);
goto fail_return;
}
@@ -443,7 +443,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
@@ -444,7 +444,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
break;
case PHOTOMETRIC_LOGL:
if (compress != COMPRESSION_SGILOG) {
@ -200,7 +200,7 @@ Index: libtiff/tif_getimage.c
"Compression", COMPRESSION_SGILOG);
goto fail_return;
}
@@ -453,12 +453,12 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
@@ -454,12 +454,12 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
break;
case PHOTOMETRIC_LOGLUV:
if (compress != COMPRESSION_SGILOG && compress != COMPRESSION_SGILOG24) {
@ -215,7 +215,7 @@ Index: libtiff/tif_getimage.c
"Planarconfiguration", planarconfig);
return (0);
}
@@ -469,7 +469,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
@@ -470,7 +470,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
case PHOTOMETRIC_CIELAB:
break;
default:
@ -224,7 +224,7 @@ Index: libtiff/tif_getimage.c
photoTag, img->photometric);
goto fail_return;
}
@@ -480,12 +480,12 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
@@ -481,12 +481,12 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int
!(planarconfig == PLANARCONFIG_SEPARATE && img->samplesperpixel > 1);
if (img->isContig) {
if (!PickContigCase(img)) {

View File

@ -1,8 +1,8 @@
$OpenBSD: patch-libtiff_tif_luv_c,v 1.9 2019/11/29 16:43:01 naddy Exp $
$OpenBSD: patch-libtiff_tif_luv_c,v 1.10 2021/03/16 15:34:23 landry Exp $
Index: libtiff/tif_luv.c
--- libtiff/tif_luv.c.orig
+++ libtiff/tif_luv.c
@@ -748,7 +748,7 @@ static int itrunc(double x, int m)
@@ -754,7 +754,7 @@ static int tiff_itrunc(double x, int m)
return (int)x;
/* Silence CoverityScan warning about bad crypto function */
/* coverity[dont_call] */

View File

@ -1,75 +0,0 @@
$OpenBSD: patch-libtiff_tif_ojpeg_c,v 1.3 2019/11/29 16:43:01 naddy Exp $
OJPEG: fix broken sanity check added in 4.1.0
https://gitlab.com/libtiff/libtiff/commit/0356ea76bac908c61160d735f078437ace953bd3
Index: libtiff/tif_ojpeg.c
--- libtiff/tif_ojpeg.c.orig
+++ libtiff/tif_ojpeg.c
@@ -837,36 +837,6 @@ OJPEGDecodeRaw(TIFF* tif, uint8* buf, tmsize_t cc)
{
if (sp->subsampling_convert_state==0)
{
- const jpeg_decompress_struct* cinfo = &sp->libjpeg_jpeg_decompress_struct;
- int width = 0;
- int last_col_width = 0;
- int jpeg_bytes;
- int expected_bytes;
- int i;
- if (cinfo->MCUs_per_row == 0)
- {
- sp->error_in_raw_data_decoding = 1;
- return 0;
- }
- for (i = 0; i < cinfo->comps_in_scan; ++i)
- {
- const jpeg_component_info* info = cinfo->cur_comp_info[i];
-#if JPEG_LIB_VERSION >= 70
- width += info->MCU_width * info->DCT_h_scaled_size;
- last_col_width += info->last_col_width * info->DCT_h_scaled_size;
-#else
- width += info->MCU_width * info->DCT_scaled_size;
- last_col_width += info->last_col_width * info->DCT_scaled_size;
-#endif
- }
- jpeg_bytes = (cinfo->MCUs_per_row - 1) * width + last_col_width;
- expected_bytes = sp->subsampling_convert_clinelenout * sp->subsampling_ver * sp->subsampling_hor;
- if (jpeg_bytes != expected_bytes)
- {
- TIFFErrorExt(tif->tif_clientdata,module,"Inconsistent number of MCU in codestream");
- sp->error_in_raw_data_decoding = 1;
- return(0);
- }
if (jpeg_read_raw_data_encap(sp,&(sp->libjpeg_jpeg_decompress_struct),sp->subsampling_convert_ycbcrimage,sp->subsampling_ver*8)==0)
{
sp->error_in_raw_data_decoding = 1;
@@ -1291,6 +1261,29 @@ OJPEGWriteHeaderInfo(TIFF* tif)
}
if (jpeg_start_decompress_encap(sp,&(sp->libjpeg_jpeg_decompress_struct))==0)
return(0);
+ if(sp->libjpeg_jpeg_decompress_struct.image_width != sp->strile_width ||
+ sp->libjpeg_jpeg_decompress_struct.image_height < sp->strile_length) {
+ TIFFErrorExt(tif->tif_clientdata,module,
+ "jpeg_start_decompress() returned image_width = %d "
+ "and image_height = %d, expected %d and %d",
+ sp->libjpeg_jpeg_decompress_struct.image_width,
+ sp->libjpeg_jpeg_decompress_struct.image_height,
+ sp->strile_width,
+ sp->strile_length);
+ return 0;
+ }
+ if(sp->libjpeg_jpeg_decompress_struct.max_h_samp_factor != sp->subsampling_hor ||
+ sp->libjpeg_jpeg_decompress_struct.max_v_samp_factor != sp->subsampling_ver) {
+ TIFFErrorExt(tif->tif_clientdata,module,
+ "jpeg_start_decompress() returned max_h_samp_factor = %d "
+ "and max_v_samp_factor = %d, expected %d and %d",
+ sp->libjpeg_jpeg_decompress_struct.max_h_samp_factor,
+ sp->libjpeg_jpeg_decompress_struct.max_v_samp_factor,
+ sp->subsampling_hor,
+ sp->subsampling_ver);
+ return 0;
+ }
+
sp->writeheader_done=1;
return(1);
}

View File

@ -1,4 +1,4 @@
$OpenBSD: patch-libtiff_tif_open_c,v 1.3 2018/12/05 20:35:25 naddy Exp $
$OpenBSD: patch-libtiff_tif_open_c,v 1.4 2021/03/16 15:34:23 landry Exp $
Index: libtiff/tif_open.c
--- libtiff/tif_open.c.orig
+++ libtiff/tif_open.c
@ -10,7 +10,7 @@ Index: libtiff/tif_open.c
/* The following are configuration checks. They should be redundant, but should not
* compile to any actual code in an optimised release build anyway. If any of them
@@ -114,14 +115,15 @@ TIFFClientOpen(
@@ -115,14 +116,15 @@ TIFFClientOpen(
m = _TIFFgetMode(mode, module);
if (m == -1)
goto bad2;

View File

@ -1,11 +1,11 @@
$OpenBSD: patch-test_Makefile_in,v 1.12 2019/11/29 16:43:01 naddy Exp $
$OpenBSD: patch-test_Makefile_in,v 1.13 2021/03/16 15:34:23 landry Exp $
Avoid picking up an old libtiff in ${LOCALBASE}.
Index: test/Makefile.in
--- test/Makefile.in.orig
+++ test/Makefile.in
@@ -549,10 +549,10 @@ INSTALL_PROGRAM = @INSTALL_PROGRAM@
@@ -566,10 +566,10 @@ INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
LD = @LD@

View File

@ -1,4 +1,4 @@
$OpenBSD: patch-test_tiff2ps-EPS1_sh,v 1.1 2019/11/29 16:43:02 naddy Exp $
$OpenBSD: patch-test_tiff2ps-EPS1_sh,v 1.2 2021/03/16 15:34:23 landry Exp $
Index: test/tiff2ps-EPS1.sh
--- test/tiff2ps-EPS1.sh.orig
@ -7,5 +7,5 @@ Index: test/tiff2ps-EPS1.sh
PSFILE=o-tiff2ps-EPS1.ps
. ${srcdir:-.}/common.sh
f_test_stdout "${TIFF2PS} -e -1" "${IMG_MINISWHITE_1C_1B}" "${PSFILE}"
-diff -I '%%\(CreationDate\|Title\):*' -u "${REFS}/${PSFILE}" "${PSFILE}" || exit 1
-diff -I '%%CreationDate:.*' -I '%%Title:.*' -u "${REFS}/${PSFILE}" "${PSFILE}" || exit 1
+diff -I '%%(CreationDate|Title):*' -u "${REFS}/${PSFILE}" "${PSFILE}" || exit 1

View File

@ -1,11 +1,12 @@
$OpenBSD: patch-test_tiff2ps-PS1_sh,v 1.1 2019/11/29 16:43:02 naddy Exp $
$OpenBSD: patch-test_tiff2ps-PS1_sh,v 1.2 2021/03/16 15:34:23 landry Exp $
Index: test/tiff2ps-PS1.sh
--- test/tiff2ps-PS1.sh.orig
+++ test/tiff2ps-PS1.sh
@@ -5,4 +5,4 @@
@@ -5,5 +5,5 @@
PSFILE="o-tiff2ps-PS1.ps"
. ${srcdir:-.}/common.sh
f_test_stdout "${TIFF2PS} -a -p -1" "${IMG_MINISWHITE_1C_1B}" "${PSFILE}"
-diff -I '%%\(CreationDate\|Title\):*' -u "${REFS}/${PSFILE}" "${PSFILE}" || exit 1
-#diff -I '%%(CreationDate|Title):.*' -u "${REFS}/${PSFILE}" "${PSFILE}" || exit 1
+diff -I '%%(CreationDate|Title):*' -u "${REFS}/${PSFILE}" "${PSFILE}" || exit 1
diff -I '%%CreationDate:.*' -I '%%Title:.*' -u "${REFS}/${PSFILE}" "${PSFILE}" || exit 1

View File

@ -1,4 +1,4 @@
$OpenBSD: patch-test_tiff2ps-PS2_sh,v 1.1 2019/11/29 16:43:02 naddy Exp $
$OpenBSD: patch-test_tiff2ps-PS2_sh,v 1.2 2021/03/16 15:34:23 landry Exp $
Index: test/tiff2ps-PS2.sh
--- test/tiff2ps-PS2.sh.orig
@ -7,5 +7,5 @@ Index: test/tiff2ps-PS2.sh
PSFILE=o-tiff2ps-PS2.ps
. ${srcdir:-.}/common.sh
f_test_stdout "${TIFF2PS} -a -p -2" "${IMG_MINISWHITE_1C_1B}" "${PSFILE}"
-diff -I '%%\(CreationDate\|Title\):*' -u "${REFS}/${PSFILE}" "${PSFILE}" || exit 1
-diff -I '%%CreationDate:.*' -I '%%Title:.*' -u "${REFS}/${PSFILE}" "${PSFILE}" || exit 1
+diff -I '%%(CreationDate|Title):*' -u "${REFS}/${PSFILE}" "${PSFILE}" || exit 1

View File

@ -1,4 +1,4 @@
$OpenBSD: patch-test_tiff2ps-PS3_sh,v 1.1 2019/11/29 16:43:02 naddy Exp $
$OpenBSD: patch-test_tiff2ps-PS3_sh,v 1.2 2021/03/16 15:34:23 landry Exp $
Index: test/tiff2ps-PS3.sh
--- test/tiff2ps-PS3.sh.orig
@ -7,5 +7,5 @@ Index: test/tiff2ps-PS3.sh
PSFILE=o-tiff2ps-PS3.ps
. ${srcdir:-.}/common.sh
f_test_stdout "${TIFF2PS} -a -p -3" "${IMG_MINISWHITE_1C_1B}" "${PSFILE}"
-diff -I '%%\(CreationDate\|Title\):*' -u "${REFS}/${PSFILE}" "${PSFILE}" || exit 1
-diff -I '%%CreationDate:.*' -I '%%Title:.*' -u "${REFS}/${PSFILE}" "${PSFILE}" || exit 1
+diff -I '%%(CreationDate|Title):*' -u "${REFS}/${PSFILE}" "${PSFILE}" || exit 1

View File

@ -1,4 +1,4 @@
@comment $OpenBSD: PLIST,v 1.28 2019/11/29 16:43:02 naddy Exp $
@comment $OpenBSD: PLIST,v 1.29 2021/03/16 15:34:23 landry Exp $
@bin bin/fax2ps
@bin bin/fax2tiff
@bin bin/pal2rgb
@ -243,3 +243,4 @@ share/doc/tiff/v4.0.7.html
share/doc/tiff/v4.0.8.html
share/doc/tiff/v4.0.9.html
share/doc/tiff/v4.1.0.html
share/doc/tiff/v4.2.0.html