[pkgsrc/pkgsrc-2012Q1]: pkgsrc/graphics/tiff Pullup ticket #3728 - requested ...

[tron <tron%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/bc2511e4f222
branches:  pkgsrc-2012Q1
changeset: 602019:bc2511e4f222
user:      tron <tron%pkgsrc.org@localhost>
date:      Wed Apr 11 10:06:47 2012 +0000

description:
Pullup ticket #3728 - requested by taca
graphics/tiff: security patch

Revisions pulled up:
- graphics/tiff/Makefile                                        1.104
- graphics/tiff/distinfo                                        1.55
- graphics/tiff/patches/patch-libtiff_tif__getimage.c           1.1
- graphics/tiff/patches/patch-libtiff_tiffiop.h                 1.1

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Tue Apr 10 14:13:04 UTC 2012

   Modified Files:
        pkgsrc/graphics/tiff: Makefile distinfo
   Added Files:
        pkgsrc/graphics/tiff/patches: patch-libtiff_tif__getimage.c
            patch-libtiff_tiffiop.h

   Log Message:
   Add fix for CVE-2012-1173 from upstream.

   Bump PKGREVISION.

diffstat:

 graphics/tiff/Makefile                              |   3 +-
 graphics/tiff/distinfo                              |   4 +-
 graphics/tiff/patches/patch-libtiff_tif__getimage.c |  60 +++++++++++++++++++++
 graphics/tiff/patches/patch-libtiff_tiffiop.h       |  15 +++++
 4 files changed, 80 insertions(+), 2 deletions(-)

diffs (108 lines):

diff -r 810af6e2e2b7 -r bc2511e4f222 graphics/tiff/Makefile
--- a/graphics/tiff/Makefile    Mon Apr 09 19:54:44 2012 +0000
+++ b/graphics/tiff/Makefile    Wed Apr 11 10:06:47 2012 +0000
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.103 2012/02/21 13:03:00 drochner Exp $
+# $NetBSD: Makefile,v 1.103.2.1 2012/04/11 10:06:47 tron Exp $
 
 DISTNAME=      tiff-4.0.1
+PKGREVISION=   1
 CATEGORIES=    graphics
 MASTER_SITES=  ftp://ftp.remotesensing.org/pub/libtiff/ \
                http://libtiff.maptools.org/dl/
diff -r 810af6e2e2b7 -r bc2511e4f222 graphics/tiff/distinfo
--- a/graphics/tiff/distinfo    Mon Apr 09 19:54:44 2012 +0000
+++ b/graphics/tiff/distinfo    Wed Apr 11 10:06:47 2012 +0000
@@ -1,6 +1,8 @@
-$NetBSD: distinfo,v 1.54 2012/02/21 13:03:00 drochner Exp $
+$NetBSD: distinfo,v 1.54.2.1 2012/04/11 10:06:48 tron Exp $
 
 SHA1 (tiff-4.0.1.tar.gz) = 8baf382231c9051a1b3eb294581289aa21447171
 RMD160 (tiff-4.0.1.tar.gz) = abf98ab277edaee302b432dbcecfe68061dd91dc
 Size (tiff-4.0.1.tar.gz) = 1991580 bytes
 SHA1 (patch-configure) = 0e86c6d69783333c03d6241e1824f68602f3c732
+SHA1 (patch-libtiff_tif__getimage.c) = fc1f63b669fb8871935d4bf12e09dc1c78150f91
+SHA1 (patch-libtiff_tiffiop.h) = 8729e474106a0edce4284004f6f6d95b97c4a544
diff -r 810af6e2e2b7 -r bc2511e4f222 graphics/tiff/patches/patch-libtiff_tif__getimage.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/graphics/tiff/patches/patch-libtiff_tif__getimage.c       Wed Apr 11 10:06:47 2012 +0000
@@ -0,0 +1,60 @@
+$NetBSD: patch-libtiff_tif__getimage.c,v 1.1.2.2 2012/04/11 10:06:48 tron Exp $
+
+Fix for CVE-2012-1173 from upstream.
+
+--- libtiff/tif_getimage.c.orig        2011-02-25 03:34:02.000000000 +0000
++++ libtiff/tif_getimage.c
+@@ -692,6 +692,7 @@ gtTileSeparate(TIFFRGBAImage* img, uint3
+       unsigned char* p2;
+       unsigned char* pa;
+       tmsize_t tilesize;
++      tmsize_t bufsize;
+       int32 fromskew, toskew;
+       int alpha = img->alpha;
+       uint32 nrow;
+@@ -699,12 +700,17 @@ gtTileSeparate(TIFFRGBAImage* img, uint3
+         int colorchannels;
+ 
+       tilesize = TIFFTileSize(tif);  
+-      buf = (unsigned char*) _TIFFmalloc((alpha?4:3)*tilesize);
++      bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,tilesize);
++      if (bufsize == 0) {
++              TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
++              return (0);
++      }
++      buf = (unsigned char*) _TIFFmalloc(bufsize);
+       if (buf == 0) {
+               TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "No space for tile buffer");
+               return (0);
+       }
+-      _TIFFmemset(buf, 0, (alpha?4:3)*tilesize);
++      _TIFFmemset(buf, 0, bufsize);
+       p0 = buf;
+       p1 = p0 + tilesize;
+       p2 = p1 + tilesize;
+@@ -917,17 +923,23 @@ gtStripSeparate(TIFFRGBAImage* img, uint
+       uint32 rowsperstrip, offset_row;
+       uint32 imagewidth = img->width;
+       tmsize_t stripsize;
++      tmsize_t bufsize;
+       int32 fromskew, toskew;
+       int alpha = img->alpha;
+       int ret = 1, flip, colorchannels;
+ 
+       stripsize = TIFFStripSize(tif);  
+-      p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize);
++      bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,stripsize);
++      if (bufsize == 0) {
++              TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
++              return (0);
++      }
++      p0 = buf = (unsigned char *)_TIFFmalloc(bufsize);
+       if (buf == 0) {
+               TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
+               return (0);
+       }
+-      _TIFFmemset(buf, 0, (alpha?4:3)*stripsize);
++      _TIFFmemset(buf, 0, bufsize);
+       p1 = p0 + stripsize;
+       p2 = p1 + stripsize;
+       pa = (alpha?(p2+stripsize):NULL);
diff -r 810af6e2e2b7 -r bc2511e4f222 graphics/tiff/patches/patch-libtiff_tiffiop.h
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/graphics/tiff/patches/patch-libtiff_tiffiop.h     Wed Apr 11 10:06:47 2012 +0000
@@ -0,0 +1,15 @@
+$NetBSD: patch-libtiff_tiffiop.h,v 1.1.2.2 2012/04/11 10:06:48 tron Exp $
+
+Fix for CVE-2012-1173 from upstream.
+
+--- libtiff/tiffiop.h.orig     2011-02-19 16:26:09.000000000 +0000
++++ libtiff/tiffiop.h
+@@ -250,7 +250,7 @@ struct tiff {
+ #define TIFFroundup_64(x, y) (TIFFhowmany_64(x,y)*(y))
+ 
+ /* Safe multiply which returns zero if there is an integer overflow */
+-#define TIFFSafeMultiply(t,v,m) ((((t)m != (t)0) && (((t)((v*m)/m)) == (t)v)) ? (t)(v*m) : (t)0)
++#define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
+ 
+ #define TIFFmax(A,B) ((A)>(B)?(A):(B))
+ #define TIFFmin(A,B) ((A)<(B)?(A):(B))