pkgsrc-Changes-HG archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

[pkgsrc/pkgsrc-2018Q3]: pkgsrc/graphics/tiff Pullup ticket #5881 - requested ...



details:   https://anonhg.NetBSD.org/pkgsrc/rev/bb5e8e8735b6
branches:  pkgsrc-2018Q3
changeset: 315346:bb5e8e8735b6
user:      spz <spz%pkgsrc.org@localhost>
date:      Thu Nov 22 05:50:52 2018 +0000

description:
Pullup ticket #5881 - requested by maya
graphics/tiff: security update

Revisions pulled up:
- graphics/tiff/Makefile                                        1.144
- graphics/tiff/PLIST                                           1.26
- graphics/tiff/distinfo                                        1.93
- graphics/tiff/patches/patch-CVE-2017-11613                    deleted
- graphics/tiff/patches/patch-CVE-2017-18013                    deleted
- graphics/tiff/patches/patch-CVE-2017-9935                     deleted
- graphics/tiff/patches/patch-CVE-2018-10963                    deleted
- graphics/tiff/patches/patch-CVE-2018-17100                    deleted
- graphics/tiff/patches/patch-CVE-2018-17101                    deleted
- graphics/tiff/patches/patch-CVE-2018-5784                     deleted
- graphics/tiff/patches/patch-CVE-2018-8905                     deleted
- graphics/tiff/patches/patch-libtiff_tif__jbig.c               deleted
- graphics/tiff/patches/patch-libtiff_tif__read.c               deleted
- graphics/tiff/patches/patch-tools_pal2rgb.c                   deleted

-------------------------------------------------------------------
   Module Name: pkgsrc
   Committed By:        maya
   Date:                Sat Nov 10 21:14:54 UTC 2018

   Modified Files:
        pkgsrc/graphics/tiff: Makefile PLIST distinfo
   Removed Files:
        pkgsrc/graphics/tiff/patches: patch-CVE-2017-11613 patch-CVE-2017-18013
            patch-CVE-2017-9935 patch-CVE-2018-10963 patch-CVE-2018-17100
            patch-CVE-2018-17101 patch-CVE-2018-5784 patch-CVE-2018-8905
            patch-libtiff_tif__jbig.c patch-libtiff_tif__read.c
            patch-tools_pal2rgb.c

   Log Message:
   tiff: update to 4.0.10

   It has been a year since the previous release.  This is the first
   release made from the Git repository at
   https://gitlab.com/libtiff/libtiff using a collaborative process.

   Since the previous release, a number of security issues have been
   fixed, and some significant new features have been added.

   This release adds support for Zstd and WebP compression algorithms.
   In their own way, each of these compression algorithms is highly
   complimentary to TIFF.

   Zstd provides improved compression and decompression speed vs zlib's
   Deflate as well as a broader range of compression ratios.  Zstd is
   developed by Facebook and the implementation continues to be improved.

   WebP is optimized for small/medium 8-bit images while offering
   improved compression performance vs traditional JPEG.  WebP works well
   in strips or tiles to compress large images down to very small files,
   while preserving a good looking image.  WebP is developed by Google,
   and its implementation continues to be improved.

   Due to Adobe's TIFF tag registration interface going off-line, we have
   had to assign our own tags for Zstd and WebP.


   To generate a diff of this commit:
   cvs rdiff -u -r1.143 -r1.144 pkgsrc/graphics/tiff/Makefile
   cvs rdiff -u -r1.25 -r1.26 pkgsrc/graphics/tiff/PLIST
   cvs rdiff -u -r1.92 -r1.93 pkgsrc/graphics/tiff/distinfo
   cvs rdiff -u -r1.1 -r0 pkgsrc/graphics/tiff/patches/patch-CVE-2017-11613 \
       pkgsrc/graphics/tiff/patches/patch-CVE-2017-18013 \
       pkgsrc/graphics/tiff/patches/patch-CVE-2017-9935 \
       pkgsrc/graphics/tiff/patches/patch-CVE-2018-10963 \
       pkgsrc/graphics/tiff/patches/patch-CVE-2018-17100 \
       pkgsrc/graphics/tiff/patches/patch-CVE-2018-17101 \
       pkgsrc/graphics/tiff/patches/patch-CVE-2018-5784 \
       pkgsrc/graphics/tiff/patches/patch-CVE-2018-8905 \
       pkgsrc/graphics/tiff/patches/patch-libtiff_tif__jbig.c \
       pkgsrc/graphics/tiff/patches/patch-libtiff_tif__read.c \
       pkgsrc/graphics/tiff/patches/patch-tools_pal2rgb.c

diffstat:

 graphics/tiff/Makefile                          |    7 +-
 graphics/tiff/PLIST                             |    8 +-
 graphics/tiff/distinfo                          |   21 +---
 graphics/tiff/patches/patch-CVE-2017-11613      |  113 ----------------------
 graphics/tiff/patches/patch-CVE-2017-18013      |   24 ----
 graphics/tiff/patches/patch-CVE-2017-9935       |  119 ------------------------
 graphics/tiff/patches/patch-CVE-2018-10963      |   20 ----
 graphics/tiff/patches/patch-CVE-2018-17100      |   30 ------
 graphics/tiff/patches/patch-CVE-2018-17101      |   56 -----------
 graphics/tiff/patches/patch-CVE-2018-5784       |  110 ----------------------
 graphics/tiff/patches/patch-CVE-2018-8905       |   40 --------
 graphics/tiff/patches/patch-libtiff_tif__jbig.c |   77 ---------------
 graphics/tiff/patches/patch-libtiff_tif__read.c |   23 ----
 graphics/tiff/patches/patch-tools_pal2rgb.c     |   23 ----
 14 files changed, 12 insertions(+), 659 deletions(-)

diffs (truncated from 755 to 300 lines):

diff -r 65a2149051b7 -r bb5e8e8735b6 graphics/tiff/Makefile
--- a/graphics/tiff/Makefile    Thu Nov 22 05:45:13 2018 +0000
+++ b/graphics/tiff/Makefile    Thu Nov 22 05:50:52 2018 +0000
@@ -1,9 +1,8 @@
-# $NetBSD: Makefile,v 1.141.4.2 2018/10/29 14:49:32 bsiegert Exp $
+# $NetBSD: Makefile,v 1.141.4.3 2018/11/22 05:50:52 spz Exp $
 
-DISTNAME=      tiff-4.0.9
-PKGREVISION=   5
+DISTNAME=      tiff-4.0.10
 CATEGORIES=    graphics
-MASTER_SITES=  ftp://download.osgeo.org/libtiff/
+MASTER_SITES=  https://download.osgeo.org/libtiff/
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
 HOMEPAGE=      http://simplesystems.org/libtiff/
diff -r 65a2149051b7 -r bb5e8e8735b6 graphics/tiff/PLIST
--- a/graphics/tiff/PLIST       Thu Nov 22 05:45:13 2018 +0000
+++ b/graphics/tiff/PLIST       Thu Nov 22 05:50:52 2018 +0000
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.25 2017/11/19 16:31:04 he Exp $
+@comment $NetBSD: PLIST,v 1.25.8.1 2018/11/22 05:50:52 spz Exp $
 bin/fax2ps
 bin/fax2tiff
 bin/pal2rgb
@@ -90,8 +90,7 @@
 man/man3/libtiff.3
 share/doc/tiff/COPYRIGHT
 share/doc/tiff/ChangeLog
-share/doc/tiff/README
-share/doc/tiff/README.vms
+share/doc/tiff/README.md
 share/doc/tiff/RELEASE-DATE
 share/doc/tiff/TODO
 share/doc/tiff/VERSION
@@ -226,6 +225,7 @@
 share/doc/tiff/html/v3.9.2.html
 share/doc/tiff/html/v4.0.0.html
 share/doc/tiff/html/v4.0.1.html
+share/doc/tiff/html/v${PKGVERSION}.html
 share/doc/tiff/html/v4.0.2.html
 share/doc/tiff/html/v4.0.3.html
 share/doc/tiff/html/v4.0.4.html
@@ -234,4 +234,4 @@
 share/doc/tiff/html/v4.0.6.html
 share/doc/tiff/html/v4.0.7.html
 share/doc/tiff/html/v4.0.8.html
-share/doc/tiff/html/v${PKGVERSION}.html
+share/doc/tiff/html/v4.0.9.html
diff -r 65a2149051b7 -r bb5e8e8735b6 graphics/tiff/distinfo
--- a/graphics/tiff/distinfo    Thu Nov 22 05:45:13 2018 +0000
+++ b/graphics/tiff/distinfo    Thu Nov 22 05:50:52 2018 +0000
@@ -1,18 +1,7 @@
-$NetBSD: distinfo,v 1.90.4.2 2018/10/29 14:49:32 bsiegert Exp $
+$NetBSD: distinfo,v 1.90.4.3 2018/11/22 05:50:52 spz Exp $
 
-SHA1 (tiff-4.0.9.tar.gz) = 87d4543579176cc568668617c22baceccd568296
-RMD160 (tiff-4.0.9.tar.gz) = ab5b3b7297e79344775b1e70c4d54c90c06836a3
-SHA512 (tiff-4.0.9.tar.gz) = 04f3d5eefccf9c1a0393659fe27f3dddd31108c401ba0dc587bca152a1c1f6bc844ba41622ff5572da8cc278593eff8c402b44e7af0a0090e91d326c2d79f6cd
-Size (tiff-4.0.9.tar.gz) = 2305681 bytes
-SHA1 (patch-CVE-2017-11613) = 76db7d185ef5b82e7136ce451432e3e4b0cc5c12
-SHA1 (patch-CVE-2017-18013) = ebfdfb964aeafb3d8af2f7ad151270d8133f3e96
-SHA1 (patch-CVE-2017-9935) = d33f3311e5bb96bf415f894237ab4dfcfafd2610
-SHA1 (patch-CVE-2018-10963) = 564b65546c0e63a00d87ef9bb9d9cc8c5ca5a4ee
-SHA1 (patch-CVE-2018-17100) = 85290ca7d806087e640b1a6f5c3de5dda9c2060e
-SHA1 (patch-CVE-2018-17101) = 02039854f7c79d5937d585ca3e6355a7f41b7d1a
-SHA1 (patch-CVE-2018-5784) = 26e2c196b4150958dd37b33c1900c5baa6188661
-SHA1 (patch-CVE-2018-8905) = 3a7081957ff2f4d6e777df5a9609ba89eecd8fbc
+SHA1 (tiff-4.0.10.tar.gz) = c783b80f05cdacf282aa022dc5f5b0ede5e021ae
+RMD160 (tiff-4.0.10.tar.gz) = b25cc4002f2493e71763d0a465a50e9d6ee2aff0
+SHA512 (tiff-4.0.10.tar.gz) = d213e5db09fd56b8977b187c5a756f60d6e3e998be172550c2892dbdb4b2a8e8c750202bc863fe27d0d1c577ab9de1710d15e9f6ed665aadbfd857525a81eea8
+Size (tiff-4.0.10.tar.gz) = 2402867 bytes
 SHA1 (patch-configure) = a0032133f06b6ac92bbf52349fabe83f74ea14a6
-SHA1 (patch-libtiff_tif__jbig.c) = feb404c5c70c0f4f10fa53351fab4db163bbccf3
-SHA1 (patch-libtiff_tif__read.c) = a69f7a462e0dfe6b01240816ed546d7e381044e8
-SHA1 (patch-tools_pal2rgb.c) = f91652e8013940c162add870ceb9845e2730bc2c
diff -r 65a2149051b7 -r bb5e8e8735b6 graphics/tiff/patches/patch-CVE-2017-11613
--- a/graphics/tiff/patches/patch-CVE-2017-11613        Thu Nov 22 05:45:13 2018 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,113 +0,0 @@
-$NetBSD: patch-CVE-2017-11613,v 1.1.2.2 2018/10/29 14:49:32 bsiegert Exp $
-
-patch for CVE-2017-11613 taken from upstream git repo
-
---- libtiff/tif_dirread.c.orig 2017-09-16 19:07:56.000000000 +0000
-+++ libtiff/tif_dirread.c
-@@ -167,6 +167,7 @@ static int TIFFFetchStripThing(TIFF* tif
- static int TIFFFetchSubjectDistance(TIFF*, TIFFDirEntry*);
- static void ChopUpSingleUncompressedStrip(TIFF*);
- static uint64 TIFFReadUInt64(const uint8 *value);
-+static int _TIFFGetMaxColorChannels(uint16 photometric);
- 
- static int _TIFFFillStrilesInternal( TIFF *tif, int loadStripByteCount );
- 
-@@ -3507,6 +3508,35 @@ static void TIFFReadDirEntryOutputErr(TI
- }
- 
- /*
-+ * Return the maximum number of color channels specified for a given photometric
-+ * type. 0 is returned if photometric type isn't supported or no default value
-+ * is defined by the specification.
-+ */
-+static int _TIFFGetMaxColorChannels( uint16 photometric )
-+{
-+    switch (photometric) {
-+      case PHOTOMETRIC_PALETTE:
-+      case PHOTOMETRIC_MINISWHITE:
-+      case PHOTOMETRIC_MINISBLACK:
-+          return 1;
-+      case PHOTOMETRIC_YCBCR:
-+      case PHOTOMETRIC_RGB:
-+      case PHOTOMETRIC_CIELAB:
-+          return 3;
-+      case PHOTOMETRIC_SEPARATED:
-+      case PHOTOMETRIC_MASK:
-+          return 4;
-+      case PHOTOMETRIC_LOGL:
-+      case PHOTOMETRIC_LOGLUV:
-+      case PHOTOMETRIC_CFA:
-+      case PHOTOMETRIC_ITULAB:
-+      case PHOTOMETRIC_ICCLAB:
-+      default:
-+          return 0;
-+    }
-+}
-+      
-+/*
-  * Read the next TIFF directory from a file and convert it to the internal
-  * format. We read directories sequentially.
-  */
-@@ -3522,6 +3552,7 @@ TIFFReadDirectory(TIFF* tif)
-       uint32 fii=FAILED_FII;
-         toff_t nextdiroff;
-     int bitspersample_read = FALSE;
-+      int color_channels;
- 
-       tif->tif_diroff=tif->tif_nextdiroff;
-       if (!TIFFCheckDirOffset(tif,tif->tif_nextdiroff))
-@@ -4026,6 +4057,37 @@ TIFFReadDirectory(TIFF* tif)
-                       }
-               }
-       }
-+
-+      /*
-+       * Make sure all non-color channels are extrasamples.
-+       * If it's not the case, define them as such.
-+       */
-+      color_channels = _TIFFGetMaxColorChannels(tif->tif_dir.td_photometric);
-+      if (color_channels && tif->tif_dir.td_samplesperpixel - tif->tif_dir.td_extrasamples > color_channels) {
-+              uint16 old_extrasamples;
-+              uint16 *new_sampleinfo;
-+
-+              TIFFWarningExt(tif->tif_clientdata,module, "Sum of Photometric type-related "
-+                  "color channels and ExtraSamples doesn't match SamplesPerPixel. "
-+                  "Defining non-color channels as ExtraSamples.");
-+
-+              old_extrasamples = tif->tif_dir.td_extrasamples;
-+              tif->tif_dir.td_extrasamples = (tif->tif_dir.td_samplesperpixel - color_channels);
-+
-+              // sampleinfo should contain information relative to these new extra samples
-+              new_sampleinfo = (uint16*) _TIFFcalloc(tif->tif_dir.td_extrasamples, sizeof(uint16));
-+              if (!new_sampleinfo) {
-+                  TIFFErrorExt(tif->tif_clientdata, module, "Failed to allocate memory for "
-+                              "temporary new sampleinfo array (%d 16 bit elements)",
-+                              tif->tif_dir.td_extrasamples);
-+                  goto bad;
-+              }
-+
-+              memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, old_extrasamples * sizeof(uint16));
-+              _TIFFsetShortArray(&tif->tif_dir.td_sampleinfo, new_sampleinfo, tif->tif_dir.td_extrasamples);
-+              _TIFFfree(new_sampleinfo);
-+      }
-+
-       /*
-        * Verify Palette image has a Colormap.
-        */
-@@ -5698,6 +5760,16 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
-         if( nstrips == 0 )
-             return;
- 
-+        /* If we are going to allocate a lot of memory, make sure that the */
-+      /* file is as big as needed */
-+      if( tif->tif_mode == O_RDONLY &&
-+          nstrips > 1000000 &&
-+          (offset >= TIFFGetFileSize(tif) ||
-+           stripbytes > (TIFFGetFileSize(tif) - offset) / (nstrips - 1)) )
-+      {
-+          return;
-+      }
-+
-       newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
-                               "for chopped \"StripByteCounts\" array");
-       newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
diff -r 65a2149051b7 -r bb5e8e8735b6 graphics/tiff/patches/patch-CVE-2017-18013
--- a/graphics/tiff/patches/patch-CVE-2017-18013        Thu Nov 22 05:45:13 2018 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,24 +0,0 @@
-$NetBSD: patch-CVE-2017-18013,v 1.1.2.2 2018/10/29 14:49:32 bsiegert Exp $
-
-patch for patch-CVE-2017-18013 from upstream git repo
-
---- libtiff/tif_print.c.orig   2016-11-25 17:26:23.000000000 +0000
-+++ libtiff/tif_print.c        2018-10-09 17:35:21.544815948 +0000
-@@ -667,13 +667,13 @@
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
-                       fprintf(fd, "    %3lu: [%8I64u, %8I64u]\n",
-                           (unsigned long) s,
--                          (unsigned __int64) td->td_stripoffset[s],
--                          (unsigned __int64) td->td_stripbytecount[s]);
-+                          td->td_stripoffset ? (unsigned __int64) td->td_stripoffset[s] : 0,
-+                          td->td_stripbytecount ? (unsigned __int64) td->td_stripbytecount[s] : 0);
- #else
-                       fprintf(fd, "    %3lu: [%8llu, %8llu]\n",
-                           (unsigned long) s,
--                          (unsigned long long) td->td_stripoffset[s],
--                          (unsigned long long) td->td_stripbytecount[s]);
-+                          td->td_stripoffset ? (unsigned long long) td->td_stripoffset[s] : 0,
-+                          td->td_stripbytecount ? (unsigned long long) td->td_stripbytecount[s] : 0);
- #endif
-       }
- }
diff -r 65a2149051b7 -r bb5e8e8735b6 graphics/tiff/patches/patch-CVE-2017-9935
--- a/graphics/tiff/patches/patch-CVE-2017-9935 Thu Nov 22 05:45:13 2018 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,119 +0,0 @@
-$NetBSD: patch-CVE-2017-9935,v 1.1 2018/01/16 23:52:06 tez Exp $
-
-Patch for cve-2017-9935 from upstream git repo
-
-
---- libtiff/tif_dir.c.orig
-+++ libtiff/tif_dir.c
-@@ -1065,6 +1065,9 @@ 
-                       if (td->td_samplesperpixel - td->td_extrasamples > 1) {
-                               *va_arg(ap, uint16**) = td->td_transferfunction[1];
-                               *va_arg(ap, uint16**) = td->td_transferfunction[2];
-+                      } else {
-+                              *va_arg(ap, uint16**) = NULL;
-+                              *va_arg(ap, uint16**) = NULL;
-                       }
-                       break;
-               case TIFFTAG_REFERENCEBLACKWHITE:
-
---- tools/tiff2pdf.c.orig      2017-10-29 18:50:41.000000000 +0000
-+++ tools/tiff2pdf.c
-@@ -237,7 +237,7 @@ typedef struct {
-       float tiff_whitechromaticities[2];
-       float tiff_primarychromaticities[6];
-       float tiff_referenceblackwhite[2];
--      float* tiff_transferfunction[3];
-+      uint16* tiff_transferfunction[3];
-       int pdf_image_interpolate;      /* 0 (default) : do not interpolate,
-                                          1 : interpolate */
-       uint16 tiff_transferfunctioncount;
-@@ -1047,6 +1047,8 @@ void t2p_read_tiff_init(T2P* t2p, TIFF*
-       uint16 pagen=0;
-       uint16 paged=0;
-       uint16 xuint16=0;
-+      uint16 tiff_transferfunctioncount=0;
-+      uint16* tiff_transferfunction[3];
- 
-       directorycount=TIFFNumberOfDirectories(input);
-       t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE)));
-@@ -1147,26 +1149,48 @@ void t2p_read_tiff_init(T2P* t2p, TIFF*
-                 }
- #endif
-               if (TIFFGetField(input, TIFFTAG_TRANSFERFUNCTION,
--                                 &(t2p->tiff_transferfunction[0]),
--                                 &(t2p->tiff_transferfunction[1]),
--                                 &(t2p->tiff_transferfunction[2]))) {
--                      if((t2p->tiff_transferfunction[1] != (float*) NULL) &&
--                           (t2p->tiff_transferfunction[2] != (float*) NULL) &&
--                           (t2p->tiff_transferfunction[1] !=
--                            t2p->tiff_transferfunction[0])) {
--                              t2p->tiff_transferfunctioncount = 3;
--                              t2p->tiff_pages[i].page_extra += 4;
--                              t2p->pdf_xrefcount += 4;
--                      } else {
--                              t2p->tiff_transferfunctioncount = 1;
--                              t2p->tiff_pages[i].page_extra += 2;
--                              t2p->pdf_xrefcount += 2;
--                      }
--                      if(t2p->pdf_minorversion < 2)
--                              t2p->pdf_minorversion = 2;
-+                                 &(tiff_transferfunction[0]),
-+                                 &(tiff_transferfunction[1]),
-+                                 &(tiff_transferfunction[2]))) {
-+
-+                        if((tiff_transferfunction[1] != (uint16*) NULL) &&
-+                           (tiff_transferfunction[2] != (uint16*) NULL)
-+                          ) {
-+                            tiff_transferfunctioncount=3;
-+                        } else {
-+                            tiff_transferfunctioncount=1;
-+                        }
-                 } else {
--                      t2p->tiff_transferfunctioncount=0;
-+                      tiff_transferfunctioncount=0;
-               }
-+



Home | Main Index | Thread Index | Old Index