tiff: bump version to 4.0.8

deleted file mode 100644
index 9df4577e1..000000000
@@ -1,46 +0,0 @@
-From 438274f938e046d33cb0e1230b41da32ffe223e1 Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Fri, 2 Dec 2016 21:56:56 +0000
-Subject: [PATCH] * libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow
- in TIFFReadEncodedStrip() that caused an integer division by zero. Reported
- by Agostino Sarubbo. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2596
-
-Fixes CVE-2016-10266
-
-Signed-off-by: Peter Korsgaard <[email protected]>
----
- libtiff/tif_read.c | 2 +-
- libtiff/tiffiop.h  | 4 ++++
- 2 files changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
-index c26c55f4..52bbf507 100644
---- a/libtiff/tif_read.c
-+++ b/libtiff/tif_read.c
-@@ -346,7 +346,7 @@ TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
- 	rowsperstrip=td->td_rowsperstrip;
- 	if (rowsperstrip>td->td_imagelength)
- 		rowsperstrip=td->td_imagelength;
--	stripsperplane=((td->td_imagelength+rowsperstrip-1)/rowsperstrip);
-+	stripsperplane= TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip);
- 	stripinplane=(strip%stripsperplane);
- 	plane=(uint16)(strip/stripsperplane);
- 	rows=td->td_imagelength-stripinplane*rowsperstrip;
-diff --git a/libtiff/tiffiop.h b/libtiff/tiffiop.h
-index ffbb647b..cb59460a 100644
---- a/libtiff/tiffiop.h
-+++ b/libtiff/tiffiop.h
-@@ -250,6 +250,10 @@ struct tiff {
- #define TIFFhowmany_32(x, y) (((uint32)x < (0xffffffff - (uint32)(y-1))) ? \
- 			   ((((uint32)(x))+(((uint32)(y))-1))/((uint32)(y))) : \
- 			   0U)
-+/* Variant of TIFFhowmany_32() that doesn't return 0 if x close to MAXUINT. */
-+/* Caution: TIFFhowmany_32_maxuint_compat(x,y)*y might overflow */
-+#define TIFFhowmany_32_maxuint_compat(x, y) \
-+			   (((uint32)(x) / (uint32)(y)) + ((((uint32)(x) % (uint32)(y)) != 0) ? 1 : 0))
- #define TIFFhowmany8_32(x) (((x)&0x07)?((uint32)(x)>>3)+1:(uint32)(x)>>3)
- #define TIFFroundup_32(x, y) (TIFFhowmany_32(x,y)*(y))
- #define TIFFhowmany_64(x, y) ((((uint64)(x))+(((uint64)(y))-1))/((uint64)(y)))
--- 
-2.11.0
-

53 lines not on this page · raw message

110 lines not on this page · raw message

107 lines not on this page · raw message

74 lines not on this page · raw message

deleted file mode 100644
index b3d8a40bb..000000000
@@ -1,31 +0,0 @@
-From 48780b4fcc425cddc4ef8ffdf536f96a0d1b313b Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Wed, 11 Jan 2017 16:38:26 +0000
-Subject: [PATCH] libtiff/tif_getimage.c: add explicit uint32 cast in putagreytile to
- avoid UndefinedBehaviorSanitizer warning.
- Patch by Nicol?s Pe?a.
- Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2658
-
-Fixes CVE-2017-7592
-
-Signed-off-by: Peter Korsgaard <[email protected]>
----
- libtiff/tif_getimage.c | 2 +-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
-index fed31f1f..2fa1775c 100644
---- a/libtiff/tif_getimage.c
-+++ b/libtiff/tif_getimage.c
-@@ -1302,7 +1302,7 @@ DECLAREContigPutFunc(putagreytile)
-     while (h-- > 0) {
- 	for (x = w; x-- > 0;)
-         {
--            *cp++ = BWmap[*pp][0] & (*(pp+1) << 24 | ~A1);
-+            *cp++ = BWmap[*pp][0] & ((uint32)*(pp+1) << 24 | ~A1);
-             pp += samplesperpixel;
-         }
- 	cp += toskew;
--- 
-2.11.0
-

88 lines not on this page · raw message

43 lines not on this page · raw message

deleted file mode 100644
index a1aae2dce..000000000
@@ -1,36 +0,0 @@
-From 8283e4d1b7e53340684d12932880cbcbaf23a8c1 Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Thu, 12 Jan 2017 17:43:25 +0000
-Subject: [PATCH] libtiff/tif_ojpeg.c: fix leak in
- OJPEGReadHeaderInfoSecTablesAcTable when read fails.
- Patch by Nicol?s Pe?a.
- Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2659
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Fixes CVE-2017-7594
-
-Signed-off-by: Peter Korsgaard <[email protected]>
----
- libtiff/tif_ojpeg.c | 3 +++
- 1 file changed, 10 insertions(+)
-
-diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
-index f19e8fd0..b92f0ebd 100644
---- a/libtiff/tif_ojpeg.c
-+++ b/libtiff/tif_ojpeg.c
-@@ -1918,7 +1918,10 @@ OJPEGReadHeaderInfoSecTablesAcTable(TIFF* tif)
- 				rb[sizeof(uint32)+5+n]=o[n];
- 			p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q);
- 			if (p!=q)
-+                        {
-+                                _TIFFfree(rb);
- 				return(0);
-+                        }
- 			sp->actable[m]=rb;
- 			sp->sos_tda[m]=(sp->sos_tda[m]|m);
- 		}
--- 
-2.11.0
-

deleted file mode 100644
index 862aae2a5..000000000
@@ -1,35 +0,0 @@
-From 47f2fb61a3a64667bce1a8398a8fcb1b348ff122 Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Wed, 11 Jan 2017 12:15:01 +0000
-Subject: [PATCH] * libtiff/tif_jpeg.c: avoid integer division by zero in
- JPEGSetupEncode() when horizontal or vertical sampling is set to 0. Fixes
- http://bugzilla.maptools.org/show_bug.cgi?id=2653
-
-Fixes CVE-2017-7595
-
-Signed-off-by: Peter Korsgaard <[email protected]>
----
- libtiff/tif_jpeg.c | 7 +++++++
- 1 file changed, 13 insertions(+)
-
-diff --git a/libtiff/tif_jpeg.c b/libtiff/tif_jpeg.c
-index 38595f98..6c17c388 100644
---- a/libtiff/tif_jpeg.c
-+++ b/libtiff/tif_jpeg.c
-@@ -1626,6 +1626,13 @@ JPEGSetupEncode(TIFF* tif)
- 	case PHOTOMETRIC_YCBCR:
- 		sp->h_sampling = td->td_ycbcrsubsampling[0];
- 		sp->v_sampling = td->td_ycbcrsubsampling[1];
-+                if( sp->h_sampling == 0 || sp->v_sampling == 0 )
-+                {
-+                    TIFFErrorExt(tif->tif_clientdata, module,
-+                            "Invalig horizontal/vertical sampling value");
-+                    return (0);
-+                }
-+
- 		/*
- 		 * A ReferenceBlackWhite field *must* be present since the
- 		 * default value is inappropriate for YCbCr.  Fill in the
--- 
-2.11.0
-

47 lines not on this page · raw message

deleted file mode 100644
index 4f46d9bb0..000000000
@@ -1,35 +0,0 @@
-From 0a76a8c765c7b8327c59646284fa78c3c27e5490 Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Wed, 11 Jan 2017 16:13:50 +0000
-Subject: [PATCH] * libtiff/tif_jpeg.c: validate BitsPerSample in
- JPEGSetupEncode() to avoid undefined behaviour caused by invalid shift
- exponent. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2648
-
-Fixes CVE-2017-7601
-
-Signed-off-by: Peter Korsgaard <[email protected]>
----
- libtiff/tif_jpeg.c | 7 +++++++
- 1 file changed, 13 insertions(+)
-
-diff --git a/libtiff/tif_jpeg.c b/libtiff/tif_jpeg.c
-index 6c17c388..192989a9 100644
---- a/libtiff/tif_jpeg.c
-+++ b/libtiff/tif_jpeg.c
-@@ -1632,6 +1632,13 @@ JPEGSetupEncode(TIFF* tif)
-                             "Invalig horizontal/vertical sampling value");
-                     return (0);
-                 }
-+                if( td->td_bitspersample > 16 )
-+                {
-+                    TIFFErrorExt(tif->tif_clientdata, module,
-+                                 "BitsPerSample %d not allowed for JPEG",
-+                                 td->td_bitspersample);
-+                    return (0);
-+                }
- 
- 		/*
- 		 * A ReferenceBlackWhite field *must* be present since the
--- 
-2.11.0
-

56 lines not on this page · raw message

index 4439a35f3..516cb0626 100644
@@ -1,2 +1,2 @@
 # Locally computed
-sha256 9f43a2cfb9589e5cecaa66e16bf87f814c945f22df7ba600d63aac4632c4f019  tiff-4.0.7.tar.gz
+sha256 59d7a5a8ccd92059913f246877db95a2918e6c04fb9d43fd74e5c3390dac2910  tiff-4.0.8.tar.gz

index e5b01db88..405cb9251 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-TIFF_VERSION = 4.0.7
+TIFF_VERSION = 4.0.8
 TIFF_SITE = http://download.osgeo.org/libtiff
 TIFF_LICENSE = tiff license
 TIFF_LICENSE_FILES = COPYRIGHT