tiff: fix CVEs

new file mode 100644
index 0000000..4d965be
@@ -0,0 +1,118 @@
+From 7c39352ccd9060d311d3dc9a1f1bc00133a160e6 Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Mon, 15 Aug 2016 20:06:40 +0000
+Subject: [PATCH] * tools/tiff2rgba.c: Fix integer overflow in size of
+ allocated buffer, when -b mode is enabled, that could result in out-of-bounds
+ write. Based initially on patch tiff-CVE-2016-3945.patch from
+ libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with correction for invalid
+ tests that rejected valid files.
+
+CVE: CVE-2016-3945
+Upstream-Status: Backport
+https://github.com/vadz/libtiff/commit/7c39352ccd9060d311d3dc9a1f1bc00133a160e6
+
+Signed-off-by: Yi Zhao <[email protected]>
+---
+ ChangeLog         |  8 ++++++++
+ tools/tiff2rgba.c | 34 ++++++++++++++++++++++++++++++----
+ 2 files changed, 38 insertions(+), 4 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index 62dc1b5..9c0ab29 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,11 @@
++2016-08-15 Even Rouault <even.rouault at spatialys.com>
++
++	* tools/tiff2rgba.c: Fix integer overflow in size of allocated
++	buffer, when -b mode is enabled, that could result in out-of-bounds
++	write. Based initially on patch tiff-CVE-2016-3945.patch from
++	libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with correction for
++	invalid tests that rejected valid files.
++
+ 2016-07-11 Even Rouault <even.rouault at spatialys.com>
+ 
+ 	* tools/tiffcrop.c: Avoid access outside of stack allocated array
+diff --git a/tools/tiff2rgba.c b/tools/tiff2rgba.c
+index b7a81eb..16e3dc4 100644
+--- a/tools/tiff2rgba.c
++++ b/tools/tiff2rgba.c
+@@ -147,6 +147,7 @@ cvt_by_tile( TIFF *in, TIFF *out )
+     uint32  row, col;
+     uint32  *wrk_line;
+     int	    ok = 1;
++    uint32  rastersize, wrk_linesize;
+ 
+     TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);
+     TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);
+@@ -163,7 +164,13 @@ cvt_by_tile( TIFF *in, TIFF *out )
+     /*
+      * Allocate tile buffer
+      */
+-    raster = (uint32*)_TIFFmalloc(tile_width * tile_height * sizeof (uint32));
++    rastersize = tile_width * tile_height * sizeof (uint32);
++    if (tile_width != (rastersize / tile_height) / sizeof( uint32))
++    {
++	TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");
++	exit(-1);
++    }
++    raster = (uint32*)_TIFFmalloc(rastersize);
+     if (raster == 0) {
+         TIFFError(TIFFFileName(in), "No space for raster buffer");
+         return (0);
+@@ -173,7 +180,13 @@ cvt_by_tile( TIFF *in, TIFF *out )
+      * Allocate a scanline buffer for swapping during the vertical
+      * mirroring pass.
+      */
+-    wrk_line = (uint32*)_TIFFmalloc(tile_width * sizeof (uint32));
++    wrk_linesize = tile_width * sizeof (uint32);
++    if (tile_width != wrk_linesize / sizeof (uint32))
++    {
++        TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");
++	exit(-1);
++    }
++    wrk_line = (uint32*)_TIFFmalloc(wrk_linesize);
+     if (!wrk_line) {
+         TIFFError(TIFFFileName(in), "No space for raster scanline buffer");
+         ok = 0;
+@@ -249,6 +262,7 @@ cvt_by_strip( TIFF *in, TIFF *out )
+     uint32  row;
+     uint32  *wrk_line;
+     int	    ok = 1;
++    uint32  rastersize, wrk_linesize;
+ 
+     TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);
+     TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);
+@@ -263,7 +277,13 @@ cvt_by_strip( TIFF *in, TIFF *out )
+     /*
+      * Allocate strip buffer
+      */
+-    raster = (uint32*)_TIFFmalloc(width * rowsperstrip * sizeof (uint32));
++    rastersize = width * rowsperstrip * sizeof (uint32);
++    if (width != (rastersize / rowsperstrip) / sizeof( uint32))
++    {
++	TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");
++	exit(-1);
++    }
++    raster = (uint32*)_TIFFmalloc(rastersize);
+     if (raster == 0) {
+         TIFFError(TIFFFileName(in), "No space for raster buffer");
+         return (0);
+@@ -273,7 +293,13 @@ cvt_by_strip( TIFF *in, TIFF *out )
+      * Allocate a scanline buffer for swapping during the vertical
+      * mirroring pass.
+      */
+-    wrk_line = (uint32*)_TIFFmalloc(width * sizeof (uint32));
++    wrk_linesize = width * sizeof (uint32);
++    if (width != wrk_linesize / sizeof (uint32))
++    {
++        TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");
++	exit(-1);
++    }
++    wrk_line = (uint32*)_TIFFmalloc(wrk_linesize);
+     if (!wrk_line) {
+         TIFFError(TIFFFileName(in), "No space for raster scanline buffer");
+         ok = 0;
+-- 
+2.7.4
+

index 8147bc4..b978528 100644
@@ -10,6 +10,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
            file://CVE-2016-3186.patch \
            file://CVE-2016-5321.patch \
            file://CVE-2016-5323.patch \
+           file://CVE-2016-3945.patch \
           "
 
 SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72"

new file mode 100644
index 0000000..7bf52ee
@@ -0,0 +1,66 @@
+From 6a4dbb07ccf92836bb4adac7be4575672d0ac5f1 Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Mon, 15 Aug 2016 20:49:48 +0000
+Subject: [PATCH] * libtiff/tif_pixarlog.c: Fix write buffer overflow in
+ PixarLogEncode if more input samples are provided than expected by
+ PixarLogSetupEncode. Idea based on libtiff-CVE-2016-3990.patch from
+ libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with different and
+ simpler check. (bugzilla #2544)
+
+invalid tests that rejected valid files. (bugzilla #2545)
+
+CVE: CVE-2016-3990
+Upstream-Status: Backport
+https://github.com/vadz/libtiff/commit/6a4dbb07ccf92836bb4adac7be4575672d0ac5f1
+
+Signed-off-by: Yi Zhao <[email protected]>
+---
+ ChangeLog              | 10 +++++++++-
+ libtiff/tif_pixarlog.c |  7 +++++++
+ 2 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index 9c0ab29..db4ea18 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,10 +1,18 @@
+ 2016-08-15 Even Rouault <even.rouault at spatialys.com>
+ 
++	* libtiff/tif_pixarlog.c: Fix write buffer overflow in PixarLogEncode
++	if more input samples are provided than expected by PixarLogSetupEncode.
++	Idea based on libtiff-CVE-2016-3990.patch from
++	libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with different and
++	simpler check. (bugzilla #2544)
++
++2016-08-15 Even Rouault <even.rouault at spatialys.com>
++
+ 	* tools/tiff2rgba.c: Fix integer overflow in size of allocated
+ 	buffer, when -b mode is enabled, that could result in out-of-bounds
+ 	write. Based initially on patch tiff-CVE-2016-3945.patch from
+ 	libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with correction for
+-	invalid tests that rejected valid files.
++	invalid tests that rejected valid files. (bugzilla #2545)
+ 
+ 2016-07-11 Even Rouault <even.rouault at spatialys.com>
+ 
+diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
+index e78f788..28329d1 100644
+--- a/libtiff/tif_pixarlog.c
++++ b/libtiff/tif_pixarlog.c
+@@ -1141,6 +1141,13 @@ PixarLogEncode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
+ 	}
+ 
+ 	llen = sp->stride * td->td_imagewidth;
++    /* Check against the number of elements (of size uint16) of sp->tbuf */
++    if( n > td->td_rowsperstrip * llen )
++    {
++        TIFFErrorExt(tif->tif_clientdata, module,
++                     "Too many input bytes provided");
++        return 0;
++    }
+ 
+ 	for (i = 0, up = sp->tbuf; i < n; i += llen, up += llen) {
+ 		switch (sp->user_datafmt)  {
+-- 
+2.7.4
+

index b978528..dfb2996 100644
@@ -11,6 +11,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
            file://CVE-2016-5321.patch \
            file://CVE-2016-5323.patch \
            file://CVE-2016-3945.patch \
+           file://CVE-2016-3990.patch \
           "
 
 SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72"

new file mode 100644
index 0000000..27dfd37
@@ -0,0 +1,147 @@
+From e596d4e27c5afb7960dc360fdd3afd90ba0fb8ba Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Mon, 15 Aug 2016 21:05:40 +0000
+Subject: [PATCH 2/2] * tools/tiffcrop.c: Fix out-of-bounds write in
+ loadImage(). From patch libtiff-CVE-2016-3991.patch from
+ libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro (bugzilla #2543)
+
+CVE: CVE-2016-3991
+Upstream-Status: Backport
+https://github.com/vadz/libtiff/commit/e596d4e27c5afb7960dc360fdd3afd90ba0fb8ba
+
+Signed-off-by: Yi Zhao <[email protected]>
+---
+ ChangeLog        |  6 ++++++
+ tools/tiffcrop.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++++---
+ 2 files changed, 62 insertions(+), 3 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index db4ea18..5d60608 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,5 +1,11 @@
+ 2016-08-15 Even Rouault <even.rouault at spatialys.com>
+ 
++	* tools/tiffcrop.c: Fix out-of-bounds write in loadImage().
++	From patch libtiff-CVE-2016-3991.patch from
++	libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro (bugzilla #2543)
++
++2016-08-15 Even Rouault <even.rouault at spatialys.com>
++
+ 	* libtiff/tif_pixarlog.c: Fix write buffer overflow in PixarLogEncode
+ 	if more input samples are provided than expected by PixarLogSetupEncode.
+ 	Idea based on libtiff-CVE-2016-3990.patch from
+diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
+index 27abc0b..ddba7b9 100644
+--- a/tools/tiffcrop.c
++++ b/tools/tiffcrop.c
+@@ -798,6 +798,11 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8* buf,
+     }
+ 
+   tile_buffsize = tilesize;
++  if (tilesize == 0 || tile_rowsize == 0)
++  {
++     TIFFError("readContigTilesIntoBuffer", "Tile size or tile rowsize is zero");
++     exit(-1);
++  }
+ 
+   if (tilesize < (tsize_t)(tl * tile_rowsize))
+     {
+@@ -807,7 +812,12 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8* buf,
+               tilesize, tl * tile_rowsize);
+ #endif
+     tile_buffsize = tl * tile_rowsize;
+-    } 
++    if (tl != (tile_buffsize / tile_rowsize))
++    {
++    	TIFFError("readContigTilesIntoBuffer", "Integer overflow when calculating buffer size.");
++        exit(-1);
++    }
++    }
+ 
+   tilebuf = _TIFFmalloc(tile_buffsize);
+   if (tilebuf == 0)
+@@ -1210,6 +1220,12 @@ static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
+       !TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps) )
+       return 1;
+ 
++  if (tilesize == 0 || tile_rowsize == 0 || tl == 0 || tw == 0)
++  {
++    TIFFError("writeBufferToContigTiles", "Tile size, tile row size, tile width, or tile length is zero");
++    exit(-1);
++  }
++  
+   tile_buffsize = tilesize;
+   if (tilesize < (tsize_t)(tl * tile_rowsize))
+     {
+@@ -1219,6 +1235,11 @@ static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
+               tilesize, tl * tile_rowsize);
+ #endif
+     tile_buffsize = tl * tile_rowsize;
++    if (tl != tile_buffsize / tile_rowsize)
++    {
++	TIFFError("writeBufferToContigTiles", "Integer overflow when calculating buffer size");
++	exit(-1);
++    }
+     }
+ 
+   tilebuf = _TIFFmalloc(tile_buffsize);
+@@ -5945,12 +5966,27 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c
+     TIFFGetField(in, TIFFTAG_TILELENGTH, &tl);
+ 
+     tile_rowsize  = TIFFTileRowSize(in);      
++    if (ntiles == 0 || tlsize == 0 || tile_rowsize == 0)
++    {
++	TIFFError("loadImage", "File appears to be tiled, but the number of tiles, tile size, or tile rowsize is zero.");
++	exit(-1);
++    }
+     buffsize = tlsize * ntiles;
++    if (tlsize != (buffsize / ntiles))
++    {
++	TIFFError("loadImage", "Integer overflow when calculating buffer size");
++	exit(-1);
++    }
+ 
+-        
+     if (buffsize < (uint32)(ntiles * tl * tile_rowsize))
+       {
+       buffsize = ntiles * tl * tile_rowsize;
++      if (ntiles != (buffsize / tl / tile_rowsize))
++      {
++	TIFFError("loadImage", "Integer overflow when calculating buffer size");
++	exit(-1);
++      }
++      
+ #ifdef DEBUG2
+       TIFFError("loadImage",
+ 	        "Tilesize %u is too small, using ntiles * tilelength * tilerowsize %lu",
+@@ -5969,8 +6005,25 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c
+     TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
+     stsize = TIFFStripSize(in);
+     nstrips = TIFFNumberOfStrips(in);
++    if (nstrips == 0 || stsize == 0)
++    {
++	TIFFError("loadImage", "File appears to be striped, but the number of stipes or stripe size is zero.");
++	exit(-1);
++    }
++
+     buffsize = stsize * nstrips;
+-    
++    if (stsize != (buffsize / nstrips))
++    {
++	TIFFError("loadImage", "Integer overflow when calculating buffer size");
++	exit(-1);
++    }
++    uint32 buffsize_check;
++    buffsize_check = ((length * width * spp * bps) + 7);
++    if (length != ((buffsize_check - 7) / width / spp / bps))
++    {
++	TIFFError("loadImage", "Integer overflow detected.");
++	exit(-1);
++    }
+     if (buffsize < (uint32) (((length * width * spp * bps) + 7) / 8))
+       {
+       buffsize =  ((length * width * spp * bps) + 7) / 8;
+-- 
+2.7.4
+

index dfb2996..713cf24 100644
@@ -12,6 +12,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
            file://CVE-2016-5323.patch \
            file://CVE-2016-3945.patch \
            file://CVE-2016-3990.patch \
+           file://CVE-2016-3991.patch \
           "
 
 SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72"

new file mode 100644
index 0000000..f554ac5
@@ -0,0 +1,52 @@
+From bd024f07019f5d9fea236675607a69f74a66bc7b Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Mon, 15 Aug 2016 21:26:56 +0000
+Subject: [PATCH] * tools/rgb2ycbcr.c: validate values of -v and -h parameters
+ to avoid potential divide by zero. Fixes CVE-2016-3623 (bugzilla #2569)
+
+CVE: CVE-2016-3623
+Upstream-Status: Backport
+https://github.com/vadz/libtiff/commit/bd024f07019f5d9fea236675607a69f74a66bc7b
+
+Signed-off-by: Yi Zhao <[email protected]>
+---
+ ChangeLog         | 5 +++++
+ tools/rgb2ycbcr.c | 4 ++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/ChangeLog b/ChangeLog
+index 5d60608..3e6642a 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,5 +1,10 @@
+ 2016-08-15 Even Rouault <even.rouault at spatialys.com>
+ 
++	* tools/rgb2ycbcr.c: validate values of -v and -h parameters to
++	avoid potential divide by zero. Fixes CVE-2016-3623 (bugzilla #2569)
++
++2016-08-15 Even Rouault <even.rouault at spatialys.com>
++
+ 	* tools/tiffcrop.c: Fix out-of-bounds write in loadImage().
+ 	From patch libtiff-CVE-2016-3991.patch from
+ 	libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro (bugzilla #2543)
+diff --git a/tools/rgb2ycbcr.c b/tools/rgb2ycbcr.c
+index 3829d6b..51f4259 100644
+--- a/tools/rgb2ycbcr.c
++++ b/tools/rgb2ycbcr.c
+@@ -95,9 +95,13 @@ main(int argc, char* argv[])
+ 			break;
+ 		case 'h':
+ 			horizSubSampling = atoi(optarg);
++            if( horizSubSampling != 1 && horizSubSampling != 2 && horizSubSampling != 4 )
++                usage(-1);
+ 			break;
+ 		case 'v':
+ 			vertSubSampling = atoi(optarg);
++            if( vertSubSampling != 1 && vertSubSampling != 2 && vertSubSampling != 4 )
++                usage(-1);
+ 			break;
+ 		case 'r':
+ 			rowsperstrip = atoi(optarg);
+-- 
+2.7.4
+

index 713cf24..466dfbb 100644
@@ -13,6 +13,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
            file://CVE-2016-3945.patch \
            file://CVE-2016-3990.patch \
            file://CVE-2016-3991.patch \
+           file://CVE-2016-3623.patch \
           "
 
 SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72"

new file mode 100644
index 0000000..0c8b716
@@ -0,0 +1,129 @@
+From 92d966a5fcfbdca67957c8c5c47b467aa650b286 Mon Sep 17 00:00:00 2001
+From: bfriesen <bfriesen>
+Date: Sat, 24 Sep 2016 23:11:55 +0000
+Subject: [PATCH] * libtiff/tif_getimage.c (TIFFRGBAImageOK): Reject attempts
+ to read floating point images.
+
+* libtiff/tif_predict.c (PredictorSetup): Enforce bits-per-sample
+requirements of floating point predictor (3).  Fixes CVE-2016-3622
+"Divide By Zero in the tiff2rgba tool."
+
+CVE: CVE-2016-3622
+Upstream-Status: Backport
+https://github.com/vadz/libtiff/commit/92d966a5fcfbdca67957c8c5c47b467aa650b286
+
+Signed-off-by: Yi Zhao <[email protected]>
+---
+ ChangeLog              | 11 ++++++++++-
+ libtiff/tif_getimage.c | 38 ++++++++++++++++++++------------------
+ libtiff/tif_predict.c  | 11 ++++++++++-
+ 3 files changed, 40 insertions(+), 20 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index 26d6f47..a628277 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,12 @@
++2016-09-24  Bob Friesenhahn  <[email protected]>
++
++	* libtiff/tif_getimage.c (TIFFRGBAImageOK): Reject attempts to
++	read floating point images.
++
++	* libtiff/tif_predict.c (PredictorSetup): Enforce bits-per-sample
++	requirements of floating point predictor (3).  Fixes CVE-2016-3622
++	"Divide By Zero in the tiff2rgba tool."
++
+ 2016-08-15 Even Rouault <even.rouault at spatialys.com>
+ 
+ 	* tools/rgb2ycbcr.c: validate values of -v and -h parameters to
+diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
+index 386cee0..3e689ee 100644
+--- a/libtiff/tif_getimage.c
++++ b/libtiff/tif_getimage.c
+@@ -95,6 +95,10 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
+ 			    td->td_bitspersample);
+ 			return (0);
+ 	}
++        if (td->td_sampleformat == SAMPLEFORMAT_IEEEFP) {
++                sprintf(emsg, "Sorry, can not handle images with IEEE floating-point samples");
++                return (0);
++        }
+ 	colorchannels = td->td_samplesperpixel - td->td_extrasamples;
+ 	if (!TIFFGetField(tif, TIFFTAG_PHOTOMETRIC, &photometric)) {
+ 		switch (colorchannels) {
+@@ -182,27 +186,25 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
+ 				    "Planarconfiguration", td->td_planarconfig);
+ 				return (0);
+ 			}
+-			if( td->td_samplesperpixel != 3 || colorchannels != 3 )
+-            {
+-                sprintf(emsg,
+-                        "Sorry, can not handle image with %s=%d, %s=%d",
+-                        "Samples/pixel", td->td_samplesperpixel,
+-                        "colorchannels", colorchannels);
+-                return 0;
+-            }
++			if ( td->td_samplesperpixel != 3 || colorchannels != 3 ) {
++                                sprintf(emsg,
++                                        "Sorry, can not handle image with %s=%d, %s=%d",
++                                        "Samples/pixel", td->td_samplesperpixel,
++                                        "colorchannels", colorchannels);
++                                return 0;
++                        }
+ 			break;
+ 		case PHOTOMETRIC_CIELAB:
+-            if( td->td_samplesperpixel != 3 || colorchannels != 3 || td->td_bitspersample != 8 )
+-            {
+-                sprintf(emsg,
+-                        "Sorry, can not handle image with %s=%d, %s=%d and %s=%d",
+-                        "Samples/pixel", td->td_samplesperpixel,
+-                        "colorchannels", colorchannels,
+-                        "Bits/sample", td->td_bitspersample);
+-                return 0;
+-            }
++                        if ( td->td_samplesperpixel != 3 || colorchannels != 3 || td->td_bitspersample != 8 ) {
++                                sprintf(emsg,
++                                        "Sorry, can not handle image with %s=%d, %s=%d and %s=%d",
++                                        "Samples/pixel", td->td_samplesperpixel,
++                                        "colorchannels", colorchannels,
++                                        "Bits/sample", td->td_bitspersample);
++                                return 0;
++                        }
+ 			break;
+-		default:
++                default:
+ 			sprintf(emsg, "Sorry, can not handle image with %s=%d",
+ 			    photoTag, photometric);
+ 			return (0);
+diff --git a/libtiff/tif_predict.c b/libtiff/tif_predict.c
+index 081eb11..555f2f9 100644
+--- a/libtiff/tif_predict.c
++++ b/libtiff/tif_predict.c
+@@ -80,6 +80,15 @@ PredictorSetup(TIFF* tif)
+ 				    td->td_sampleformat);
+ 				return 0;
+ 			}
++                        if (td->td_bitspersample != 16
++                            && td->td_bitspersample != 24
++                            && td->td_bitspersample != 32
++                            && td->td_bitspersample != 64) { /* Should 64 be allowed? */
++                                TIFFErrorExt(tif->tif_clientdata, module,
++                                             "Floating point \"Predictor\" not supported with %d-bit samples",
++                                             td->td_bitspersample);
++				return 0;
++                            }
+ 			break;
+ 		default:
+ 			TIFFErrorExt(tif->tif_clientdata, module,
+@@ -174,7 +183,7 @@ PredictorSetupDecode(TIFF* tif)
+ 		}
+ 		/*
+ 		 * Allocate buffer to keep the decoded bytes before
+-		 * rearranging in the ight order
++		 * rearranging in the right order
+ 		 */
+ 	}
+ 
+-- 
+2.7.4
+

index 466dfbb..796d86e 100644
@@ -14,6 +14,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
            file://CVE-2016-3990.patch \
            file://CVE-2016-3991.patch \
            file://CVE-2016-3623.patch \
+           file://CVE-2016-3622.patch \
           "
 
 SRC_URI[md5sum] = "d1d2e940dea0b5ad435f21f03d96dd72"