diff --git a/package/tiff/0001-don-t-skip-the-first-line-of-the-input-image.patch b/package/tiff/0001-don-t-skip-the-first-line-of-the-input-image.patch new file mode 100644 index 0000000000..bdf4bd8e94 --- /dev/null +++ b/package/tiff/0001-don-t-skip-the-first-line-of-the-input-image.patch @@ -0,0 +1,61 @@ +From 3994cf3b3bc6b54c32f240ca5a412cffa11633fa Mon Sep 17 00:00:00 2001 +From: Lee Howard +Date: Mon, 19 May 2025 10:53:30 -0700 +Subject: [PATCH] Don't skip the first line of the input image. Addresses + issue #703 + +Upstream: https://gitlab.com/libtiff/libtiff/-/commit/3994cf3b3bc6b54c32f240ca5a412cffa11633fa +CVE: CVE-2025-8176 +Signed-off-by: Thomas Perale +--- + tools/tiffdither.c | 4 ++-- + tools/tiffmedian.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/tiffdither.c b/tools/tiffdither.c +index 714fe03d4..bfed6df18 100644 +--- a/tools/tiffdither.c ++++ b/tools/tiffdither.c +@@ -98,7 +98,7 @@ static int fsdither(TIFF *in, TIFF *out) + nextptr = nextline; + for (j = 0; j < imagewidth; ++j) + *nextptr++ = *inptr++; +- for (i = 1; i < imagelength; ++i) ++ for (i = 0; i < imagelength; ++i) + { + tmpptr = thisline; + thisline = nextline; +@@ -146,7 +146,7 @@ static int fsdither(TIFF *in, TIFF *out) + nextptr[0] += v / 16; + } + } +- if (TIFFWriteScanline(out, outline, i - 1, 0) < 0) ++ if (TIFFWriteScanline(out, outline, i, 0) < 0) + goto skip_on_error; + } + goto exit_label; +diff --git a/tools/tiffmedian.c b/tools/tiffmedian.c +index 02b0bc2b4..f6cf26c2c 100644 +--- a/tools/tiffmedian.c ++++ b/tools/tiffmedian.c +@@ -917,7 +917,7 @@ static void quant_fsdither(TIFF *in, TIFF *out) + outline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out)); + + GetInputLine(in, 0, goto bad); /* get first line */ +- for (i = 1; i <= imagelength; ++i) ++ for (i = 0; i <= imagelength; ++i) + { + SWAP(short *, thisline, nextline); + lastline = (i >= imax); +@@ -997,7 +997,7 @@ static void quant_fsdither(TIFF *in, TIFF *out) + nextptr += 3; + } + } +- if (TIFFWriteScanline(out, outline, i - 1, 0) < 0) ++ if (TIFFWriteScanline(out, outline, i, 0) < 0) + break; + } + bad: +-- +GitLab + diff --git a/package/tiff/0002-fix-tiffmedian-bug.patch b/package/tiff/0002-fix-tiffmedian-bug.patch new file mode 100644 index 0000000000..880bade7d8 --- /dev/null +++ b/package/tiff/0002-fix-tiffmedian-bug.patch @@ -0,0 +1,31 @@ +From ce46f002eca4148497363f80fab33f9396bcbeda Mon Sep 17 00:00:00 2001 +From: Lee Howard +Date: Sat, 24 May 2025 21:25:16 -0700 +Subject: [PATCH] Fix tiffmedian bug #707 + +Upstream: https://gitlab.com/libtiff/libtiff/-/merge_requests/727/diffs?commit_id=ce46f002eca4148497363f80fab33f9396bcbeda +CVE: CVE-2025-8176 +Signed-off-by: Thomas Perale +--- + tools/tiffmedian.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/tiffmedian.c b/tools/tiffmedian.c +index f6cf26c2c..8c9978bab 100644 +--- a/tools/tiffmedian.c ++++ b/tools/tiffmedian.c +@@ -414,7 +414,10 @@ static void get_histogram(TIFF *in, Colorbox *box) + for (i = 0; i < imagelength; i++) + { + if (TIFFReadScanline(in, inputline, i, 0) <= 0) +- break; ++ { ++ fprintf(stderr, "Error reading scanline\n"); ++ exit(EXIT_FAILURE); ++ } + inptr = inputline; + for (j = imagewidth; j-- > 0;) + { +-- +GitLab + diff --git a/package/tiff/0003-conflict-resolution.patch b/package/tiff/0003-conflict-resolution.patch new file mode 100644 index 0000000000..0c16aa3271 --- /dev/null +++ b/package/tiff/0003-conflict-resolution.patch @@ -0,0 +1,28 @@ +From ecc4ddbf1f0fed7957d1e20361e37f01907898e0 Mon Sep 17 00:00:00 2001 +From: Lee Howard +Date: Sat, 24 May 2025 21:38:09 -0700 +Subject: [PATCH] conflict resolution + +Upstream: https://gitlab.com/libtiff/libtiff/-/merge_requests/727/diffs?commit_id=ecc4ddbf1f0fed7957d1e20361e37f01907898e0 +CVE: CVE-2025-8176 +Signed-off-by: Thomas Perale +--- + tools/tiffmedian.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/tiffmedian.c b/tools/tiffmedian.c +index 8c9978bab..47e0524bc 100644 +--- a/tools/tiffmedian.c ++++ b/tools/tiffmedian.c +@@ -920,7 +920,7 @@ static void quant_fsdither(TIFF *in, TIFF *out) + outline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out)); + + GetInputLine(in, 0, goto bad); /* get first line */ +- for (i = 0; i <= imagelength; ++i) ++ for (i = 0; i < imagelength; ++i) + { + SWAP(short *, thisline, nextline); + lastline = (i >= imax); +-- +GitLab + diff --git a/package/tiff/tiff.mk b/package/tiff/tiff.mk index 5d7219d7da..bd95fdca7f 100644 --- a/package/tiff/tiff.mk +++ b/package/tiff/tiff.mk @@ -13,6 +13,9 @@ TIFF_CPE_ID_VENDOR = libtiff TIFF_CPE_ID_PRODUCT = libtiff TIFF_INSTALL_STAGING = YES +# 0001-don-t-skip-the-first-line-of-the-input-image.patch, 0002-fix-tiffmedian-bug.patch, 0003-conflict-resolution.patch +TIFF_IGNORE_CVES += CVE-2025-8176 + # webp has a (optional) dependency on tiff, so we can't have webp # support in tiff, or that would create a circular dependency. TIFF_CONF_OPTS = \