tiff: bump version to 4.0.8
Patch 0001 already included in this release:438274f938
Patch 0002 already included in this release:43bc256d8a
Patch 0003 already included in this release:1044b43637
Patch 0004 already included in this release:9a72a69e03
Patch 0005 already included in this release:5c080298d5
Patch 0006 already included in this release:48780b4fcc
Patch 0007 already included in this release:d60332057b
Patch 0008 already included in this release:2ea32f7372
Patch 0009 already included in this release:8283e4d1b7
Patch 0010 already included in this release:47f2fb61a3
Patch 0011 already included in this release:3cfd62d77c
Patch 0012 already included in this release:0a76a8c765
Patch 0013 already included in this release:66e7bd5952
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
This commit is contained in:
parent
de993bc23a
commit
3301fbb516
|
@ -1,46 +0,0 @@
|
||||||
From 438274f938e046d33cb0e1230b41da32ffe223e1 Mon Sep 17 00:00:00 2001
|
|
||||||
From: erouault <erouault>
|
|
||||||
Date: Fri, 2 Dec 2016 21:56:56 +0000
|
|
||||||
Subject: [PATCH] * libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow
|
|
||||||
in TIFFReadEncodedStrip() that caused an integer division by zero. Reported
|
|
||||||
by Agostino Sarubbo. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2596
|
|
||||||
|
|
||||||
Fixes CVE-2016-10266
|
|
||||||
|
|
||||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
||||||
---
|
|
||||||
libtiff/tif_read.c | 2 +-
|
|
||||||
libtiff/tiffiop.h | 4 ++++
|
|
||||||
2 files changed, 12 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
|
|
||||||
index c26c55f4..52bbf507 100644
|
|
||||||
--- a/libtiff/tif_read.c
|
|
||||||
+++ b/libtiff/tif_read.c
|
|
||||||
@@ -346,7 +346,7 @@ TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
|
|
||||||
rowsperstrip=td->td_rowsperstrip;
|
|
||||||
if (rowsperstrip>td->td_imagelength)
|
|
||||||
rowsperstrip=td->td_imagelength;
|
|
||||||
- stripsperplane=((td->td_imagelength+rowsperstrip-1)/rowsperstrip);
|
|
||||||
+ stripsperplane= TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip);
|
|
||||||
stripinplane=(strip%stripsperplane);
|
|
||||||
plane=(uint16)(strip/stripsperplane);
|
|
||||||
rows=td->td_imagelength-stripinplane*rowsperstrip;
|
|
||||||
diff --git a/libtiff/tiffiop.h b/libtiff/tiffiop.h
|
|
||||||
index ffbb647b..cb59460a 100644
|
|
||||||
--- a/libtiff/tiffiop.h
|
|
||||||
+++ b/libtiff/tiffiop.h
|
|
||||||
@@ -250,6 +250,10 @@ struct tiff {
|
|
||||||
#define TIFFhowmany_32(x, y) (((uint32)x < (0xffffffff - (uint32)(y-1))) ? \
|
|
||||||
((((uint32)(x))+(((uint32)(y))-1))/((uint32)(y))) : \
|
|
||||||
0U)
|
|
||||||
+/* Variant of TIFFhowmany_32() that doesn't return 0 if x close to MAXUINT. */
|
|
||||||
+/* Caution: TIFFhowmany_32_maxuint_compat(x,y)*y might overflow */
|
|
||||||
+#define TIFFhowmany_32_maxuint_compat(x, y) \
|
|
||||||
+ (((uint32)(x) / (uint32)(y)) + ((((uint32)(x) % (uint32)(y)) != 0) ? 1 : 0))
|
|
||||||
#define TIFFhowmany8_32(x) (((x)&0x07)?((uint32)(x)>>3)+1:(uint32)(x)>>3)
|
|
||||||
#define TIFFroundup_32(x, y) (TIFFhowmany_32(x,y)*(y))
|
|
||||||
#define TIFFhowmany_64(x, y) ((((uint64)(x))+(((uint64)(y))-1))/((uint64)(y)))
|
|
||||||
--
|
|
||||||
2.11.0
|
|
||||||
|
|
|
@ -1,53 +0,0 @@
|
||||||
From 43bc256d8ae44b92d2734a3c5bc73957a4d7c1ec Mon Sep 17 00:00:00 2001
|
|
||||||
From: erouault <erouault>
|
|
||||||
Date: Sat, 3 Dec 2016 11:15:18 +0000
|
|
||||||
Subject: [PATCH] * libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case
|
|
||||||
of failure in OJPEGPreDecode(). This will avoid a divide by zero, and
|
|
||||||
potential other issues. Reported by Agostino Sarubbo. Fixes
|
|
||||||
http://bugzilla.maptools.org/show_bug.cgi?id=2611
|
|
||||||
|
|
||||||
Fixes CVE-2016-10267
|
|
||||||
|
|
||||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
||||||
---
|
|
||||||
libtiff/tif_ojpeg.c | 8 ++++++++
|
|
||||||
1 files changed, 15 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
|
|
||||||
index 1ccc3f9b..f19e8fd0 100644
|
|
||||||
--- a/libtiff/tif_ojpeg.c
|
|
||||||
+++ b/libtiff/tif_ojpeg.c
|
|
||||||
@@ -244,6 +244,7 @@ typedef enum {
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
TIFF* tif;
|
|
||||||
+ int decoder_ok;
|
|
||||||
#ifndef LIBJPEG_ENCAP_EXTERNAL
|
|
||||||
JMP_BUF exit_jmpbuf;
|
|
||||||
#endif
|
|
||||||
@@ -722,6 +723,7 @@ OJPEGPreDecode(TIFF* tif, uint16 s)
|
|
||||||
}
|
|
||||||
sp->write_curstrile++;
|
|
||||||
}
|
|
||||||
+ sp->decoder_ok = 1;
|
|
||||||
return(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -784,8 +786,14 @@ OJPEGPreDecodeSkipScanlines(TIFF* tif)
|
|
||||||
static int
|
|
||||||
OJPEGDecode(TIFF* tif, uint8* buf, tmsize_t cc, uint16 s)
|
|
||||||
{
|
|
||||||
+ static const char module[]="OJPEGDecode";
|
|
||||||
OJPEGState* sp=(OJPEGState*)tif->tif_data;
|
|
||||||
(void)s;
|
|
||||||
+ if( !sp->decoder_ok )
|
|
||||||
+ {
|
|
||||||
+ TIFFErrorExt(tif->tif_clientdata,module,"Cannot decode: decoder not correctly initialized");
|
|
||||||
+ return 0;
|
|
||||||
+ }
|
|
||||||
if (sp->libjpeg_jpeg_query_style==0)
|
|
||||||
{
|
|
||||||
if (OJPEGDecodeRaw(tif,buf,cc)==0)
|
|
||||||
--
|
|
||||||
2.11.0
|
|
||||||
|
|
|
@ -1,110 +0,0 @@
|
||||||
From 1044b43637fa7f70fb19b93593777b78bd20da86 Mon Sep 17 00:00:00 2001
|
|
||||||
From: erouault <erouault>
|
|
||||||
Date: Fri, 2 Dec 2016 23:05:51 +0000
|
|
||||||
Subject: [PATCH] * libtiff/tif_pixarlog.c, libtiff/tif_luv.c: fix heap-based
|
|
||||||
buffer overflow on generation of PixarLog / LUV compressed files, with
|
|
||||||
ColorMap, TransferFunction attached and nasty plays with bitspersample. The
|
|
||||||
fix for LUV has not been tested, but suffers from the same kind of issue of
|
|
||||||
PixarLog. Reported by Agostino Sarubbo. Fixes
|
|
||||||
http://bugzilla.maptools.org/show_bug.cgi?id=2604
|
|
||||||
|
|
||||||
Fixes CVE-2016-10269
|
|
||||||
|
|
||||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
||||||
---
|
|
||||||
libtiff/tif_luv.c | 18 ++++++++++++++----
|
|
||||||
libtiff/tif_pixarlog.c | 17 +++++++++++++++--
|
|
||||||
2 files changed, 39 insertions(+), 6 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/libtiff/tif_luv.c b/libtiff/tif_luv.c
|
|
||||||
index f68a9b13..e6783db5 100644
|
|
||||||
--- a/libtiff/tif_luv.c
|
|
||||||
+++ b/libtiff/tif_luv.c
|
|
||||||
@@ -158,6 +158,7 @@
|
|
||||||
typedef struct logLuvState LogLuvState;
|
|
||||||
|
|
||||||
struct logLuvState {
|
|
||||||
+ int encoder_state; /* 1 if encoder correctly initialized */
|
|
||||||
int user_datafmt; /* user data format */
|
|
||||||
int encode_meth; /* encoding method */
|
|
||||||
int pixel_size; /* bytes per pixel */
|
|
||||||
@@ -1552,6 +1553,7 @@ LogLuvSetupEncode(TIFF* tif)
|
|
||||||
td->td_photometric, "must be either LogLUV or LogL");
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
+ sp->encoder_state = 1;
|
|
||||||
return (1);
|
|
||||||
notsupported:
|
|
||||||
TIFFErrorExt(tif->tif_clientdata, module,
|
|
||||||
@@ -1563,19 +1565,27 @@ notsupported:
|
|
||||||
static void
|
|
||||||
LogLuvClose(TIFF* tif)
|
|
||||||
{
|
|
||||||
+ LogLuvState* sp = (LogLuvState*) tif->tif_data;
|
|
||||||
TIFFDirectory *td = &tif->tif_dir;
|
|
||||||
|
|
||||||
+ assert(sp != 0);
|
|
||||||
/*
|
|
||||||
* For consistency, we always want to write out the same
|
|
||||||
* bitspersample and sampleformat for our TIFF file,
|
|
||||||
* regardless of the data format being used by the application.
|
|
||||||
* Since this routine is called after tags have been set but
|
|
||||||
* before they have been recorded in the file, we reset them here.
|
|
||||||
+ * Note: this is really a nasty approach. See PixarLogClose
|
|
||||||
*/
|
|
||||||
- td->td_samplesperpixel =
|
|
||||||
- (td->td_photometric == PHOTOMETRIC_LOGL) ? 1 : 3;
|
|
||||||
- td->td_bitspersample = 16;
|
|
||||||
- td->td_sampleformat = SAMPLEFORMAT_INT;
|
|
||||||
+ if( sp->encoder_state )
|
|
||||||
+ {
|
|
||||||
+ /* See PixarLogClose. Might avoid issues with tags whose size depends
|
|
||||||
+ * on those below, but not completely sure this is enough. */
|
|
||||||
+ td->td_samplesperpixel =
|
|
||||||
+ (td->td_photometric == PHOTOMETRIC_LOGL) ? 1 : 3;
|
|
||||||
+ td->td_bitspersample = 16;
|
|
||||||
+ td->td_sampleformat = SAMPLEFORMAT_INT;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
static void
|
|
||||||
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
|
|
||||||
index d1246c3d..aa99bc92 100644
|
|
||||||
--- a/libtiff/tif_pixarlog.c
|
|
||||||
+++ b/libtiff/tif_pixarlog.c
|
|
||||||
@@ -1233,8 +1233,10 @@ PixarLogPostEncode(TIFF* tif)
|
|
||||||
static void
|
|
||||||
PixarLogClose(TIFF* tif)
|
|
||||||
{
|
|
||||||
+ PixarLogState* sp = (PixarLogState*) tif->tif_data;
|
|
||||||
TIFFDirectory *td = &tif->tif_dir;
|
|
||||||
|
|
||||||
+ assert(sp != 0);
|
|
||||||
/* In a really sneaky (and really incorrect, and untruthful, and
|
|
||||||
* troublesome, and error-prone) maneuver that completely goes against
|
|
||||||
* the spirit of TIFF, and breaks TIFF, on close, we covertly
|
|
||||||
@@ -1243,8 +1245,19 @@ PixarLogClose(TIFF* tif)
|
|
||||||
* readers that don't know about PixarLog, or how to set
|
|
||||||
* the PIXARLOGDATFMT pseudo-tag.
|
|
||||||
*/
|
|
||||||
- td->td_bitspersample = 8;
|
|
||||||
- td->td_sampleformat = SAMPLEFORMAT_UINT;
|
|
||||||
+
|
|
||||||
+ if (sp->state&PLSTATE_INIT) {
|
|
||||||
+ /* We test the state to avoid an issue such as in
|
|
||||||
+ * http://bugzilla.maptools.org/show_bug.cgi?id=2604
|
|
||||||
+ * What appends in that case is that the bitspersample is 1 and
|
|
||||||
+ * a TransferFunction is set. The size of the TransferFunction
|
|
||||||
+ * depends on 1<<bitspersample. So if we increase it, an access
|
|
||||||
+ * out of the buffer will happen at directory flushing.
|
|
||||||
+ * Another option would be to clear those targs.
|
|
||||||
+ */
|
|
||||||
+ td->td_bitspersample = 8;
|
|
||||||
+ td->td_sampleformat = SAMPLEFORMAT_UINT;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
static void
|
|
||||||
--
|
|
||||||
2.11.0
|
|
||||||
|
|
|
@ -1,107 +0,0 @@
|
||||||
From 9a72a69e035ee70ff5c41541c8c61cd97990d018 Mon Sep 17 00:00:00 2001
|
|
||||||
From: erouault <erouault>
|
|
||||||
Date: Sat, 3 Dec 2016 11:02:15 +0000
|
|
||||||
Subject: [PATCH] * libtiff/tif_dirread.c: modify
|
|
||||||
ChopUpSingleUncompressedStrip() to instanciate compute ntrips as
|
|
||||||
TIFFhowmany_32(td->td_imagelength, rowsperstrip), instead of a logic based on
|
|
||||||
the total size of data. Which is faulty is the total size of data is not
|
|
||||||
sufficient to fill the whole image, and thus results in reading outside of
|
|
||||||
the StripByCounts/StripOffsets arrays when using TIFFReadScanline(). Reported
|
|
||||||
by Agostino Sarubbo. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2608.
|
|
||||||
|
|
||||||
* libtiff/tif_strip.c: revert the change in TIFFNumberOfStrips() done
|
|
||||||
for http://bugzilla.maptools.org/show_bug.cgi?id=2587 / CVE-2016-9273 since
|
|
||||||
the above change is a better fix that makes it unnecessary.
|
|
||||||
|
|
||||||
Fixes CVE-2016-10270
|
|
||||||
|
|
||||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
||||||
---
|
|
||||||
libtiff/tif_dirread.c | 22 ++++++++++------------
|
|
||||||
libtiff/tif_strip.c | 9 ---------
|
|
||||||
2 files changed, 25 insertions(+), 21 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
|
|
||||||
index 3eec79c9..570d0c32 100644
|
|
||||||
--- a/libtiff/tif_dirread.c
|
|
||||||
+++ b/libtiff/tif_dirread.c
|
|
||||||
@@ -5502,8 +5502,7 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
|
|
||||||
uint64 rowblockbytes;
|
|
||||||
uint64 stripbytes;
|
|
||||||
uint32 strip;
|
|
||||||
- uint64 nstrips64;
|
|
||||||
- uint32 nstrips32;
|
|
||||||
+ uint32 nstrips;
|
|
||||||
uint32 rowsperstrip;
|
|
||||||
uint64* newcounts;
|
|
||||||
uint64* newoffsets;
|
|
||||||
@@ -5534,18 +5533,17 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
|
|
||||||
return;
|
|
||||||
|
|
||||||
/*
|
|
||||||
- * never increase the number of strips in an image
|
|
||||||
+ * never increase the number of rows per strip
|
|
||||||
*/
|
|
||||||
if (rowsperstrip >= td->td_rowsperstrip)
|
|
||||||
return;
|
|
||||||
- nstrips64 = TIFFhowmany_64(bytecount, stripbytes);
|
|
||||||
- if ((nstrips64==0)||(nstrips64>0xFFFFFFFF)) /* something is wonky, do nothing. */
|
|
||||||
- return;
|
|
||||||
- nstrips32 = (uint32)nstrips64;
|
|
||||||
+ nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
|
|
||||||
+ if( nstrips == 0 )
|
|
||||||
+ return;
|
|
||||||
|
|
||||||
- newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
|
|
||||||
+ newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
|
|
||||||
"for chopped \"StripByteCounts\" array");
|
|
||||||
- newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
|
|
||||||
+ newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
|
|
||||||
"for chopped \"StripOffsets\" array");
|
|
||||||
if (newcounts == NULL || newoffsets == NULL) {
|
|
||||||
/*
|
|
||||||
@@ -5562,18 +5560,18 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
|
|
||||||
* Fill the strip information arrays with new bytecounts and offsets
|
|
||||||
* that reflect the broken-up format.
|
|
||||||
*/
|
|
||||||
- for (strip = 0; strip < nstrips32; strip++) {
|
|
||||||
+ for (strip = 0; strip < nstrips; strip++) {
|
|
||||||
if (stripbytes > bytecount)
|
|
||||||
stripbytes = bytecount;
|
|
||||||
newcounts[strip] = stripbytes;
|
|
||||||
- newoffsets[strip] = offset;
|
|
||||||
+ newoffsets[strip] = stripbytes ? offset : 0;
|
|
||||||
offset += stripbytes;
|
|
||||||
bytecount -= stripbytes;
|
|
||||||
}
|
|
||||||
/*
|
|
||||||
* Replace old single strip info with multi-strip info.
|
|
||||||
*/
|
|
||||||
- td->td_stripsperimage = td->td_nstrips = nstrips32;
|
|
||||||
+ td->td_stripsperimage = td->td_nstrips = nstrips;
|
|
||||||
TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
|
|
||||||
|
|
||||||
_TIFFfree(td->td_stripbytecount);
|
|
||||||
diff --git a/libtiff/tif_strip.c b/libtiff/tif_strip.c
|
|
||||||
index 4c46ecf5..1676e47d 100644
|
|
||||||
--- a/libtiff/tif_strip.c
|
|
||||||
+++ b/libtiff/tif_strip.c
|
|
||||||
@@ -63,15 +63,6 @@ TIFFNumberOfStrips(TIFF* tif)
|
|
||||||
TIFFDirectory *td = &tif->tif_dir;
|
|
||||||
uint32 nstrips;
|
|
||||||
|
|
||||||
- /* If the value was already computed and store in td_nstrips, then return it,
|
|
||||||
- since ChopUpSingleUncompressedStrip might have altered and resized the
|
|
||||||
- since the td_stripbytecount and td_stripoffset arrays to the new value
|
|
||||||
- after the initial affectation of td_nstrips = TIFFNumberOfStrips() in
|
|
||||||
- tif_dirread.c ~line 3612.
|
|
||||||
- See http://bugzilla.maptools.org/show_bug.cgi?id=2587 */
|
|
||||||
- if( td->td_nstrips )
|
|
||||||
- return td->td_nstrips;
|
|
||||||
-
|
|
||||||
nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
|
|
||||||
TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
|
|
||||||
if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
|
|
||||||
--
|
|
||||||
2.11.0
|
|
||||||
|
|
|
@ -1,74 +0,0 @@
|
||||||
From 5c080298d59efa53264d7248bbe3a04660db6ef7 Mon Sep 17 00:00:00 2001
|
|
||||||
From: erouault <erouault>
|
|
||||||
Date: Wed, 11 Jan 2017 19:25:44 +0000
|
|
||||||
Subject: [PATCH] * tools/tiffcp.c: error out cleanly in cpContig2SeparateByRow
|
|
||||||
and cpSeparate2ContigByRow if BitsPerSample != 8 to avoid heap based
|
|
||||||
overflow. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2656 and
|
|
||||||
http://bugzilla.maptools.org/show_bug.cgi?id=2657
|
|
||||||
|
|
||||||
Fixes CVE-2017-5225
|
|
||||||
|
|
||||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
||||||
---
|
|
||||||
tools/tiffcp.c | 24 ++++++++++++++++++++++--
|
|
||||||
1 file changed, 29 insertions(+), 2 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/tools/tiffcp.c b/tools/tiffcp.c
|
|
||||||
index bdf754c3..8bbcd52f 100644
|
|
||||||
--- a/tools/tiffcp.c
|
|
||||||
+++ b/tools/tiffcp.c
|
|
||||||
@@ -591,7 +591,7 @@ static copyFunc pickCopyFunc(TIFF*, TIFF*, uint16, uint16);
|
|
||||||
static int
|
|
||||||
tiffcp(TIFF* in, TIFF* out)
|
|
||||||
{
|
|
||||||
- uint16 bitspersample, samplesperpixel = 1;
|
|
||||||
+ uint16 bitspersample = 1, samplesperpixel = 1;
|
|
||||||
uint16 input_compression, input_photometric = PHOTOMETRIC_MINISBLACK;
|
|
||||||
copyFunc cf;
|
|
||||||
uint32 width, length;
|
|
||||||
@@ -1067,6 +1067,16 @@ DECLAREcpFunc(cpContig2SeparateByRow)
|
|
||||||
register uint32 n;
|
|
||||||
uint32 row;
|
|
||||||
tsample_t s;
|
|
||||||
+ uint16 bps = 0;
|
|
||||||
+
|
|
||||||
+ (void) TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps);
|
|
||||||
+ if( bps != 8 )
|
|
||||||
+ {
|
|
||||||
+ TIFFError(TIFFFileName(in),
|
|
||||||
+ "Error, can only handle BitsPerSample=8 in %s",
|
|
||||||
+ "cpContig2SeparateByRow");
|
|
||||||
+ return 0;
|
|
||||||
+ }
|
|
||||||
|
|
||||||
inbuf = _TIFFmalloc(scanlinesizein);
|
|
||||||
outbuf = _TIFFmalloc(scanlinesizeout);
|
|
||||||
@@ -1120,6 +1130,16 @@ DECLAREcpFunc(cpSeparate2ContigByRow)
|
|
||||||
register uint32 n;
|
|
||||||
uint32 row;
|
|
||||||
tsample_t s;
|
|
||||||
+ uint16 bps = 0;
|
|
||||||
+
|
|
||||||
+ (void) TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps);
|
|
||||||
+ if( bps != 8 )
|
|
||||||
+ {
|
|
||||||
+ TIFFError(TIFFFileName(in),
|
|
||||||
+ "Error, can only handle BitsPerSample=8 in %s",
|
|
||||||
+ "cpSeparate2ContigByRow");
|
|
||||||
+ return 0;
|
|
||||||
+ }
|
|
||||||
|
|
||||||
inbuf = _TIFFmalloc(scanlinesizein);
|
|
||||||
outbuf = _TIFFmalloc(scanlinesizeout);
|
|
||||||
@@ -1784,7 +1804,7 @@ pickCopyFunc(TIFF* in, TIFF* out, uint16 bitspersample, uint16 samplesperpixel)
|
|
||||||
uint32 w, l, tw, tl;
|
|
||||||
int bychunk;
|
|
||||||
|
|
||||||
- (void) TIFFGetField(in, TIFFTAG_PLANARCONFIG, &shortv);
|
|
||||||
+ (void) TIFFGetFieldDefaulted(in, TIFFTAG_PLANARCONFIG, &shortv);
|
|
||||||
if (shortv != config && bitspersample != 8 && samplesperpixel > 1) {
|
|
||||||
fprintf(stderr,
|
|
||||||
"%s: Cannot handle different planar configuration w/ bits/sample != 8\n",
|
|
||||||
--
|
|
||||||
2.11.0
|
|
||||||
|
|
|
@ -1,31 +0,0 @@
|
||||||
From 48780b4fcc425cddc4ef8ffdf536f96a0d1b313b Mon Sep 17 00:00:00 2001
|
|
||||||
From: erouault <erouault>
|
|
||||||
Date: Wed, 11 Jan 2017 16:38:26 +0000
|
|
||||||
Subject: [PATCH] libtiff/tif_getimage.c: add explicit uint32 cast in putagreytile to
|
|
||||||
avoid UndefinedBehaviorSanitizer warning.
|
|
||||||
Patch by Nicolás Peña.
|
|
||||||
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2658
|
|
||||||
|
|
||||||
Fixes CVE-2017-7592
|
|
||||||
|
|
||||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
||||||
---
|
|
||||||
libtiff/tif_getimage.c | 2 +-
|
|
||||||
1 file changed, 8 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
|
|
||||||
index fed31f1f..2fa1775c 100644
|
|
||||||
--- a/libtiff/tif_getimage.c
|
|
||||||
+++ b/libtiff/tif_getimage.c
|
|
||||||
@@ -1302,7 +1302,7 @@ DECLAREContigPutFunc(putagreytile)
|
|
||||||
while (h-- > 0) {
|
|
||||||
for (x = w; x-- > 0;)
|
|
||||||
{
|
|
||||||
- *cp++ = BWmap[*pp][0] & (*(pp+1) << 24 | ~A1);
|
|
||||||
+ *cp++ = BWmap[*pp][0] & ((uint32)*(pp+1) << 24 | ~A1);
|
|
||||||
pp += samplesperpixel;
|
|
||||||
}
|
|
||||||
cp += toskew;
|
|
||||||
--
|
|
||||||
2.11.0
|
|
||||||
|
|
|
@ -1,88 +0,0 @@
|
||||||
From d60332057b9575ada4f264489582b13e30137be1 Mon Sep 17 00:00:00 2001
|
|
||||||
From: erouault <erouault>
|
|
||||||
Date: Wed, 11 Jan 2017 19:02:49 +0000
|
|
||||||
Subject: [PATCH] * libtiff/tiffiop.h, tif_unix.c, tif_win32.c, tif_vms.c: add
|
|
||||||
_TIFFcalloc()
|
|
||||||
|
|
||||||
* libtiff/tif_read.c: TIFFReadBufferSetup(): use _TIFFcalloc() to zero
|
|
||||||
initialize tif_rawdata.
|
|
||||||
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2651
|
|
||||||
|
|
||||||
Fixes CVE-2017-7593
|
|
||||||
|
|
||||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
||||||
---
|
|
||||||
libtiff/tif_read.c | 4 +++-
|
|
||||||
libtiff/tif_unix.c | 8 ++++++++
|
|
||||||
libtiff/tif_win32.c | 8 ++++++++
|
|
||||||
libtiff/tiffio.h | 1 +
|
|
||||||
4 files changed, 36 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
|
|
||||||
index 277fdd69..4535ccb3 100644
|
|
||||||
--- a/libtiff/tif_read.c
|
|
||||||
+++ b/libtiff/tif_read.c
|
|
||||||
@@ -985,7 +985,9 @@ TIFFReadBufferSetup(TIFF* tif, void* bp, tmsize_t size)
|
|
||||||
"Invalid buffer size");
|
|
||||||
return (0);
|
|
||||||
}
|
|
||||||
- tif->tif_rawdata = (uint8*) _TIFFmalloc(tif->tif_rawdatasize);
|
|
||||||
+ /* Initialize to zero to avoid uninitialized buffers in case of */
|
|
||||||
+ /* short reads (http://bugzilla.maptools.org/show_bug.cgi?id=2651) */
|
|
||||||
+ tif->tif_rawdata = (uint8*) _TIFFcalloc(1, tif->tif_rawdatasize);
|
|
||||||
tif->tif_flags |= TIFF_MYBUFFER;
|
|
||||||
}
|
|
||||||
if (tif->tif_rawdata == NULL) {
|
|
||||||
diff --git a/libtiff/tif_unix.c b/libtiff/tif_unix.c
|
|
||||||
index 7c7bc961..89dd32e8 100644
|
|
||||||
--- a/libtiff/tif_unix.c
|
|
||||||
+++ b/libtiff/tif_unix.c
|
|
||||||
@@ -316,6 +316,14 @@ _TIFFmalloc(tmsize_t s)
|
|
||||||
return (malloc((size_t) s));
|
|
||||||
}
|
|
||||||
|
|
||||||
+void* _TIFFcalloc(tmsize_t nmemb, tmsize_t siz)
|
|
||||||
+{
|
|
||||||
+ if( nmemb == 0 || siz == 0 )
|
|
||||||
+ return ((void *) NULL);
|
|
||||||
+
|
|
||||||
+ return calloc((size_t) nmemb, (size_t)siz);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
void
|
|
||||||
_TIFFfree(void* p)
|
|
||||||
{
|
|
||||||
diff --git a/libtiff/tif_win32.c b/libtiff/tif_win32.c
|
|
||||||
index d730b3ab..3e9001b7 100644
|
|
||||||
--- a/libtiff/tif_win32.c
|
|
||||||
+++ b/libtiff/tif_win32.c
|
|
||||||
@@ -360,6 +360,14 @@ _TIFFmalloc(tmsize_t s)
|
|
||||||
return (malloc((size_t) s));
|
|
||||||
}
|
|
||||||
|
|
||||||
+void* _TIFFcalloc(tmsize_t nmemb, tmsize_t siz)
|
|
||||||
+{
|
|
||||||
+ if( nmemb == 0 || siz == 0 )
|
|
||||||
+ return ((void *) NULL);
|
|
||||||
+
|
|
||||||
+ return calloc((size_t) nmemb, (size_t)siz);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
void
|
|
||||||
_TIFFfree(void* p)
|
|
||||||
{
|
|
||||||
diff --git a/libtiff/tiffio.h b/libtiff/tiffio.h
|
|
||||||
index 732da17f..fbd9171f 100644
|
|
||||||
--- a/libtiff/tiffio.h
|
|
||||||
+++ b/libtiff/tiffio.h
|
|
||||||
@@ -293,6 +293,7 @@ extern TIFFCodec* TIFFGetConfiguredCODECs(void);
|
|
||||||
*/
|
|
||||||
|
|
||||||
extern void* _TIFFmalloc(tmsize_t s);
|
|
||||||
+extern void* _TIFFcalloc(tmsize_t nmemb, tmsize_t siz);
|
|
||||||
extern void* _TIFFrealloc(void* p, tmsize_t s);
|
|
||||||
extern void _TIFFmemset(void* p, int v, tmsize_t c);
|
|
||||||
extern void _TIFFmemcpy(void* d, const void* s, tmsize_t c);
|
|
||||||
--
|
|
||||||
2.11.0
|
|
||||||
|
|
|
@ -1,43 +0,0 @@
|
||||||
From 2ea32f7372b65c24b2816f11c04bf59b5090d05b Mon Sep 17 00:00:00 2001
|
|
||||||
From: erouault <erouault>
|
|
||||||
Date: Thu, 12 Jan 2017 19:23:20 +0000
|
|
||||||
Subject: [PATCH] * libtiff/tif_ojpeg.c: fix leak in
|
|
||||||
OJPEGReadHeaderInfoSecTablesQTable, OJPEGReadHeaderInfoSecTablesDcTable and
|
|
||||||
OJPEGReadHeaderInfoSecTablesAcTable
|
|
||||||
|
|
||||||
Fixes CVE-2017-7594
|
|
||||||
|
|
||||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
||||||
---
|
|
||||||
libtiff/tif_ojpeg.c | 6 ++++++
|
|
||||||
1 file changed, 8 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
|
|
||||||
index b92f0ebd..5f6c684c 100644
|
|
||||||
--- a/libtiff/tif_ojpeg.c
|
|
||||||
+++ b/libtiff/tif_ojpeg.c
|
|
||||||
@@ -1790,7 +1790,10 @@ OJPEGReadHeaderInfoSecTablesQTable(TIFF* tif)
|
|
||||||
TIFFSeekFile(tif,sp->qtable_offset[m],SEEK_SET);
|
|
||||||
p=(uint32)TIFFReadFile(tif,&ob[sizeof(uint32)+5],64);
|
|
||||||
if (p!=64)
|
|
||||||
+ {
|
|
||||||
+ _TIFFfree(ob);
|
|
||||||
return(0);
|
|
||||||
+ }
|
|
||||||
sp->qtable[m]=ob;
|
|
||||||
sp->sof_tq[m]=m;
|
|
||||||
}
|
|
||||||
@@ -1854,7 +1857,10 @@ OJPEGReadHeaderInfoSecTablesDcTable(TIFF* tif)
|
|
||||||
rb[sizeof(uint32)+5+n]=o[n];
|
|
||||||
p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q);
|
|
||||||
if (p!=q)
|
|
||||||
+ {
|
|
||||||
+ _TIFFfree(rb);
|
|
||||||
return(0);
|
|
||||||
+ }
|
|
||||||
sp->dctable[m]=rb;
|
|
||||||
sp->sos_tda[m]=(m<<4);
|
|
||||||
}
|
|
||||||
--
|
|
||||||
2.11.0
|
|
||||||
|
|
|
@ -1,36 +0,0 @@
|
||||||
From 8283e4d1b7e53340684d12932880cbcbaf23a8c1 Mon Sep 17 00:00:00 2001
|
|
||||||
From: erouault <erouault>
|
|
||||||
Date: Thu, 12 Jan 2017 17:43:25 +0000
|
|
||||||
Subject: [PATCH] libtiff/tif_ojpeg.c: fix leak in
|
|
||||||
OJPEGReadHeaderInfoSecTablesAcTable when read fails.
|
|
||||||
Patch by Nicolás Peña.
|
|
||||||
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2659
|
|
||||||
MIME-Version: 1.0
|
|
||||||
Content-Type: text/plain; charset=UTF-8
|
|
||||||
Content-Transfer-Encoding: 8bit
|
|
||||||
|
|
||||||
Fixes CVE-2017-7594
|
|
||||||
|
|
||||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
||||||
---
|
|
||||||
libtiff/tif_ojpeg.c | 3 +++
|
|
||||||
1 file changed, 10 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
|
|
||||||
index f19e8fd0..b92f0ebd 100644
|
|
||||||
--- a/libtiff/tif_ojpeg.c
|
|
||||||
+++ b/libtiff/tif_ojpeg.c
|
|
||||||
@@ -1918,7 +1918,10 @@ OJPEGReadHeaderInfoSecTablesAcTable(TIFF* tif)
|
|
||||||
rb[sizeof(uint32)+5+n]=o[n];
|
|
||||||
p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q);
|
|
||||||
if (p!=q)
|
|
||||||
+ {
|
|
||||||
+ _TIFFfree(rb);
|
|
||||||
return(0);
|
|
||||||
+ }
|
|
||||||
sp->actable[m]=rb;
|
|
||||||
sp->sos_tda[m]=(sp->sos_tda[m]|m);
|
|
||||||
}
|
|
||||||
--
|
|
||||||
2.11.0
|
|
||||||
|
|
|
@ -1,35 +0,0 @@
|
||||||
From 47f2fb61a3a64667bce1a8398a8fcb1b348ff122 Mon Sep 17 00:00:00 2001
|
|
||||||
From: erouault <erouault>
|
|
||||||
Date: Wed, 11 Jan 2017 12:15:01 +0000
|
|
||||||
Subject: [PATCH] * libtiff/tif_jpeg.c: avoid integer division by zero in
|
|
||||||
JPEGSetupEncode() when horizontal or vertical sampling is set to 0. Fixes
|
|
||||||
http://bugzilla.maptools.org/show_bug.cgi?id=2653
|
|
||||||
|
|
||||||
Fixes CVE-2017-7595
|
|
||||||
|
|
||||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
||||||
---
|
|
||||||
libtiff/tif_jpeg.c | 7 +++++++
|
|
||||||
1 file changed, 13 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/libtiff/tif_jpeg.c b/libtiff/tif_jpeg.c
|
|
||||||
index 38595f98..6c17c388 100644
|
|
||||||
--- a/libtiff/tif_jpeg.c
|
|
||||||
+++ b/libtiff/tif_jpeg.c
|
|
||||||
@@ -1626,6 +1626,13 @@ JPEGSetupEncode(TIFF* tif)
|
|
||||||
case PHOTOMETRIC_YCBCR:
|
|
||||||
sp->h_sampling = td->td_ycbcrsubsampling[0];
|
|
||||||
sp->v_sampling = td->td_ycbcrsubsampling[1];
|
|
||||||
+ if( sp->h_sampling == 0 || sp->v_sampling == 0 )
|
|
||||||
+ {
|
|
||||||
+ TIFFErrorExt(tif->tif_clientdata, module,
|
|
||||||
+ "Invalig horizontal/vertical sampling value");
|
|
||||||
+ return (0);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
/*
|
|
||||||
* A ReferenceBlackWhite field *must* be present since the
|
|
||||||
* default value is inappropriate for YCbCr. Fill in the
|
|
||||||
--
|
|
||||||
2.11.0
|
|
||||||
|
|
|
@ -1,47 +0,0 @@
|
||||||
From 3cfd62d77c2a7e147a05bd678524c345fa9c2bb8 Mon Sep 17 00:00:00 2001
|
|
||||||
From: erouault <erouault>
|
|
||||||
Date: Wed, 11 Jan 2017 13:28:01 +0000
|
|
||||||
Subject: [PATCH] * libtiff/tif_dirread.c: avoid division by floating point 0
|
|
||||||
in TIFFReadDirEntryCheckedRational() and TIFFReadDirEntryCheckedSrational(),
|
|
||||||
and return 0 in that case (instead of infinity as before presumably)
|
|
||||||
Apparently some sanitizers do not like those divisions by zero. Fixes
|
|
||||||
http://bugzilla.maptools.org/show_bug.cgi?id=2644
|
|
||||||
|
|
||||||
Fixes CVE-2017-7598
|
|
||||||
|
|
||||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
||||||
---
|
|
||||||
libtiff/tif_dirread.c | 10 ++++++++--
|
|
||||||
1 file changed, 16 insertions(+), 2 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
|
|
||||||
index 570d0c32..8a1e42aa 100644
|
|
||||||
--- a/libtiff/tif_dirread.c
|
|
||||||
+++ b/libtiff/tif_dirread.c
|
|
||||||
@@ -2872,7 +2872,10 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFD
|
|
||||||
m.l = direntry->tdir_offset.toff_long8;
|
|
||||||
if (tif->tif_flags&TIFF_SWAB)
|
|
||||||
TIFFSwabArrayOfLong(m.i,2);
|
|
||||||
- if (m.i[0]==0)
|
|
||||||
+ /* Not completely sure what we should do when m.i[1]==0, but some */
|
|
||||||
+ /* sanitizers do not like division by 0.0: */
|
|
||||||
+ /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
|
|
||||||
+ if (m.i[0]==0 || m.i[1]==0)
|
|
||||||
*value=0.0;
|
|
||||||
else
|
|
||||||
*value=(double)m.i[0]/(double)m.i[1];
|
|
||||||
@@ -2900,7 +2903,10 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFF
|
|
||||||
m.l=direntry->tdir_offset.toff_long8;
|
|
||||||
if (tif->tif_flags&TIFF_SWAB)
|
|
||||||
TIFFSwabArrayOfLong(m.i,2);
|
|
||||||
- if ((int32)m.i[0]==0)
|
|
||||||
+ /* Not completely sure what we should do when m.i[1]==0, but some */
|
|
||||||
+ /* sanitizers do not like division by 0.0: */
|
|
||||||
+ /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
|
|
||||||
+ if ((int32)m.i[0]==0 || m.i[1]==0)
|
|
||||||
*value=0.0;
|
|
||||||
else
|
|
||||||
*value=(double)((int32)m.i[0])/(double)m.i[1];
|
|
||||||
--
|
|
||||||
2.11.0
|
|
||||||
|
|
|
@ -1,35 +0,0 @@
|
||||||
From 0a76a8c765c7b8327c59646284fa78c3c27e5490 Mon Sep 17 00:00:00 2001
|
|
||||||
From: erouault <erouault>
|
|
||||||
Date: Wed, 11 Jan 2017 16:13:50 +0000
|
|
||||||
Subject: [PATCH] * libtiff/tif_jpeg.c: validate BitsPerSample in
|
|
||||||
JPEGSetupEncode() to avoid undefined behaviour caused by invalid shift
|
|
||||||
exponent. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2648
|
|
||||||
|
|
||||||
Fixes CVE-2017-7601
|
|
||||||
|
|
||||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
||||||
---
|
|
||||||
libtiff/tif_jpeg.c | 7 +++++++
|
|
||||||
1 file changed, 13 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/libtiff/tif_jpeg.c b/libtiff/tif_jpeg.c
|
|
||||||
index 6c17c388..192989a9 100644
|
|
||||||
--- a/libtiff/tif_jpeg.c
|
|
||||||
+++ b/libtiff/tif_jpeg.c
|
|
||||||
@@ -1632,6 +1632,13 @@ JPEGSetupEncode(TIFF* tif)
|
|
||||||
"Invalig horizontal/vertical sampling value");
|
|
||||||
return (0);
|
|
||||||
}
|
|
||||||
+ if( td->td_bitspersample > 16 )
|
|
||||||
+ {
|
|
||||||
+ TIFFErrorExt(tif->tif_clientdata, module,
|
|
||||||
+ "BitsPerSample %d not allowed for JPEG",
|
|
||||||
+ td->td_bitspersample);
|
|
||||||
+ return (0);
|
|
||||||
+ }
|
|
||||||
|
|
||||||
/*
|
|
||||||
* A ReferenceBlackWhite field *must* be present since the
|
|
||||||
--
|
|
||||||
2.11.0
|
|
||||||
|
|
|
@ -1,56 +0,0 @@
|
||||||
From 66e7bd59520996740e4df5495a830b42fae48bc4 Mon Sep 17 00:00:00 2001
|
|
||||||
From: erouault <erouault>
|
|
||||||
Date: Wed, 11 Jan 2017 16:33:34 +0000
|
|
||||||
Subject: [PATCH] * libtiff/tif_read.c: avoid potential undefined behaviour on
|
|
||||||
signed integer addition in TIFFReadRawStrip1() in isMapped() case. Fixes
|
|
||||||
http://bugzilla.maptools.org/show_bug.cgi?id=2650
|
|
||||||
|
|
||||||
Fixes CVE-2017-7602
|
|
||||||
|
|
||||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
||||||
---
|
|
||||||
libtiff/tif_read.c | 27 ++++++++++++++++++---------
|
|
||||||
1 file changed, 24 insertions(+), 9 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
|
|
||||||
index 52bbf507..b7aacbda 100644
|
|
||||||
--- a/libtiff/tif_read.c
|
|
||||||
+++ b/libtiff/tif_read.c
|
|
||||||
@@ -420,16 +420,25 @@ TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size,
|
|
||||||
return ((tmsize_t)(-1));
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
- tmsize_t ma,mb;
|
|
||||||
+ tmsize_t ma;
|
|
||||||
tmsize_t n;
|
|
||||||
- ma=(tmsize_t)td->td_stripoffset[strip];
|
|
||||||
- mb=ma+size;
|
|
||||||
- if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||(ma>tif->tif_size))
|
|
||||||
- n=0;
|
|
||||||
- else if ((mb<ma)||(mb<size)||(mb>tif->tif_size))
|
|
||||||
- n=tif->tif_size-ma;
|
|
||||||
- else
|
|
||||||
- n=size;
|
|
||||||
+ if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||
|
|
||||||
+ ((ma=(tmsize_t)td->td_stripoffset[strip])>tif->tif_size))
|
|
||||||
+ {
|
|
||||||
+ n=0;
|
|
||||||
+ }
|
|
||||||
+ else if( ma > TIFF_TMSIZE_T_MAX - size )
|
|
||||||
+ {
|
|
||||||
+ n=0;
|
|
||||||
+ }
|
|
||||||
+ else
|
|
||||||
+ {
|
|
||||||
+ tmsize_t mb=ma+size;
|
|
||||||
+ if (mb>tif->tif_size)
|
|
||||||
+ n=tif->tif_size-ma;
|
|
||||||
+ else
|
|
||||||
+ n=size;
|
|
||||||
+ }
|
|
||||||
if (n!=size) {
|
|
||||||
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
|
|
||||||
TIFFErrorExt(tif->tif_clientdata, module,
|
|
||||||
--
|
|
||||||
2.11.0
|
|
||||||
|
|
|
@ -1,2 +1,2 @@
|
||||||
# Locally computed
|
# Locally computed
|
||||||
sha256 9f43a2cfb9589e5cecaa66e16bf87f814c945f22df7ba600d63aac4632c4f019 tiff-4.0.7.tar.gz
|
sha256 59d7a5a8ccd92059913f246877db95a2918e6c04fb9d43fd74e5c3390dac2910 tiff-4.0.8.tar.gz
|
||||||
|
|
|
@ -4,7 +4,7 @@
|
||||||
#
|
#
|
||||||
################################################################################
|
################################################################################
|
||||||
|
|
||||||
TIFF_VERSION = 4.0.7
|
TIFF_VERSION = 4.0.8
|
||||||
TIFF_SITE = http://download.osgeo.org/libtiff
|
TIFF_SITE = http://download.osgeo.org/libtiff
|
||||||
TIFF_LICENSE = tiff license
|
TIFF_LICENSE = tiff license
|
||||||
TIFF_LICENSE_FILES = COPYRIGHT
|
TIFF_LICENSE_FILES = COPYRIGHT
|
||||||
|
|
Loading…
Reference in a new issue