NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/tiff: security bump to version 4.4.0

Browse Source 
Fix CVE-2022-0561, CVE-2022-0562, CVE-2022-0865, CVE-2022-0891,
CVE-2022-0907, CVE-2022-0908, CVE-2022-0909, CVE-2022-0924,
CVE-2022-1056, CVE-2022-1210, CVE-2022-1622 and CVE-2022-1623

Drop patch (already in version)

http://www.simplesystems.org/libtiff/v4.4.0.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Fabrice Fontaine 2022-06-04 23:06:28 +02:00 committed by Peter Korsgaard
parent b1dd0548d3
commit dec6a0af3f
3 changed files with 2 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
package/tiff/0001-tiffset-fix-global-buffer-overflow-for-ASCII-tags.patch
View File

@ -1,43 +0,0 @@
From 03047a26952a82daaa0792957ce211e0aa51bc64 Mon Sep 17 00:00:00 2001
From: 4ugustus <wangdw.augustus@qq.com>
Date: Tue, 25 Jan 2022 16:25:28 +0000
Subject: [PATCH] tiffset: fix global-buffer-overflow for ASCII tags where
count is required (fixes #355)
[Retrieved from:
https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e0aa51bc64]
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
tools/tiffset.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/tools/tiffset.c b/tools/tiffset.c
index 8c9e23c5..e7a88c09 100644
--- a/tools/tiffset.c
+++ b/tools/tiffset.c
@@ -146,9 +146,19 @@ main(int argc, char* argv[])
arg_index++;
if (TIFFFieldDataType(fip) == TIFF_ASCII) {
- if (TIFFSetField(tiff, TIFFFieldTag(fip), argv[arg_index]) != 1)
- fprintf( stderr, "Failed to set %s=%s\n",
- TIFFFieldName(fip), argv[arg_index] );
+ if(TIFFFieldPassCount( fip )) {
+ size_t len;
+ len = strlen(argv[arg_index]) + 1;
+ if (len > UINT16_MAX || TIFFSetField(tiff, TIFFFieldTag(fip),
+ (uint16_t)len, argv[arg_index]) != 1)
+ fprintf( stderr, "Failed to set %s=%s\n",
+ TIFFFieldName(fip), argv[arg_index] );
+ } else {
+ if (TIFFSetField(tiff, TIFFFieldTag(fip),
+ argv[arg_index]) != 1)
+ fprintf( stderr, "Failed to set %s=%s\n",
+ TIFFFieldName(fip), argv[arg_index] );
+ }
} else if (TIFFFieldWriteCount(fip) > 0
|| TIFFFieldWriteCount(fip) == TIFF_VARIABLE) {
int ret = 1;
--
GitLab

2
package/tiff/tiff.hash
View File

@ -1,3 +1,3 @@
# Locally computed
sha256 0e46e5acb087ce7d1ac53cf4f56a09b221537fc86dfc5daaad1c2e89e1b37ac8 tiff-4.3.0.tar.gz
sha256 917223b37538959aca3b790d2d73aa6e626b688e02dcda272aec24c2f498abed tiff-4.4.0.tar.gz
sha256 fbd6fed7938541d2c809c0826225fc85e551fdbfa8732b10f0c87e0847acafd7 COPYRIGHT

5
package/tiff/tiff.mk
View File

@ -4,7 +4,7 @@
#
################################################################################
TIFF_VERSION = 4.3.0
TIFF_VERSION = 4.4.0
TIFF_SITE = http://download.osgeo.org/libtiff
TIFF_LICENSE = tiff license
TIFF_LICENSE_FILES = COPYRIGHT
@ -12,9 +12,6 @@ TIFF_CPE_ID_VENDOR = libtiff
TIFF_CPE_ID_PRODUCT = libtiff
TIFF_INSTALL_STAGING = YES
# 0001-tiffset-fix-global-buffer-overflow-for-ASCII-tags.patch
TIFF_IGNORE_CVES += CVE-2022-22844
TIFF_CONF_OPTS = \
--disable-cxx \
--without-x