diff --git a/0023-fix-cve-2023-52356.patch b/0023-fix-cve-2023-52356.patch deleted file mode 100644 index c4a418c9d6ef61ed691b1f64e36af44342b882ce..0000000000000000000000000000000000000000 --- a/0023-fix-cve-2023-52356.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 98db84ec639ab06cbbe1525f08c1e57a011c373e Mon Sep 17 00:00:00 2001 -From: Yang_X_Y -Date: Thu, 8 Aug 2024 13:42:48 +0800 -Subject: [PATCH] fix-cve-2023-52356 - ---- - libtiff/tif_getimage.c | 18 +++++++++++++++++- - 1 file changed, 17 insertions(+), 1 deletion(-) - -diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c -index 9a2e0c5..f7a8d2c 100644 ---- a/libtiff/tif_getimage.c -+++ b/libtiff/tif_getimage.c -@@ -2943,7 +2943,15 @@ TIFFReadRGBAStripExt(TIFF* tif, uint32_t row, uint32_t * raster, int stop_on_err - - if (TIFFRGBAImageOK(tif, emsg) && TIFFRGBAImageBegin(&img, tif, stop_on_error, emsg)) { - -- img.row_offset = row; -+ if (row >= img.height) -+ { -+ TIFFErrorExt(tif, TIFFFileName(tif), -+ "Invalid row passed to TIFFReadRGBAStrip()."); -+ TIFFRGBAImageEnd(&img); -+ return (0); -+ } -+ -+ img.row_offset = row; - img.col_offset = 0; - - if( row + rowsperstrip > img.height ) -@@ -3018,6 +3026,14 @@ TIFFReadRGBATileExt(TIFF* tif, uint32_t col, uint32_t row, uint32_t * raster, in - return( 0 ); - } - -+ if (col >= img.width || row >= img.height) -+ { -+ TIFFErrorExt(tif, TIFFFileName(tif), -+ "Invalid row/col passed to TIFFReadRGBATile()."); -+ TIFFRGBAImageEnd(&img); -+ return (0); -+ } -+ - /* - * The TIFFRGBAImageGet() function doesn't allow us to get off the - * edge of the image, even to fill an otherwise valid tile. So we --- -2.33.0 - diff --git a/0024-fix-cve-2024-7006.patch b/libtiff-4.6.0-CVE-2024-7006.patch similarity index 73% rename from 0024-fix-cve-2024-7006.patch rename to libtiff-4.6.0-CVE-2024-7006.patch index 2066cf8a3a84a56ed0f0cf762400919e4271e617..e953fea53bf74938b9b32a8d8441170736f823b9 100644 --- a/0024-fix-cve-2024-7006.patch +++ b/libtiff-4.6.0-CVE-2024-7006.patch @@ -1,8 +1,7 @@ -diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c -index c30f569..c2df6cf 100644 ---- a/libtiff/tif_dirinfo.c -+++ b/libtiff/tif_dirinfo.c -@@ -824,7 +824,7 @@ _TIFFFindOrRegisterField(TIFF *tif, uint32_t tag, TIFFDataType dt) +diff -up tiff-4.4.0/libtiff/tif_dirinfo.c.CVE-2024-7006 tiff-4.4.0/libtiff/tif_dirinfo.c +--- tiff-4.4.0/libtiff/tif_dirinfo.c.CVE-2024-7006 2024-08-16 00:35:35.339965778 +0200 ++++ tiff-4.4.0/libtiff/tif_dirinfo.c 2024-08-16 00:54:58.255221954 +0200 +@@ -824,7 +824,7 @@ _TIFFFindOrRegisterField(TIFF *tif, uint fld = TIFFFindField(tif, tag, dt); if (fld == NULL) { fld = _TIFFCreateAnonField(tif, tag, dt); @@ -11,10 +10,9 @@ index c30f569..c2df6cf 100644 return NULL; } -diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c -index 32653f0..58c1c2a 100644 ---- a/libtiff/tif_dirread.c -+++ b/libtiff/tif_dirread.c +diff -up tiff-4.4.0/libtiff/tif_dirread.c.CVE-2024-7006 tiff-4.4.0/libtiff/tif_dirread.c +--- tiff-4.4.0/libtiff/tif_dirread.c.CVE-2024-7006 2024-08-16 00:35:35.341965797 +0200 ++++ tiff-4.4.0/libtiff/tif_dirread.c 2024-08-16 00:59:02.455017380 +0200 @@ -4038,11 +4038,10 @@ TIFFReadDirectory(TIFF* tif) dp->tdir_tag,dp->tdir_tag); /* the following knowingly leaks the @@ -31,7 +29,7 @@ index 32653f0..58c1c2a 100644 TIFFWarningExt(tif->tif_clientdata, module, "Registering anonymous field with tag %"PRIu16" (0x%"PRIx16") failed", -@@ -4805,10 +4804,10 @@ TIFFReadCustomDirectory(TIFF* tif, toff_t diroff, +@@ -4805,10 +4804,10 @@ TIFFReadCustomDirectory(TIFF* tif, toff_ TIFFWarningExt(tif->tif_clientdata, module, "Unknown field with tag %"PRIu16" (0x%"PRIx16") encountered", dp->tdir_tag, dp->tdir_tag); diff --git a/libtiff.spec b/libtiff.spec index 06d0499124815af7165be4002b4fbd0afc114a35..8050f76b906bb2d1980468e23d6eb031182c65e9 100644 --- a/libtiff.spec +++ b/libtiff.spec @@ -1,9 +1,9 @@ -%define anolis_release .0.3 +%define anolis_release .0.1 Summary: Library of functions for manipulating TIFF format image files Name: libtiff Version: 4.4.0 -Release: 12%{anolis_release}%{?dist} +Release: 13%{anolis_release}%{?dist} License: libtiff URL: http://www.simplesystems.org/libtiff/ @@ -38,10 +38,9 @@ Patch0020: 0020-CVE-2023-3618-tiffcrop-fix-553-by-considering-error-.patch Patch0021: 0021-CVE-2023-40745-CVE-2023-41175-raw2tiff-fix-integer-o.patch Patch0022: 0022-CVE-2023-6228-Merge-branch-fix_606_tiffcp_check_also.patch -#https://gitlab.com/libtiff/libtiff/-/commit/51558511bdbbcffdce534db21dbaf5d54b31638a -Patch0023: 0023-fix-cve-2023-52356.patch - -Patch0024: 0024-fix-cve-2024-7006.patch +# from upstream, for <=4.6.0, RHEL-52931 +# https://gitlab.com/libtiff/libtiff/-/commit/3705f82b6483c7906cf08cd6b9dcdcd59c61d779 +Patch23: libtiff-4.6.0-CVE-2024-7006.patch BuildRequires: gcc, gcc-c++ BuildRequires: zlib-devel libjpeg-devel jbigkit-devel libzstd-devel libwebp-devel @@ -204,15 +203,12 @@ find html -name 'Makefile*' | xargs rm %doc README.md RELEASE-DATE VERSION %changelog -* Thu Nov 07 2024 Xulin Gao - 4.4.0-12.0.3 -- fix cve-2024-7006 - -* Thu Aug 08 2024 yangxinyu - 4.4.0-10.0.2 -- fix cve-2023-52356 - -* Wed May 15 2024 Zhao Hang - 4.4.0-12.0.1 +* Thu Dec 12 2024 Zhao Hang - 4.4.0-13.0.1 - Add doc sub package +* Wed Aug 21 2024 Michal Hlavinka - 4.4.0-13 +- fix CVE-2024-7006 a null pointer dereference in tif_dirinfo (RHEL-52931) + * Thu Nov 23 2023 Matej Mužila - 4.4.0-12 - Fix CVE-2023-6228 - Resolves: RHEL-10084