packages: libtiff/libtiff-sec.patch, libtiff/libtiff.spec, libtiff/libtiff-...

qboosh qboosh at pld-linux.org
Fri Sep 18 22:09:15 CEST 2009


Author: qboosh                       Date: Fri Sep 18 20:09:15 2009 GMT
Module: packages                      Tag: HEAD
---- Log message:
- merged from DEVEL; release 1

---- Files affected:
packages/libtiff:
   libtiff-sec.patch (1.2 -> 1.3) , libtiff.spec (1.97 -> 1.98) , libtiff-CVE-2006-2193.patch (1.1 -> NONE)  (REMOVED), libtiff-CVE-2009-2285.patch (1.1 -> NONE)  (REMOVED), libtiff-libtool.patch (1.1 -> NONE)  (REMOVED), libtiff-lzw-bugs.patch (1.1 -> NONE)  (REMOVED)

---- Diffs:

================================================================
Index: packages/libtiff/libtiff-sec.patch
diff -u packages/libtiff/libtiff-sec.patch:1.2 packages/libtiff/libtiff-sec.patch:1.3
--- packages/libtiff/libtiff-sec.patch:1.2	Sun Aug  6 22:06:00 2006
+++ packages/libtiff/libtiff-sec.patch	Fri Sep 18 22:09:09 2009
@@ -1,299 +1,121 @@
-diff -ruN tiff-3.7.4-old/tools/tiffsplit.c tiff-3.7.4/tools/tiffsplit.c
---- tiff-3.7.4-old/tools/tiffsplit.c	2005-05-26 20:38:48.000000000 +0200
-+++ tiff-3.7.4/tools/tiffsplit.c	2006-06-01 16:00:11.000000000 +0200
-@@ -60,14 +60,13 @@
- 		return (-3);
- 	}
- 	if (argc > 2)
--		strcpy(fname, argv[2]);
-+		snprintf(fname, sizeof(fname), "%s", argv[2]);
- 	in = TIFFOpen(argv[1], "r");
- 	if (in != NULL) {
- 		do {
- 			char path[1024+1];
- 			newfilename();
--			strcpy(path, fname);
--			strcat(path, ".tif");
-+			snprintf(path, sizeof(path), "%s.tif", fname);
- 			out = TIFFOpen(path, TIFFIsBigEndian(in)?"wb":"wl");
- 			if (out == NULL)
- 				return (-2);
-diff -ru tiff-3.8.2/libtiff/tif_dir.c tiff-3.8.2-goo/libtiff/tif_dir.c
---- tiff-3.8.2/libtiff/tif_dir.c	2006-03-21 16:42:50.000000000 +0000
-+++ tiff-3.8.2-goo/libtiff/tif_dir.c	2006-07-14 13:52:01.027562000 +0100
-@@ -122,6 +122,7 @@
+--- tiff-3.9.1/libtiff/tif_dir.c.orig	2009-01-01 01:10:43.000000000 +0100
++++ tiff-3.9.1/libtiff/tif_dir.c	2009-08-31 17:46:34.892612613 +0200
+@@ -138,6 +138,7 @@ _TIFFVSetField(TIFF* tif, ttag_t tag, va
  {
  	static const char module[] = "_TIFFVSetField";
- 	
-+	const TIFFFieldInfo* fip = _TIFFFindFieldInfo(tif, tag, TIFF_ANY);
+ 
++	const TIFFFieldInfo* fip;
  	TIFFDirectory* td = &tif->tif_dir;
  	int status = 1;
  	uint32 v32, i, v;
-@@ -195,10 +196,12 @@
- 		break;
- 	case TIFFTAG_ORIENTATION:
- 		v = va_arg(ap, uint32);
-+		const TIFFFieldInfo* fip;
- 		if (v < ORIENTATION_TOPLEFT || ORIENTATION_LEFTBOT < v) {
-+			fip = _TIFFFieldWithTag(tif, tag);
- 			TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
- 			    "Bad value %lu for \"%s\" tag ignored",
--			    v, _TIFFFieldWithTag(tif, tag)->field_name);
-+			    v, fip ? fip->field_name : "Unknown");
- 		} else
- 			td->td_orientation = (uint16) v;
- 		break;
-@@ -387,11 +390,15 @@
- 	     * happens, for example, when tiffcp is used to convert between
- 	     * compression schemes and codec-specific tags are blindly copied.
-              */
-+	    /* 
-+	     * better not dereference fip if it is NULL.
-+	     * -- taviso at google.com 15 Jun 2006
-+	     */
-             if(fip == NULL || fip->field_bit != FIELD_CUSTOM) {
- 		TIFFErrorExt(tif->tif_clientdata, module,
- 		    "%s: Invalid %stag \"%s\" (not supported by codec)",
- 		    tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
--		    _TIFFFieldWithTag(tif, tag)->field_name);
-+		    fip ? fip->field_name : "Unknown");
- 		status = 0;
- 		break;
-             }
-@@ -468,7 +475,7 @@
- 	    if (fip->field_type == TIFF_ASCII)
- 		    _TIFFsetString((char **)&tv->value, va_arg(ap, char *));
- 	    else {
--                tv->value = _TIFFmalloc(tv_size * tv->count);
-+                tv->value = _TIFFCheckMalloc(tif, tv_size, tv->count, "Tag Value");
- 		if (!tv->value) {
- 		    status = 0;
- 		    goto end;
-@@ -563,7 +570,7 @@
-           }
- 	}
- 	if (status) {
--		TIFFSetFieldBit(tif, _TIFFFieldWithTag(tif, tag)->field_bit);
-+		TIFFSetFieldBit(tif, fip->field_bit);
- 		tif->tif_flags |= TIFF_DIRTYDIRECT;
- 	}
- 
-@@ -572,12 +579,12 @@
+@@ -585,17 +586,19 @@ end:
+ 	va_end(ap);
  	return (status);
  badvalue:
- 	TIFFErrorExt(tif->tif_clientdata, module, "%s: Bad value %d for \"%s\"",
--		  tif->tif_name, v, _TIFFFieldWithTag(tif, tag)->field_name);
-+		  tif->tif_name, v, fip ? fip->field_name : "Unknown");
++	fip = _TIFFFindFieldInfo(tif, tag, TIFF_ANY);
+ 	TIFFErrorExt(tif->tif_clientdata, module,
+ 		     "%s: Bad value %d for \"%s\" tag",
+ 		     tif->tif_name, v,
+-		     _TIFFFieldWithTag(tif, tag)->field_name);
++		     fip ? fip->field_name : "Unknown");
  	va_end(ap);
  	return (0);
  badvalue32:
- 	TIFFErrorExt(tif->tif_clientdata, module, "%s: Bad value %ld for \"%s\"",
--		   tif->tif_name, v32, _TIFFFieldWithTag(tif, tag)->field_name);
-+		   tif->tif_name, v32, fip ? fip->field_name : "Unknown");
++	fip = _TIFFFindFieldInfo(tif, tag, TIFF_ANY);
+ 	TIFFErrorExt(tif->tif_clientdata, module,
+ 		     "%s: Bad value %u for \"%s\" tag",
+ 		     tif->tif_name, v32,
+-		     _TIFFFieldWithTag(tif, tag)->field_name);
++		     fip ? fip->field_name : "Unknown");
  	va_end(ap);
  	return (0);
  }
-@@ -813,12 +820,16 @@
-              * If the client tries to get a tag that is not valid
-              * for the image's codec then we'll arrive here.
-              */
-+	    /*
-+	     * dont dereference fip if it's NULL.
-+	     * -- taviso at google.com 15 Jun 2006
-+	     */
-             if( fip == NULL || fip->field_bit != FIELD_CUSTOM )
-             {
- 				TIFFErrorExt(tif->tif_clientdata, "_TIFFVGetField",
-                           "%s: Invalid %stag \"%s\" (not supported by codec)",
-                           tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
--                          _TIFFFieldWithTag(tif, tag)->field_name);
-+                          fip ? fip->field_name : "Unknown");
-                 ret_val = 0;
-                 break;
-             }
-diff -ru tiff-3.8.2/libtiff/tif_dirinfo.c tiff-3.8.2-goo/libtiff/tif_dirinfo.c
---- tiff-3.8.2/libtiff/tif_dirinfo.c	2006-02-07 13:51:03.000000000 +0000
-+++ tiff-3.8.2-goo/libtiff/tif_dirinfo.c	2006-07-14 13:52:00.953558000 +0100
-@@ -775,7 +775,8 @@
+--- tiff-3.9.1/libtiff/tif_dirinfo.c.orig	2008-04-11 01:05:55.000000000 +0200
++++ tiff-3.9.1/libtiff/tif_dirinfo.c	2009-08-31 17:48:30.568606747 +0200
+@@ -807,8 +807,6 @@ _TIFFFieldWithTag(TIFF* tif, ttag_t tag)
  		TIFFErrorExt(tif->tif_clientdata, "TIFFFieldWithTag",
- 			  "Internal error, unknown tag 0x%x",
-                           (unsigned int) tag);
+ 			     "Internal error, unknown tag 0x%x",
+ 			     (unsigned int) tag);
 -		assert(fip != NULL);
-+		/* assert(fip != NULL); */
-+
- 		/*NOTREACHED*/
+-		/*NOTREACHED*/
  	}
  	return (fip);
-@@ -789,7 +790,8 @@
+ }
+@@ -821,8 +819,6 @@ _TIFFFieldWithName(TIFF* tif, const char
  	if (!fip) {
  		TIFFErrorExt(tif->tif_clientdata, "TIFFFieldWithName",
- 			  "Internal error, unknown tag %s", field_name);
+ 			     "Internal error, unknown tag %s", field_name);
 -		assert(fip != NULL);
-+		/* assert(fip != NULL); */
-+		
- 		/*NOTREACHED*/
+-		/*NOTREACHED*/
  	}
  	return (fip);
-diff -ru tiff-3.8.2/libtiff/tif_dirread.c tiff-3.8.2-goo/libtiff/tif_dirread.c
---- tiff-3.8.2/libtiff/tif_dirread.c	2006-03-21 16:42:50.000000000 +0000
-+++ tiff-3.8.2-goo/libtiff/tif_dirread.c	2006-07-14 13:52:00.842557000 +0100
-@@ -29,6 +29,9 @@
-  *
-  * Directory Read Support Routines.
-  */
-+
-+#include <limits.h>
-+
- #include "tiffiop.h"
- 
- #define	IGNORE	0		/* tag placeholder used below */
-@@ -81,6 +84,7 @@
- 	uint16 dircount;
- 	toff_t nextdiroff;
- 	int diroutoforderwarning = 0;
-+	int compressionknown = 0;
- 	toff_t* new_dirlist;
- 
- 	tif->tif_diroff = tif->tif_nextdiroff;
-@@ -147,13 +151,20 @@
- 	} else {
- 		toff_t off = tif->tif_diroff;
- 
--		if (off + sizeof (uint16) > tif->tif_size) {
--			TIFFErrorExt(tif->tif_clientdata, module,
--			    "%s: Can not read TIFF directory count",
--                            tif->tif_name);
--			return (0);
-+		/*
-+		 * Check for integer overflow when validating the dir_off, otherwise
-+		 * a very high offset may cause an OOB read and crash the client.
-+		 * -- taviso at google.com, 14 Jun 2006.
-+		 */
-+		if (off + sizeof (uint16) > tif->tif_size || 
-+			off > (UINT_MAX - sizeof(uint16))) {
-+				TIFFErrorExt(tif->tif_clientdata, module,
-+				    "%s: Can not read TIFF directory count",
-+				    tif->tif_name);
-+				return (0);
- 		} else
--			_TIFFmemcpy(&dircount, tif->tif_base + off, sizeof (uint16));
-+			_TIFFmemcpy(&dircount, tif->tif_base + off,
-+					sizeof (uint16));
- 		off += sizeof (uint16);
- 		if (tif->tif_flags & TIFF_SWAB)
- 			TIFFSwabShort(&dircount);
-@@ -254,6 +265,7 @@
- 		while (fix < tif->tif_nfields &&
- 		       tif->tif_fieldinfo[fix]->field_tag < dp->tdir_tag)
- 			fix++;
-+
- 		if (fix >= tif->tif_nfields ||
- 		    tif->tif_fieldinfo[fix]->field_tag != dp->tdir_tag) {
- 
-@@ -264,17 +276,23 @@
- 						       dp->tdir_tag,
+ }
+--- tiff-3.9.1/libtiff/tif_dirread.c.orig	2009-01-01 01:10:43.000000000 +0100
++++ tiff-3.9.1/libtiff/tif_dirread.c	2009-08-31 18:38:28.060606747 +0200
+@@ -190,6 +190,11 @@ TIFFReadDirectory(TIFF* tif)
  						       dp->tdir_tag,
- 						       dp->tdir_type);
--
--                    TIFFMergeFieldInfo(tif,
--                                       _TIFFCreateAnonFieldInfo(tif,
--						dp->tdir_tag,
--						(TIFFDataType) dp->tdir_type),
--				       1 );
-+					/*
-+					 * creating anonymous fields prior to knowing the compression
-+					 * algorithm (ie, when the field info has been merged) could cause
-+					 * crashes with pathological directories.
-+					 * -- taviso at google.com 15 Jun 2006
-+					 */
-+					if (compressionknown)
-+			                    TIFFMergeFieldInfo(tif, _TIFFCreateAnonFieldInfo(tif, dp->tdir_tag, 
-+						(TIFFDataType) dp->tdir_type), 1 );
-+					else goto ignore;
-+		    
-                     fix = 0;
-                     while (fix < tif->tif_nfields &&
-                            tif->tif_fieldinfo[fix]->field_tag < dp->tdir_tag)
- 			fix++;
- 		}
-+		
- 		/*
- 		 * Null out old tags that we ignore.
+ 						       dp->tdir_tag);
+ 
++					if (!compressionknown) {
++						TIFFWarningExt(tif->tif_clientdata, module,
++								"Ignoring, compression unknown");
++						goto ignore;
++					}
+ 					if (!_TIFFMergeFieldInfo(tif,
+ 						_TIFFCreateAnonFieldInfo(tif,
+ 						dp->tdir_tag,
+@@ -583,6 +588,7 @@ TIFFReadDirectory(TIFF* tif)
+ 		 * Attempt to deal with a missing StripByteCounts tag.
  		 */
-@@ -326,6 +344,7 @@
- 				    dp->tdir_type, dp->tdir_offset);
- 				if (!TIFFSetField(tif, dp->tdir_tag, (uint16)v))
- 					goto bad;
-+				else compressionknown++;
- 				break;
- 			/* XXX: workaround for broken TIFFs */
- 			} else if (dp->tdir_type == TIFF_LONG) {
-@@ -540,6 +559,7 @@
- 	 * Attempt to deal with a missing StripByteCounts tag.
- 	 */
- 	if (!TIFFFieldSet(tif, FIELD_STRIPBYTECOUNTS)) {
-+		const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, TIFFTAG_STRIPBYTECOUNTS);
- 		/*
- 		 * Some manufacturers violate the spec by not giving
- 		 * the size of the strips.  In this case, assume there
-@@ -556,7 +576,7 @@
- 			"%s: TIFF directory is missing required "
- 			"\"%s\" field, calculating from imagelength",
- 			tif->tif_name,
--		        _TIFFFieldWithTag(tif,TIFFTAG_STRIPBYTECOUNTS)->field_name);
-+		        fip ? fip->field_name : "Unknown");
- 		if (EstimateStripByteCounts(tif, dir, dircount) < 0)
- 		    goto bad;
- /* 
-@@ -580,6 +600,7 @@
- 	} else if (td->td_nstrips == 1 
-                    && td->td_stripoffset[0] != 0 
-                    && BYTECOUNTLOOKSBAD) {
-+		const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, TIFFTAG_STRIPBYTECOUNTS);
+ 		if (!TIFFFieldSet(tif, FIELD_STRIPBYTECOUNTS)) {
++			const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, TIFFTAG_STRIPBYTECOUNTS);
+ 			/*
+ 			 * Some manufacturers violate the spec by not giving
+ 			 * the size of the strips.  In this case, assume there
+@@ -599,7 +605,7 @@ TIFFReadDirectory(TIFF* tif)
+ 				"%s: TIFF directory is missing required "
+ 				"\"%s\" field, calculating from imagelength",
+ 				tif->tif_name,
+-				_TIFFFieldWithTag(tif,TIFFTAG_STRIPBYTECOUNTS)->field_name);
++				fip ? fip->field_name : "Unknown");
+ 			if (EstimateStripByteCounts(tif, dir, dircount) < 0)
+ 			    goto bad;
  		/*
- 		 * XXX: Plexus (and others) sometimes give a value of zero for
- 		 * a tag when they don't know what the correct value is!  Try
-@@ -589,13 +610,14 @@
- 		TIFFWarningExt(tif->tif_clientdata, module,
+@@ -626,6 +632,7 @@ TIFFReadDirectory(TIFF* tif)
+ 		} else if (td->td_nstrips == 1
+ 			   && td->td_stripoffset[0] != 0
+ 			   && BYTECOUNTLOOKSBAD) {
++			const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, TIFFTAG_STRIPBYTECOUNTS);
+ 			/*
+ 			 * XXX: Plexus (and others) sometimes give a value of
+ 			 * zero for a tag when they don't know what the
+@@ -635,7 +642,7 @@ TIFFReadDirectory(TIFF* tif)
+ 			TIFFWarningExt(tif->tif_clientdata, module,
  	"%s: Bogus \"%s\" field, ignoring and calculating from imagelength",
-                             tif->tif_name,
--		            _TIFFFieldWithTag(tif,TIFFTAG_STRIPBYTECOUNTS)->field_name);
-+		            fip ? fip->field_name : "Unknown");
- 		if(EstimateStripByteCounts(tif, dir, dircount) < 0)
- 		    goto bad;
- 	} else if (td->td_planarconfig == PLANARCONFIG_CONTIG
- 		   && td->td_nstrips > 2
- 		   && td->td_compression == COMPRESSION_NONE
- 		   && td->td_stripbytecount[0] != td->td_stripbytecount[1]) {
-+		const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, TIFFTAG_STRIPBYTECOUNTS);
- 		/*
- 		 * XXX: Some vendors fill StripByteCount array with absolutely
- 		 * wrong values (it can be equal to StripOffset array, for
-@@ -604,7 +626,7 @@
- 		TIFFWarningExt(tif->tif_clientdata, module,
+ 				    tif->tif_name,
+-				    _TIFFFieldWithTag(tif,TIFFTAG_STRIPBYTECOUNTS)->field_name);
++				    fip ? fip->field_name : "Unknown");
+ 			if(EstimateStripByteCounts(tif, dir, dircount) < 0)
+ 			    goto bad;
+ 		} else if (td->td_planarconfig == PLANARCONFIG_CONTIG
+@@ -644,6 +651,7 @@ TIFFReadDirectory(TIFF* tif)
+ 			   && td->td_stripbytecount[0] != td->td_stripbytecount[1]
+                            && td->td_stripbytecount[0] != 0 
+                            && td->td_stripbytecount[1] != 0 ) {
++			const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, TIFFTAG_STRIPBYTECOUNTS);
+ 			/*
+ 			 * XXX: Some vendors fill StripByteCount array with 
+                          * absolutely wrong values (it can be equal to 
+@@ -653,7 +661,7 @@ TIFFReadDirectory(TIFF* tif)
+ 			TIFFWarningExt(tif->tif_clientdata, module,
  	"%s: Wrong \"%s\" field, ignoring and calculating from imagelength",
-                             tif->tif_name,
--		            _TIFFFieldWithTag(tif,TIFFTAG_STRIPBYTECOUNTS)->field_name);
-+		            fip ? fip->field_name : "Unknown");
- 		if (EstimateStripByteCounts(tif, dir, dircount) < 0)
- 		    goto bad;
- 	}
-@@ -870,7 +892,13 @@
- 
- 	register TIFFDirEntry *dp;
- 	register TIFFDirectory *td = &tif->tif_dir;
--	uint16 i;
-+	
-+	/* i is used to iterate over td->td_nstrips, so must be
-+	 * at least the same width.
-+	 * -- taviso at google.com 15 Jun 2006
-+	 */
-+
-+	uint32 i;
- 
- 	if (td->td_stripbytecount)
- 		_TIFFfree(td->td_stripbytecount);
-@@ -947,16 +975,18 @@
+ 				    tif->tif_name,
+-				    _TIFFFieldWithTag(tif,TIFFTAG_STRIPBYTECOUNTS)->field_name);
++				    fip ? fip->field_name : "Unknown");
+ 			if (EstimateStripByteCounts(tif, dir, dircount) < 0)
+ 			    goto bad;
+ 		}
+@@ -1024,16 +1032,18 @@ TIFFCheckDirOffset(TIFF* tif, toff_t dir
  static int
  CheckDirCount(TIFF* tif, TIFFDirEntry* dir, uint32 count)
  {
@@ -301,29 +123,32 @@
 +
  	if (count > dir->tdir_count) {
  		TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
- 	"incorrect count for field \"%s\" (%lu, expecting %lu); tag ignored",
+ 	"incorrect count for field \"%s\" (%u, expecting %u); tag ignored",
 -		    _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name,
 +		    fip ? fip->field_name : "Unknown",
  		    dir->tdir_count, count);
  		return (0);
  	} else if (count < dir->tdir_count) {
  		TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
- 	"incorrect count for field \"%s\" (%lu, expecting %lu); tag trimmed",
+ 	"incorrect count for field \"%s\" (%u, expecting %u); tag trimmed",
 -		    _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name,
 +		    fip ? fip->field_name : "Unknown",
  		    dir->tdir_count, count);
  		return (1);
  	}
-@@ -970,6 +1000,7 @@
+@@ -1153,6 +1163,7 @@ static tsize_t
  TIFFFetchData(TIFF* tif, TIFFDirEntry* dir, char* cp)
  {
- 	int w = TIFFDataWidth((TIFFDataType) dir->tdir_type);
-+	const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, dir->tdir_tag);
- 	tsize_t cc = dir->tdir_count * w;
- 
- 	/* Check for overflow. */
-@@ -1013,7 +1044,7 @@
+ 	uint32 w = TIFFDataWidth((TIFFDataType) dir->tdir_type);
++	const TIFFFieldInfo* fip;
+ 	/* 
+ 	 * FIXME: butecount should have tsize_t type, but for now libtiff
+ 	 * defines tsize_t as a signed 32-bit integer and we are losing
+@@ -1200,9 +1211,10 @@ TIFFFetchData(TIFF* tif, TIFFDirEntry* d
+ 	}
+ 	return (cc);
  bad:
++	fip = _TIFFFieldWithTag(tif, dir->tdir_tag);
  	TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
  		     "Error fetching data for field \"%s\"",
 -		     _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name);
@@ -331,359 +156,88 @@
  	return (tsize_t) 0;
  }
  
-@@ -1039,10 +1070,12 @@
- static int
+@@ -1229,9 +1241,10 @@ static int
  cvtRational(TIFF* tif, TIFFDirEntry* dir, uint32 num, uint32 denom, float* rv)
  {
-+	const TIFFFieldInfo* fip;
  	if (denom == 0) {
-+		fip = _TIFFFieldWithTag(tif, dir->tdir_tag);
++		const TIFFFieldInfo *fip = _TIFFFieldWithTag(tif, dir->tdir_tag);
  		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
- 		    "%s: Rational with zero denominator (num = %lu)",
+ 		    "%s: Rational with zero denominator (num = %u)",
 -		    _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name, num);
 +		    fip ? fip->field_name : "Unknown", num);
  		return (0);
  	} else {
  		if (dir->tdir_type == TIFF_RATIONAL)
-@@ -1159,6 +1192,20 @@
- static int
- TIFFFetchShortPair(TIFF* tif, TIFFDirEntry* dir)
- {
-+	/*
-+	 * Prevent overflowing the v stack arrays below by performing a sanity
-+	 * check on tdir_count, this should never be greater than two.
-+	 * -- taviso at google.com 14 Jun 2006.
-+	 */
-+	if (dir->tdir_count > 2) {
+@@ -1351,9 +1364,10 @@ TIFFFetchShortPair(TIFF* tif, TIFFDirEnt
+ 	 * check on tdir_count, this should never be greater than two.
+ 	 */
+ 	if (dir->tdir_count > 2) {
 +		const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, dir->tdir_tag);
-+		TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
-+				"unexpected count for field \"%s\", %lu, expected 2; ignored.",
-+				fip ? fip->field_name : "Unknown",
-+				dir->tdir_count);
-+		return 0;
-+	}
-+
- 	switch (dir->tdir_type) {
- 		case TIFF_BYTE:
- 		case TIFF_SBYTE:
-@@ -1329,14 +1376,15 @@
- 	case TIFF_DOUBLE:
- 		return (TIFFFetchDoubleArray(tif, dir, (double*) v));
- 	default:
-+		{ const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, dir->tdir_tag);
+ 		TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
+ 		"unexpected count for field \"%s\", %u, expected 2; ignored",
+-			_TIFFFieldWithTag(tif, dir->tdir_tag)->field_name,
++			fip ? fip->field_name : "Unknown",
+ 			dir->tdir_count);
+ 		return 0;
+ 	}
+@@ -1529,11 +1543,14 @@ TIFFFetchAnyArray(TIFF* tif, TIFFDirEntr
  		/* TIFF_NOTYPE */
  		/* TIFF_ASCII */
  		/* TIFF_UNDEFINED */
++		{
++		const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, dir->tdir_tag);
  		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
  			     "cannot read TIFF_ANY type %d for field \"%s\"",
  			     dir->tdir_type,
 -			     _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name);
--		return (0);
 +			     fip ? fip->field_name : "Unknown");
-+		return (0); }
+ 		return (0);
++		}
  	}
  	return (1);
  }
-@@ -1351,6 +1399,9 @@
+@@ -1548,6 +1565,8 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEnt
  	int ok = 0;
  	const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, dp->tdir_tag);
  
-+	if (fip == NULL) {
++	if (fip == NULL)
 +		return (0);
-+	}
  	if (dp->tdir_count > 1) {		/* array of values */
  		char* cp = NULL;
  
-@@ -1493,6 +1544,7 @@
- TIFFFetchPerSampleShorts(TIFF* tif, TIFFDirEntry* dir, uint16* pl)
- {
-     uint16 samples = tif->tif_dir.td_samplesperpixel;
-+    const TIFFFieldInfo* fip;
-     int status = 0;
- 
-     if (CheckDirCount(tif, dir, (uint32) samples)) {
-@@ -1510,9 +1562,10 @@
+@@ -1707,9 +1726,10 @@ TIFFFetchPerSampleShorts(TIFF* tif, TIFF
  
              for (i = 1; i < check_count; i++)
                  if (v[i] != v[0]) {
-+				fip = _TIFFFieldWithTag(tif, dir->tdir_tag);
- 					TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
-                               "Cannot handle different per-sample values for field \"%s\"",
--                              _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name);
-+                              fip ? fip->field_name : "Unknown");
-                     goto bad;
++			const TIFFFieldInfo *fip = _TIFFFieldWithTag(tif, dir->tdir_tag);
+ 			TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+                 "Cannot handle different per-sample values for field \"%s\"",
+-			_TIFFFieldWithTag(tif, dir->tdir_tag)->field_name);
++			fip ? fip->field_name : "Unknown");
+ 			goto bad;
                  }
              *pl = v[0];
-@@ -1534,6 +1587,7 @@
- TIFFFetchPerSampleLongs(TIFF* tif, TIFFDirEntry* dir, uint32* pl)
- {
-     uint16 samples = tif->tif_dir.td_samplesperpixel;
-+    const TIFFFieldInfo* fip;
-     int status = 0;
- 
-     if (CheckDirCount(tif, dir, (uint32) samples)) {
-@@ -1551,9 +1605,10 @@
+@@ -1748,9 +1768,10 @@ TIFFFetchPerSampleLongs(TIFF* tif, TIFFD
                  check_count = samples;
              for (i = 1; i < check_count; i++)
                  if (v[i] != v[0]) {
-+				fip = _TIFFFieldWithTag(tif, dir->tdir_tag);
- 					TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
-                               "Cannot handle different per-sample values for field \"%s\"",
--                              _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name);
-+                              fip ? fip->field_name : "Unknown");
-                     goto bad;
++			const TIFFFieldInfo *fip = _TIFFFieldWithTag(tif, dir->tdir_tag);
+ 			TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+                 "Cannot handle different per-sample values for field \"%s\"",
+-			_TIFFFieldWithTag(tif, dir->tdir_tag)->field_name);
++			fip ? fip->field_name : "Unknown");
+ 			goto bad;
                  }
              *pl = v[0];
-@@ -1574,6 +1629,7 @@
- TIFFFetchPerSampleAnys(TIFF* tif, TIFFDirEntry* dir, double* pl)
- {
-     uint16 samples = tif->tif_dir.td_samplesperpixel;
-+    const TIFFFieldInfo* fip;
-     int status = 0;
- 
-     if (CheckDirCount(tif, dir, (uint32) samples)) {
-@@ -1591,9 +1647,10 @@
+@@ -1788,9 +1809,10 @@ TIFFFetchPerSampleAnys(TIFF* tif, TIFFDi
  
              for (i = 1; i < check_count; i++)
                  if (v[i] != v[0]) {
-+		    fip = _TIFFFieldWithTag(tif, dir->tdir_tag);
-                     TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
-                               "Cannot handle different per-sample values for field \"%s\"",
--                              _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name);
<<Diff was trimmed, longer than 597 lines>>

---- CVS-web:
    http://cvs.pld-linux.org/cgi-bin/cvsweb.cgi/packages/libtiff/libtiff-sec.patch?r1=1.2&r2=1.3&f=u
    http://cvs.pld-linux.org/cgi-bin/cvsweb.cgi/packages/libtiff/libtiff.spec?r1=1.97&r2=1.98&f=u



More information about the pld-cvs-commit mailing list