rpms
/
mingw-libtiff
20
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

- update upstream URL

Browse Source 
- Fix some more LZW decoding vulnerabilities (CVE-2009-2285) Related:
    #511015
epel9
plouj 16 years ago
parent 121475f5fb
commit 1aa6993d5e
2 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File

6
libtiff-3.8.2-lzw-bugs.patch
Unescape View File

@ -1,4 +1,4 @@
Fixes for CVE-2008-2327 Fixes for CVE-2008-2327 and CVE-2009-2285
diff -Naur tiff-3.8.2.orig/libtiff/tif_lzw.c tiff-3.8.2/libtiff/tif_lzw.c diff -Naur tiff-3.8.2.orig/libtiff/tif_lzw.c tiff-3.8.2/libtiff/tif_lzw.c
@ -27,7 +27,7 @@ diff -Naur tiff-3.8.2.orig/libtiff/tif_lzw.c tiff-3.8.2/libtiff/tif_lzw.c
NextCode(tif, sp, bp, code, GetNextCode); NextCode(tif, sp, bp, code, GetNextCode);
if (code == CODE_EOI) if (code == CODE_EOI)
break; break;
+ if (code == CODE_CLEAR) { + if (code >= CODE_CLEAR) {
+ TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+ "LZWDecode: Corrupted LZW table at scanline %d", + "LZWDecode: Corrupted LZW table at scanline %d",
+ tif->tif_row); + tif->tif_row);
@ -47,7 +47,7 @@ diff -Naur tiff-3.8.2.orig/libtiff/tif_lzw.c tiff-3.8.2/libtiff/tif_lzw.c
NextCode(tif, sp, bp, code, GetNextCodeCompat); NextCode(tif, sp, bp, code, GetNextCodeCompat);
if (code == CODE_EOI) if (code == CODE_EOI)
break; break;
+ if (code == CODE_CLEAR) { + if (code >= CODE_CLEAR) {
+ TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+ "LZWDecodeCompat: Corrupted LZW table at scanline %d", + "LZWDecodeCompat: Corrupted LZW table at scanline %d",
+ tif->tif_row); + tif->tif_row);

9
mingw32-libtiff.spec
Unescape View File

@ -7,10 +7,10 @@
Summary: MinGW Windows port of the LibTIFF library Summary: MinGW Windows port of the LibTIFF library
Name: mingw32-libtiff Name: mingw32-libtiff
Version: 3.8.2 Version: 3.8.2
Release: 16%{?dist} Release: 17%{?dist}
License: libtiff License: libtiff
Group: System Environment/Libraries Group: System Environment/Libraries
URL: http://www.libtiff.org/ URL: http://www.remotesensing.org/libtiff/
Source: ftp://ftp.remotesensing.org/pub/libtiff/tiff-%{version}.tar.gz Source: ftp://ftp.remotesensing.org/pub/libtiff/tiff-%{version}.tar.gz
Patch0: tiffsplit-overflow.patch Patch0: tiffsplit-overflow.patch
@ -77,6 +77,11 @@ rm -rf $RPM_BUILD_ROOT
%changelog %changelog
* Mon Jul 13 2009 Michael Ploujnikov <ploujj@gmail.com> - 3.8.2-17
- update upstream URL
- Fix some more LZW decoding vulnerabilities (CVE-2009-2285)
Related: #511015
* Mon Jun 8 2009 Michael Ploujnikov <ploujj@gmail.com> - 3.8.2-16 * Mon Jun 8 2009 Michael Ploujnikov <ploujj@gmail.com> - 3.8.2-16
- add mingw32-gcc-c++ to the BuildRequirements - add mingw32-gcc-c++ to the BuildRequirements

Write Preview
Loading…
Cancel
Save