From c20d284a28a124e715ebcd66a2a0f6fadc12057a6669f68dadda907a35ccb2e1 Mon Sep 17 00:00:00 2001
From: Michael Vetter <jubalh@iodoru.org>
Date: Mon, 1 Aug 2022 12:17:33 +0000
Subject: [PATCH] - security update:   * CVE-2022-34526 [bsc#1202026]     +
 tiff-CVE-2022-34526.patch

OBS-URL: https://build.opensuse.org/package/show/graphics/tiff?expand=0&rev=157
---
 tiff-CVE-2022-34526.patch | 14 ++++++++++++++
 tiff.changes              |  7 +++++++
 tiff.spec                 |  2 ++
 3 files changed, 23 insertions(+)
 create mode 100644 tiff-CVE-2022-34526.patch

diff --git a/tiff-CVE-2022-34526.patch b/tiff-CVE-2022-34526.patch
new file mode 100644
index 0000000..c9a359d
--- /dev/null
+++ b/tiff-CVE-2022-34526.patch
@@ -0,0 +1,14 @@
+Index: tiff-4.4.0/libtiff/tif_dirinfo.c
+===================================================================
+--- tiff-4.4.0.orig/libtiff/tif_dirinfo.c
++++ tiff-4.4.0/libtiff/tif_dirinfo.c
+@@ -1191,6 +1191,9 @@ _TIFFCheckFieldIsValidForCodec(TIFF *tif
+ 	    default:
+ 		return 1;
+ 	}
++	if( !TIFFIsCODECConfigured(tif->tif_dir.td_compression) ) {
++		return 0;
++	}
+ 	/* Check if codec specific tags are allowed for the current
+ 	 * compression scheme (codec) */
+ 	switch (tif->tif_dir.td_compression) {
diff --git a/tiff.changes b/tiff.changes
index 20f848c..f050201 100644
--- a/tiff.changes
+++ b/tiff.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Mon Aug  1 12:06:01 UTC 2022 - Michael Vetter <mvetter@suse.com>
+
+- security update:
+  * CVE-2022-34526 [bsc#1202026]
+    + tiff-CVE-2022-34526.patch
+
 -------------------------------------------------------------------
 Wed Jul  6 07:55:09 UTC 2022 - Michael Vetter <mvetter@suse.com>
 
diff --git a/tiff.spec b/tiff.spec
index 95aa0d1..ad07a42 100644
--- a/tiff.spec
+++ b/tiff.spec
@@ -34,6 +34,7 @@ Patch0:         tiff-4.0.3-seek.patch
 # http://bugzilla.maptools.org/show_bug.cgi?id=2442
 Patch1:         tiff-4.0.3-compress-warning.patch
 Patch2:         tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch
+Patch3:         tiff-CVE-2022-34526.patch
 BuildRequires:  gcc-c++
 BuildRequires:  libjbig-devel
 BuildRequires:  libjpeg-devel
@@ -74,6 +75,7 @@ the libtiff library.
 %patch0 -p1
 %patch1 -p1
 %patch2 -p1
+%patch3 -p1
 
 %build
 CFLAGS="%{optflags} -fPIE"