- Update test/test_directory.c not to fail on big-endian machines.

* Add tiff-4.7.0-test_directory.patch
    Fix memory leaks (fixes issue #652)
  * Resolves bsc#1236834
    fix build fail on s390x

OBS-URL: https://build.opensuse.org/package/show/graphics/tiff?expand=0&rev=190
This commit is contained in:
Michael Vetter 2025-02-06 08:21:12 +00:00 committed by Git OBS Bridge
commit 68e521d854
16 changed files with 2833 additions and 0 deletions

23
.gitattributes vendored Normal file
View File

@ -0,0 +1,23 @@
## Default LFS
*.7z filter=lfs diff=lfs merge=lfs -text
*.bsp filter=lfs diff=lfs merge=lfs -text
*.bz2 filter=lfs diff=lfs merge=lfs -text
*.gem filter=lfs diff=lfs merge=lfs -text
*.gz filter=lfs diff=lfs merge=lfs -text
*.jar filter=lfs diff=lfs merge=lfs -text
*.lz filter=lfs diff=lfs merge=lfs -text
*.lzma filter=lfs diff=lfs merge=lfs -text
*.obscpio filter=lfs diff=lfs merge=lfs -text
*.oxt filter=lfs diff=lfs merge=lfs -text
*.pdf filter=lfs diff=lfs merge=lfs -text
*.png filter=lfs diff=lfs merge=lfs -text
*.rpm filter=lfs diff=lfs merge=lfs -text
*.tbz filter=lfs diff=lfs merge=lfs -text
*.tbz2 filter=lfs diff=lfs merge=lfs -text
*.tgz filter=lfs diff=lfs merge=lfs -text
*.ttf filter=lfs diff=lfs merge=lfs -text
*.txz filter=lfs diff=lfs merge=lfs -text
*.whl filter=lfs diff=lfs merge=lfs -text
*.xz filter=lfs diff=lfs merge=lfs -text
*.zip filter=lfs diff=lfs merge=lfs -text
*.zst filter=lfs diff=lfs merge=lfs -text

1
.gitignore vendored Normal file
View File

@ -0,0 +1 @@
.osc

2
README.SUSE Normal file
View File

@ -0,0 +1,2 @@
The documentation for tiff programs and library is in package tiff
in directory /usr/share/doc/packages/tiff.

3
_multibuild Normal file
View File

@ -0,0 +1,3 @@
<multibuild>
<package>man</package>
</multibuild>

6
baselibs.conf Normal file
View File

@ -0,0 +1,6 @@
libtiff6
obsoletes "libtiff-<targettype> <= <version>"
provides "libtiff-<targettype> = <version>"
libtiff-devel
requires -libtiff-<targettype>
requires "libtiff6-<targettype> = <version>"

13
tiff-4.0.3-seek.patch Normal file
View File

@ -0,0 +1,13 @@
Index: tiff-4.6.0/libtiff/tiffiop.h
===================================================================
--- tiff-4.6.0.orig/libtiff/tiffiop.h
+++ tiff-4.6.0/libtiff/tiffiop.h
@@ -256,7 +256,7 @@ struct TIFFOpenOptions
#define TIFFWriteFile(tif, buf, size) \
((*(tif)->tif_writeproc)((tif)->tif_clientdata, (buf), (size)))
#define TIFFSeekFile(tif, off, whence) \
- ((*(tif)->tif_seekproc)((tif)->tif_clientdata, (off), (whence)))
+ ((tif)->tif_seekproc?((*(tif)->tif_seekproc)((tif)->tif_clientdata,(toff_t)(off),whence)):0)
#define TIFFCloseFile(tif) ((*(tif)->tif_closeproc)((tif)->tif_clientdata))
#define TIFFGetFileSize(tif) ((*(tif)->tif_sizeproc)((tif)->tif_clientdata))
#define TIFFMapFileContents(tif, paddr, psize) \

BIN
tiff-4.6.0.tar.xz (Stored with Git LFS) Normal file

Binary file not shown.

BIN
tiff-4.6.0.tar.xz.sig Normal file

Binary file not shown.

View File

@ -0,0 +1,167 @@
From ea6f6bd7bccbe9a80327810993b8aae5587e1307 Mon Sep 17 00:00:00 2001
From: Su Laus <sulau@freenet.de>
Date: Tue, 19 Nov 2024 18:34:02 +0000
Subject: [PATCH] Update test/test_directory.c not to fail on big-endian
machines. Fix memory leaks
Closes #652 et #656
---
test/test_directory.c | 67 ++++++++++++++++++++++++++++++++++++-------
1 file changed, 56 insertions(+), 11 deletions(-)
diff --git a/test/test_directory.c b/test/test_directory.c
index 0556da1ec..8cc376958 100644
--- a/test/test_directory.c
+++ b/test/test_directory.c
@@ -1365,6 +1365,7 @@ int test_rewrite_lastdir_offset(unsigned int openMode)
filename, N_DIRECTORIES, count);
goto failure;
}
+ /* hint: file was closed by count_directories() */
unlink(filename);
return 0;
@@ -1511,6 +1512,8 @@ int test_lastdir_offset(unsigned int openMode)
}
}
}
+ /* hint: files are always closed by count_directories() and
+ * get_dir_offsets() */
unlink(filename_optimized);
unlink(filename_non_optimized);
return 0;
@@ -1977,8 +1980,8 @@ int test_current_dirnum_incrementing(int testcase, unsigned int openMode)
TIFFSetSubDirectory(tif, 0);
CHECKCURDIRNUM_M(tif, (tdir_t)(-1), __LINE__);
-/*-- Patch offset of IFD2 to not existing IFD3 without entries.
- * Thus TIFFFetchDirectory() will fail. --*/
+ /*-- Patch offset of IFD2 to not existing IFD3 without entries.
+ * Thus TIFFFetchDirectory() will fail. --*/
#define TIFFReadFile_M(tif, buf, size) \
((*TIFFGetReadProc(tif))(TIFFClientdata(tif), (buf), (size)));
#define TIFFWriteFile_M(tif, buf, size) \
@@ -1986,51 +1989,90 @@ int test_current_dirnum_incrementing(int testcase, unsigned int openMode)
#define TIFFSeekFile_M(tif, off, whence) \
((*TIFFGetSeekProc(tif))(TIFFClientdata(tif), (off), (whence)));
- /* Code below does only handle Classic-TIFF without swapping". */
- if (!(TIFFIsByteSwapped(tif) || TIFFIsBigTIFF(tif)))
- {
+ /* ---------------------------------------------------------------------
+ * Test IFD index incrementing in case the functions return with certain
+ * errors. To provoke that errors, the file is patched by writing bytes
+ * directly into the file. Therefore, code below does only handle
+ * Classic-TIFF and little-endian files.
+ * The code works also on big endian machines, which have to swap some
+ * directly read/written values.
+ * --------------------------------------------------------------------- */
+ if (!(TIFFIsBigEndian(tif) || TIFFIsBigTIFF(tif)))
+ {
+ /* Patch nextIFDOffset of IFD2, which is 0, with offset to itself.
+ * This generates an IFD3 without any elements at the end of file.
+ * Reading IFD3 should provoke reading error. */
uint64_t ss = TIFFSeekFile_M(tif, offsetBase[2], 0);
uint16_t cnt = 0;
uint64_t rr = TIFFReadFile_M(tif, &cnt, 2);
+ if (TIFFIsByteSwapped(tif))
+ TIFFSwabShort(&cnt);
ss = TIFFSeekFile_M(tif, offsetBase[2] + cnt * 12 + 2, 0);
uint32_t wt = (uint32_t)ss;
+ if (TIFFIsByteSwapped(tif))
+ TIFFSwabLong(&wt);
rr = TIFFWriteFile_M(tif, &wt, 4);
(void)rr;
/* Now there are offsets to four IFDs in the file, where the last one is
- * not existing and has a non-valid dircount and entries behind EOF. */
+ * not existing and has a non-valid dircount and entries behind EOF.
+ * (dircount is 458 (as offset) */
fprintf(stderr, "----- Expect error messages about 'Error fetching "
"directory link.' -----\n");
- /* TIFFNumberOfDirectories() returns 3 */
+ /* TIFFNumberOfDirectories() returns 3 and omits the invalid fourth IFD.
+ */
lastdir = TIFFNumberOfDirectories(tif);
TIFFSetDirectory(tif, 0);
CHECKCURDIRNUM_M(tif, 0, __LINE__);
+
+ /* TIFFSetDirectory(3) fails with error messages:
+ * TIFFFetchDirectory: test_current_dirnum_incrementing_wl.tif:
+ * Can not read TIFF directory.
+ * TIFFReadDirectory: Failed to read directory at offset 458. */
fprintf(stderr, "----- Expect error messages about 'Cannot read TIFF "
"directory.' -----\n");
if (TIFFSetDirectory(tif, 3))
{
fprintf(stderr,
- "TIFFSetDirectory(3) for IFD4 was expected to fail but "
+ "TIFFSetDirectory(3) for IFD3 was expected to fail but "
"succeeded for %s "
"at %d\n",
filename, __LINE__);
goto failure;
}
+
/* Fails in 4.6.0 */
+ /* Reading invalid IFD 3 leads to an error and was not read in.
+ * Therefore, curdir shall be 65535 (non-existing directory) */
CHECKCURDIRNUM_M(tif, (tdir_t)(-1), __LINE__);
offsetBase[3] = TIFFCurrentDirOffset(tif);
- /* Point IFD3 to a location within the file, where it has now a
- * non-valid dircount=0. */
+ /* Point IFD3 to a location within the file, where it has now for
+ * little-endian TIFF files a non-valid dircount=0, which leads also to
+ * an error and the IFD is not read in. */
ss = TIFFSeekFile_M(tif, offsetBase[2] + cnt * 12 + 2, 0);
wt = (uint32_t)(offsetBase[1] + 8);
+ // wt = (uint32_t)(ss + 400);
+ if (TIFFIsByteSwapped(tif))
+ TIFFSwabLong(&wt);
rr = TIFFWriteFile_M(tif, &wt, 4);
+
fprintf(stderr, "----- Expect error messages about 'Error fetching "
"directory link.' -----\n");
- /* TIFFNumberOfDirectories() returns now 4 */
+ /* TIFFNumberOfDirectories() returns now 4, because for an IFD linked
+ * list dircount=0 is not treated as an error and there is an offset
+ * (=1) to a next IFD. Then, at the fifth IFD a link error occurs. */
lastdir = TIFFNumberOfDirectories(tif);
TIFFSetDirectory(tif, 0);
CHECKCURDIRNUM_M(tif, 0, __LINE__);
+
+ /* TIFFSetDirectory(3) fails with error messages:
+ * test_current_dirnum_incrementing_wl.tif: Failed to allocate
+ * memory for to read TIFF directory (0 elements of 12 bytes each).
+ * TIFFReadDirectory: Failed to read directory at offset 178.
+ * The IFD 3 is not read in and curdir is set to 65535 (non-existing
+ * directory).
+ */
fprintf(stderr,
"----- Expect error messages about 'Failed to allocate "
"memory for to read TIFF directory.' AND 'Failed to read "
@@ -2044,10 +2086,12 @@ int test_current_dirnum_incrementing(int testcase, unsigned int openMode)
filename, __LINE__);
goto failure;
}
+
/* Fails in 4.6.0 */
CHECKCURDIRNUM_M(tif, (tdir_t)(-1), __LINE__);
}
+ TIFFClose(tif);
unlink(filename);
return 0;
@@ -2136,6 +2180,7 @@ int test_curdircount_setting(unsigned int openMode)
CHECKCURDIRNUM_M(tif, (tdir_t)(-1), __LINE__);
}
+ TIFFClose(tif);
unlink(filename);
return 0;
--
GitLab

BIN
tiff-4.7.0.tar.xz (Stored with Git LFS) Normal file

Binary file not shown.

BIN
tiff-4.7.0.tar.xz.sig Normal file

Binary file not shown.

33
tiff-CVE-2023-52356.patch Normal file
View File

@ -0,0 +1,33 @@
Index: tiff-4.6.0/libtiff/tif_getimage.c
===================================================================
--- tiff-4.6.0.orig/libtiff/tif_getimage.c
+++ tiff-4.6.0/libtiff/tif_getimage.c
@@ -3224,6 +3224,13 @@ int TIFFReadRGBAStripExt(TIFF *tif, uint
if (TIFFRGBAImageOK(tif, emsg) &&
TIFFRGBAImageBegin(&img, tif, stop_on_error, emsg))
{
+ if (row >= img.height)
+ {
+ TIFFErrorExtR(tif, TIFFFileName(tif),
+ "Invalid row passed to TIFFReadRGBAStrip().");
+ TIFFRGBAImageEnd(&img);
+ return (0);
+ }
img.row_offset = row;
img.col_offset = 0;
@@ -3301,6 +3308,14 @@ int TIFFReadRGBATileExt(TIFF *tif, uint3
return (0);
}
+ if (col >= img.width || row >= img.height)
+ {
+ TIFFErrorExtR(tif, TIFFFileName(tif),
+ "Invalid row/col passed to TIFFReadRGBATile().");
+ TIFFRGBAImageEnd(&img);
+ return (0);
+ }
+
/*
* The TIFFRGBAImageGet() function doesn't allow us to get off the
* edge of the image, even to fill an otherwise valid tile. So we

49
tiff-CVE-2024-7006.patch Normal file
View File

@ -0,0 +1,49 @@
Upstream:
3705f82b6483c7906cf08cd6b9dcdcd59c61d779
Index: tiff-4.6.0/libtiff/tif_dirinfo.c
===================================================================
--- tiff-4.6.0.orig/libtiff/tif_dirinfo.c
+++ tiff-4.6.0/libtiff/tif_dirinfo.c
@@ -887,7 +887,7 @@ const TIFFField *_TIFFFindOrRegisterFiel
if (fld == NULL)
{
fld = _TIFFCreateAnonField(tif, tag, dt);
- if (!_TIFFMergeFields(tif, fld, 1))
+ if (fld == NULL || !_TIFFMergeFields(tif, fld, 1))
return NULL;
}
Index: tiff-4.6.0/libtiff/tif_dirread.c
===================================================================
--- tiff-4.6.0.orig/libtiff/tif_dirread.c
+++ tiff-4.6.0/libtiff/tif_dirread.c
@@ -4260,11 +4260,9 @@ int TIFFReadDirectory(TIFF *tif)
dp->tdir_tag, dp->tdir_tag);
/* the following knowingly leaks the
anonymous field structure */
- if (!_TIFFMergeFields(
- tif,
- _TIFFCreateAnonField(tif, dp->tdir_tag,
- (TIFFDataType)dp->tdir_type),
- 1))
+ const TIFFField *fld = _TIFFCreateAnonField(
+ tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type);
+ if (fld == NULL || !_TIFFMergeFields(tif, fld, 1))
{
TIFFWarningExtR(
tif, module,
@@ -5138,11 +5136,9 @@ int TIFFReadCustomDirectory(TIFF *tif, t
"Unknown field with tag %" PRIu16 " (0x%" PRIx16
") encountered",
dp->tdir_tag, dp->tdir_tag);
- if (!_TIFFMergeFields(
- tif,
- _TIFFCreateAnonField(tif, dp->tdir_tag,
- (TIFFDataType)dp->tdir_type),
- 1))
+ const TIFFField *fld = _TIFFCreateAnonField(
+ tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type);
+ if (fld == NULL || !_TIFFMergeFields(tif, fld, 1))
{
TIFFWarningExtR(tif, module,
"Registering anonymous field with tag %" PRIu16

2321
tiff.changes Normal file

File diff suppressed because it is too large Load Diff

29
tiff.keyring Normal file
View File

@ -0,0 +1,29 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQENBFWDB10BCADeJcYKb4zsG2fs3MWGf996ZS4KIiOBRNQtQwCI5+h3K8m1qDur
qyRZ50tB/ODJwJNqdKGdGyrIvGDynsS9JsZMJ2PVoI9IK+X/vQiokx9lJCuDXTtw
1THmA85lyl1blLe3j6tA74MSXDiT3nVk375djTz+zOGxa/Ueg49tM+DjltYpkVsG
TCc29/QJ4rZmto0Lj8iU+9S7S8H/2/54qUn7vFzfzsTkI8fiLM0deCzONzE7j9Ho
vj/8dSHmB5GOGtLf2kMHbgDhHfs61UN4FawugnilCfrxVzi5EmmEByP8Zp6h/or5
+QrTCFrVEW+zRXDGsqicN01rK22/JvyUbpyNABEBAAG0KUV2ZW4gUm91YXVsdCA8
ZXZlbi5yb3VhdWx0QHNwYXRpYWx5cy5jb20+iQE4BBMBAgAiBQJVgwddAhsDBgsJ
CAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAz67/Eez3YfZphB/9H/fWUakZqzlqi
NhZbev0um5GUYBERB7cp8JqmILF6TzCvievmR8q0zJb3vyc+8Kjti/n5CyziWDtH
XqibyhsoAFoOHhyMjQVj/hFR6oCWxF6fASkzpUSoDAHtVpFXqaLrbI1B2Fb9JpTs
VrHz0HVaW30E7eybmi7oYjV4T1bO22D/aH80zx3i6cLnoGqMCHmKrwNOK7A95mKj
k9s9GRbamR/3ef8BDF3xikDe8nSxICVc3WJbMHcGjHU6p8C/RzCvWqfHDtTuiWcG
feqaA1LmBKtpIHwG1uigM8+MJT+S+NYljTLqbz0FsORbUQ1QqXuqrfNoBqAEbLxg
esSGPx7UuQENBFWDB10BCADwo42Jwl14Tq3xhPM+1BSOfy3Aw6wTXsWzxoDABs+8
42WhD53vn7MnOSz2VX4cTvw4ioi+N3NB2zaHGNTrwyV3DExh0d8ZNq53IXoMYfot
Uv/lZ6QHJB+kIYe+twOjkKCYj4jt1m7aEDZ3Ra4aoZbYWfFbQNZ0tnUKFVUBWcWQ
jyCWC84BdXkbxcmsr2njocqyu0lfjXpVcCBcTCcgf/LHy79asm4jgB0XpE+e8ri8
kEadj7x7x4rrhJfa9t3oJ3AZ3rmo5zzFdbJtNKhCmwCoHrvRNWOPn6u5E7YYW9kB
xgzUUhh1g2F9RMbh3CZjICi9HtbWK3slWGYTaMt4lg/ZABEBAAGJAR8EGAECAAkF
AlWDB10CGwwACgkQM+u/xHs92H2a0wf/XV0XjqMWufAIKkvL6CmrZrCixWmPOiC1
q8894h+gR5JpKD9h0gLJhtk4tLMy+pDmNSxPXsoRYHneJIqHl1M72Q7vEhTKIVXn
h9A306ZjCHTTNSQ3npNG1wpO0LyLDmn+Zvd1JBoFyCzsTPZ+TbUYvVJT0CeFbJBe
1JzoO1Mi2fOtA91GuYtstWLNccDbv2b5s+JSbAf3ix3+qiUpA5fglWFljCYPxzkA
eU8AReBpuirD0ZQ1Z7GJDJs2zHKZu5BqCTf5gpVLUHCXd3F46CZ4IaVrOGhNP1Ki
KemC/dPHz7Ku7HN0tqmmmu12nvUACBckNsVebCefOFrkGtdryHQ1Zw==
=4/vP
-----END PGP PUBLIC KEY BLOCK-----

180
tiff.spec Normal file
View File

@ -0,0 +1,180 @@
#
# spec file for package tiff
#
# Copyright (c) 2025 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
%global build_flavor @BUILD_FLAVOR@%{nil}
%if "%{?build_flavor}" == "man"
%bcond_without tiff_manpages
%else
%bcond_with tiff_manpages
%endif
%define asan_build 0
%define debug_build 0
%define pkg_name tiff
%if "%{build_flavor}" == ""
Name: tiff
%else
Name: tiff-%{build_flavor}
%endif
Version: 4.7.0
Release: 0
Summary: Tools for Converting from and to the Tagged Image File Format
License: HPND
Group: Productivity/Graphics/Convertors
URL: https://libtiff.gitlab.io/libtiff/
Source: https://download.osgeo.org/libtiff/tiff-%{version}.tar.xz
Source1: https://download.osgeo.org/libtiff/tiff-%{version}.tar.xz.sig
Source2: README.SUSE
Source3: baselibs.conf
Source99: tiff.keyring
Patch0: tiff-4.0.3-seek.patch
# PATCH-FIX-UPSTREAM tiff-4.7.0-test_directory.patch based on commit ea6f6bd7bccb bsc#1236834
Patch1: tiff-4.7.0-test_directory.patch
%if %{with tiff_manpages}
BuildRequires: %{primary_python}-Sphinx
%endif
BuildRequires: cmake
BuildRequires: gcc-c++
BuildRequires: libjbig-devel
BuildRequires: libjpeg-devel
BuildRequires: libtool
BuildRequires: lzma-devel
BuildRequires: pkgconfig
BuildRequires: pkgconfig(libzstd)
BuildRequires: pkgconfig(zlib)
Recommends: tiff-docs = %{version}
%description
This package contains the library and support programs for the TIFF
image format.
%package -n libtiff6
Summary: The Tiff Library (with JPEG and compression support)
Group: System/Libraries
Provides: libtiff = %{version}
%description -n libtiff6
This package includes the tiff libraries. To link a program with
libtiff, you will have to add -ljpeg and -lz to include the necessary
libjpeg and libz in the linking process.
%package -n libtiff-devel
Summary: Development Tools for Programs which will use the libtiff Library
Group: Development/Libraries/C and C++
Requires: glibc-devel
Requires: libstdc++-devel
Requires: libtiff6 = %{version}
Recommends: libtiff-devel-docs = %{version}
%description -n libtiff-devel
This package contains the header files and static libraries for
developing programs which will manipulate TIFF format image files using
the libtiff library.
%if %{with tiff_manpages}
%package -n tiff-docs
Summary: Development Tools for Programs which will use the libtiff Library
Group: Productivity/Graphics/Convertors
Requires: tiff = %{version}
BuildArch: noarch
%description -n tiff-docs
This package contains the header files and static libraries for
developing programs which will manipulate TIFF format image files using
the libtiff library.
This package holds the man pages for the command lint tools.
%package -n libtiff-devel-docs
Summary: Development Documentation for Programs which will use the libtiff Library
Group: Development/Libraries/C and C++
Requires: libtiff-devel = %{version}
BuildArch: noarch
%description -n libtiff-devel-docs
This package contains the header files and static libraries for
developing programs which will manipulate TIFF format image files using
the libtiff library.
This package holds the development man pages.
%endif
%prep
%autosetup -p1 -n %{pkg_name}-%{version}
%build
CFLAGS="%{optflags} -fPIC"
%if %{debug_build}
CFLAGS="$CFLAGS -O0"
%endif
# tools are not enabled for now due to test failure `FAIL: tiffcp-32bpp-None-jpeg.sh`
%cmake
%if %{asan_build}
find -name Makefile | xargs sed -i 's/\(^CFLAGS.*\)/\1 -fsanitize=address/'
%endif
%cmake_build
%install
%cmake_install
cp %{SOURCE2} .
rm -rf %{buildroot}%{_datadir}/doc/{,packages/}tiff*
find %{buildroot} -type f -name "*.la" -delete -print
%if %{with tiff_manpages}
rm -rv \
%{buildroot}%{_bindir} \
%{buildroot}%{_libdir} \
%{buildroot}%{_includedir}
%files -n tiff-docs
%{_mandir}/man1/*
%files -n libtiff-devel-docs
%{_mandir}/man3/*
%else
%check
%if %{asan_build}
# ASAN needs /proc to be mounted
exit 0
%endif
%ctest
%ldconfig_scriptlets -n libtiff6
%files
%{_bindir}/*
%doc README.md VERSION ChangeLog TODO RELEASE-DATE
%files -n libtiff6
%license LICENSE.md
%doc README.md README.SUSE
%{_libdir}/*.so.*
%files -n libtiff-devel
%{_includedir}/*
%{_libdir}/*.so
%{_libdir}/pkgconfig/*.pc
%{_libdir}/cmake/tiff/
%endif
%changelog