1 |
commit: 6f50c6e9a116c3d950db0cd2e131893aca2f1cf2 |
2 |
Author: Mattias Nissler <mnissler <AT> chromium <DOT> org> |
3 |
AuthorDate: Tue Sep 3 10:25:18 2019 +0000 |
4 |
Commit: Aaron Bauman <bman <AT> gentoo <DOT> org> |
5 |
CommitDate: Tue Sep 3 19:45:36 2019 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6f50c6e9 |
7 |
|
8 |
media-libs/tiff: Pull in patch for CVE-2019-14973 |
9 |
|
10 |
Bug: https://bugs.gentoo.org/693394 |
11 |
|
12 |
Signed-off-by: Mattias Nissler <mnissler <AT> chromium.org> |
13 |
Closes: https://github.com/gentoo/gentoo/pull/12851 |
14 |
Signed-off-by: Aaron Bauman <bman <AT> gentoo.org> |
15 |
|
16 |
....0.10-CVE-2019-14973-fix-integer-overflow.patch | 395 +++++++++++++++++++++ |
17 |
media-libs/tiff/tiff-4.0.10-r2.ebuild | 85 +++++ |
18 |
2 files changed, 480 insertions(+) |
19 |
|
20 |
diff --git a/media-libs/tiff/files/tiff-4.0.10-CVE-2019-14973-fix-integer-overflow.patch b/media-libs/tiff/files/tiff-4.0.10-CVE-2019-14973-fix-integer-overflow.patch |
21 |
new file mode 100644 |
22 |
index 00000000000..cbcbfd9d7f0 |
23 |
--- /dev/null |
24 |
+++ b/media-libs/tiff/files/tiff-4.0.10-CVE-2019-14973-fix-integer-overflow.patch |
25 |
@@ -0,0 +1,395 @@ |
26 |
+From 6ebfcac47224d3b8661c501967d495135449883e Mon Sep 17 00:00:00 2001 |
27 |
+From: Even Rouault <even.rouault@×××××××××.com> |
28 |
+Date: Sat, 10 Aug 2019 18:25:03 +0200 |
29 |
+Subject: [PATCH] Fix integer overflow in _TIFFCheckMalloc() and other |
30 |
+ implementation-defined behaviour (CVE-2019-14973) |
31 |
+ |
32 |
+_TIFFCheckMalloc()/_TIFFCheckRealloc() used a unsafe way to detect overflow |
33 |
+in the multiplication of nmemb and elem_size (which are of type tmsize_t, thus |
34 |
+signed), which was especially easily triggered on 32-bit builds (with recent |
35 |
+enough compilers that assume that signed multiplication cannot overflow, since |
36 |
+this is undefined behaviour by the C standard). The original issue which lead to |
37 |
+this fix was trigged from tif_fax3.c |
38 |
+ |
39 |
+There were also unsafe (implementation defied), and broken in practice on 64bit |
40 |
+builds, ways of checking that a uint64 fits of a (signed) tmsize_t by doing |
41 |
+(uint64)(tmsize_t)uint64_var != uint64_var comparisons. Those have no known |
42 |
+at that time exploits, but are better to fix in a more bullet-proof way. |
43 |
+Or similarly use of (int64)uint64_var <= 0. |
44 |
+ |
45 |
+--- a/libtiff/tif_aux.c |
46 |
++++ b/libtiff/tif_aux.c |
47 |
+@@ -57,18 +57,57 @@ _TIFFMultiply64(TIFF* tif, uint64 first, uint64 second, const char* where) |
48 |
+ return bytes; |
49 |
+ } |
50 |
+ |
51 |
++tmsize_t |
52 |
++_TIFFMultiplySSize(TIFF* tif, tmsize_t first, tmsize_t second, const char* where) |
53 |
++{ |
54 |
++ if( first <= 0 || second <= 0 ) |
55 |
++ { |
56 |
++ if( tif != NULL && where != NULL ) |
57 |
++ { |
58 |
++ TIFFErrorExt(tif->tif_clientdata, where, |
59 |
++ "Invalid argument to _TIFFMultiplySSize() in %s", where); |
60 |
++ } |
61 |
++ return 0; |
62 |
++ } |
63 |
++ |
64 |
++ if( first > TIFF_TMSIZE_T_MAX / second ) |
65 |
++ { |
66 |
++ if( tif != NULL && where != NULL ) |
67 |
++ { |
68 |
++ TIFFErrorExt(tif->tif_clientdata, where, |
69 |
++ "Integer overflow in %s", where); |
70 |
++ } |
71 |
++ return 0; |
72 |
++ } |
73 |
++ return first * second; |
74 |
++} |
75 |
++ |
76 |
++tmsize_t _TIFFCastUInt64ToSSize(TIFF* tif, uint64 val, const char* module) |
77 |
++{ |
78 |
++ if( val > (uint64)TIFF_TMSIZE_T_MAX ) |
79 |
++ { |
80 |
++ if( tif != NULL && module != NULL ) |
81 |
++ { |
82 |
++ TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); |
83 |
++ } |
84 |
++ return 0; |
85 |
++ } |
86 |
++ return (tmsize_t)val; |
87 |
++} |
88 |
++ |
89 |
+ void* |
90 |
+ _TIFFCheckRealloc(TIFF* tif, void* buffer, |
91 |
+ tmsize_t nmemb, tmsize_t elem_size, const char* what) |
92 |
+ { |
93 |
+ void* cp = NULL; |
94 |
+- tmsize_t bytes = nmemb * elem_size; |
95 |
+- |
96 |
++ tmsize_t count = _TIFFMultiplySSize(tif, nmemb, elem_size, NULL); |
97 |
+ /* |
98 |
+- * XXX: Check for integer overflow. |
99 |
++ * Check for integer overflow. |
100 |
+ */ |
101 |
+- if (nmemb && elem_size && bytes / elem_size == nmemb) |
102 |
+- cp = _TIFFrealloc(buffer, bytes); |
103 |
++ if (count != 0) |
104 |
++ { |
105 |
++ cp = _TIFFrealloc(buffer, count); |
106 |
++ } |
107 |
+ |
108 |
+ if (cp == NULL) { |
109 |
+ TIFFErrorExt(tif->tif_clientdata, tif->tif_name, |
110 |
+--- a/libtiff/tif_getimage.c |
111 |
++++ b/libtiff/tif_getimage.c |
112 |
+@@ -755,9 +755,8 @@ gtTileSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) |
113 |
+ uint32 leftmost_tw; |
114 |
+ |
115 |
+ tilesize = TIFFTileSize(tif); |
116 |
+- bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,tilesize); |
117 |
++ bufsize = _TIFFMultiplySSize(tif, alpha?4:3,tilesize, "gtTileSeparate"); |
118 |
+ if (bufsize == 0) { |
119 |
+- TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate"); |
120 |
+ return (0); |
121 |
+ } |
122 |
+ |
123 |
+@@ -1019,9 +1018,8 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) |
124 |
+ uint16 colorchannels; |
125 |
+ |
126 |
+ stripsize = TIFFStripSize(tif); |
127 |
+- bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,stripsize); |
128 |
++ bufsize = _TIFFMultiplySSize(tif,alpha?4:3,stripsize, "gtStripSeparate"); |
129 |
+ if (bufsize == 0) { |
130 |
+- TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate"); |
131 |
+ return (0); |
132 |
+ } |
133 |
+ |
134 |
+--- a/libtiff/tif_luv.c |
135 |
++++ b/libtiff/tif_luv.c |
136 |
+@@ -1264,16 +1264,10 @@ LogL16GuessDataFmt(TIFFDirectory *td) |
137 |
+ return (SGILOGDATAFMT_UNKNOWN); |
138 |
+ } |
139 |
+ |
140 |
+- |
141 |
+-#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0)) |
142 |
+-#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1) |
143 |
+- |
144 |
+ static tmsize_t |
145 |
+ multiply_ms(tmsize_t m1, tmsize_t m2) |
146 |
+ { |
147 |
+- if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 ) |
148 |
+- return 0; |
149 |
+- return m1 * m2; |
150 |
++ return _TIFFMultiplySSize(NULL, m1, m2, NULL); |
151 |
+ } |
152 |
+ |
153 |
+ static int |
154 |
+--- a/libtiff/tif_pixarlog.c |
155 |
++++ b/libtiff/tif_pixarlog.c |
156 |
+@@ -634,15 +634,10 @@ PixarLogGuessDataFmt(TIFFDirectory *td) |
157 |
+ return guess; |
158 |
+ } |
159 |
+ |
160 |
+-#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0)) |
161 |
+-#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1) |
162 |
+- |
163 |
+ static tmsize_t |
164 |
+ multiply_ms(tmsize_t m1, tmsize_t m2) |
165 |
+ { |
166 |
+- if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 ) |
167 |
+- return 0; |
168 |
+- return m1 * m2; |
169 |
++ return _TIFFMultiplySSize(NULL, m1, m2, NULL); |
170 |
+ } |
171 |
+ |
172 |
+ static tmsize_t |
173 |
+--- a/libtiff/tif_read.c |
174 |
++++ b/libtiff/tif_read.c |
175 |
+@@ -29,9 +29,6 @@ |
176 |
+ #include "tiffiop.h" |
177 |
+ #include <stdio.h> |
178 |
+ |
179 |
+-#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0)) |
180 |
+-#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1) |
181 |
+- |
182 |
+ int TIFFFillStrip(TIFF* tif, uint32 strip); |
183 |
+ int TIFFFillTile(TIFF* tif, uint32 tile); |
184 |
+ static int TIFFStartStrip(TIFF* tif, uint32 strip); |
185 |
+@@ -49,6 +46,8 @@ TIFFReadRawTile1(TIFF* tif, uint32 tile, void* buf, tmsize_t size, const char* m |
186 |
+ #define THRESHOLD_MULTIPLIER 10 |
187 |
+ #define MAX_THRESHOLD (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * INITIAL_THRESHOLD) |
188 |
+ |
189 |
++#define TIFF_INT64_MAX ((((int64)0x7FFFFFFF) << 32) | 0xFFFFFFFF) |
190 |
++ |
191 |
+ /* Read 'size' bytes in tif_rawdata buffer starting at offset 'rawdata_offset' |
192 |
+ * Returns 1 in case of success, 0 otherwise. */ |
193 |
+ static int TIFFReadAndRealloc( TIFF* tif, tmsize_t size, |
194 |
+@@ -734,23 +733,8 @@ TIFFReadRawStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size) |
195 |
+ return ((tmsize_t)(-1)); |
196 |
+ } |
197 |
+ bytecount = td->td_stripbytecount[strip]; |
198 |
+- if ((int64)bytecount <= 0) { |
199 |
+-#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) |
200 |
+- TIFFErrorExt(tif->tif_clientdata, module, |
201 |
+- "%I64u: Invalid strip byte count, strip %lu", |
202 |
+- (unsigned __int64) bytecount, |
203 |
+- (unsigned long) strip); |
204 |
+-#else |
205 |
+- TIFFErrorExt(tif->tif_clientdata, module, |
206 |
+- "%llu: Invalid strip byte count, strip %lu", |
207 |
+- (unsigned long long) bytecount, |
208 |
+- (unsigned long) strip); |
209 |
+-#endif |
210 |
+- return ((tmsize_t)(-1)); |
211 |
+- } |
212 |
+- bytecountm = (tmsize_t)bytecount; |
213 |
+- if ((uint64)bytecountm!=bytecount) { |
214 |
+- TIFFErrorExt(tif->tif_clientdata, module, "Integer overflow"); |
215 |
++ bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount, module); |
216 |
++ if (bytecountm == 0) { |
217 |
+ return ((tmsize_t)(-1)); |
218 |
+ } |
219 |
+ if (size != (tmsize_t)(-1) && size < bytecountm) |
220 |
+@@ -774,7 +758,7 @@ TIFFFillStrip(TIFF* tif, uint32 strip) |
221 |
+ if ((tif->tif_flags&TIFF_NOREADRAW)==0) |
222 |
+ { |
223 |
+ uint64 bytecount = td->td_stripbytecount[strip]; |
224 |
+- if ((int64)bytecount <= 0) { |
225 |
++ if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) { |
226 |
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) |
227 |
+ TIFFErrorExt(tif->tif_clientdata, module, |
228 |
+ "Invalid strip byte count %I64u, strip %lu", |
229 |
+@@ -801,7 +785,7 @@ TIFFFillStrip(TIFF* tif, uint32 strip) |
230 |
+ (bytecount - 4096) / 10 > (uint64)stripsize ) |
231 |
+ { |
232 |
+ uint64 newbytecount = (uint64)stripsize * 10 + 4096; |
233 |
+- if( (int64)newbytecount >= 0 ) |
234 |
++ if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX ) |
235 |
+ { |
236 |
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) |
237 |
+ TIFFWarningExt(tif->tif_clientdata, module, |
238 |
+@@ -1196,10 +1180,8 @@ TIFFReadRawTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size) |
239 |
+ bytecount64 = td->td_stripbytecount[tile]; |
240 |
+ if (size != (tmsize_t)(-1) && (uint64)size < bytecount64) |
241 |
+ bytecount64 = (uint64)size; |
242 |
+- bytecountm = (tmsize_t)bytecount64; |
243 |
+- if ((uint64)bytecountm!=bytecount64) |
244 |
+- { |
245 |
+- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); |
246 |
++ bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module); |
247 |
++ if( bytecountm == 0 ) { |
248 |
+ return ((tmsize_t)(-1)); |
249 |
+ } |
250 |
+ return (TIFFReadRawTile1(tif, tile, buf, bytecountm, module)); |
251 |
+@@ -1221,7 +1203,7 @@ TIFFFillTile(TIFF* tif, uint32 tile) |
252 |
+ if ((tif->tif_flags&TIFF_NOREADRAW)==0) |
253 |
+ { |
254 |
+ uint64 bytecount = td->td_stripbytecount[tile]; |
255 |
+- if ((int64)bytecount <= 0) { |
256 |
++ if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) { |
257 |
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) |
258 |
+ TIFFErrorExt(tif->tif_clientdata, module, |
259 |
+ "%I64u: Invalid tile byte count, tile %lu", |
260 |
+@@ -1248,7 +1230,7 @@ TIFFFillTile(TIFF* tif, uint32 tile) |
261 |
+ (bytecount - 4096) / 10 > (uint64)stripsize ) |
262 |
+ { |
263 |
+ uint64 newbytecount = (uint64)stripsize * 10 + 4096; |
264 |
+- if( (int64)newbytecount >= 0 ) |
265 |
++ if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX ) |
266 |
+ { |
267 |
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) |
268 |
+ TIFFWarningExt(tif->tif_clientdata, module, |
269 |
+--- a/libtiff/tif_strip.c |
270 |
++++ b/libtiff/tif_strip.c |
271 |
+@@ -129,15 +129,8 @@ TIFFVStripSize(TIFF* tif, uint32 nrows) |
272 |
+ { |
273 |
+ static const char module[] = "TIFFVStripSize"; |
274 |
+ uint64 m; |
275 |
+- tmsize_t n; |
276 |
+ m=TIFFVStripSize64(tif,nrows); |
277 |
+- n=(tmsize_t)m; |
278 |
+- if ((uint64)n!=m) |
279 |
+- { |
280 |
+- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); |
281 |
+- n=0; |
282 |
+- } |
283 |
+- return(n); |
284 |
++ return _TIFFCastUInt64ToSSize(tif, m, module); |
285 |
+ } |
286 |
+ |
287 |
+ /* |
288 |
+@@ -211,15 +204,8 @@ TIFFStripSize(TIFF* tif) |
289 |
+ { |
290 |
+ static const char module[] = "TIFFStripSize"; |
291 |
+ uint64 m; |
292 |
+- tmsize_t n; |
293 |
+ m=TIFFStripSize64(tif); |
294 |
+- n=(tmsize_t)m; |
295 |
+- if ((uint64)n!=m) |
296 |
+- { |
297 |
+- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); |
298 |
+- n=0; |
299 |
+- } |
300 |
+- return(n); |
301 |
++ return _TIFFCastUInt64ToSSize(tif, m, module); |
302 |
+ } |
303 |
+ |
304 |
+ /* |
305 |
+@@ -330,14 +316,8 @@ TIFFScanlineSize(TIFF* tif) |
306 |
+ { |
307 |
+ static const char module[] = "TIFFScanlineSize"; |
308 |
+ uint64 m; |
309 |
+- tmsize_t n; |
310 |
+ m=TIFFScanlineSize64(tif); |
311 |
+- n=(tmsize_t)m; |
312 |
+- if ((uint64)n!=m) { |
313 |
+- TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow"); |
314 |
+- n=0; |
315 |
+- } |
316 |
+- return(n); |
317 |
++ return _TIFFCastUInt64ToSSize(tif, m, module); |
318 |
+ } |
319 |
+ |
320 |
+ /* |
321 |
+@@ -366,15 +346,8 @@ TIFFRasterScanlineSize(TIFF* tif) |
322 |
+ { |
323 |
+ static const char module[] = "TIFFRasterScanlineSize"; |
324 |
+ uint64 m; |
325 |
+- tmsize_t n; |
326 |
+ m=TIFFRasterScanlineSize64(tif); |
327 |
+- n=(tmsize_t)m; |
328 |
+- if ((uint64)n!=m) |
329 |
+- { |
330 |
+- TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow"); |
331 |
+- n=0; |
332 |
+- } |
333 |
+- return(n); |
334 |
++ return _TIFFCastUInt64ToSSize(tif, m, module); |
335 |
+ } |
336 |
+ |
337 |
+ /* vim: set ts=8 sts=8 sw=8 noet: */ |
338 |
+--- a/libtiff/tif_tile.c |
339 |
++++ b/libtiff/tif_tile.c |
340 |
+@@ -181,15 +181,8 @@ TIFFTileRowSize(TIFF* tif) |
341 |
+ { |
342 |
+ static const char module[] = "TIFFTileRowSize"; |
343 |
+ uint64 m; |
344 |
+- tmsize_t n; |
345 |
+ m=TIFFTileRowSize64(tif); |
346 |
+- n=(tmsize_t)m; |
347 |
+- if ((uint64)n!=m) |
348 |
+- { |
349 |
+- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); |
350 |
+- n=0; |
351 |
+- } |
352 |
+- return(n); |
353 |
++ return _TIFFCastUInt64ToSSize(tif, m, module); |
354 |
+ } |
355 |
+ |
356 |
+ /* |
357 |
+@@ -248,15 +241,8 @@ TIFFVTileSize(TIFF* tif, uint32 nrows) |
358 |
+ { |
359 |
+ static const char module[] = "TIFFVTileSize"; |
360 |
+ uint64 m; |
361 |
+- tmsize_t n; |
362 |
+ m=TIFFVTileSize64(tif,nrows); |
363 |
+- n=(tmsize_t)m; |
364 |
+- if ((uint64)n!=m) |
365 |
+- { |
366 |
+- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); |
367 |
+- n=0; |
368 |
+- } |
369 |
+- return(n); |
370 |
++ return _TIFFCastUInt64ToSSize(tif, m, module); |
371 |
+ } |
372 |
+ |
373 |
+ /* |
374 |
+@@ -272,15 +258,8 @@ TIFFTileSize(TIFF* tif) |
375 |
+ { |
376 |
+ static const char module[] = "TIFFTileSize"; |
377 |
+ uint64 m; |
378 |
+- tmsize_t n; |
379 |
+ m=TIFFTileSize64(tif); |
380 |
+- n=(tmsize_t)m; |
381 |
+- if ((uint64)n!=m) |
382 |
+- { |
383 |
+- TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow"); |
384 |
+- n=0; |
385 |
+- } |
386 |
+- return(n); |
387 |
++ return _TIFFCastUInt64ToSSize(tif, m, module); |
388 |
+ } |
389 |
+ |
390 |
+ /* |
391 |
+--- a/libtiff/tiffiop.h |
392 |
++++ b/libtiff/tiffiop.h |
393 |
+@@ -77,6 +77,9 @@ extern int snprintf(char* str, size_t size, const char* format, ...); |
394 |
+ #define FALSE 0 |
395 |
+ #endif |
396 |
+ |
397 |
++#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0)) |
398 |
++#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1) |
399 |
++ |
400 |
+ typedef struct client_info { |
401 |
+ struct client_info *next; |
402 |
+ void *data; |
403 |
+@@ -258,7 +261,7 @@ struct tiff { |
404 |
+ #define TIFFhowmany8_64(x) (((x)&0x07)?((uint64)(x)>>3)+1:(uint64)(x)>>3) |
405 |
+ #define TIFFroundup_64(x, y) (TIFFhowmany_64(x,y)*(y)) |
406 |
+ |
407 |
+-/* Safe multiply which returns zero if there is an integer overflow */ |
408 |
++/* Safe multiply which returns zero if there is an *unsigned* integer overflow. This macro is not safe for *signed* integer types */ |
409 |
+ #define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0) |
410 |
+ |
411 |
+ #define TIFFmax(A,B) ((A)>(B)?(A):(B)) |
412 |
+@@ -368,6 +371,8 @@ extern TIFFErrorHandlerExt _TIFFerrorHandlerExt; |
413 |
+ |
414 |
+ extern uint32 _TIFFMultiply32(TIFF*, uint32, uint32, const char*); |
415 |
+ extern uint64 _TIFFMultiply64(TIFF*, uint64, uint64, const char*); |
416 |
++extern tmsize_t _TIFFMultiplySSize(TIFF*, tmsize_t, tmsize_t, const char*); |
417 |
++extern tmsize_t _TIFFCastUInt64ToSSize(TIFF*, uint64, const char*); |
418 |
+ extern void* _TIFFCheckMalloc(TIFF*, tmsize_t, tmsize_t, const char*); |
419 |
+ extern void* _TIFFCheckRealloc(TIFF*, void*, tmsize_t, tmsize_t, const char*); |
420 |
+ |
421 |
|
422 |
diff --git a/media-libs/tiff/tiff-4.0.10-r2.ebuild b/media-libs/tiff/tiff-4.0.10-r2.ebuild |
423 |
new file mode 100644 |
424 |
index 00000000000..1a5a5bbf526 |
425 |
--- /dev/null |
426 |
+++ b/media-libs/tiff/tiff-4.0.10-r2.ebuild |
427 |
@@ -0,0 +1,85 @@ |
428 |
+# Copyright 1999-2019 Gentoo Authors |
429 |
+# Distributed under the terms of the GNU General Public License v2 |
430 |
+ |
431 |
+EAPI=7 |
432 |
+ |
433 |
+inherit autotools libtool multilib-minimal |
434 |
+ |
435 |
+DESCRIPTION="Tag Image File Format (TIFF) library" |
436 |
+HOMEPAGE="http://libtiff.maptools.org" |
437 |
+SRC_URI="https://download.osgeo.org/libtiff/${P}.tar.gz" |
438 |
+ |
439 |
+LICENSE="libtiff" |
440 |
+SLOT="0" |
441 |
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris" |
442 |
+IUSE="+cxx jbig jpeg lzma static-libs test webp zlib zstd" |
443 |
+ |
444 |
+RDEPEND=" |
445 |
+ jbig? ( >=media-libs/jbigkit-2.1:=[${MULTILIB_USEDEP}] ) |
446 |
+ jpeg? ( >=virtual/jpeg-0-r2:0=[${MULTILIB_USEDEP}] ) |
447 |
+ lzma? ( >=app-arch/xz-utils-5.0.5-r1[${MULTILIB_USEDEP}] ) |
448 |
+ webp? ( media-libs/libwebp:=[${MULTILIB_USEDEP}] ) |
449 |
+ zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] ) |
450 |
+ zstd? ( >=app-arch/zstd-1.3.7-r1:=[${MULTILIB_USEDEP}] ) |
451 |
+" |
452 |
+DEPEND="${RDEPEND}" |
453 |
+ |
454 |
+REQUIRED_USE="test? ( jpeg )" #483132 |
455 |
+ |
456 |
+PATCHES=( |
457 |
+ "${FILESDIR}"/${PN}-4.0.10-CVE-2018-17000-tif_dirwrite-null-dereference.patch |
458 |
+ "${FILESDIR}"/${PN}-4.0.10-CVE-2019-6128-pal2rgb-leak.patch |
459 |
+ "${FILESDIR}"/${PN}-4.0.10-CVE-2019-7663-tiffcpIntegerOverflow.patch |
460 |
+ "${FILESDIR}"/${P}-CVE-2019-14973-fix-integer-overflow.patch |
461 |
+) |
462 |
+ |
463 |
+MULTILIB_WRAPPED_HEADERS=( |
464 |
+ /usr/include/tiffconf.h |
465 |
+) |
466 |
+ |
467 |
+src_prepare() { |
468 |
+ default |
469 |
+ |
470 |
+ # tiffcp-thumbnail.sh fails as thumbnail binary doesn't get built anymore since tiff-4.0.7 |
471 |
+ sed '/tiffcp-thumbnail\.sh/d' -i test/Makefile.am || die |
472 |
+ |
473 |
+ eautoreconf |
474 |
+} |
475 |
+ |
476 |
+multilib_src_configure() { |
477 |
+ local myeconfargs=( |
478 |
+ --without-x |
479 |
+ --with-docdir="${EPREFIX}"/usr/share/doc/${PF} |
480 |
+ $(use_enable cxx) |
481 |
+ $(use_enable jbig) |
482 |
+ $(use_enable jpeg) |
483 |
+ $(use_enable lzma) |
484 |
+ $(use_enable static-libs static) |
485 |
+ $(use_enable webp) |
486 |
+ $(use_enable zlib) |
487 |
+ $(use_enable zstd) |
488 |
+ ) |
489 |
+ ECONF_SOURCE="${S}" econf "${myeconfargs[@]}" |
490 |
+ |
491 |
+ # remove useless subdirs |
492 |
+ if ! multilib_is_native_abi ; then |
493 |
+ sed -i \ |
494 |
+ -e 's/ tools//' \ |
495 |
+ -e 's/ contrib//' \ |
496 |
+ -e 's/ man//' \ |
497 |
+ -e 's/ html//' \ |
498 |
+ Makefile || die |
499 |
+ fi |
500 |
+} |
501 |
+ |
502 |
+multilib_src_test() { |
503 |
+ if ! multilib_is_native_abi ; then |
504 |
+ emake -C tools |
505 |
+ fi |
506 |
+ emake check |
507 |
+} |
508 |
+ |
509 |
+multilib_src_install_all() { |
510 |
+ find "${ED}" -name '*.la' -delete || die |
511 |
+ rm "${ED}"/usr/share/doc/${PF}/{COPYRIGHT,README*,RELEASE-DATE,TODO,VERSION} || die |
512 |
+} |