tiff: Update to 4.0.10

[feed/packages.git] / libs / tiff / patches / 024-CVE-2018-8905.patch

diff --git a/libs/tiff/patches/024-CVE-2018-8905.patch b/libs/tiff/patches/024-CVE-2018-8905.patch
deleted file mode 100644 (file)
index be6bee4..0000000
--- a/libs/tiff/patches/024-CVE-2018-8905.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 1c127eb3cb7653bd61b61f9c3cfeb36fd10edab1 Mon Sep 17 00:00:00 2001
-From: Even Rouault <even.rouault@spatialys.com>
-Date: Sat, 12 May 2018 15:32:31 +0200
-Subject: [PATCH 3/4] LZWDecodeCompat(): fix potential index-out-of-bounds
- write. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2780 /
- CVE-2018-8905
-
-The fix consists in using the similar code LZWDecode() to validate we
-don't write outside of the output buffer.
----
- libtiff/tif_lzw.c | 18 ++++++++++++------
- 1 file changed, 12 insertions(+), 6 deletions(-)
-
-diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
-index bc8f9c8..186ea3c 100644
---- a/libtiff/tif_lzw.c
-+++ b/libtiff/tif_lzw.c
-@@ -604,6 +604,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
-       char *tp;
-       unsigned char *bp;
-       int code, nbits;
-+      int len;
-       long nextbits, nextdata, nbitsmask;
-       code_t *codep, *free_entp, *maxcodep, *oldcodep;
- 
-@@ -755,13 +756,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
-                               }  while (--occ);
-                               break;
-                       }
--                      assert(occ >= codep->length);
--                      op += codep->length;
--                      occ -= codep->length;
--                      tp = op;
-+                      len = codep->length;
-+                      tp = op + len;
-                       do {
--                              *--tp = codep->value;
--                      } while( (codep = codep->next) != NULL );
-+                              int t;
-+                              --tp;
-+                              t = codep->value;
-+                              codep = codep->next;
-+                              *tp = (char)t;
-+                      } while (codep && tp > op);
-+                      assert(occ >= len);
-+                      op += len;
-+                      occ -= len;
-               } else {
-                       *op++ = (char)code;
-                       occ--;
--- 
-2.17.0
-