ryan77627/guix
1
0
Fork 0
mirror of https://git.in.rschanz.org/ryan77627/guix.git synced 2025-01-24 11:39:46 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: libtiff: Fix CVE-2022-34526.

Browse source 
* gnu/packages/patches/libtiff-CVE-2022-34526.patch: New file.
* gnu/local.mk (dist_patch_DATA): Adjust accordingly.
* gnu/packages/image.scm (libtiff)[source](patches): New field.
This commit is contained in:
Marius Bakke 2022-09-16 19:54:02 +02:00
parent bbc99d0c23
commit c7966ba3ef
No known key found for this signature in database
GPG key ID: A2A06DF2A33A54FA
3 changed files with 24 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
gnu/local.mk
View file

@ -1416,6 +1416,7 @@ dist_patch_DATA = \
%D%/packages/patches/libtgvoip-disable-sse2.patch \
%D%/packages/patches/libtgvoip-disable-webrtc.patch \
%D%/packages/patches/libtheora-config-guess.patch \
%D%/packages/patches/libtiff-CVE-2022-34526.patch \
%D%/packages/patches/libtirpc-CVE-2021-46828.patch \
%D%/packages/patches/libtirpc-hurd.patch \
%D%/packages/patches/libtommath-fix-linkage.patch \

1
gnu/packages/image.scm
View file

@ -575,6 +575,7 @@ (define-public libtiff
(method url-fetch)
(uri (string-append "https://download.osgeo.org/libtiff/tiff-"
version ".tar.xz"))
(patches (search-patches "libtiff-CVE-2022-34526.patch"))
(sha256
(base32
"1h8xrcpbyf9id2hw2ms0cmpgx0li8gladjzj82ycgk28018pnc29"))))

22
gnu/packages/patches/libtiff-CVE-2022-34526.patch Normal file
View file

@ -0,0 +1,22 @@
Fix CVE-2022-34526:
https://nvd.nist.gov/vuln/detail/CVE-2022-34526
https://gitlab.com/libtiff/libtiff/-/issues/433
Patch taken from upstream source repository:
https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990
diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c
--- a/libtiff/tif_dirinfo.c
+++ b/libtiff/tif_dirinfo.c
@@ -1191,6 +1191,9 @@ _TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag)
default:
return 1;
}
+ if( !TIFFIsCODECConfigured(tif->tif_dir.td_compression) ) {
+ return 0;
+ }
/* Check if codec specific tags are allowed for the current
* compression scheme (codec) */
switch (tif->tif_dir.td_compression) {