head 1.2; access; symbols OPENPKG_E1_MP_HEAD:1.2 OPENPKG_E1_MP:1.2 OPENPKG_E1_MP_2_STABLE:1.2 OPENPKG_E1_FP:1.2 OPENPKG_2_STABLE_20061018:1.2 OPENPKG_2_STABLE:1.2.0.8 OPENPKG_2_STABLE_BP:1.2 OPENPKG_2_5_SOLID:1.2.0.6 OPENPKG_2_5_SOLID_BP:1.2 OPENPKG_2_4_RELEASE:1.2 OPENPKG_2_4_SOLID:1.2.0.4 OPENPKG_2_4_SOLID_BP:1.2 OPENPKG_2_3_RELEASE:1.2 OPENPKG_2_3_SOLID:1.2.0.2 OPENPKG_2_3_SOLID_BP:1.2 OPENPKG_2_2_RELEASE:1.1.2.1 OPENPKG_2_0_SOLID:1.1.0.6 OPENPKG_2_1_SOLID:1.1.0.4 OPENPKG_2_2_SOLID:1.1.0.2; locks; strict; comment @# @; 1.2 date 2004.10.16.13.47.07; author rse; state dead; branches; next 1.1; 1.1 date 2004.10.14.15.12.24; author thl; state Exp; branches 1.1.2.1 1.1.4.1 1.1.6.1; next ; 1.1.2.1 date 2004.10.14.15.19.25; author thl; state Exp; branches; next ; 1.1.4.1 date 2004.10.14.15.20.31; author thl; state Exp; branches; next ; 1.1.6.1 date 2004.10.14.15.22.49; author thl; state Exp; branches; next ; desc @@ 1.2 log @upgrading package: tiff 3.6.1 -> 3.7.0 @ text @The chris-bound.patch fixes some buffer overflows; CAN-2004-0803 ftp://ftp.altlinux.org/pub/people/ldv/tiff/libtiff-3.6.1-chris-bound.patch The alt-bound.patch fixes malloc issues and integer overflows; CAN-2004-0886 ftp://ftp.altlinux.org/pub/people/ldv/tiff/libtiff-3.6.1-alt-bound.patch The libtiff-3.7.0beta2-suse-alt-bound-fix2.patch improves the -alt.bound patch Index: libtiff/tif_dirread.c =================================================================== RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_dirread.c,v retrieving revision 1.42 diff -u -p -r1.42 tif_dirread.c --- libtiff/tif_dirread.c 29 Sep 2004 07:42:52 -0000 1.42 +++ libtiff/tif_dirread.c 12 Oct 2004 12:41:06 -0000 @@@@ -644,19 +644,29 @@@@ TIFFReadDirectory(TIFF* tif) tif->tif_curstrip = (tstrip_t) -1; tif->tif_col = (uint32) -1; tif->tif_curtile = (ttile_t) -1; - tif->tif_tilesize = TIFFTileSize(tif); - tif->tif_scanlinesize = TIFFScanlineSize(tif); + tif->tif_tilesize = (tsize_t) -1; - if (!tif->tif_tilesize) { - TIFFError(module, "%s: cannot handle zero tile size", - tif->tif_name); - return (0); - } + tif->tif_scanlinesize = TIFFScanlineSize(tif); if (!tif->tif_scanlinesize) { TIFFError(module, "%s: cannot handle zero scanline size", tif->tif_name); return (0); } + + if (isTiled(tif)) { + tif->tif_tilesize = TIFFTileSize(tif); + if (!tif->tif_tilesize) { + TIFFError(module, "%s: cannot handle zero tile size", + tif->tif_name); + return (0); + } + } else { + if (!TIFFStripSize(tif)) { + TIFFError(module, "%s: cannot handle zero strip size", + tif->tif_name); + return (0); + } + } return (1); bad: if (dir) Index: libtiff/tif_jpeg.c =================================================================== RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_jpeg.c,v retrieving revision 1.23 diff -u -p -r1.23 tif_jpeg.c --- libtiff/tif_jpeg.c 2 Oct 2004 13:29:41 -0000 1.23 +++ libtiff/tif_jpeg.c 12 Oct 2004 12:41:06 -0000 @@@@ -1396,7 +1396,7 @@@@ JPEGVSetField(TIFF* tif, ttag_t tag, va_ * Must recalculate cached tile size * in case sampling state changed. */ - tif->tif_tilesize = TIFFTileSize(tif); + tif->tif_tilesize = isTiled(tif) ? TIFFTileSize(tif) : (tsize_t) -1; return (1); /* pseudo tag */ case TIFFTAG_JPEGTABLESMODE: sp->jpegtablesmode = va_arg(ap, int); Index: libtiff/tif_luv.c =================================================================== RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_luv.c,v retrieving revision 1.12 diff -u -p -r1.12 tif_luv.c --- libtiff/tif_luv.c 2 Oct 2004 13:29:41 -0000 1.12 +++ libtiff/tif_luv.c 12 Oct 2004 12:41:06 -0000 @@@@ -1509,7 +1509,7 @@@@ LogLuvVSetField(TIFF* tif, ttag_t tag, v /* * Must recalculate sizes should bits/sample change. */ - tif->tif_tilesize = TIFFTileSize(tif); + tif->tif_tilesize = isTiled(tif) ? TIFFTileSize(tif) : (tsize_t) -1; tif->tif_scanlinesize = TIFFScanlineSize(tif); return (1); case TIFFTAG_SGILOGENCODE: Index: libtiff/tif_ojpeg.c =================================================================== RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_ojpeg.c,v retrieving revision 1.13 diff -u -p -r1.13 tif_ojpeg.c --- libtiff/tif_ojpeg.c 14 Sep 2004 06:32:19 -0000 1.13 +++ libtiff/tif_ojpeg.c 12 Oct 2004 12:41:06 -0000 @@@@ -2301,7 +2301,7 @@@@ OJPEGVSetField(register TIFF *tif,ttag_t if ((tif->tif_flags ^ v32) & TIFF_UPSAMPLED) { - tif->tif_tilesize = TIFFTileSize(tif); + tif->tif_tilesize = isTiled(tif) ? TIFFTileSize(tif) : (tsize_t) -1; tif->tif_flags |= TIFF_DIRTYDIRECT; }; return 1; Index: libtiff/tif_pixarlog.c =================================================================== RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_pixarlog.c,v retrieving revision 1.7 diff -u -p -r1.7 tif_pixarlog.c --- libtiff/tif_pixarlog.c 2 Oct 2004 13:29:41 -0000 1.7 +++ libtiff/tif_pixarlog.c 12 Oct 2004 12:41:06 -0000 @@@@ -1232,7 +1232,7 @@@@ PixarLogVSetField(TIFF* tif, ttag_t tag, /* * Must recalculate sizes should bits/sample change. */ - tif->tif_tilesize = TIFFTileSize(tif); + tif->tif_tilesize = isTiled(tif) ? TIFFTileSize(tif) : (tsize_t) -1; tif->tif_scanlinesize = TIFFScanlineSize(tif); result = 1; /* NB: pseudo tag */ break; Index: libtiff/tif_write.c =================================================================== RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_write.c,v retrieving revision 1.15 diff -u -p -r1.15 tif_write.c --- libtiff/tif_write.c 2 Oct 2004 13:29:41 -0000 1.15 +++ libtiff/tif_write.c 12 Oct 2004 12:41:06 -0000 @@@@ -528,7 +528,7 @@@@ TIFFWriteCheck(TIFF* tif, int tiles, con tif->tif_name, isTiled(tif) ? "tile" : "strip"); return (0); } - tif->tif_tilesize = TIFFTileSize(tif); + tif->tif_tilesize = isTiled(tif) ? TIFFTileSize(tif) : (tsize_t) -1; tif->tif_scanlinesize = TIFFScanlineSize(tif); tif->tif_flags |= TIFF_BEENWRITING; return (1); @ 1.1 log @SA-2004.043-tiff; CAN-2004-0803, CAN-2004-0886 @ text @@ 1.1.6.1 log @MFC: SA-2004.043-tiff; CAN-2004-0803, CAN-2004-0886 @ text @@ 1.1.4.1 log @MFC: SA-2004.043-tiff; CAN-2004-0803, CAN-2004-0886 @ text @@ 1.1.2.1 log @MFC: SA-2004.043-tiff; CAN-2004-0803, CAN-2004-0886 @ text @@