helium-3rd-party/poky
1
0
Fork 0
mirror of git://git.yoctoproject.org/poky synced 2026-04-02 02:49:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

tiff: patch CVE-2025-61143

Browse Source 
Pick patch from merge request mentioned in NVD report.

(From OE-Core rev: 7a02f5d41c9fdde4dbec9e35d2535a58d727b8f7)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Peter Marko 2026-03-08 23:42:38 +01:00 committed by Paul Barker
parent 06f1750ad5
commit 20c48403c1
2 changed files with 45 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
meta/recipes-multimedia/libtiff/tiff/CVE-2025-61143.patch Normal file
View File

@ -0,0 +1,44 @@
From 4d28af5fe61b1760f10981f5072ff1e6fd44f210 Mon Sep 17 00:00:00 2001
From: Lee Howard <faxguy@howardsilvan.com>
Date: Fri, 5 Sep 2025 21:44:49 +0000
Subject: [PATCH] tiffcrop: avoid nullptr dereference
Fixes #734
CVE: CVE-2025-61143
Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/4d28af5fe61b1760f10981f5072ff1e6fd44f210]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
tools/tiffcrop.c | 2 +-
tools/tiffdither.c | 5 +++++
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index ae414efc..1cbb49b6 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -2561,7 +2561,7 @@ main(int argc, char* argv[])
if (dump.outfile != NULL)
{
- dump_info (dump.outfile, dump.format, "", "Completed run for %s", TIFFFileName(out));
+ dump_info (dump.outfile, dump.format, "", "Completed run for %s", out ? TIFFFileName(out) : "(not opened)");
fclose (dump.outfile);
}
}
diff --git a/tools/tiffdither.c b/tools/tiffdither.c
index 3c64fdc0..405527c7 100644
--- a/tools/tiffdither.c
+++ b/tools/tiffdither.c
@@ -84,6 +84,11 @@ fsdither(TIFF* in, TIFF* out)
fprintf(stderr, "Out of memory.\n");
goto skip_on_error;
}
+ if (imagewidth > TIFFScanlineSize(in))
+ {
+ fprintf(stderr, "Image width exceeds scanline size.\n");
+ goto skip_on_error;
+ }
/*
* Get first line

1
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb
View File

@ -65,6 +65,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
file://CVE-2025-9900.patch \
file://CVE-2025-8961.patch \
file://CVE-2025-9165.patch \
file://CVE-2025-61143.patch \
"
SRC_URI[sha256sum] = "0e46e5acb087ce7d1ac53cf4f56a09b221537fc86dfc5daaad1c2e89e1b37ac8"