[libtiff] Add fix for CVE-2012-1173

[Tom Lane]

commit 8e441a59262c0f6bf33a2702f83df990838ded92
Author: Tom Lane <tgl at redhat.com>
Date:   Thu Apr 5 11:02:02 2012 -0400

    Add fix for CVE-2012-1173

 libtiff-CVE-2012-1173.patch |   71 +++++++++++++++++++++++++++++++++++++++++++
 libtiff.spec                |   10 +++++-
 2 files changed, 80 insertions(+), 1 deletions(-)
---
diff --git a/libtiff-CVE-2012-1173.patch b/libtiff-CVE-2012-1173.patch
new file mode 100644
index 0000000..0ada700
--- /dev/null
+++ b/libtiff-CVE-2012-1173.patch
@@ -0,0 +1,71 @@
+This patch is submitted to upstream for CVE-2012-1173
+
+
+diff -Naur tiff-3.9.5.orig/libtiff/tif_getimage.c tiff-3.9.5/libtiff/tif_getimage.c
+--- tiff-3.9.5.orig/libtiff/tif_getimage.c	2010-07-08 12:17:59.000000000 -0400
++++ tiff-3.9.5/libtiff/tif_getimage.c	2012-03-14 14:49:25.796728783 -0400
+@@ -673,18 +673,24 @@
+ 	unsigned char* p2;
+ 	unsigned char* pa;
+ 	tsize_t tilesize;
++	tsize_t bufsize;
+ 	int32 fromskew, toskew;
+ 	int alpha = img->alpha;
+ 	uint32 nrow;
+ 	int ret = 1, flip;
+ 
+ 	tilesize = TIFFTileSize(tif);
+-	buf = (unsigned char*) _TIFFmalloc((alpha?4:3)*tilesize);
++	bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,tilesize);
++	if (bufsize == 0) {
++		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
++		return (0);
++	}
++	buf = (unsigned char*) _TIFFmalloc(bufsize);
+ 	if (buf == 0) {
+ 		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
+ 		return (0);
+ 	}
+-	_TIFFmemset(buf, 0, (alpha?4:3)*tilesize);
++	_TIFFmemset(buf, 0, bufsize);
+ 	p0 = buf;
+ 	p1 = p0 + tilesize;
+ 	p2 = p1 + tilesize;
+@@ -880,17 +886,23 @@
+ 	uint32 rowsperstrip, offset_row;
+ 	uint32 imagewidth = img->width;
+ 	tsize_t stripsize;
++	tsize_t bufsize;
+ 	int32 fromskew, toskew;
+ 	int alpha = img->alpha;
+ 	int ret = 1, flip;
+ 
+ 	stripsize = TIFFStripSize(tif);
+-	p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize);
++	bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,stripsize);
++	if (bufsize == 0) {
++		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
++		return (0);
++	}
++	p0 = buf = (unsigned char *)_TIFFmalloc(bufsize);
+ 	if (buf == 0) {
+ 		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
+ 		return (0);
+ 	}
+-	_TIFFmemset(buf, 0, (alpha?4:3)*stripsize);
++	_TIFFmemset(buf, 0, bufsize);
+ 	p1 = p0 + stripsize;
+ 	p2 = p1 + stripsize;
+ 	pa = (alpha?(p2+stripsize):NULL);
+diff -Naur tiff-3.9.5.orig/libtiff/tiffiop.h tiff-3.9.5/libtiff/tiffiop.h
+--- tiff-3.9.5.orig/libtiff/tiffiop.h	2011-03-28 09:43:43.000000000 -0400
++++ tiff-3.9.5/libtiff/tiffiop.h	2012-03-14 14:49:25.797728754 -0400
+@@ -246,7 +246,7 @@
+ #define	TIFFroundup(x, y) (TIFFhowmany(x,y)*(y))
+ 
+ /* Safe multiply which returns zero if there is an integer overflow */
+-#define TIFFSafeMultiply(t,v,m) ((((t)m != (t)0) && (((t)((v*m)/m)) == (t)v)) ? (t)(v*m) : (t)0)
++#define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
+ 
+ #define TIFFmax(A,B) ((A)>(B)?(A):(B))
+ #define TIFFmin(A,B) ((A)<(B)?(A):(B))
diff --git a/libtiff.spec b/libtiff.spec
index 77d2cbd..36cf013 100644
--- a/libtiff.spec
+++ b/libtiff.spec
@@ -1,7 +1,7 @@
 Summary: Library of functions for manipulating TIFF format image files
 Name: libtiff
 Version: 3.9.5
-Release: 2%{?dist}
+Release: 3%{?dist}
 
 License: libtiff
 Group: System Environment/Libraries
@@ -9,6 +9,8 @@ URL: http://www.remotesensing.org/libtiff/
 
 Source: ftp://ftp.remotesensing.org/pub/libtiff/tiff-%{version}.tar.gz
 
+Patch1: libtiff-CVE-2012-1173.patch
+
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
 BuildRequires: zlib-devel libjpeg-devel
 BuildRequires: libtool automake autoconf
@@ -60,6 +62,8 @@ image files using the libtiff library.
 %prep
 %setup -q -n tiff-%{version}
 
+%patch1 -p1
+
 # Use build system's libtool.m4, not the one in the package.
 rm -f libtool.m4
 
@@ -170,6 +174,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man1/*
 
 %changelog
+* Thu Apr  5 2012 Tom Lane <tgl at redhat.com> 3.9.5-3
+- Add fix for CVE-2012-1173
+Resolves: #CVE-2012-1173
+
 * Fri Jan 13 2012 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 3.9.5-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild