SPECS/libtiff/libtiff-4.0.9-CVE-2018-17101.patch
08033e9c
 commit f1b94e8a3ba49febdd3361c0214a1d1149251577
 Author: Young_X <YangX92@hotmail.com>
 Date:   Sat Sep 8 14:36:12 2018 +0800
 
     only read/write TIFFTAG_GROUP3OPTIONS or TIFFTAG_GROUP4OPTIONS if compression is COMPRESSION_CCITTFAX3 or COMPRESSION_CCITTFAX4
 
 diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c
 index 01fcf94..01d8502 100644
 --- a/tools/pal2rgb.c
 +++ b/tools/pal2rgb.c
 @@ -402,7 +402,23 @@ cpTags(TIFF* in, TIFF* out)
  {
      struct cpTag *p;
      for (p = tags; p < &tags[NTAGS]; p++)
 -	cpTag(in, out, p->tag, p->count, p->type);
 +    {
 +        if( p->tag == TIFFTAG_GROUP3OPTIONS )
 +        {
 +            uint16 compression;
 +            if( !TIFFGetField(in, TIFFTAG_COMPRESSION, &compression) ||
 +                    compression != COMPRESSION_CCITTFAX3 )
 +                continue;
 +        }
 +        if( p->tag == TIFFTAG_GROUP4OPTIONS )
 +        {
 +            uint16 compression;
 +            if( !TIFFGetField(in, TIFFTAG_COMPRESSION, &compression) ||
 +                    compression != COMPRESSION_CCITTFAX4 )
 +                continue;
 +        }
 +        cpTag(in, out, p->tag, p->count, p->type);
 +    }
  }
  #undef NTAGS
  
 diff --git a/tools/tiff2bw.c b/tools/tiff2bw.c
 index 05faba8..5bef314 100644
 --- a/tools/tiff2bw.c
 +++ b/tools/tiff2bw.c
 @@ -450,7 +450,23 @@ cpTags(TIFF* in, TIFF* out)
  {
      struct cpTag *p;
      for (p = tags; p < &tags[NTAGS]; p++)
 -	cpTag(in, out, p->tag, p->count, p->type);
 +    {
 +        if( p->tag == TIFFTAG_GROUP3OPTIONS )
 +        {
 +            uint16 compression;
 +            if( !TIFFGetField(in, TIFFTAG_COMPRESSION, &compression) ||
 +                    compression != COMPRESSION_CCITTFAX3 )
 +                continue;
 +        }
 +        if( p->tag == TIFFTAG_GROUP4OPTIONS )
 +        {
 +            uint16 compression;
 +            if( !TIFFGetField(in, TIFFTAG_COMPRESSION, &compression) ||
 +                    compression != COMPRESSION_CCITTFAX4 )
 +                continue;
 +        }
 +        cpTag(in, out, p->tag, p->count, p->type);
 +    }
  }
  #undef NTAGS