new file mode 100644

@@ -0,0 +1,78 @@

+--- a/tiff-4.0.6/tools/tiff2rgba.c	2015-08-28 15:17:08.259977000 -0700

+@@ -147,6 +147,7 @@

+     uint32  row, col;

+     uint32  *wrk_line;

+     int	    ok = 1;

++    uint32  rastersize, wrk_linesize;

+ 

+     TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);

+     TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);

+@@ -163,7 +164,13 @@

+     /*

+      * Allocate tile buffer

+      */

+-    raster = (uint32*)_TIFFmalloc(tile_width * tile_height * sizeof (uint32));

++    rastersize = tile_width * tile_height * sizeof (uint32);

++    if (tile_width != (rastersize / tile_height) / sizeof( uint32))

++    {

++	TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");

++	exit(-1);

++    }

++    raster = (uint32*)_TIFFmalloc(rastersize);

+     if (raster == 0) {

+         TIFFError(TIFFFileName(in), "No space for raster buffer");

+         return (0);

+@@ -173,7 +180,13 @@

+      * Allocate a scanline buffer for swapping during the vertical

+      * mirroring pass.

+      */

+-    wrk_line = (uint32*)_TIFFmalloc(tile_width * sizeof (uint32));

++    wrk_linesize = tile_width * sizeof (uint32);

++    if (tile_width != wrk_linesize / sizeof (uint32))

++    {

++        TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");

++	exit(-1);

++    }

++    wrk_line = (uint32*)_TIFFmalloc(wrk_linesize);

+     if (!wrk_line) {

+         TIFFError(TIFFFileName(in), "No space for raster scanline buffer");

+         ok = 0;

+@@ -249,6 +262,7 @@

+     uint32  row;

+     uint32  *wrk_line;

+     int	    ok = 1;

++    uint32  rastersize, wrk_linesize;

+ 

+     TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);

+     TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);

+@@ -263,7 +277,13 @@

+     /*

+      * Allocate strip buffer

+      */

+-    raster = (uint32*)_TIFFmalloc(width * rowsperstrip * sizeof (uint32));

++    rastersize = width * rowsperstrip * sizeof (uint32);

++    if (width != (rastersize / rowsperstrip) / sizeof( uint32))

++    {

++	TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");

++	exit(-1);

++    }

++    raster = (uint32*)_TIFFmalloc(rastersize);

+     if (raster == 0) {

+         TIFFError(TIFFFileName(in), "No space for raster buffer");

+         return (0);

+@@ -273,7 +293,13 @@

+      * Allocate a scanline buffer for swapping during the vertical

+      * mirroring pass.

+      */

+-    wrk_line = (uint32*)_TIFFmalloc(width * sizeof (uint32));

++    wrk_linesize = width * sizeof (uint32);

++    if (width != wrk_linesize / sizeof (uint32))

++    {

++        TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");

++	exit(-1);

++    }

++    wrk_line = (uint32*)_TIFFmalloc(wrk_linesize);

+     if (!wrk_line) {

+         TIFFError(TIFFFileName(in), "No space for raster scanline buffer");

+         ok = 0;

new file mode 100644

@@ -0,0 +1,17 @@

+--- a/tiff-4.0.6/libtiff/tif_pixarlog.c	2015-08-28 15:16:22.630733000 -0700

+@@ -1131,6 +1131,14 @@

+ 	}

+ 

+ 	llen = sp->stride * td->td_imagewidth;

++	

++        /* Check against the number of elements (of size uint16) of sp->tbuf */

++	if( n > td->td_rowsperstrip * llen )

++	{

++		TIFFErrorExt(tif->tif_clientdata, module,

++			     "Too many input bytes provided");

++		return 0;

++	}

+ 

+ 	for (i = 0, up = sp->tbuf; i < n; i += llen, up += llen) {

+ 		switch (sp->user_datafmt)  {

new file mode 100644

@@ -0,0 +1,109 @@

+--- a/tiff-4.0.6/tools/tiffcrop.c	2015-08-28 15:17:08.312151000 -0700

+@@ -798,6 +798,11 @@

+     }

+ 

+   tile_buffsize = tilesize;

++  if (tilesize == 0 || tile_rowsize == 0)

++  {

++     TIFFError("readContigTilesIntoBuffer", "Tile size or tile rowsize is zero");

++     exit(-1);

++  }

+ 

+   if (tilesize < (tsize_t)(tl * tile_rowsize))

+     {

+@@ -807,7 +812,12 @@

+               tilesize, tl * tile_rowsize);

+ #endif

+     tile_buffsize = tl * tile_rowsize;

+-    } 

++    if (tl != (tile_buffsize / tile_rowsize))

++    {

++    	TIFFError("readContigTilesIntoBuffer", "Integer overflow when calculating buffer size.");

++        exit(-1);

++    }

++    }

+ 

+   tilebuf = _TIFFmalloc(tile_buffsize);

+   if (tilebuf == 0)

+@@ -1210,6 +1220,12 @@

+       !TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps) )

+       return 1;

+ 

++  if (tilesize == 0 || tile_rowsize == 0 || tl == 0 || tw == 0)

++  {

++    TIFFError("writeBufferToContigTiles", "Tile size, tile row size, tile width, or tile length is zero");

++    exit(-1);

++  }

++  

+   tile_buffsize = tilesize;

+   if (tilesize < (tsize_t)(tl * tile_rowsize))

+     {

+@@ -1219,6 +1235,11 @@

+               tilesize, tl * tile_rowsize);

+ #endif

+     tile_buffsize = tl * tile_rowsize;

++    if (tl != tile_buffsize / tile_rowsize)

++    {

++	TIFFError("writeBufferToContigTiles", "Integer overflow when calculating buffer size");

++	exit(-1);

++    }

+     }

+ 

+   tilebuf = _TIFFmalloc(tile_buffsize);

+@@ -5945,12 +5966,27 @@

+     TIFFGetField(in, TIFFTAG_TILELENGTH, &tl);

+ 

+     tile_rowsize  = TIFFTileRowSize(in);      

++    if (ntiles == 0 || tlsize == 0 || tile_rowsize == 0)

++    {

++	TIFFError("loadImage", "File appears to be tiled, but the number of tiles, tile size, or tile rowsize is zero.");

++	exit(-1);

++    }

+     buffsize = tlsize * ntiles;

++    if (tlsize != (buffsize / ntiles))

++    {

++	TIFFError("loadImage", "Integer overflow when calculating buffer size");

++	exit(-1);

++    }

+ 

+-        

+     if (buffsize < (uint32)(ntiles * tl * tile_rowsize))

+       {

+       buffsize = ntiles * tl * tile_rowsize;

++      if (ntiles != (buffsize / tl / tile_rowsize))

++      {

++	TIFFError("loadImage", "Integer overflow when calculating buffer size");

++	exit(-1);

++      }

++      

+ #ifdef DEBUG2

+       TIFFError("loadImage",

+ 	        "Tilesize %u is too small, using ntiles * tilelength * tilerowsize %lu",

+@@ -5969,8 +6005,25 @@

+     TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);

+     stsize = TIFFStripSize(in);

+     nstrips = TIFFNumberOfStrips(in);

++    if (nstrips == 0 || stsize == 0)

++    {

++	TIFFError("loadImage", "File appears to be striped, but the number of stipes or stripe size is zero.");

++	exit(-1);

++    }

++

+     buffsize = stsize * nstrips;

+-    

++    if (stsize != (buffsize / nstrips))

++    {

++	TIFFError("loadImage", "Integer overflow when calculating buffer size");

++	exit(-1);

++    }

++    uint32 buffsize_check;

++    buffsize_check = ((length * width * spp * bps) + 7);

++    if (length != ((buffsize_check - 7) / width / spp / bps))

++    {

++	TIFFError("loadImage", "Integer overflow detected.");

++	exit(-1);

++    }

+     if (buffsize < (uint32) (((length * width * spp * bps) + 7) / 8))

+       {

+       buffsize =  ((length * width * spp * bps) + 7) / 8;

@@ -1,7 +1,7 @@

 Summary:	TIFF libraries and associated utilities.

 Name:		libtiff

 Version:	4.0.6

-Release:	2%{?dist}

+Release:	3%{?dist}

 License:	libtiff

 URL:		http://www.remotesensing.org/libtiff

 Group:		System Environment/Libraries

@@ -14,6 +14,9 @@ Patch1:		libtiff-4.0.6-CVE-2015-7554.patch

 Patch2:		libtiff-4.0.6-CVE-2015-8683+CVE-2015-8665.patch

 Patch3:     	libtiff-4.0.6-CVE-2016-3186.patch

 Patch4:     	libtiff-4.0.6-CVE-2015-1547.patch

+Patch5:     	libtiff-4.0.6-CVE-2016-3945.patch

+Patch6:     	libtiff-4.0.6-CVE-2016-3990.patch

+Patch7:     	libtiff-4.0.6-CVE-2016-3991.patch

 BuildRequires:	libjpeg-turbo-devel

 Requires:	libjpeg-turbo

 %description

@@ -32,6 +35,9 @@ It contains the libraries and header files to create applications

 %patch2 -p1

 %patch3 -p1

 %patch4 -p1

+%patch5 -p2

+%patch6 -p2

+%patch7 -p2

 %build

 ./configure \

@@ -62,6 +68,8 @@ find %{buildroot} -name '*.la' -delete

 %{_libdir}/pkgconfig/*.pc

 %changelog

+*       Wed Oct 12 2016 Dheeraj Shetty <dheerajs@vmware.com> 4.0.6-3

+-       Fixed security issues : CVE-2016-3945, CVE-2016-3990, CVE-2016-3991

 *       Thu Sep 22 2016 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 4.0.6-2

 -       Fixed security issues : CVE-2015-8668, CVE-2015-7554, CVE-2015-8683+CVE-2015-8665,CVE-2016-3186

         CVE-2015-1547