new file mode 100644

@@ -0,0 +1,107 @@

+diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c

+index 6baa7b3..af5b84a 100644

+--- a/libtiff/tif_dirread.c

+@@ -165,6 +165,7 @@ static int TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uin

+ static int TIFFFetchSubjectDistance(TIFF*, TIFFDirEntry*);

+ static void ChopUpSingleUncompressedStrip(TIFF*);

+ static uint64 TIFFReadUInt64(const uint8 *value);

++static int _TIFFGetMaxColorChannels(uint16 photometric);

+ 

+ static int _TIFFFillStrilesInternal( TIFF *tif, int loadStripByteCount );

+ 

+@@ -3505,6 +3506,35 @@ static void TIFFReadDirEntryOutputErr(TIFF* tif, enum TIFFReadDirEntryErr err, c

+ }

+ 

+ /*

++ * Return the maximum number of color channels specified for a given photometric

++ * type. 0 is returned if photometric type isn't supported or no default value

++ * is defined by the specification.

++ */

++static int _TIFFGetMaxColorChannels( uint16 photometric )

++{

++    switch (photometric) {

++	case PHOTOMETRIC_PALETTE:

++	case PHOTOMETRIC_MINISWHITE:

++	case PHOTOMETRIC_MINISBLACK:

++            return 1;

++	case PHOTOMETRIC_YCBCR:

++	case PHOTOMETRIC_RGB:

++	case PHOTOMETRIC_CIELAB:

++            return 3;

++	case PHOTOMETRIC_SEPARATED:

++	case PHOTOMETRIC_MASK:

++            return 4;

++	case PHOTOMETRIC_LOGL:

++	case PHOTOMETRIC_LOGLUV:

++	case PHOTOMETRIC_CFA:

++	case PHOTOMETRIC_ITULAB:

++	case PHOTOMETRIC_ICCLAB:

++	default:

++            return 0;

++    }

++}

++

++/*

+  * Read the next TIFF directory from a file and convert it to the internal

+  * format. We read directories sequentially.

+  */

+@@ -3520,6 +3550,7 @@ TIFFReadDirectory(TIFF* tif)

+ 	uint32 fii=FAILED_FII;

+         toff_t nextdiroff;

+     int bitspersample_read = FALSE;

++        int color_channels;

+ 

+ 	tif->tif_diroff=tif->tif_nextdiroff;

+ 	if (!TIFFCheckDirOffset(tif,tif->tif_nextdiroff))

+@@ -4024,6 +4055,37 @@ TIFFReadDirectory(TIFF* tif)

+ 			}

+ 		}

+ 	}

++

++	/*

++	 * Make sure all non-color channels are extrasamples.

++	 * If it's not the case, define them as such.

++	 */

++        color_channels = _TIFFGetMaxColorChannels(tif->tif_dir.td_photometric);

++        if (color_channels && tif->tif_dir.td_samplesperpixel - tif->tif_dir.td_extrasamples > color_channels) {

++                uint16 old_extrasamples;

++                uint16 *new_sampleinfo;

++

++                TIFFWarningExt(tif->tif_clientdata,module, "Sum of Photometric type-related "

++                    "color channels and ExtraSamples doesn't match SamplesPerPixel. "

++                    "Defining non-color channels as ExtraSamples.");

++

++                old_extrasamples = tif->tif_dir.td_extrasamples;

++                tif->tif_dir.td_extrasamples = (tif->tif_dir.td_samplesperpixel - color_channels);

++

++                // sampleinfo should contain information relative to these new extra samples

++                new_sampleinfo = (uint16*) _TIFFcalloc(tif->tif_dir.td_extrasamples, sizeof(uint16));

++                if (!new_sampleinfo) {

++                    TIFFErrorExt(tif->tif_clientdata, module, "Failed to allocate memory for "

++                                "temporary new sampleinfo array (%d 16 bit elements)",

++                                tif->tif_dir.td_extrasamples);

++                    goto bad;

++                }

++

++                memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, old_extrasamples * sizeof(uint16));

++                _TIFFsetShortArray(&tif->tif_dir.td_sampleinfo, new_sampleinfo, tif->tif_dir.td_extrasamples);

++                _TIFFfree(new_sampleinfo);

++        }

++

+ 	/*

+ 	 * Verify Palette image has a Colormap.

+ 	 */

+diff --git a/libtiff/tif_print.c b/libtiff/tif_print.c

+index 8deceb2..1d86adb 100644

+--- a/libtiff/tif_print.c

+@@ -544,7 +544,7 @@ TIFFPrintDirectory(TIFF* tif, FILE* fd, long flags)

+ 				uint16 i;

+ 				fprintf(fd, "    %2ld: %5u",

+ 				    l, td->td_transferfunction[0][l]);

+-				for (i = 1; i < td->td_samplesperpixel; i++)

++				for (i = 1; i < td->td_samplesperpixel - td->td_extrasamples && i < 3; i++)

+ 					fprintf(fd, " %5u",

+ 					    td->td_transferfunction[i][l]);

+ 				fputc('\n', fd);

new file mode 100644

@@ -0,0 +1,37 @@

+diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c

+index 4ccb443..94d85e3 100644

+--- a/libtiff/tif_lzw.c

+@@ -602,6 +602,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)

+ 	char *tp;

+ 	unsigned char *bp;

+ 	int code, nbits;

++	int len;

+ 	long nextbits, nextdata, nbitsmask;

+ 	code_t *codep, *free_entp, *maxcodep, *oldcodep;

+ 

+@@ -753,13 +754,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)

+ 				}  while (--occ);

+ 				break;

+ 			}

+-			assert(occ >= codep->length);

+-			op += codep->length;

+-			occ -= codep->length;

+-			tp = op;

++			len = codep->length;

++			tp = op + len;

+ 			do {

+-				*--tp = codep->value;

+-			} while( (codep = codep->next) != NULL );

++				int t;

++				--tp;

++				t = codep->value;

++				codep = codep->next;

++				*tp = (char)t;

++			} while (codep && tp > op);

++			assert(occ >= len);

++			op += len;

++			occ -= len;

+ 		} else {

+ 			*op++ = (char)code;

+ 			occ--;

@@ -1,7 +1,7 @@

 Summary:        TIFF libraries and associated utilities.

 Name:           libtiff

 Version:        4.0.9

-Release:        4%{?dist}

+Release:        5%{?dist}

 License:        libtiff

 URL:            http://www.simplesystems.org/libtiff/

 Group:          System Environment/Libraries

@@ -16,6 +16,9 @@ Patch2:         libtiff-4.0.9-CVE-2017-17095.patch

 Patch3:         libtiff-4.0.9-CVE-2018-5784.patch

 Patch4:         libtiff-4.0-9-CVE-2017-11613-1.patch

 Patch5:         libtiff-4.0-9-CVE-2017-11613-2.patch

+Patch6:         libtiff-4.0-9-CVE-2018-7456.patch

+Patch7:         libtiff-4.0.9-CVE-2018-8905.patch

+

 BuildRequires:  libjpeg-turbo-devel

 Requires:       libjpeg-turbo

 %description

@@ -36,6 +39,8 @@ It contains the libraries and header files to create applications

 %patch3 -p1

 %patch4 -p1

 %patch5 -p1

+%patch6 -p1

+%patch7 -p1

 %build

 %configure \

     --disable-static

@@ -69,6 +74,8 @@ make %{?_smp_mflags} -k check

 %{_datadir}/man/man3/*

 %changelog

+*   Mon May 14 2018 Xiaolin Li <xiaolinl@vmware.com> 4.0.9-5

+-   Fix CVE-2018-7456, CVE-2018-8905

 *   Fri Apr 20 2018 Xiaolin Li <xiaolinl@vmware.com> 4.0.9-4

 -   Patches for CVE-2018-5784, CVE-2017-11613

 *   Wed Feb 14 2018 Dheeraj Shetty <dheerajs@vmware.com> 4.0.9-3