Package Release Info

tiff-4.0.9-5.30.28

Update Info: Base Release
Available in Package Hub : 15 SP3 Subpackages

platforms

AArch64
ppc64le
s390x
x86-64

subpackages

tiff

Change Logs

* Wed Nov 06 2019 pgajdos@suse.com
- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)
* Wed Nov 06 2019 mvetter@suse.com
- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch
Version: 4.0.9-3.15
* Tue Feb 20 2018 mvetter@suse.com
- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory
* Fri Feb 16 2018 mvetter@suse.com
- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf
* Thu Dec 21 2017 dimstar@opensuse.org
- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.
* Wed Nov 29 2017 fstrba@suse.com
- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float->int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaƫl
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip >= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use > 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.
* Tue Jun 20 2017 fstrba@suse.com
- Upgrade to upstream release 4.0.8
  * libtiff/tif_getimage.c, libtiff/tif_open.c
    + add parenthesis to fix cppcheck clarifyCalculation warnings
  * libtiff/tif_predict.c, libtiff/tif_print.c
    + fix printf unsigned vs signed formatting (cppcheck
    invalidPrintfArgType_uint warnings)
  * libtiff/tif_read.c, libtiff/tiffiop.h
    + fix uint32 overflow in TIFFReadEncodedStrip() that caused an
    integer division by zero. Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2596
  * libtiff/tif_pixarlog.c, libtiff/tif_luv.c
    + fix heap-based buffer overflow on generation of PixarLog / LUV
    compressed files, with ColorMap, TransferFunction attached and
    nasty plays with bitspersample. The fix for LUV has not been
    tested, but suffers from the same kind of issue of PixarLog.
    Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2604
  * libtiff/tif_strip.c
    + revert the change in TIFFNumberOfStrips() done for
    http://bugzilla.maptools.org/show_bug.cgi?id=2587 /
    CVE-2016-9273 since the above change is a better fix that
    makes it unnecessary.
  * libtiff/tif_dirread.c
    + modify ChopUpSingleUncompressedStrip() to instanciate compute
    ntrips as TIFFhowmany_32(td->td_imagelength, rowsperstrip),
    instead of a logic based on the total size of data. Which is
    faulty is the total size of data is not sufficient to fill the
    whole image, and thus results in reading outside of the
    StripByCounts/StripOffsets arrays when using
    TIFFReadScanline(). Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2608.
  * libtiff/tif_ojpeg.c
    + make OJPEGDecode() early exit in case of failure in
    OJPEGPreDecode(). This will avoid a divide by zero, and
    potential other issues. Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2611
  * libtiff/tif_write.c
    + fix misleading indentation as warned by GCC.
  * libtiff/tif_fax3.h
    + revert change done on 2016-01-09 that made Param member of
    TIFFFaxTabEnt structure a uint16 to reduce size of the
    binary. It happens that the Hylafax software uses the tables
    that follow this typedef (TIFFFaxMainTable, TIFFFaxWhiteTable,
    TIFFFaxBlackTable), although they are not in a public libtiff
    header. Raised by Lee Howard.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2636
  * libtiff/tiffio.h, libtiff/tif_getimage.c
    + add TIFFReadRGBAStripExt() and TIFFReadRGBATileExt() variants
    of the functions without ext, with an extra argument to control
    the stop_on_error behaviour.
  * libtiff/tif_getimage.c
    + fix potential memory leaks in error code path of
    TIFFRGBAImageBegin().
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2627
  * libtiff/tif_jpeg.c
    + increase libjpeg max memory usable to 10 MB instead of libjpeg
    1MB default. This helps when creating files with "big" tile,
    without using libjpeg temporary files.
    Related to https://trac.osgeo.org/gdal/ticket/6757
  * libtiff/tif_jpeg.c
    + avoid integer division by zero in JPEGSetupEncode() when
    horizontal or vertical sampling is set to 0.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2653,
    bsc#1033127, CVE-2017-7595
  * libtiff/tif_dirwrite.c
    + in TIFFWriteDirectoryTagCheckedRational, replace assertion by
    runtime check to error out if passed value is strictly
    negative.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2535,
    bsc#1038438, CVE-2016-10371
  * libtiff/tif_dirread.c
    + avoid division by floating point 0 in
    TIFFReadDirEntryCheckedRational() and
    TIFFReadDirEntryCheckedSrational(), and return 0 in that case
    (instead of infinity as before presumably) Apparently some
    sanitizers do not like those divisions by zero.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2644,
    bsc#1033118, CVE-2017-7598
  * libtiff/tif_dir.c, tif_dirread.c, tif_dirwrite.c
    + implement various clampings of double to other data types to
    avoid undefined behaviour if the output range isn't big enough
    to hold the input value.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2643
    http://bugzilla.maptools.org/show_bug.cgi?id=2642
    http://bugzilla.maptools.org/show_bug.cgi?id=2646
    http://bugzilla.maptools.org/show_bug.cgi?id=2647,
    bsc#1033126, CVE-2017-7596, bsc#1033120, CVE-2017-7597,
    bsc#1033113, CVE-2017-7599, bsc#1033112, CVE-2017-7600,
  * libtiff/tif_jpeg.c
    + validate BitsPerSample in JPEGSetupEncode() to avoid undefined
    behaviour caused by invalid shift exponent.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2648,
    bsc#1033111, CVE-2017-7601
  * libtiff/tif_read.c
    + avoid potential undefined behaviour on signed integer addition
    in TIFFReadRawStrip1() in isMapped() case.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2650,
    bsc#1033109, CVE-2017-7602
  * libtiff/tif_getimage.c
    + add explicit uint32 cast in putagreytile to avoid
    UndefinedBehaviorSanitizer warning. Patch by Nicolas Pena.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2658,
    bsc#1033131, CVE-2017-7592
  * libtiff/tif_read.c
    + TIFFReadBufferSetup(): use _TIFFcalloc() to zero initialize
    tif_rawdata.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2651,
    bsc#1033129, CVE-2017-7593
  * libtiff/tiffio.h, tif_unix.c, tif_win32.c, tif_vms.c
    + add _TIFFcalloc()
  * libtiff/tif_luv.c, tif_lzw.c, tif_packbits.c
    + return 0 in Encode functions instead of -1 when
    TIFFFlushData1() fails.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2130
  * libtiff/tif_ojpeg.c
    + fix leak in OJPEGReadHeaderInfoSecTablesQTable,
    OJPEGReadHeaderInfoSecTablesDcTable and
    OJPEGReadHeaderInfoSecTablesAcTable when read fails. Patch by
    Nicolas Pena.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2659,
    bsc#1033128, CVE-2017-7594
  * libtiff/tif_jpeg.c
    + only run JPEGFixupTagsSubsampling() if the YCbCrSubsampling
    tag is not explicitly present. This helps a bit to reduce the
    I/O amount when the tag is present (especially on cloud hosted
    files).
  * libtiff/tif_lzw.c
    + in LZWPostEncode(), increase, if necessary, the code bit-width
    after flushing the remaining code and before emitting the EOI
    code. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=1982
  * libtiff/tif_pixarlog.c
    + fix memory leak in error code path of PixarLogSetupDecode().
    Patch by Nicolas Pena.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2665
  * libtiff/tif_fax3.c, tif_predict.c, tif_getimage.c
    + fix GCC 7 -Wimplicit-fallthrough warnings.
  * libtiff/tif_dirread.c
    + fix memory leak in non DEFER_STRILE_LOAD mode (ie default)
    when there is both a StripOffsets and TileOffsets tag, or a
    StripByteCounts and TileByteCounts
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2689,
    bsc#1042805, CVE-2017-9403)
  * libtiff/tif_ojpeg.c
    + fix potential memory leak in
    OJPEGReadHeaderInfoSecTablesQTable,
    OJPEGReadHeaderInfoSecTablesDcTable and
    OJPEGReadHeaderInfoSecTablesAcTable
    Patch by Nicolas Pena.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2670
  * libtiff/tif_fax3.c
    + avoid crash in Fax3Close() on empty file. Patch by Alan
    Coopersmith + complement by myself.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2673
  * libtiff/tif_read.c
    + TIFFFillStrip(): add limitation to the number of bytes read
    in case td_stripbytecount[strip] is bigger than reasonable,
    so as to avoid excessive memory allocation.
  * libtiff/tif_zip.c, tif_pixarlog.c, tif_predict.c
    + fix memory leak when the underlying codec (ZIP, PixarLog)
    succeeds its setupdecode() method, but PredictorSetup fails.
    Credit to OSS-Fuzz (locally run, on GDAL)
  * libtiff/tif_read.c
    + TIFFFillStrip() and TIFFFillTile(): avoid excessive memory
    allocation in case of shorten files. Only effective on 64 bit
    builds and non-mapped cases.
    Credit to OSS-Fuzz (locally run, on GDAL)
  * libtiff/tif_read.c
    + TIFFFillStripPartial() / TIFFSeek(), avoid potential integer
    overflows with read_ahead in CHUNKY_STRIP_READ_SUPPORT mode.
    Should especially occur on 32 bit platforms.
  * libtiff/tif_read.c
    + TIFFFillStripPartial()
    + avoid excessive memory allocation in case of shorten files.
    Only effective on 64 bit builds.
    Credit to OSS-Fuzz (locally run, on GDAL)
  * libtiff/tif_read.c
    + update tif_rawcc in CHUNKY_STRIP_READ_SUPPORT mode with
    tif_rawdataloaded when calling TIFFStartStrip() or
    TIFFFillStripPartial(). This avoids reading beyond tif_rawdata
    when bytecount > tif_rawdatasize. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1545.
    Credit to OSS-Fuzz
  * libtiff/tif_color.c
    + avoid potential int32 overflow in TIFFYCbCrToRGBInit() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1533
    Credit to OSS-Fuzz
  * libtiff/tif_pixarlog.c, tif_luv.c
    + avoid potential int32 overflows in multiply_ms() and add_ms().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1558
    Credit to OSS-Fuzz
  * libtiff/tif_packbits.c
    + fix out-of-buffer read in PackBitsDecode() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1563
    Credit to OSS-Fuzz
  * libtiff/tif_luv.c
    + LogL16InitState(): avoid excessive memory allocation when
    RowsPerStrip tag is missing.
    Credit to OSS-Fuzz (locally run, on GDAL)
  * libtiff/tif_lzw.c
    + update dec_bitsleft at beginning of LZWDecode(), and update
    tif_rawcc at end of LZWDecode(). This is needed to properly
    work with the latest chnges in tif_read.c in
    CHUNKY_STRIP_READ_SUPPORT mode.
  * libtiff/tif_pixarlog.c
    + PixarLogDecode(): resync tif_rawcp with next_in and tif_rawcc
    with avail_in at beginning and end of function, similarly to
    what is done in LZWDecode(). Likely needed so that it works
    properly with latest chnges in tif_read.c in
    CHUNKY_STRIP_READ_SUPPORT mode. But untested...
  * libtiff/tif_getimage.c
    + initYCbCrConversion(): add basic validation of luma and
    refBlackWhite coefficients (just check they are not NaN for
    now), to avoid potential float to int overflows. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1663
    Credit to OSS Fuzz
  * libtiff/tif_read.c
    + _TIFFVSetField(): fix outside range cast of double to float.
    Credit to Google Autofuzz project
  * libtiff/tif_getimage.c
    + initYCbCrConversion(): check luma[1] is not zero to avoid
    division by zero. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1665
    Credit to OSS Fuzz
  * libtiff/tif_read.c
    + _TIFFVSetField(): fix outside range cast of double to float.
    Credit to Google Autofuzz project
  * libtiff/tif_getimage.c
    + initYCbCrConversion(): check luma[1] is not zero to avoid
    division by zero. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1665
    Credit to OSS Fuzz
  * libtiff/tif_getimage.c
    + initYCbCrConversion(): stricter validation for refBlackWhite
    coefficients values. To avoid invalid float->int32 conversion.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1718
    Credit to OSS Fuzz
  * tools/fax2tiff.c (main)
    + Applied patch by Joerg Ahrens to fix passing client data for
    Win32 builds using tif_win32.c (USE_WIN32_FILEIO defined) for
    file I/O. Patch was provided via email on November 20, 2016.
  * tools/tiffcp.c
    + avoid uint32 underflow in cpDecodedStrips that can cause
    various issues, such as buffer overflows in the library.
    Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2598
  * tools/tiffcrop.c
    + fix readContigStripsIntoBuffer() in -i (ignore) mode so that
    the output buffer is correctly incremented to avoid write
    outside bounds. Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620
  * tools/tiffcrop.c
    + add 3 extra bytes at end of strip buffer in
    readSeparateStripsIntoBuffer() to avoid read outside of heap
    allocated buffer. Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2621
  * tools/tiffcrop.c
    + fix integer division by zero when BitsPerSample is missing.
    Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2619
  * tools/tiffinfo.c
    + fix null pointer dereference in -r mode when the image has no
    StripByteCount tag. Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2594
  * tools/tiffcp.c
    + avoid potential division by zero is BitsPerSamples tag is
    missing. Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2597
  * tools/tif_dir.c
    + when TIFFGetField(, TIFFTAG_NUMBEROFINKS, ) is called, limit
    the return number of inks to SamplesPerPixel, so that code
    that parses ink names doesn't go past the end of the buffer.
    Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2599
  * tools/tiffcp.c
    + avoid potential division by zero is BitsPerSamples tag is
    missing. Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2607
  * tools/tiffcp.c
    + fix uint32 underflow/overflow that can cause heap-based buffer
    overflow. Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610
  * tools/tiffcp.c
    + replace assert( (bps % 8) == 0 ) by a non assert check.
    Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2605
  * tools/tiff2ps.c
    + fix 2 heap-based buffer overflows (in PSDataBW and
    PSDataColorContig). Reported by Agostino Sarubbo.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2633 and
    http://bugzilla.maptools.org/show_bug.cgi?id=2634.
  * tools/tiff2pdf.c
    + prevent heap-based buffer overflow in -j mode on a paletted
    image. Note: this fix errors out before the overflow happens.
    There could probably be a better fix.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2635
  * tools/tiff2pdf.c
    + fix wrong usage of memcpy() that can trigger unspecified behaviour.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2638
  * tools/tiff2pdf.c
    + avoid potential invalid memory read in t2p_writeproc.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2639
  * tools/tiff2pdf.c
    + avoid potential heap-based overflow in t2p_readwrite_pdf_image_tile().
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2640
  * tools/tiffcrop.c
    + remove extraneous TIFFClose() in error code path, that caused
    double free.
    Related to http://bugzilla.maptools.org/show_bug.cgi?id=2535
  * tools/tiffcp.c
    + error out cleanly in cpContig2SeparateByRow and
    cpSeparate2ContigByRow if BitsPerSample != 8 to avoid heap
    based overflow.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2656 and
    http://bugzilla.maptools.org/show_bug.cgi?id=2657
  * tools/raw2tiff.c
    + avoid integer division by zero.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2631
  * tools/tiff2ps.c
    + call TIFFClose() in error code paths.
  * tools/fax2tiff.c
    + emit appropriate message if the input file is empty. Patch by
    Alan Coopersmith.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2672
  * tools/tiff2bw.c
    + close TIFF handle in error code path.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2677
  * Other issues fixed:
    + bsc#1042804, CVE-2017-9404
  * CVE-2016-10092, CVE-2016-10093, CVE-2016-10094 [bsc#1017693]
- Removed patches:
  * tiff-4.0.7-CVE-2015-7554.patch
  * tiff-4.0.7-CVE-2017-5225.patch
  * tiff-4.0.7-TIFFTAG_FAXRECVPARAMS.patch
  * tiff-CVE-2016-10266.patch
  * tiff-CVE-2016-10267.patch
  * tiff-CVE-2016-10268.patch
  * tiff-CVE-2016-10269.patch
  * tiff-CVE-2016-10270.patch
  * tiff-CVE-2016-10271.patch
  * tiff-CVE-2016-10272.patch
    + Fixed upstream
* Wed Mar 29 2017 fstrba@suse.com
- Added patches:
  * tiff-CVE-2016-10266.patch
    + Upstream fix for CVE-2016-10266, LibTIFF 4.0.7 allows remote
    attackers to cause a denial of service (divide-by-zero error
    and application crash) via a crafted TIFF image (bsc#1031263)
  * tiff-CVE-2016-10267.patch
    + Upstream fix for CVE-2016-10267, LibTIFF 4.0.7 allows remote
    attackers to cause a denial of service (divide-by-zero error
    and application crash) via a crafted TIFF image (bsc#1031262)
  * tiff-CVE-2016-10268.patch
    + Upstream fix for CVE-2016-10268, LibTIFF 4.0.7 allows remote
    attackers to cause a denial of service (divide-by-zero error
    and application crash) via a crafted TIFF image (bsc#1031255)
  * tiff-CVE-2016-10269.patch
    + Upstream fix for CVE-2016-10269, LibTIFF 4.0.7 allows remote
    attackers to cause a denial of service (heap-based buffer
    over-read) or possibly have unspecified other impact via a
    crafted TIFF image (bsc#1031254)
  * tiff-CVE-2016-10270.patch
    + Upstream fix for CVE-2016-10270, LibTIFF 4.0.7 allows remote
    attackers to cause a denial of service (heap-based buffer
    over-read) or possibly have unspecified other impact via a
    crafted TIFF image (bsc#1031250)
  * tiff-CVE-2016-10271.patch
    + Upstream fix for CVE-2016-10271, LibTIFF 4.0.7 allows remote
    attackers to cause a denial of service (heap-based buffer
    over-read and buffer overflow) or possibly have unspecified
    other impact via a crafted TIFF image (bsc#1031249)
  * tiff-CVE-2016-10272.patch
    + Upstream fix for CVE-2016-10272, LibTIFF 4.0.7 allows remote
    attackers to cause a denial of service (heap-based buffer
    overflow) or possibly have unspecified other impact via a
    crafted TIFF image (bsc#1031247)
* Thu Feb 02 2017 fstrba@suse.com
- Added patch:
  * tiff-4.0.7-TIFFTAG_FAXRECVPARAMS.patch
  - Fix a regression introduced in 4.0.7 (bsc#1022103)
  - http://bugzilla.maptools.org/show_bug.cgi?id=2636
* Fri Jan 13 2017 fstrba@suse.com
- Added patch:
  * tiff-4.0.7-CVE-2017-5225.patch
  - Upstream fix for CVE-2017-5225, bsc#1019611: heap buffer
    overflow in tools/tiffcp via a crafted BitsPerSample value
* Mon Dec 19 2016 jengelh@inai.de
- Drop --with-pic, this is only for static libs (which are not built)
- Update descriptions
* Mon Dec 19 2016 idonmez@suse.com
- Update homepage
Version: 4.0.9-150000.45.35.1
* Wed Dec 06 2023 mvetter@suse.com
- security update:
  * CVE-2023-2731 [bsc#1211478]
    Fix null pointer deference in LZWDecode()
    This patch also contains a required commit which is marked
    to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable
    to that CVE because relevant code is not present.
    + tiff-CVE-2023-2731.patch
  * CVE-2023-26965 [bsc#1212398]
    Fix heap-based use after free in loadImage()
    + tiff-CVE-2023-26965.patch
  * CVE-2022-40090 [bsc#1214680]
    Fix infinite loop in TIFFReadDirectory()
    + tiff-CVE-2022-40090.patch
  * CVE-2023-1916 [bsc#1210231]
    Fix out-of-bounds read in extractImageSection()
    + tiff-CVE-2023-1916.patch
Version: 4.0.9-150000.45.32.1
* Mon Oct 30 2023 mvetter@suse.com
- security update:
  * CVE-2023-38289 [bsc#1213589]
    + tiff-CVE-2023-38289.patch
  * CVE-2023-38288 [bsc#1213590]
    + tiff-CVE-2023-38288.patch
  * CVE-2023-3576 [bsc#1213273]
    + tiff-CVE-2023-3576.patch
  * CVE-2020-18768 [bsc#1214574]
    + tiff-CVE-2020-18768.patch
  * CVE-2023-26966 [bsc#1212881]
    + tiff-CVE-2023-26966.patch
  * CVE-2023-3618 [bsc#1213274]
    + tiff-CVE-2023-3618.patch
  * CVE-2023-2908 [bsc#1212888]
    + tiff-CVE-2023-2908.patch
  * CVE-2023-3316 [bsc#1212535]
    + tiff-CVE-2023-3316.patch
Version: 4.0.9-150000.45.28.1
* Fri May 19 2023 mvetter@suse.com
- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
  * CVE-2023-25433 [bsc#1212883]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch
Version: 4.0.9-5.27.5
* Tue Feb 12 2019 mvetter@suse.com
- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch
* Mon Feb 04 2019 mvetter@suse.com
- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch
* Wed Jan 30 2019 pgajdos@suse.com
- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]
Version: 4.0.9-5.20.1
* Mon Nov 19 2018 pgajdos@suse.com
- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch
Version: 4.0.9-5.17.1
* Mon Nov 12 2018 pgajdos@suse.com
- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch
* Mon Nov 12 2018 pgajdos@suse.com
- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch
* Wed Oct 17 2018 pgajdos@suse.com
- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN
* Wed Aug 15 2018 pgajdos@suse.com
- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch
* Tue Jun 05 2018 pgajdos@suse.com
- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch
* Mon Jun 04 2018 pgajdos@suse.com
- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch
* Mon Jun 04 2018 pgajdos@suse.com
- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch
* Fri May 18 2018 pgajdos@suse.com
- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch
* Tue May 15 2018 pgajdos@suse.com
- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch
* Tue Nov 29 2016 fstrba@suse.com
- Upgrade to upstream release 4.0.7
  * libtiff/tif_aux.c
    + Fix crash in TIFFVGetFieldDefaulted() when requesting
    Predictor tag and that the zip/lzw codec is not configured.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2591
  * libtiff/tif_compress.c
    + Make TIFFNoDecode() return 0 to indicate an error and make
    upper level read routines treat it accordingly. (linked to the
    test case of http://bugzilla.maptools.org/show_bug.cgi?id=2517)
  * libtiff/tif_dir.c
    + Discard values of SMinSampleValue and SMaxSampleValue when
    they have been read and the value of SamplesPerPixel is
    changed afterwards (like when reading a OJPEG compressed image
    with a missing SamplesPerPixel tag, and whose photometric is
    RGB or YCbCr, forcing SamplesPerPixel being 3). Otherwise when
    rewriting the directory (for example with tiffset, we will
    expect 3 values whereas the array had been allocated with just
    one), thus causing a out of bound read access. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2500
    (CVE-2014-8127, bsc#914890, duplicate: CVE-2016-3658, bsc#974840)
  * libtiff/tif_dirread.c
    + In TIFFFetchNormalTag(), do not dereference NULL pointer when
    values of tags with TIFF_SETGET_C16_ASCII/TIFF_SETGET_C32_ASCII
    access are 0-byte arrays. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2593 (regression
    introduced by previous fix done on 2016-11-11 for
    CVE-2016-9297, bsc#1010161). Assigned as CVE-2016-9448,
    bsc#1011103
    + In TIFFFetchNormalTag(), make sure that values of tags with
    TIFF_SETGET_C16_ASCII/TIFF_SETGET_C32_ASCII access are null
    terminated, to avoid potential read outside buffer in
    _TIFFPrintField(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2590
    (CVE-2016-9297, bsc#1010161)
    + Initialize doubledata at line 3693 to NULL to please MSVC 2013
    + Prevent reading ColorMap or TransferFunction if
    BitsPerPixel > 24, so as to avoid huge memory allocation and
    file read attempts
    + Reject images with OJPEG compression that have no
    TileOffsets/StripOffsets tag, when OJPEG compression is
    disabled. Prevent null pointer dereference in
    TIFFReadRawStrip1() and other functions that expect
    td_stripbytecount to be non NULL. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2585
    + When compiled with DEFER_STRILE_LOAD, fix regression, when
    reading a one-strip file without a StripByteCounts tag.
    + Workaround false positive warning of Clang Static Analyzer
    about null pointer dereference in TIFFCheckDirOffset().
  * libtiff/tif_dirwrite.c
    + Avoid null pointer dereference on td_stripoffset when writing
    directory, if FIELD_STRIPOFFSETS was artificially set for a
    hack case in OJPEG case. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2500
    (CVE-2014-8127, bsc#914890, duplicate: CVE-2016-3658,
    bsc#974840)
    + Fix truncation to 32 bit of file offsets in TIFFLinkDirectory()
    and TIFFWriteDirectorySec() when aligning directory offsets on
    an even offset (affects BigTIFF).
  * libtiff/tif_dumpmode.c
    + DumpModeEncode() should return 0 in case of failure so that
    the above mentionned functions detect the error.
  * libtiff/tif_fax3.c
    + remove dead assignment in Fax3PutEOLgdal().
  * libtiff/tif_fax3.h
    + make Param member of TIFFFaxTabEnt structure a uint16 to
    reduce size of the binary.
  * libtiff/tif_getimage.c
    + Fix out-of-bound reads in TIFFRGBAImage interface in case of
    unsupported values of SamplesPerPixel/ExtraSamples for
    LogLUV/CIELab. Add explicit call to TIFFRGBAImageOK() in
    TIFFRGBAImageBegin(). Fix CVE-2015-8665 and CVE-2015-8683.
    + Fix some benign warnings which appear in 64-bit compilation
    under Microsoft Visual Studio of the form "Arithmetic
    overflow: 32-bit value is shifted, then cast to 64-bit value.
    Results might not be an expected value."
    + TIFFRGBAImageOK: Reject attempts to read floating point images.
  * libtiff/tif_luv.c
    + Fix potential out-of-bound writes in decode functions in non
    debug builds by replacing assert()s by regular if checks
    (http://bugzilla.maptools.org/show_bug.cgi?id=2522). Fix
    potential out-of-bound reads in case of short input data.
    + Validate that for COMPRESSION_SGILOG and PHOTOMETRIC_LOGL,
    there is only one sample per pixel. Avoid potential invalid
    memory write on corrupted/unexpected images when using the
    TIFFRGBAImageBegin() interface
  * libtiff/tif_next.c
    + Fix potential out-of-bound write in NeXTDecode()
    (http://bugzilla.maptools.org/show_bug.cgi?id=2508)
  * libtiff/tif_pixarlog.c
    + Avoid zlib error messages to pass a NULL string to %s
    formatter, which is undefined behaviour in sprintf().
    + Fix out-of-bounds write vulnerabilities in heap allocated
    buffers. Reported as MSVR 35094.
    + Fix potential buffer write overrun in PixarLogDecode() on
    corrupted/unexpected images (CVE-2016-5875, bsc#987351)
    + Fix write buffer overflow in PixarLogEncode if more input
    samples are provided than expected by PixarLogSetupEncode.
    Idea based on libtiff-CVE-2016-3990.patch from
    libtiff-4.0.3-25.el7_2.src.rpm, but with different and simpler
    check. (http://bugzilla.maptools.org/show_bug.cgi?id=2544,
    bsc#975069)
  * libtiff/tif_predict.c
    + PredictorSetup: Enforce bits-per-sample requirements of
    floating point predictor (3). Fixes CVE-2016-3622 "Divide By
    Zero in the tiff2rgba tool." (bsc#974449)
  * libtiff/tif_predict.h, libtiff/tif_predict.c
    + Replace assertions by runtime checks to avoid assertions in
    debug mode, or buffer overflows in release mode. Can happen
    when dealing with unusual tile size like YCbCr with
    subsampling. Reported as MSVR 35105.
  * libtiff/tif_read.c
    + Fix out-of-bounds read on memory-mapped files in
    TIFFReadRawStrip1() and TIFFReadRawTile1() when stripoffset
    is beyond tmsize_t max value
    + Make TIFFReadEncodedStrip() and TIFFReadEncodedTile() directly
    use user provided buffer when no compression (and other
    conditions) to save a memcpy().
  * libtiff/tif_strip.c
    + Make TIFFNumberOfStrips() return the td->td_nstrips value when
    it is non-zero, instead of recomputing it. This is needed in
    TIFF_STRIPCHOP mode where td_nstrips is modified. Fixes a read
    outsize of array in tiffsplit (or other utilities using
    TIFFNumberOfStrips()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2587
    (CVE-2016-9273, bsc#1010163)
  * libtiff/tif_write.c
    + Fix issue in error code path of TIFFFlushData1() that didn't
    reset the tif_rawcc and tif_rawcp members. I'm not completely
    sure if that could happen in practice outside of the odd
    behaviour of t2p_seekproc() of tiff2pdf). The report points
    that a better fix could be to check the return value of
    TIFFFlushData1() in places where it isn't done currently, but
    it seems this patch is enough. Reported as MSVR 35095.
    + Make TIFFWriteEncodedStrip() and TIFFWriteEncodedTile()
    directly use user provided buffer when no compression to save
    a memcpy().
    + TIFFWriteEncodedStrip() and TIFFWriteEncodedTile() should
    return -1 in case of failure of tif_encodestrip() as documented
  * tools/fax2tiff.D    c
    + Fix segfault when specifying -r without argument. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2572
  * tools/Makefile.am
    + The libtiff tools bmp2tiff, gif2tiff, ras2tiff, sgi2tiff,
    sgisv, and ycbcr are completely removed from the distribution.
    The libtiff tools rgb2ycbcr and thumbnail are only built in
    the build tree for testing. Old files are put in new 'archive'
    subdirectory of the source repository, but not in
    distribution archives. These changes are made in order to
    lessen the maintenance burden.
  * tools/rgb2ycbcr.c
    + Validate values of -v and -h parameters to avoid potential
    divide by zero. Fixes CVE-2016-3623, bsc#974618
    (http://bugzilla.maptools.org/show_bug.cgi?id=2569)
  * tools/tiff2bw.c
    + Fix weight computation that could result of color value
    overflow (no security implication). Fix
    http://bugzilla.maptools.org/show_bug.cgi?id=2550.
  * tools/tiff2pdf.c
    + Avoid undefined behaviour related to overlapping of source and
    destination buffer in memcpy() call in
    t2p_sample_rgbaa_to_rgb() Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2577
    + Fix out-of-bounds write vulnerabilities in heap allocate buffer
    in t2p_process_jpeg_strip(). Reported as MSVR 35098.
    + Fix potential integer overflows on 32 bit builds in
    t2p_read_tiff_size() Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2576
    + Fix read -largely- outsize of buffer in
    t2p_readwrite_pdf_image_tile(), causing crash, when reading a
    JPEG compressed image with TIFFTAG_JPEGTABLES length being one.
    Reported as MSVR 35101. CVE-2016-9453, bsc#1011107
    + Fix write buffer overflow of 2 bytes on JPEG compressed images.
    Reported as TALOS-CAN-0187, CVE-2016-5652, bsc#1007280. Also
    prevents writing 2 extra uninitialized bytes to the file
    stream.
  * tools/tiff2rgba.c
    + Fix integer overflow in size of allocated buffer, when -b mode
    is enabled, that could result in out-of-bounds write. Based
    initially on patch tiff-CVE-2016-3945.patch from
    libtiff-4.0.3-25.el7_2.src.rpm, with correction for invalid
    tests that rejected valid files.
    (http://bugzilla.maptools.org/show_bug.cgi?id=2545, bsc#974614)
  * tools/tiffcp.c
    + Fix out-of-bounds write on tiled images with odd tile width vs
    image width. Reported as MSVR 35103. (bsc#1011841,
    CVE-2016-9538)
    + Fix read of undefined variable in case of missing required
    tags. Found on test case of MSVR 35100.
  * tools/tiffcrop.c
    + Avoid access outside of stack allocated array on a tiled
    separate TIFF with more than 8 samples per pixel.
    (CVE-2016-5321, CVE-2016-5323,
    http://bugzilla.maptools.org/show_bug.cgi?id=2558,
    http://bugzilla.maptools.org/show_bug.cgi?id=2559, bsc#984813,
    bsc#984815)
    + Fix memory leak in (recent) error code path. Fixes Coverity
    1394415.
    + Fix multiple uint32 overflows in writeBufferToSeparateStrips(),
    writeBufferToContigTiles() and writeBufferToSeparateTiles()
    that could cause heap buffer overflows. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2592
    + Fix out-of-bound read of up to 3 bytes in
    readContigTilesIntoBuffer(). Reported as MSVR 35092.
    + Fix out-of-bounds write in loadImage(). From patch
    libtiff-CVE-2016-3991.patch from
    libtiff-4.0.3-25.el7_2.src.rpm
    (http://bugzilla.maptools.org/show_bug.cgi?id=2543, bsc#975070)
    + Fix read of undefined buffer in readContigStripsIntoBuffer()
    due to uint16 overflow. Reported as MSVR 35100. (bsc#1011841,
    CVE-2016-9538)
    + Fix various out-of-bounds write vulnerabilities in heap or
    stack allocated buffers. Reported as MSVR 35093, MSVR 35096
    and MSVR 35097.
    + readContigTilesIntoBuffer: Fix signed/unsigned comparison
    warning.
  * tools/tiffdump.c
    + Fix a few misaligned 64-bit reads warned by -fsanitize
    + ReadDirectory: Remove uint32 cast to_TIFFmalloc() argument
    which resulted in Coverity report. Added more mutiplication
    overflow checks
  * tools/tiffinfo.c
    + Fix out-of-bound read on some tiled images.
    (http://bugzilla.maptools.org/show_bug.cgi?id=2517)
    + TIFFReadContigTileData: Fix signed/unsigned comparison warning.
    + TIFFReadSeparateTileData: Fix signed/unsigned comparison
    warning.
- Removed patches:
  * tiff-4.0.4-uninitialized_mem_NeXTDecode.patch
  * tiff-4.0.6-CVE-2015-8782.patch
  * tiff-4.0.6-CVE-2016-3186.patch
  * tiff-4.0.6-CVE-2016-3623.patch
  * tiff-4.0.6-CVE-2016-3945.patch
  * tiff-4.0.6-CVE-2016-3990.patch
  * tiff-4.0.6-CVE-2016-3991.patch
  * tiff-4.0.6-libtiff-tif_getimage.c-TIFFRGBAImageOK-Reject-attemp.patch
  * tiff-4.0.6-libtiff-tif_luv.c-validate-that-for-COMPRESSION_SGIL.patch
  * tiff-4.0.6-libtiff-tif_pixarlog.c-fix-potential-buffer-write-ov.patch
  * tiff-4.0.6-libtiff-tif_read.c-make-TIFFReadEncodedStrip-and.patch
  * tiff-4.0.6-tools-tiffcrop.c-fix-various-out-of-bounds-write-vul.patch
  - Fixed in the upsteam release
- Changed patch:
  * tiff-4.0.6-CVE-2015-7554.patch -> tiff-4.0.7-CVE-2015-7554.patch
  - Rediffed to the changed context
Version: 4.0.9-45.5.1
* Mon Jan 17 2022 mvetter@suse.com
- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch
Version: 4.0.9-150000.45.8.1
* Fri May 06 2022 mvetter@suse.com
- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch
* Fri May 06 2022 mvetter@suse.com
- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch
Version: 4.0.9-150000.45.25.1
* Thu Jan 26 2023 mvetter@suse.com
- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch
Version: 4.0.9-150000.45.22.1
* Fri Nov 18 2022 fstrba@suse.com
- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch
Version: 4.0.9-150000.45.19.1
* Sun Nov 13 2022 mvetter@suse.com
- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch
Version: 4.0.9-150000.45.16.1
* Mon Oct 17 2022 mvetter@suse.com
- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch
* Wed Aug 03 2022 mvetter@suse.com
- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.
* Mon Aug 01 2022 mvetter@suse.com
- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch
Version: 4.0.9-150000.45.11.1
* Wed Jul 06 2022 mvetter@suse.com
- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch