diff options
| author | Thomas Gerbet <thomas@gerbet.me> | 2023-01-30 22:03:18 +0100 |
|---|---|---|
| committer | Robert Scott <code@humanleg.org.uk> | 2023-01-31 19:16:47 +0000 |
| commit | bf18393ed339d43bd5433e9a9386e4aaefe2a49e (patch) | |
| tree | bb7ce4af4cc17100bbfcacdc989efeafc0b0d6ab | |
| parent | Merge staging-next-22.11 into staging-22.11 (diff) | |
| download | nixpkgs-bf18393ed339d43bd5433e9a9386e4aaefe2a49e.tar.gz | |
libtiff: add patch for CVE-2022-48281
Upstream issue:
https://gitlab.com/libtiff/libtiff/-/issues/488
| -rw-r--r-- | pkgs/development/libraries/libtiff/4.4.0-CVE-2022-48281.patch | 16 | ||||
| -rw-r--r-- | pkgs/development/libraries/libtiff/default.nix | 1 |
2 files changed, 17 insertions, 0 deletions
diff --git a/pkgs/development/libraries/libtiff/4.4.0-CVE-2022-48281.patch b/pkgs/development/libraries/libtiff/4.4.0-CVE-2022-48281.patch new file mode 100644 index 000000000000..53a885fd0a25 --- /dev/null +++ b/pkgs/development/libraries/libtiff/4.4.0-CVE-2022-48281.patch @@ -0,0 +1,16 @@ +Based on upstream d1b6b9c1b3cae2d9e37754506c1ad8f4f7b646b5, adjusted for +formatting differences in 4.4.0 + +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index 5ebb30ae..698fb1cb 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -7735,7 +7735,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop, + crop_buff = (unsigned char *)limitMalloc(cropsize + NUM_BUFF_OVERSIZE_BYTES); + else + { +- prev_cropsize = seg_buffs[0].size; ++ prev_cropsize = seg_buffs[i].size; + if (prev_cropsize < cropsize) + { + next_buff = _TIFFrealloc(crop_buff, cropsize + NUM_BUFF_OVERSIZE_BYTES); diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix index 579abd2c7661..45a4681f05bb 100644 --- a/pkgs/development/libraries/libtiff/default.nix +++ b/pkgs/development/libraries/libtiff/default.nix @@ -62,6 +62,7 @@ stdenv.mkDerivation rec { url = "https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be.patch"; sha256 = "sha256-pgItgS+UhMjoSjkDJH5y7iGFZ+yxWKqlL7BdT2mFcH0="; }) + ./4.4.0-CVE-2022-48281.patch ]; postPatch = '' |