- Correct a few RLE decoder bugs in libtiff

PR:		nectar
Approved by:	portmgr (marcus)
Obtained from:	libtiff CVS

2 files changed, 75 insertions, 1 deletions

diff --git a/graphics/tiff/Makefile b/graphics/tiff/Makefile
index 103bca601021..cc7692ceaeba 100644
--- a/graphics/tiff/Makefile
+++ b/graphics/tiff/Makefile
@@ -9,7 +9,7 @@
 
 PORTNAME=	tiff
 PORTVERSION=	3.6.1
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	graphics
 MASTER_SITES=	ftp://ftp.remotesensing.org/pub/libtiff/ \
 		http://libtiff.maptools.org/dl/
diff --git a/graphics/tiff/files/patch-ag b/graphics/tiff/files/patch-ag
new file mode 100644
index 000000000000..b01dcec6f36d
--- /dev/null
+++ b/graphics/tiff/files/patch-ag
@@ -0,0 +1,74 @@
+Index: libtiff/tif_luv.c
+===================================================================
+RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_luv.c,v
+retrieving revision 1.10
+retrieving revision 1.11
+diff -u -p -r1.10 -r1.11
+--- libtiff/tif_luv.c	14 Sep 2004 06:02:56 -0000	1.10
++++ libtiff/tif_luv.c	19 Sep 2004 10:08:38 -0000	1.11
+@@ -214,11 +214,11 @@ LogL16Decode(TIFF* tif, tidata_t op, tsi
+ 				rc = *bp++ + (2-128);
+ 				b = (int16)(*bp++ << shft);
+ 				cc -= 2;
+-				while (rc--)
++				while (rc-- && i < npixels)
+ 					tp[i++] |= b;
+ 			} else {			/* non-run */
+ 				rc = *bp++;		/* nul is noop */
+-				while (--cc && rc--)
++				while (--cc && rc-- && i < npixels)
+ 					tp[i++] |= (int16)*bp++ << shft;
+ 			}
+ 		if (i != npixels) {
+@@ -314,11 +314,11 @@ LogLuvDecode32(TIFF* tif, tidata_t op, t
+ 				rc = *bp++ + (2-128);
+ 				b = (uint32)*bp++ << shft;
+ 				cc -= 2;
+-				while (rc--)
++				while (rc-- && i < npixels)
+ 					tp[i++] |= b;
+ 			} else {			/* non-run */
+ 				rc = *bp++;		/* nul is noop */
+-				while (--cc && rc--)
++				while (--cc && rc-- && i < npixels)
+ 					tp[i++] |= (uint32)*bp++ << shft;
+ 			}
+ 		if (i != npixels) {
+Index: libtiff/tif_next.c
+===================================================================
+RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_next.c,v
+retrieving revision 1.3
+retrieving revision 1.4
+diff -u -p -r1.3 -r1.4
+--- libtiff/tif_next.c	8 Jul 2003 16:40:46 -0000	1.3
++++ libtiff/tif_next.c	19 Sep 2004 10:08:38 -0000	1.4
+@@ -87,7 +87,7 @@ NeXTDecode(TIFF* tif, tidata_t buf, tsiz
+ 			 */
+ 			off = (bp[0] * 256) + bp[1];
+ 			n = (bp[2] * 256) + bp[3];
+-			if (cc < 4+n)
++			if (cc < 4+n || off+n > scanline)
+ 				goto bad;
+ 			_TIFFmemcpy(row+off, bp+4, n);
+ 			bp += 4+n;
+Index: libtiff/tif_thunder.c
+===================================================================
+RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_thunder.c,v
+retrieving revision 1.3
+retrieving revision 1.4
+diff -u -p -r1.3 -r1.4
+--- libtiff/tif_thunder.c	14 Sep 2004 06:42:55 -0000	1.3
++++ libtiff/tif_thunder.c	19 Sep 2004 10:08:38 -0000	1.4
+@@ -91,8 +91,10 @@ ThunderDecode(TIFF* tif, tidata_t op, ts
+ 			} else
+ 				lastpixel |= lastpixel << 4;
+ 			npixels += n;
+-			for (; n > 0; n -= 2)
+-				*op++ = (tidataval_t) lastpixel;
++			if (npixels < maxpixels) {
++				for (; n > 0; n -= 2)
++					*op++ = (tidataval_t) lastpixel;
++			}
+ 			if (n == -1)
+ 				*--op &= 0xf0;
+ 			lastpixel &= 0xf;