Fix minor issues with the libtiff 4.0.9 upgrade. - Update third_party/libtiff/README.pdfium. - Fix patch files that try to patch themselves. Change-Id: Idff8f0744d585fb981e4061b77f9c753663c8738 Reviewed-on: https://pdfium-review.googlesource.com/c/49130 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/third_party/libtiff/0017-safe_skews_in_gtTileContig.patch b/third_party/libtiff/0017-safe_skews_in_gtTileContig.patch index 9fc0ed0..b27bab5 100644 --- a/third_party/libtiff/0017-safe_skews_in_gtTileContig.patch +++ b/third_party/libtiff/0017-safe_skews_in_gtTileContig.patch
@@ -1,96 +1,3 @@ -diff --git a/third_party/libtiff/0017-safe_skews_in_gtTileContig.patch b/third_party/libtiff/0017-safe_skews_in_gtTileContig.patch -index ad6d33dae..e69de29bb 100644 ---- a/third_party/libtiff/0017-safe_skews_in_gtTileContig.patch -+++ b/third_party/libtiff/0017-safe_skews_in_gtTileContig.patch -@@ -1,88 +0,0 @@ --diff --git a/third_party/libtiff/tif_getimage.c b/third_party/libtiff/tif_getimage.c --index 84cc1d1a7..82e19164e 100644 ----- a/third_party/libtiff/tif_getimage.c --+++ b/third_party/libtiff/tif_getimage.c --@@ -31,6 +31,7 @@ -- */ -- #include "tiffiop.h" -- #include <stdio.h> --+#include <limits.h> -- -- static int gtTileContig(TIFFRGBAImage*, uint32*, uint32, uint32); -- static int gtTileSeparate(TIFFRGBAImage*, uint32*, uint32, uint32); --@@ -629,6 +628,7 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) -- uint32 tw, th; -- unsigned char* buf; -- int32 fromskew, toskew; --+ int64 safeskew; -- uint32 nrow; -- int ret = 1, flip; -- uint32 this_tw, tocol; --@@ -649,19 +647,37 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) -- flip = setorientation(img); -- if (flip & FLIP_VERTICALLY) { -- y = h - 1; --- toskew = -(int32)(tw + w); --+ safeskew = 0; --+ safeskew -= tw; --+ safeskew -= w; -- } -- else { -- y = 0; --- toskew = -(int32)(tw - w); --+ safeskew = 0; --+ safeskew -= tw; --+ safeskew +=w; -- } -- --+ if(safeskew > INT_MAX || safeskew < INT_MIN){ --+ _TIFFfree(buf); --+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "Invalid skew"); --+ return (0); --+ } --+ toskew = safeskew; --+ -- /* -- * Leftmost tile is clipped on left side if col_offset > 0. -- */ -- leftmost_fromskew = img->col_offset % tw; -- leftmost_tw = tw - leftmost_fromskew; --- leftmost_toskew = toskew + leftmost_fromskew; --+ safeskew = toskew; --+ safeskew += leftmost_fromskew; --+ if(safeskew > INT_MAX || safeskew < INT_MIN){ --+ _TIFFfree(buf); --+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "Invalid skew"); --+ return (0); --+ } --+ leftmost_toskew = safeskew; -- for (row = 0; row < h; row += nrow) -- { -- rowstoread = th - (row + img->row_offset) % th; --@@ -704,9 +684,24 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) -- /* -- * Rightmost tile is clipped on right side. -- */ --- fromskew = tw - (w - tocol); --+ safeskew = tw; --+ safeskew -= w; --+ safeskew += tocol; --+ if(safeskew > INT_MAX || safeskew < INT_MIN){ --+ _TIFFfree(buf); --+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "Invalid skew"); --+ return (0); --+ } --+ fromskew = safeskew; -- this_tw = tw - fromskew; --- this_toskew = toskew + fromskew; --+ safeskew = toskew; --+ safeskew += fromskew; --+ if(safeskew > INT_MAX || safeskew < INT_MIN){ --+ _TIFFfree(buf); --+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "Invalid skew"); --+ return (0); --+ } --+ this_toskew = safeskew; -- } -- (*put)(img, raster+y*w+tocol, tocol, y, this_tw, nrow, fromskew, this_toskew, buf + pos); -- tocol += this_tw; diff --git a/third_party/libtiff/tif_getimage.c b/third_party/libtiff/tif_getimage.c index fc554ccab..fff3f7fde 100644 --- a/third_party/libtiff/tif_getimage.c
diff --git a/third_party/libtiff/0028-nstrips-OOM.patch b/third_party/libtiff/0028-nstrips-OOM.patch index 33a4b3d..97cc953 100644 --- a/third_party/libtiff/0028-nstrips-OOM.patch +++ b/third_party/libtiff/0028-nstrips-OOM.patch
@@ -1,34 +1,3 @@ -diff --git a/third_party/libtiff/0028-nstrips-OOM.patch b/third_party/libtiff/0028-nstrips-OOM.patch -index a6db66ee8..e69de29bb 100644 ---- a/third_party/libtiff/0028-nstrips-OOM.patch -+++ b/third_party/libtiff/0028-nstrips-OOM.patch -@@ -1,26 +0,0 @@ --diff --git a/third_party/libtiff/tif_dirread.c b/third_party/libtiff/tif_dirread.c --index 772ebaf7d..ab938eac9 100644 ----- a/third_party/libtiff/tif_dirread.c --+++ b/third_party/libtiff/tif_dirread.c --@@ -41,6 +41,7 @@ -- -- #include "tiffiop.h" -- #include <float.h> --+#include <limits.h> -- -- #define IGNORE 0 /* tag placeholder used below */ -- #define FAILED_FII ((uint32) -1) --@@ -3638,6 +3639,13 @@ TIFFReadDirectory(TIFF* tif) -- isTiled(tif) ? "tiles" : "strips"); -- goto bad; -- } --+ if (tif->tif_dir.td_nstrips > INT_MAX) { --+ TIFFErrorExt(tif->tif_clientdata, module, --+ "Cannot handle %u number of %s", --+ tif->tif_dir.td_nstrips, --+ isTiled(tif) ? "tiles" : "strips"); --+ goto bad; --+ } -- tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips; -- if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE) -- tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel; diff --git a/third_party/libtiff/tif_dirread.c b/third_party/libtiff/tif_dirread.c index 5e62e8131..521dbf0a4 100644 --- a/third_party/libtiff/tif_dirread.c
diff --git a/third_party/libtiff/README.pdfium b/third_party/libtiff/README.pdfium index a370a49..16423ae 100644 --- a/third_party/libtiff/README.pdfium +++ b/third_party/libtiff/README.pdfium
@@ -1,6 +1,6 @@ Name: LibTIFF URL: http://www.simplesystems.org/libtiff/ -Version: 4.0.8 +Version: 4.0.9 Security Critical: yes License: BSD @@ -10,11 +10,8 @@ Local Modifications: 0000-build-config.patch: Local build configuration changes. -0001-build-config.patch: Enable HAVE_SEARCH_H in tiffconf.h for VS 2015 0006-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch: Fix a heap buffer overflow 0008-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch: Fix a heap buffer overflow 0017-safe_skews_in_gtTileContig.patch: return error if to/from skews overflow from int32. -0025-upstream-OOM-gtTileContig: allocates the decoded buffer only after a first successful TIFFFillStrip. -0026-upstream-null-dereference: properly evit when stoponerr is set and avoid null dereferences. 0027-build-config.patch: #define variables so their value can be used by #if. 0028-nstrips-OOM.patch: return error for excess number of tiles/strips.