Blame SOURCES/libtiff-CVE-2015-8683_8665.patch

1ad933
diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
1ad933
index 1633325..018351b 100644
1ad933
--- a/libtiff/tif_getimage.c
1ad933
+++ b/libtiff/tif_getimage.c
1ad933
@@ -182,8 +182,25 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
1ad933
 				    "Planarconfiguration", td->td_planarconfig);
1ad933
 				return (0);
1ad933
 			}
1ad933
+			if( td->td_samplesperpixel != 3 || colorchannels != 3 )
1ad933
+            {
1ad933
+                 sprintf(emsg,
1ad933
+                        "Sorry, can not handle image with %s=%d, %s=%d",
1ad933
+                        "Samples/pixel", td->td_samplesperpixel,
1ad933
+                        "colorchannels", colorchannels);
1ad933
+                 return 0;
1ad933
+             }
1ad933
 			break;
1ad933
 		case PHOTOMETRIC_CIELAB:
1ad933
+            if( td->td_samplesperpixel != 3 || colorchannels != 3 || td->td_bitspersample != 8 )
1ad933
+             {
1ad933
+                 sprintf(emsg,
1ad933
+                        "Sorry, can not handle image with %s=%d, %s=%d and %s=%d",
1ad933
+                         "Samples/pixel", td->td_samplesperpixel,
1ad933
+                         "colorchannels", colorchannels,
1ad933
+                         "Bits/sample", td->td_bitspersample);
1ad933
+                 return 0;
1ad933
+             }
1ad933
 			break;
1ad933
 		default:
1ad933
 			sprintf(emsg, "Sorry, can not handle image with %s=%d",
1ad933
@@ -241,6 +258,9 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int stop, char emsg[1024])
1ad933
 	uint16 *red_orig, *green_orig, *blue_orig;
1ad933
 	int n_color;
1ad933
 
1ad933
+	if( !TIFFRGBAImageOK(tif, emsg) )
1ad933
+		return 0;
1ad933
+
1ad933
 	/* Initialize to normal values */
1ad933
 	img->row_offset = 0;
1ad933
 	img->col_offset = 0;
1ad933
@@ -2453,29 +2473,33 @@ PickContigCase(TIFFRGBAImage* img)
1ad933
 		case PHOTOMETRIC_RGB:
1ad933
 			switch (img->bitspersample) {
1ad933
 				case 8:
1ad933
-					if (img->alpha == EXTRASAMPLE_ASSOCALPHA)
1ad933
+					if (img->alpha == EXTRASAMPLE_ASSOCALPHA &&
1ad933
+						img->samplesperpixel >= 4)
1ad933
 						img->put.contig = putRGBAAcontig8bittile;
1ad933
-					else if (img->alpha == EXTRASAMPLE_UNASSALPHA)
1ad933
+					else if (img->alpha == EXTRASAMPLE_UNASSALPHA &&
1ad933
+							 img->samplesperpixel >= 4)
1ad933
 					{
1ad933
 						if (BuildMapUaToAa(img))
1ad933
 							img->put.contig = putRGBUAcontig8bittile;
1ad933
 					}
1ad933
-					else
1ad933
+					else if( img->samplesperpixel >= 3 )
1ad933
 						img->put.contig = putRGBcontig8bittile;
1ad933
 					break;
1ad933
 				case 16:
1ad933
-					if (img->alpha == EXTRASAMPLE_ASSOCALPHA)
1ad933
+					if (img->alpha == EXTRASAMPLE_ASSOCALPHA &&
1ad933
+						img->samplesperpixel >=4 )
1ad933
 					{
1ad933
 						if (BuildMapBitdepth16To8(img))
1ad933
 							img->put.contig = putRGBAAcontig16bittile;
1ad933
 					}
1ad933
-					else if (img->alpha == EXTRASAMPLE_UNASSALPHA)
1ad933
+					else if (img->alpha == EXTRASAMPLE_UNASSALPHA &&
1ad933
+							 img->samplesperpixel >=4 )
1ad933
 					{
1ad933
 						if (BuildMapBitdepth16To8(img) &&
1ad933
 						    BuildMapUaToAa(img))
1ad933
 							img->put.contig = putRGBUAcontig16bittile;
1ad933
 					}
1ad933
-					else
1ad933
+					else if( img->samplesperpixel >=3 )
1ad933
 					{
1ad933
 						if (BuildMapBitdepth16To8(img))
1ad933
 							img->put.contig = putRGBcontig16bittile;
1ad933
@@ -2484,7 +2508,7 @@ PickContigCase(TIFFRGBAImage* img)
1ad933
 			}
1ad933
 			break;
1ad933
 		case PHOTOMETRIC_SEPARATED:
1ad933
-			if (buildMap(img)) {
1ad933
+			if (img->samplesperpixel >=4 && buildMap(img)) {
1ad933
 				if (img->bitspersample == 8) {
1ad933
 					if (!img->Map)
1ad933
 						img->put.contig = putRGBcontig8bitCMYKtile;
1ad933
@@ -2580,7 +2604,7 @@ PickContigCase(TIFFRGBAImage* img)
1ad933
 			}
1ad933
 			break;
1ad933
 		case PHOTOMETRIC_CIELAB:
1ad933
-			if (buildMap(img)) {
1ad933
+			if (img->samplesperpixel == 3 && buildMap(img)) {
1ad933
 				if (img->bitspersample == 8)
1ad933
 					img->put.contig = initCIELabConversion(img);
1ad933
 				break;