fix CVE-2023-38288 CVE-2023-38289

(cherry picked from commit 5267e6307da5e0d44c7462c6f78efd1ea4aae91f)

backport-CVE-2023-38288.patch

@@ -0,0 +1,33 @@
+From 965fa243004e012adc533ae8e38db3055f101a7f Mon Sep 17 00:00:00 2001
+From: Arie Haenel <arie.haenel@jct.ac.il>
+Date: Wed, 19 Jul 2023 14:18:12 +0000
+Subject: [PATCH] Fix for ticket #591
+
+Reference:https://gitlab.com/libtiff/libtiff/-/merge_requests/515/diffs
+Conflict:Adaptation Context
+
+---
+ tools/tiffcp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/tools/tiffcp.c b/tools/tiffcp.c
+index 57eef90..7120837 100644
+--- a/tools/tiffcp.c
++++ b/tools/tiffcp.c
+@@ -1577,6 +1577,13 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
+ 		TIFFError(TIFFFileName(in), "Error, cannot handle that much samples per tile row (Tile Width * Samples/Pixel)");
+ 		return 0;
+ 	}
++
++	if ( (imagew - tilew * spp) > INT_MAX ){
++		TIFFError(TIFFFileName(in),
++			  "Error, image raster scan line size is too large");
++	return 0;
++	}
++
+ 	iskew = imagew - tilew*spp;
+ 	tilebuf = limitMalloc(tilesize);
+ 	if (tilebuf == 0)
+-- 
+2.27.0
+

backport-CVE-2023-38289.patch

@@ -0,0 +1,69 @@
+From bdf7b2621c62e04d0408391b7d5611502a752cd0 Mon Sep 17 00:00:00 2001
+From: Arie Haenel <arie.haenel@jct.ac.il>
+Date: Wed, 19 Jul 2023 14:22:52 +0000
+Subject: [PATCH] Fix for ticket #592
+
+Reference:https://gitlab.com/libtiff/libtiff/-/merge_requests/516/diffs
+Conflict:Adaptation Context
+
+---
+ tools/raw2tiff.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/tools/raw2tiff.c b/tools/raw2tiff.c
+index 3a6f00e..c524a69 100644
+--- a/tools/raw2tiff.c
++++ b/tools/raw2tiff.c
+@@ -36,6 +36,7 @@
+ #include <sys/types.h>
+ #include <math.h>
+ #include <ctype.h>
++#include <limits.h>
+ 
+ #ifdef HAVE_UNISTD_H
+ # include <unistd.h>
+@@ -101,6 +102,7 @@ main(int argc, char* argv[])
+ 	int	fd;
+ 	char	*outfilename = NULL;
+ 	TIFF	*out;
++	uint32_t temp_limit_check = 0;     /* temp for integer overflow checking*/
+ 
+ 	uint32_t row, col, band;
+ 	int	c;
+@@ -217,6 +219,33 @@ main(int argc, char* argv[])
+ 	if (guessSize(fd, dtype, hdr_size, nbands, swab, &width, &length) < 0)
+ 		return EXIT_FAILURE;
+ 
++	/* check for integer overflow in */
++	/* hdr_size + (*width) * (*length) * nbands * depth */
++
++	if ((width == 0) || (length == 0) ){
++		fprintf(stderr, "Too large nbands value specified.\n");
++		return (EXIT_FAILURE);
++	}
++
++	temp_limit_check = nbands * depth;
++
++	if ( !temp_limit_check || length > ( UINT_MAX / temp_limit_check ) )  {
++		fprintf(stderr, "Too large length size specified.\n");
++		return (EXIT_FAILURE);
++	}
++	temp_limit_check = temp_limit_check * length;
++
++	if ( !temp_limit_check || width > ( UINT_MAX / temp_limit_check ) )  {
++		fprintf(stderr, "Too large width size specified.\n");
++		return (EXIT_FAILURE);
++	}
++	temp_limit_check = temp_limit_check * width;
++
++	if ( !temp_limit_check || hdr_size > ( UINT_MAX - temp_limit_check ) )  {
++		fprintf(stderr, "Too large header size specified.\n");
++		return (EXIT_FAILURE);
++	}
++
+ 	if (outfilename == NULL)
+ 		outfilename = argv[optind+1];
+ 	out = TIFFOpen(outfilename, "w");
+-- 
+2.27.0
+

libtiff.spec

@@ -1,6 +1,6 @@
 Name:           libtiff
 Version:        4.3.0
-Release:        29
+Release:        30
 Summary:        TIFF Library and Utilities
 License:        libtiff
 URL:            https://www.simplesystems.org/libtiff/
@@ -42,6 +42,8 @@ Patch6032:      backport-CVE-2023-25433.patch
 Patch6033:      backport-CVE-2023-26966.patch
 Patch6034:      backport-CVE-2023-2908.patch
 Patch6035:      backport-CVE-2023-3576.patch
+Patch6036:      backport-CVE-2023-38288.patch
+Patch6037:      backport-CVE-2023-38289.patch
 
 Patch9000:	fix-raw2tiff-floating-point-exception.patch
 
@@ -165,6 +167,9 @@ find html -name 'Makefile*' | xargs rm
 %exclude %{_datadir}/html/man/tiffgt.1.html
 
 %changelog
+* Fri Jul 28 2023 zhangpan <zhangpan103@h-partners.com> - 4.3.0-30
+- fix CVE-2023-38288 CVE-2023-38289
+
 * Thu Jul 13 2023 zhangpan <zhangpan103@h-partners.com> - 4.3.0-29
 - fix CVE-2023-3576