aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages/image.scm
diff options
context:
space:
mode:
authorLeo Famulari <leo@famulari.name>2017-01-10 03:22:33 -0500
committerLeo Famulari <leo@famulari.name>2017-01-10 17:52:42 -0500
commit4b96149d8b199048aa526159120d14a44d6ee054 (patch)
tree1ffa03b2a425040f2b00578d417784bf69d1abc5 /gnu/packages/image.scm
parent8966c6b43989a0f7bca972f12b78567da7de3eec (diff)
downloadguix-4b96149d8b199048aa526159120d14a44d6ee054.tar
guix-4b96149d8b199048aa526159120d14a44d6ee054.tar.gz
gnu: libtiff: Fix CVE-2016-{10092,10093,10094} and others.
* gnu/packages/patches/libtiff-CVE-2016-10092.patch, gnu/packages/patches/libtiff-CVE-2016-10093.patch, gnu/packages/patches/libtiff-CVE-2016-10094.patch, gnu/packages/patches/libtiff-assertion-failure.patch, gnu/packages/patches/libtiff-divide-by-zero-ojpeg.patch, gnu/packages/patches/libtiff-divide-by-zero-tiffcp.patch, gnu/packages/patches/libtiff-divide-by-zero-tiffcrop.patch, gnu/packages/patches/libtiff-divide-by-zero.patch, gnu/packages/patches/libtiff-heap-overflow-pixarlog-luv.patch, gnu/packages/patches/libtiff-heap-overflow-tif-dirread.patch, gnu/packages/patches/libtiff-heap-overflow-tiffcp.patch, gnu/packages/patches/libtiff-heap-overflow-tiffcrop.patch, gnu/packages/patches/libtiff-invalid-read.patch, gnu/packages/patches/libtiff-null-dereference.patch, gnu/packages/patches/libtiff-tiffcp-underflow.patch: New files. * gnu/local.mk (dist_patch_DATA): Add them. * gnu/packages/image.scm (libtiff)[replacement]: New field. (libtiff/fixed): New variable.
Diffstat (limited to 'gnu/packages/image.scm')
-rw-r--r--gnu/packages/image.scm24
1 files changed, 24 insertions, 0 deletions
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 4e40533a21..a9bbf192cc 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -8,6 +8,7 @@
;;; Copyright © 2015 Amirouche Boubekki <amirouche@hypermove.net>
;;; Copyright © 2014 John Darrington <jmd@gnu.org>
;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
+;;; Copyright © 2016, 2017 Leo Famulari <leo@famulari.name>
;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
;;; Copyright © 2016 Tobias Geerinckx-Rice <me@tobias.gr>
;;; Copyright © 2016 Eric Bavier <bavier@member.fsf.org>
@@ -258,6 +259,7 @@ extracting icontainer icon files.")
(define-public libtiff
(package
(name "libtiff")
+ (replacement libtiff/fixed)
(version "4.0.7")
(source (origin
(method url-fetch)
@@ -290,6 +292,28 @@ collection of tools for doing simple manipulations of TIFF images.")
"See COPYRIGHT in the distribution."))
(home-page "http://www.simplesystems.org/libtiff/")))
+(define libtiff/fixed
+ (package
+ (inherit libtiff)
+ (source
+ (origin
+ (inherit (package-source libtiff))
+ (patches (search-patches "libtiff-heap-overflow-tiffcp.patch"
+ "libtiff-null-dereference.patch"
+ "libtiff-heap-overflow-tif-dirread.patch"
+ "libtiff-heap-overflow-pixarlog-luv.patch"
+ "libtiff-divide-by-zero.patch"
+ "libtiff-divide-by-zero-ojpeg.patch"
+ "libtiff-tiffcp-underflow.patch"
+ "libtiff-invalid-read.patch"
+ "libtiff-CVE-2016-10092.patch"
+ "libtiff-heap-overflow-tiffcrop.patch"
+ "libtiff-divide-by-zero-tiffcrop.patch"
+ "libtiff-CVE-2016-10093.patch"
+ "libtiff-divide-by-zero-tiffcp.patch"
+ "libtiff-assertion-failure.patch"
+ "libtiff-CVE-2016-10094.patch"))))))
+
(define-public libwmf
(package
(name "libwmf")