Version in base suite: 4.7.0-3+deb13u2 Base version: tiff_4.7.0-3+deb13u2 Target version: tiff_4.7.0-3+deb13u3 Base file: /srv/ftp-master.debian.org/ftp/pool/main/t/tiff/tiff_4.7.0-3+deb13u2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/t/tiff/tiff_4.7.0-3+deb13u3.dsc changelog | 12 ++ patches/pixarlog-add-comment-explaining-4-byte-advance-in-AB.patch | 29 ++++ patches/pixarlog-complete-ABGR-bounds-check-for-multi-row-st.patch | 59 +++++++++ patches/pixarlog-error-out-on-invalid-ABGR-output-buffer-siz.patch | 60 ++++++++++ patches/pixarlog-fix-heap-buffer-overflow-in-8BITABGR-decode.patch | 47 +++++++ patches/series | 4 6 files changed, 211 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpq_tkyy1l/tiff_4.7.0-3+deb13u2.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpq_tkyy1l/tiff_4.7.0-3+deb13u3.dsc: no acceptable signature found diff -Nru tiff-4.7.0/debian/changelog tiff-4.7.0/debian/changelog --- tiff-4.7.0/debian/changelog 2026-04-06 22:05:59.000000000 +0000 +++ tiff-4.7.0/debian/changelog 2026-07-10 14:34:09.000000000 +0000 @@ -1,3 +1,15 @@ +tiff (4.7.0-3+deb13u3) trixie-security; urgency=high + + * Non-maintainer upload by the Security Team. + * Address heap-based buffer overflow in pixarlog (CVE-2026-12912) + (Closes: #1141320) + - pixarlog: fix heap-buffer-overflow in 8BITABGR decode with stride 3 + - pixarlog: add comment explaining 4-byte advance in ABGR decode + - pixarlog: complete ABGR bounds check for multi-row strip decoding + - pixarlog: error out on invalid ABGR output buffer sizes + + -- Salvatore Bonaccorso Fri, 10 Jul 2026 16:34:09 +0200 + tiff (4.7.0-3+deb13u2) trixie-security; urgency=medium * CVE-2026-4775 (Closes: #1132632) diff -Nru tiff-4.7.0/debian/patches/pixarlog-add-comment-explaining-4-byte-advance-in-AB.patch tiff-4.7.0/debian/patches/pixarlog-add-comment-explaining-4-byte-advance-in-AB.patch --- tiff-4.7.0/debian/patches/pixarlog-add-comment-explaining-4-byte-advance-in-AB.patch 1970-01-01 00:00:00.000000000 +0000 +++ tiff-4.7.0/debian/patches/pixarlog-add-comment-explaining-4-byte-advance-in-AB.patch 2026-07-10 14:30:56.000000000 +0000 @@ -0,0 +1,29 @@ +From: waugustus +Date: Fri, 24 Apr 2026 09:16:55 +0800 +Subject: pixarlog: add comment explaining 4-byte advance in ABGR decode +Origin: https://gitlab.com/libtiff/libtiff/-/commit/51fa6dfe93f20da0d38f079fbc61c7c960bcbc16 +Bug: https://gitlab.com/libtiff/libtiff/-/merge_requests/873 +Bug-Debian: https://bugs.debian.org/1141320 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-12912 + +--- + libtiff/tif_pixarlog.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c +index 18466144522a..8efd92737bd0 100644 +--- a/libtiff/tif_pixarlog.c ++++ b/libtiff/tif_pixarlog.c +@@ -1004,6 +1004,9 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s) + case PIXARLOGDATAFMT_8BITABGR: + horizontalAccumulate8abgr(up, llen, sp->stride, + (unsigned char *)op, sp->ToLinear8); ++ ++ /* For stride == 3 (RGB), horizontalAccumulate8abgr expands to 4 ++ * bytes/pixel (ABGR) */ + if (sp->stride == 3) + op += (unsigned long)td->td_imagewidth * 4; + else +-- +2.53.0 + diff -Nru tiff-4.7.0/debian/patches/pixarlog-complete-ABGR-bounds-check-for-multi-row-st.patch tiff-4.7.0/debian/patches/pixarlog-complete-ABGR-bounds-check-for-multi-row-st.patch --- tiff-4.7.0/debian/patches/pixarlog-complete-ABGR-bounds-check-for-multi-row-st.patch 1970-01-01 00:00:00.000000000 +0000 +++ tiff-4.7.0/debian/patches/pixarlog-complete-ABGR-bounds-check-for-multi-row-st.patch 2026-07-10 14:32:18.000000000 +0000 @@ -0,0 +1,59 @@ +From: waugustus +Date: Thu, 7 May 2026 12:48:42 +0800 +Subject: pixarlog: complete ABGR bounds check for multi-row strip decoding +Origin: https://gitlab.com/libtiff/libtiff/-/commit/f9bda11bf2fc819b971517582666d56f18b1bc3f +Bug: https://gitlab.com/libtiff/libtiff/-/merge_requests/883 +Bug-Debian: https://bugs.debian.org/1141320 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-12912 + +--- + libtiff/tif_pixarlog.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c +index f35f3fb01588..a6f62f18b3b7 100644 +--- a/libtiff/tif_pixarlog.c ++++ b/libtiff/tif_pixarlog.c +@@ -880,6 +880,12 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s) + if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3) + { + tmsize_t required = (tmsize_t)td->td_imagewidth * 4; ++ tmsize_t max_rows; ++ tmsize_t max_nsamples; ++ ++ /* ++ * Ensure at least one expanded output row fits. ++ */ + if (occ < required) + { + TIFFErrorExtR(tif, module, +@@ -887,6 +893,26 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s) + memset(op, 0, (size_t)occ); + return (0); + } ++ ++ /* ++ * PixarLogDecode() may process multiple rows per call ++ * (e.g. strip decoding). Limit nsamples so the total ++ * output written by the loop below never exceeds occ. ++ */ ++ max_rows = occ / required; ++ max_nsamples = max_rows * llen; ++ ++ /* ++ * Truncate excess rows to preserve as much decoded data ++ * as possible while avoiding output buffer overflow. ++ */ ++ if (nsamples > max_nsamples) ++ { ++ TIFFWarningExtR(tif, module, ++ "PixarLog ABGR decode truncated to avoid " ++ "output buffer overflow"); ++ nsamples = max_nsamples; ++ } + } + + (void)s; +-- +2.53.0 + diff -Nru tiff-4.7.0/debian/patches/pixarlog-error-out-on-invalid-ABGR-output-buffer-siz.patch tiff-4.7.0/debian/patches/pixarlog-error-out-on-invalid-ABGR-output-buffer-siz.patch --- tiff-4.7.0/debian/patches/pixarlog-error-out-on-invalid-ABGR-output-buffer-siz.patch 1970-01-01 00:00:00.000000000 +0000 +++ tiff-4.7.0/debian/patches/pixarlog-error-out-on-invalid-ABGR-output-buffer-siz.patch 2026-07-10 14:33:18.000000000 +0000 @@ -0,0 +1,60 @@ +From: waugustus +Date: Thu, 7 May 2026 16:22:27 +0800 +Subject: pixarlog: error out on invalid ABGR output buffer sizes +Origin: https://gitlab.com/libtiff/libtiff/-/commit/90601d9a23382d98f3695ec14441145c37a77574 +Bug: https://gitlab.com/libtiff/libtiff/-/merge_requests/883 +Bug-Debian: https://bugs.debian.org/1141320 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-12912 + +--- + libtiff/tif_pixarlog.c | 25 +++++++++++++++++-------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c +index a6f62f18b3b7..fa267dfbff20 100644 +--- a/libtiff/tif_pixarlog.c ++++ b/libtiff/tif_pixarlog.c +@@ -894,6 +894,19 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s) + return (0); + } + ++ /* ++ * The caller-provided output buffer size must represent a whole ++ * number of expanded ABGR scanlines. ++ */ ++ if (occ % required) ++ { ++ TIFFErrorExtR( ++ tif, module, ++ "Fractional scanline not supported for PixarLog ABGR data"); ++ memset(op, 0, (size_t)occ); ++ return (0); ++ } ++ + /* + * PixarLogDecode() may process multiple rows per call + * (e.g. strip decoding). Limit nsamples so the total +@@ -902,16 +915,12 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s) + max_rows = occ / required; + max_nsamples = max_rows * llen; + +- /* +- * Truncate excess rows to preserve as much decoded data +- * as possible while avoiding output buffer overflow. +- */ + if (nsamples > max_nsamples) + { +- TIFFWarningExtR(tif, module, +- "PixarLog ABGR decode truncated to avoid " +- "output buffer overflow"); +- nsamples = max_nsamples; ++ TIFFErrorExtR(tif, module, ++ "Output buffer too small for PixarLog ABGR data"); ++ memset(op, 0, (size_t)occ); ++ return (0); + } + } + +-- +2.53.0 + diff -Nru tiff-4.7.0/debian/patches/pixarlog-fix-heap-buffer-overflow-in-8BITABGR-decode.patch tiff-4.7.0/debian/patches/pixarlog-fix-heap-buffer-overflow-in-8BITABGR-decode.patch --- tiff-4.7.0/debian/patches/pixarlog-fix-heap-buffer-overflow-in-8BITABGR-decode.patch 1970-01-01 00:00:00.000000000 +0000 +++ tiff-4.7.0/debian/patches/pixarlog-fix-heap-buffer-overflow-in-8BITABGR-decode.patch 2026-07-10 14:29:18.000000000 +0000 @@ -0,0 +1,47 @@ +From: waugustus +Date: Thu, 23 Apr 2026 17:05:53 +0800 +Subject: pixarlog: fix heap-buffer-overflow in 8BITABGR decode with stride 3 + (#824) +Origin: https://gitlab.com/libtiff/libtiff/-/commit/ba2b04b114c5dd945107ccc613cedfcca3af73bb +Bug: https://gitlab.com/libtiff/libtiff/-/merge_requests/873 +Bug-Debian: https://bugs.debian.org/1141320 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-12912 + +--- + libtiff/tif_pixarlog.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +--- a/libtiff/tif_pixarlog.c ++++ b/libtiff/tif_pixarlog.c +@@ -865,6 +865,19 @@ static int PixarLogDecode(TIFF *tif, uin + + llen = sp->stride * td->td_imagewidth; + ++ /* Fix: ABGR with stride=3 expands 3 samples to 4 output bytes per pixel */ ++ if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3) ++ { ++ tmsize_t required = (tmsize_t)td->td_imagewidth * 4; ++ if (occ < required) ++ { ++ TIFFErrorExtR(tif, module, ++ "Output buffer too small for PixarLog ABGR data"); ++ memset(op, 0, (size_t)occ); ++ return (0); ++ } ++ } ++ + (void)s; + assert(sp != NULL); + +@@ -978,7 +991,10 @@ static int PixarLogDecode(TIFF *tif, uin + case PIXARLOGDATAFMT_8BITABGR: + horizontalAccumulate8abgr(up, llen, sp->stride, + (unsigned char *)op, sp->ToLinear8); +- op += llen * sizeof(unsigned char); ++ if (sp->stride == 3) ++ op += (unsigned long)td->td_imagewidth * 4; ++ else ++ op += (unsigned long)llen * sizeof(unsigned char); + break; + default: + TIFFErrorExtR(tif, module, "Unsupported bits/sample: %" PRIu16, diff -Nru tiff-4.7.0/debian/patches/series tiff-4.7.0/debian/patches/series --- tiff-4.7.0/debian/patches/series 2026-04-06 22:05:59.000000000 +0000 +++ tiff-4.7.0/debian/patches/series 2026-07-10 14:33:30.000000000 +0000 @@ -4,3 +4,7 @@ CVE-2025-9165.patch CVE-2025-9900.patch CVE-2026-4775.patch +pixarlog-fix-heap-buffer-overflow-in-8BITABGR-decode.patch +pixarlog-add-comment-explaining-4-byte-advance-in-AB.patch +pixarlog-complete-ABGR-bounds-check-for-multi-row-st.patch +pixarlog-error-out-on-invalid-ABGR-output-buffer-siz.patch