File tiff-CVE-2025-8961.patch of Package tiff.40314
https://gitlab.com/libtiff/libtiff/-/merge_requests/753
Index: tiff-4.0.9/tools/tiffcrop.c
===================================================================
--- tiff-4.0.9.orig/tools/tiffcrop.c
+++ tiff-4.0.9/tools/tiffcrop.c
@@ -930,6 +930,7 @@ static int readContigTilesIntoBuffer (TI
TIFFError("readContigTilesIntoBuffer",
"Unable to extract row %d from tile %lu",
row, (unsigned long)TIFFCurrentTile(in));
+ _TIFFfree(tilebuf);
return 1;
}
break;
@@ -944,6 +945,7 @@ static int readContigTilesIntoBuffer (TI
TIFFError("readContigTilesIntoBuffer",
"Unable to extract row %d from tile %lu",
row, (unsigned long)TIFFCurrentTile(in));
+ _TIFFfree(tilebuf);
return 1;
}
break;
@@ -958,6 +960,7 @@ static int readContigTilesIntoBuffer (TI
TIFFError("readContigTilesIntoBuffer",
"Unable to extract row %d from tile %lu",
row, (unsigned long)TIFFCurrentTile(in));
+ _TIFFfree(tilebuf);
return 1;
}
break;
@@ -970,6 +973,7 @@ static int readContigTilesIntoBuffer (TI
TIFFError("readContigTilesIntoBuffer",
"Unable to extract row %d from tile %lu",
row, (unsigned long)TIFFCurrentTile(in));
+ _TIFFfree(tilebuf);
return 1;
}
break;
@@ -984,10 +988,12 @@ static int readContigTilesIntoBuffer (TI
TIFFError("readContigTilesIntoBuffer",
"Unable to extract row %d from tile %lu",
row, (unsigned long)TIFFCurrentTile(in));
+ _TIFFfree(tilebuf);
return 1;
}
break;
default: TIFFError("readContigTilesIntoBuffer", "Unsupported bit depth %d", bps);
+ _TIFFfree(tilebuf);
return 1;
}
}
@@ -2534,7 +2540,7 @@ main(int argc, char* argv[])
}
/* If we did not use the read buffer as the crop buffer */
- if (read_buff)
+ if (read_buff && read_buff != crop_buff)
_TIFFfree(read_buff);
if (crop_buff)