File tiff-3.8.2-CVE-2012-1173.patch of Package tiff3

Index: libtiff/tif_getimage.c
===================================================================
--- libtiff/tif_getimage.c.orig
+++ libtiff/tif_getimage.c
@@ -665,18 +665,24 @@ gtTileSeparate(TIFFRGBAImage* img, uint3
     unsigned char* b;
     unsigned char* a;
     tsize_t tilesize;
+    tsize_t bufsize;    
     int32 fromskew, toskew;
     int alpha = img->alpha;
     uint32 nrow;
     int ret = 1, flip;
 
     tilesize = TIFFTileSize(tif);
-    buf = (unsigned char*) _TIFFmalloc(4*tilesize);
+    bufsize = TIFFSafeMultiply(tsize_t,4,tilesize);
+    if (bufsize == 0) {
+            TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
+            return (0);
+    }
+    buf = (unsigned char*) _TIFFmalloc(bufsize);
     if (buf == 0) {
 		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
 		return (0);
     }
-    _TIFFmemset(buf, 0, 4*tilesize);
+    _TIFFmemset(buf, 0, bufsize);
     r = buf;
     g = r + tilesize;
     b = g + tilesize;
@@ -866,17 +872,23 @@ gtStripSeparate(TIFFRGBAImage* img, uint
     uint32 rowsperstrip, offset_row;
     uint32 imagewidth = img->width;
     tsize_t stripsize;
+    tsize_t bufsize;
     int32 fromskew, toskew;
     int alpha = img->alpha;
     int	ret = 1, flip;
 
     stripsize = TIFFStripSize(tif);
-    r = buf = (unsigned char *)_TIFFmalloc(4*stripsize);
+    bufsize = TIFFSafeMultiply(tsize_t,4,stripsize);
+    if (bufsize == 0) {
+            TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
+            return (0);
+    }
+    r = buf = (unsigned char *)_TIFFmalloc(bufsize);
     if (buf == 0) {
 		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
 		return (0);
     }
-    _TIFFmemset(buf, 0, 4*stripsize);
+    _TIFFmemset(buf, 0, bufsize);
     g = r + stripsize;
     b = g + stripsize;
     a = b + stripsize;
Index: libtiff/tiffiop.h
===================================================================
--- libtiff/tiffiop.h.orig
+++ libtiff/tiffiop.h
@@ -226,6 +226,8 @@ struct tiff {
 #define TIFFhowmany8(x) (((x)&0x07)?((uint32)(x)>>3)+1:(uint32)(x)>>3)
 #define	TIFFroundup(x, y) (TIFFhowmany(x,y)*(y))
 
+#define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
+
 #define TIFFmax(A,B) ((A)>(B)?(A):(B))
 #define TIFFmin(A,B) ((A)<(B)?(A):(B))