File tiff-CVE-2025-8176.patch of Package tiff.40031
https://gitlab.com/libtiff/libtiff/-/merge_requests/727
Index: tiff-4.0.9/tools/tiffdither.c
===================================================================
--- tiff-4.0.9.orig/tools/tiffdither.c
+++ tiff-4.0.9/tools/tiffdither.c
@@ -93,7 +93,7 @@ fsdither(TIFF* in, TIFF* out)
nextptr = nextline;
for (j = 0; j < imagewidth; ++j)
*nextptr++ = *inptr++;
- for (i = 1; i < imagelength; ++i) {
+ for (i = 0; i < imagelength; ++i) {
tmpptr = thisline;
thisline = nextline;
nextline = tmpptr;
@@ -136,7 +136,7 @@ fsdither(TIFF* in, TIFF* out)
nextptr[0] += v / 16;
}
}
- if (TIFFWriteScanline(out, outline, i-1, 0) < 0)
+ if (TIFFWriteScanline(out, outline, i, 0) < 0)
goto skip_on_error;
}
goto exit_label;
Index: tiff-4.0.9/tools/tiffmedian.c
===================================================================
--- tiff-4.0.9.orig/tools/tiffmedian.c
+++ tiff-4.0.9/tools/tiffmedian.c
@@ -829,7 +829,7 @@ quant_fsdither(TIFF* in, TIFF* out)
outline = (unsigned char *) _TIFFmalloc(TIFFScanlineSize(out));
GetInputLine(in, 0, goto bad); /* get first line */
- for (i = 1; i <= imagelength; ++i) {
+ for (i = 0; i < imagelength; ++i) {
SWAP(short *, thisline, nextline);
lastline = (i >= imax);
if (i <= imax)
@@ -900,7 +900,7 @@ quant_fsdither(TIFF* in, TIFF* out)
nextptr += 3;
}
}
- if (TIFFWriteScanline(out, outline, i-1, 0) < 0)
+ if (TIFFWriteScanline(out, outline, i, 0) < 0)
break;
}
bad: