Skip to content

Commit 1ba93c6

Browse files
radarhereradarhere
authored
Apply libtiff patch to fix CVE-2026-4775 (#9646)
1 parent ee9e761 commit 1ba93c6

8 files changed

Lines changed: 111 additions & 4 deletions

File tree

‎.github/generate-sbom.py‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,45 @@ def generate(version: str) -> dict:
356356
"scope": "optional",
357357
"description": "TIFF codec (optional).",
358358
"licenses": [{"license": {"id": "libtiff"}}],
359+
"pedigree": {
360+
"ancestors": [
361+
{
362+
"bom-ref": "pkg:generic/libtiff@4.7.1#upstream",
363+
"type": "library",
364+
"name": "libtiff",
365+
"version": "4.7.1",
366+
"purl": "pkg:generic/libtiff@4.7.1",
367+
"externalReferences": [
368+
{
369+
"type": "distribution",
370+
"url": "https://gitlab.com/libtiff/libtiff/-/tags/v4.7.1",
371+
}
372+
],
373+
}
374+
],
375+
"patches": [
376+
{
377+
"type": "cherry-pick",
378+
"diff": {
379+
"text": {
380+
# apply https://gitlab.com/libtiff/libtiff/-/commit/782a11d6
381+
"content": base64.b64encode(
382+
(
383+
Path(__file__).parent.parent
384+
/ "patches"
385+
/ "tiff-4.7.1.tar.gz.patch"
386+
).read_bytes()
387+
).decode(),
388+
"encoding": "base64",
389+
}
390+
},
391+
},
392+
],
393+
"notes": (
394+
"Vendored from upstream libtiff v4.7.1 with a commit from master "
395+
"cherry-picked to fix CVE-2026-4775."
396+
),
397+
},
359398
"externalReferences": [
360399
{"type": "website", "url": "https://libtiff.gitlab.io/libtiff/"},
361400
{

‎.github/workflows/wheels-dependencies.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ function check_cibw_archs {
1919
# potential cross-build platforms before native platforms to ensure that we pick
2020
# up the cross environment.
2121
PROJECTDIR=$(pwd)
22+
PATCH_DIR=$(pwd)/patches
2223
if [[ "$CIBW_PLATFORM" == "ios" ]]; then
2324
check_cibw_archs
2425
# On iOS, CIBW_ARCHS is actually a multi-arch - arm64_iphoneos,

‎.pre-commit-config.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ repos:
2121
rev: v1.5.6
2222
hooks:
2323
- id: remove-tabs
24-
exclude: (Makefile$|\.bat$|\.cmake$|\.eps$|\.fits$|\.gd$|\.opt$)
24+
exclude: (Makefile$|\.bat$|\.cmake$|\.eps$|\.fits$|\.gd$|\.opt$|\.patch$)
2525

2626
- repo: https://github.com/pre-commit/mirrors-clang-format
2727
rev: v22.1.4
@@ -47,11 +47,11 @@ repos:
4747
- id: check-yaml
4848
args: [--allow-multiple-documents]
4949
- id: end-of-file-fixer
50-
exclude: ^Tests/images/
50+
exclude: ^Tests/images/|\.patch$
5151
- id: file-contents-sorter
5252
files: .github/workflows/Brewfile
5353
- id: trailing-whitespace
54-
exclude: ^\.github/.*TEMPLATE|^Tests/(fonts|images)/
54+
exclude: ^\.github/.*TEMPLATE|^Tests/(fonts|images)/|\.patch$
5555

5656
- repo: https://github.com/python-jsonschema/check-jsonschema
5757
rev: 0.37.2

‎MANIFEST.in‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ include tox.ini
1515
graft Tests
1616
graft Tests/images
1717
graft checks
18+
graft patches
1819
graft src
1920
graft depends
2021
graft winbuild

‎patches/README.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
Although we try to use official sources for dependencies, sometimes the official
2+
sources don't support a platform (especially mobile platforms), or there's a bug
3+
fix/feature that is required to support Pillow's usage.
4+
5+
This folder contains patches that must be applied to official sources, organized
6+
by the platforms that need those patches.
7+
8+
Each patch is against the root of the unpacked official tarball, and is named by
9+
appending `.patch` to the end of the tarball that is to be patched. This
10+
includes the full version number; so if the version is bumped, the patch will
11+
at a minimum require a filename change.
12+
13+
Wherever possible, these patches should be contributed upstream, in the hope that
14+
future Pillow versions won't need to maintain these patches.

‎patches/tiff-4.7.1.tar.gz.patch‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
commit 782a11d6b5b61c6dc21e714950a4af5bf89f023c
2+
Author: Even Rouault <even.rouault@spatialys.com>
3+
Date: Sun Feb 22 23:32:47 2026 +0100
4+
5+
TIFFReadRGBAImage(): prevent integer overflow and later heap overflow on images with huge width in YCbCr tile decoding functions
6+
7+
Fixes https://gitlab.com/libtiff/libtiff/-/issues/787
8+
9+
diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
10+
index 4543ddda..fa82d091 100644
11+
--- libtiff/tif_getimage.c
12+
+++ libtiff/tif_getimage.c
13+
@@ -2224,7 +2224,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr44tile)
14+
uint32_t *cp1 = cp + w + toskew;
15+
uint32_t *cp2 = cp1 + w + toskew;
16+
uint32_t *cp3 = cp2 + w + toskew;
17+
- int32_t incr = 3 * w + 4 * toskew;
18+
+ const tmsize_t incr = 3 * (tmsize_t)w + 4 * (tmsize_t)toskew;
19+
20+
(void)y;
21+
/* adjust fromskew */
22+
@@ -2364,7 +2364,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr44tile)
23+
DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
24+
{
25+
uint32_t *cp1 = cp + w + toskew;
26+
- int32_t incr = 2 * toskew + w;
27+
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
28+
29+
(void)y;
30+
fromskew = (fromskew / 4) * (4 * 2 + 2);
31+
@@ -2522,7 +2522,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr41tile)
32+
DECLAREContigPutFunc(putcontig8bitYCbCr22tile)
33+
{
34+
uint32_t *cp2;
35+
- int32_t incr = 2 * toskew + w;
36+
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
37+
(void)y;
38+
fromskew = (fromskew / 2) * (2 * 2 + 2);
39+
cp2 = cp + w + toskew;
40+
@@ -2625,7 +2625,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr21tile)
41+
DECLAREContigPutFunc(putcontig8bitYCbCr12tile)
42+
{
43+
uint32_t *cp2;
44+
- int32_t incr = 2 * toskew + w;
45+
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
46+
(void)y;
47+
fromskew = (fromskew / 1) * (1 * 2 + 2);
48+
cp2 = cp + w + toskew;

‎wheels/multibuild‎

‎winbuild/build_prepare.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,10 @@ def cmd_msbuild(
213213
# link against libwebp.lib
214214
"#ifdef WEBP_SUPPORT": '#ifdef WEBP_SUPPORT\n#pragma comment(lib, "libwebp.lib")', # noqa: E501
215215
},
216+
r"libtiff\tif_getimage.c": {
217+
"int32_t incr = 3 * w + 4 * toskew;": "const tmsize_t incr = 3 * (tmsize_t)w + 4 * (tmsize_t)toskew;", # noqa: E501
218+
"int32_t incr = 2 * toskew + w;": "const tmsize_t incr = 2 * (tmsize_t)toskew + w;", # noqa: E501
219+
},
216220
},
217221
"build": [
218222
*cmds_cmake(

0 commit comments

Comments
 (0)