Patch libtiff for CVE-2023-6228 [Low] (#11788)

Signed-off-by: Ankita Pareek <ankitapareek@microsoft.com>
Co-authored-by: Ankita Pareek <ankitapareek@microsoft.com>

Author: Ankita13-code

SPECS/libtiff/CVE-2023-6228.patch

@@ -0,0 +1,27 @@
+From 1e7d217a323eac701b134afc4ae39b6bdfdbc96a Mon Sep 17 00:00:00 2001
+From: Su_Laus <sulau@freenet.de>
+Date: Sat, 9 Sep 2023 15:45:47 +0200
+Subject: [PATCH] Check also if codec of input image is available,
+ independently from codec check of output image and return with error if not.
+ Fixes #606.
+
+---
+ tools/tiffcp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/tiffcp.c b/tools/tiffcp.c
+index aff06260e..2628bdbb9 100644
+--- a/tools/tiffcp.c
++++ b/tools/tiffcp.c
+@@ -846,6 +846,8 @@ static int tiffcp(TIFF *in, TIFF *out)
+     if (!TIFFIsCODECConfigured(compression))
+         return FALSE;
+     TIFFGetFieldDefaulted(in, TIFFTAG_COMPRESSION, &input_compression);
++    if (!TIFFIsCODECConfigured(input_compression))
++        return FALSE;
+     TIFFGetFieldDefaulted(in, TIFFTAG_PHOTOMETRIC, &input_photometric);
+     if (input_compression == COMPRESSION_JPEG)
+     {
+-- 
+GitLab
+

SPECS/libtiff/libtiff.spec

@@ -1,7 +1,7 @@
 Summary:        TIFF libraries and associated utilities.
 Name:           libtiff
 Version:        4.6.0
-Release:        5%{?dist}
+Release:        6%{?dist}
 License:        libtiff
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -12,6 +12,7 @@ Patch0:         CVE-2023-52356.patch
 Patch1:         CVE-2023-6277.patch
 Patch2:         CVE-2024-7006.patch
 Patch3:         CVE-2023-3164.patch
+Patch4:         CVE-2023-6228.patch
 
 BuildRequires:  autoconf
 BuildRequires:  automake
@@ -65,6 +66,9 @@ make %{?_smp_mflags} -k check
 %{_docdir}/*
 
 %changelog
+* Mon Feb 03 2025 Ankita Pareek <ankitapareek@microsoft.com> - 4.6.0-6
+- Address CVE-2023-6228 with a patch
+
 * Fri Jan 17 2025 Bhagyashri Pathak <bhapathak@microsoft.com> - 4.6.0-5
 - Add patch for CVE-2023-3164.patch