[AUTO-CHERRYPICK] Fix CVE-2023-3164 in libtiff package for 3.0 - branch 3.0-dev (#11984)

Co-authored-by: bhagyapathak <[email protected]>

Author: CBL-Mariner-Bot

SPECS/libtiff/CVE-2023-3164.patch

@@ -0,0 +1,30 @@
+From 7ec6f53745ab6331382e59373ffd980b38a378f0 Mon Sep 17 00:00:00 2001
+From: Lee Howard <[email protected]>
+Date: Wed, 13 Mar 2024 10:06:21 -0700
+Subject: [PATCH] fix tiffcrop issues #552, #550, and #542
+
+---
+ archive/tools/tiffcrop.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/archive/tools/tiffcrop.c b/archive/tools/tiffcrop.c
+index 95983479c..3d837d269 100644
+--- a/archive/tools/tiffcrop.c
++++ b/archive/tools/tiffcrop.c
+@@ -7766,6 +7766,14 @@ static int extractImageSection(struct image_data *image,
+         (sect_width * spp * bps) %
+         8; /* trailing bits within the last byte of destination buffer */
+ 
++    /* Check to make sure that we've got enough buffer.
++     */
++    if ((last_row - first_row) * img_rowsize > full_bytes)
++    {
++        printf("The source image data is too small.\n");
++        return(-1);
++    }
++
+ #ifdef DEVELMODE
+     TIFFError("",
+               "First row: %" PRIu32 ", last row: %" PRIu32
+-- 
+

SPECS/libtiff/libtiff.spec

@@ -1,7 +1,7 @@
 Summary:        TIFF libraries and associated utilities.
 Name:           libtiff
 Version:        4.6.0
-Release:        4%{?dist}
+Release:        5%{?dist}
 License:        libtiff
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -11,6 +11,7 @@ Source0:        https://gitlab.com/libtiff/libtiff/-/archive/v%{version}/libtiff
 Patch0:         CVE-2023-52356.patch
 Patch1:         CVE-2023-6277.patch
 Patch2:         CVE-2024-7006.patch
+Patch3:         CVE-2023-3164.patch
 
 BuildRequires:  autoconf
 BuildRequires:  automake
@@ -64,6 +65,9 @@ make %{?_smp_mflags} -k check
 %{_docdir}/*
 
 %changelog
+* Fri Jan 17 2025 Bhagyashri Pathak <[email protected]> - 4.6.0-5
+- Add patch for CVE-2023-3164.patch
+
 * Tue Aug 13 2024 Aadhar Agarwal <[email protected]> - 4.6.0-4
 - Add patch for CVE-2024-7006