tiff: patch CVE-2025-9165

Pick commit mentioned in NVD report.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>

diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2025-9165.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2025-9165.patch
new file mode 100644 (file)
index 0000000..5602292
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2025-9165.patch
@@ -0,0 +1,29 @@
+From ed141286a37f6e5ddafb5069347ff5d587e7a4e0 Mon Sep 17 00:00:00 2001
+From: Su_Laus <sulau@freenet.de>
+Date: Fri, 8 Aug 2025 21:35:30 +0200
+Subject: [PATCH] tiffcmp: fix memory leak when second file cannot be opened.
+
+Closes #728, #729
+
+CVE: CVE-2025-9165
+Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/ed141286a37f6e5ddafb5069347ff5d587e7a4e0]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ tools/tiffcmp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/tiffcmp.c b/tools/tiffcmp.c
+index 529c1cdc..88d9470f 100644
+--- a/tools/tiffcmp.c
++++ b/tools/tiffcmp.c
+@@ -105,7 +105,10 @@ int main(int argc, char *argv[])
+         return (2);
+     tif2 = TIFFOpen(argv[optind + 1], "r");
+     if (tif2 == NULL)
++    {
++        TIFFClose(tif1);
+         return (2);
++    }
+     dirnum = 0;
+     while (tiffcmp(tif1, tif2))
+     {

diff --git a/meta/recipes-multimedia/libtiff/tiff_4.7.0.bb b/meta/recipes-multimedia/libtiff/tiff_4.7.0.bb
index fd383e3d6a3a35a361eb1f359445f6c0b675aa24..405edabe6f477afe206c968650c0f0e3c813b699 100644 (file)
--- a/meta/recipes-multimedia/libtiff/tiff_4.7.0.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.7.0.bb
@@ -17,6 +17,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
           file://CVE-2025-8177_1.patch \
           file://CVE-2025-8177_2.patch \
            file://CVE-2025-8534.patch \
+           file://CVE-2025-9165.patch \
           "
 
 SRC_URI[sha256sum] = "67160e3457365ab96c5b3286a0903aa6e78bdc44c4bc737d2e486bcecb6ba976"