libtiff/tiff/CVE-2022-2867.patch

24 @@ -5194,20 +5194,33 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image,
25  	y1 = _TIFFClampDoubleToUInt32(crop->corners[i].Y1);
26  	y2 = _TIFFClampDoubleToUInt32(crop->corners[i].Y2);
48          crop->regionlist[i].x1 = image->width - 1;
50 -        crop->regionlist[i].x1 = (uint32_t) (x1 - 1);
52 +        crop->regionlist[i].x1 = (uint32_t)(x1 - 1);
55 -       crop->regionlist[i].x2 = image->width - 1;
57 -       crop->regionlist[i].x2 = (uint32_t)(x2 - 1);
59 +        crop->regionlist[i].x2 = image->width - 1;
61 +        crop->regionlist[i].x2 = (uint32_t)(x2 - 1);
63 -      zwidth  = crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1;
64 +      zwidth = crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1;
67          crop->regionlist[i].y1 = image->length - 1;
68 @@ -5219,8 +5232,7 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image,
70          crop->regionlist[i].y2 = (uint32_t)(y2 - 1);
72 -      zlength = crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1;
74 +      zlength = crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1;
78 @@ -5250,7 +5262,7 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image,
85    /* Convert crop margins into offsets into image
87 @@ -5286,7 +5298,7 @@ computeInputPixelOffsets(struct crop_mask *crop, struct image_data *image,
96 @@ -5494,10 +5506,17 @@ getCropOffsets(struct image_data *image, struct crop_mask *crop, struct dum…
98      crop->selections = crop->zones;
100 -  for (i = 0; i < crop->zones; i++)
103 +  for (int j = 0; j < crop->zones; j++)
105 -    seg = crop->zonelist[i].position;
106 -    total = crop->zonelist[i].total;
107 +    seg = crop->zonelist[j].position;
108 +    total = crop->zonelist[j].total;
115      switch (crop->edge_ref)
117 @@ -5626,8 +5645,11 @@ getCropOffsets(struct image_data *image, struct crop_mask *crop, struct dump…
119                 crop->regionlist[i].x1, crop->regionlist[i].x2,
120                 crop->regionlist[i].y1, crop->regionlist[i].y2);
126 +    crop->selections = i;