1From adfd6be615635705c2f4eb8dfe49e2f463786361 Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Thu, 24 Feb 2022 22:26:02 +0100
4Subject: [PATCH] tif_jbig.c: fix crash when reading a file with multiple
5
6CVE: CVE-2022-0865
7Upstream-Status: Backport
8Signed-off-by: Ross Burton <ross.burton@arm.com>
9
10 IFD in memory-mapped mode and when bit reversal is needed (fixes #385)
11
12---
13 libtiff/tif_jbig.c | 10 ++++++++++
14 1 file changed, 10 insertions(+)
15
16diff --git a/libtiff/tif_jbig.c b/libtiff/tif_jbig.c
17index 7408633..8bfa4ce 100644
18--- a/libtiff/tif_jbig.c
19+++ b/libtiff/tif_jbig.c
20@@ -209,6 +209,16 @@ int TIFFInitJBIG(TIFF* tif, int scheme)
21 	 */
22 	tif->tif_flags |= TIFF_NOBITREV;
23 	tif->tif_flags &= ~TIFF_MAPPED;
24+	/* We may have read from a previous IFD and thus set TIFF_BUFFERMMAP and
25+	 * cleared TIFF_MYBUFFER. It is necessary to restore them to their initial
26+	 * value to be consistent with the state of a non-memory mapped file.
27+	 */
28+	if (tif->tif_flags&TIFF_BUFFERMMAP) {
29+		tif->tif_rawdata = NULL;
30+		tif->tif_rawdatasize = 0;
31+		tif->tif_flags &= ~TIFF_BUFFERMMAP;
32+		tif->tif_flags |= TIFF_MYBUFFER;
33+	}
34
35 	/* Setup the function pointers for encode, decode, and cleanup. */
36 	tif->tif_setupdecode = JBIGSetupDecode;
37