#
# spec file for package tiff
#
# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.

# Please submit bugfixes or comments via http://bugs.opensuse.org/
#


Name:           tiff
Version:        4.0.7
Release:        2.1
Summary:        Tools for Converting from and to the Tagged Image File Format
License:        HPND
Group:          Productivity/Graphics/Convertors
Url:            http://www.simplesystems.org/libtiff/
Source:         http://download.osgeo.org/libtiff/tiff-%{version}.tar.gz
Source2:        README.SUSE
Source3:        baselibs.conf
Patch0:         tiff-4.0.3-seek.patch
# http://bugzilla.maptools.org/show_bug.cgi?id=2442
Patch1:         tiff-4.0.3-compress-warning.patch
# http://bugzilla.maptools.org/show_bug.cgi?id=2508
Patch3:         tiff-4.0.7-CVE-2015-7554.patch

# special for HylaFAX, upstream 
# http://bugzilla.maptools.org/show_bug.cgi?id=2636
Patch100:       tiff-4.0.7-HylaFAX.patch

BuildRequires:  gcc-c++
BuildRequires:  libjpeg-devel
BuildRequires:  libtool
BuildRequires:  zlib-devel
BuildRoot:      %{_tmppath}/%{name}-%{version}-build
%if 0%{?suse_version} > 1030
BuildRequires:  lzma-devel
%endif
%if 0%{?suse_version} <= 1000
BuildRequires:  pkgconfig
%endif
%if 0%{?suse_version} > 1000
BuildRequires:  pkg-config
%endif
# bug437293
%ifarch ppc64
Obsoletes:      tiff-64bit
%endif
%if 0%{?suse_version} > 1210
BuildRequires:  libjbig-devel
%endif

%description
This package contains the library and support programs for the Tagged
Image File Format (TIFF).

%package -n libtiff5
Summary:        The TIFF Library (with JPEG and compression support)
Group:          System/Libraries
Provides:       libtiff = %{version}
# bug437293
%ifarch ppc64
Obsoletes:      libtiff-64bit
%endif
#

%description -n libtiff5
This package includes the TIFF libraries. To link a program with
libtiff, you will have to add -ljpeg and -lz to include the necessary
libjpeg and libz in the linking process.

%package -n libtiff-devel
Summary:        Development tools for programs which will use the TIFF library
Group:          Development/Libraries/C and C++
Requires:       glibc-devel
Requires:       libstdc++-devel
Requires:       libtiff5 = %{version}
# bug437293
%ifarch ppc64
Obsoletes:      tiff-devel-64bit
%endif
#

%description -n libtiff-devel
This package contains the header files and static libraries for
developing programs which will manipulate TIFF format image files using
the libtiff library.

%prep
%setup -q
%patch0 -p1
%patch1 -p1
%patch3
%patch100 -p1

%build
CFLAGS="%{optflags} -fPIE"
%configure --disable-static
make %{?_smp_mflags} LDFLAGS="-pie"

%install
mkdir -p %{buildroot}/{%{_mandir}/{man1,man3},usr/{bin,lib,include}}
make DESTDIR=%{buildroot} install %{?_smp_mflags}
for f in `find %{buildroot}/%{_mandir} -type f -print ` ; do
  if [ `wc -l <$f` -eq 1 ] && grep -q "^\.so " $f ; then
    linkto=`sed -e "s|^\.so ||" $f`
    [ -f "`dirname $f`/$linkto" ] && ln -sf "$linkto" $f
  fi
done

cp %{SOURCE2} .
rm -rf %{buildroot}%{_datadir}/doc/tiff*
find %{buildroot} -type f -name "*.la" -delete -print
find html -name "Makefile*" | xargs rm

%check
for i in tools tests; do
	cd $i && make %{?_smp_mflags} check
done

%post -n libtiff5 -p /sbin/ldconfig

%postun -n libtiff5 -p /sbin/ldconfig

%files
%defattr(-,root,root)
%{_bindir}/*
%doc html
%doc README COPYRIGHT VERSION ChangeLog TODO RELEASE-DATE
%{_mandir}/man1/*

%files -n libtiff5
%defattr(-,root,root)
%doc README COPYRIGHT README.SUSE
%{_libdir}/*.so.*

%files -n libtiff-devel
%defattr(-,root,root)
%{_includedir}/*
%{_libdir}/*.so
%{_libdir}/pkgconfig/*.pc
%{_mandir}/man3/*

%changelog
* Mon Dec 19 2016 jengelh@inai.de
- Drop --with-pic, this is only for static libs (which are not built)
- Update descriptions
* Mon Dec 19 2016 idonmez@suse.com
- Update homepage
* Tue Nov 29 2016 fstrba@suse.com
- Upgrade to upstream release 4.0.7
  * libtiff/tif_aux.c
    + Fix crash in TIFFVGetFieldDefaulted() when requesting
    Predictor tag and that the zip/lzw codec is not configured.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2591
  * libtiff/tif_compress.c
    + Make TIFFNoDecode() return 0 to indicate an error and make
    upper level read routines treat it accordingly. (linked to the
    test case of http://bugzilla.maptools.org/show_bug.cgi?id=2517)
  * libtiff/tif_dir.c
    + Discard values of SMinSampleValue and SMaxSampleValue when
    they have been read and the value of SamplesPerPixel is
    changed afterwards (like when reading a OJPEG compressed image
    with a missing SamplesPerPixel tag, and whose photometric is
    RGB or YCbCr, forcing SamplesPerPixel being 3). Otherwise when
    rewriting the directory (for example with tiffset, we will
    expect 3 values whereas the array had been allocated with just
    one), thus causing a out of bound read access. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2500
    (CVE-2014-8127, bsc#914890, duplicate: CVE-2016-3658, bsc#974840)
  * libtiff/tif_dirread.c
    + In TIFFFetchNormalTag(), do not dereference NULL pointer when
    values of tags with TIFF_SETGET_C16_ASCII/TIFF_SETGET_C32_ASCII
    access are 0-byte arrays. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2593 (regression
    introduced by previous fix done on 2016-11-11 for
    CVE-2016-9297, bsc#1010161). Assigned as CVE-2016-9448,
    bsc#1011103
    + In TIFFFetchNormalTag(), make sure that values of tags with
    TIFF_SETGET_C16_ASCII/TIFF_SETGET_C32_ASCII access are null
    terminated, to avoid potential read outside buffer in
    _TIFFPrintField(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2590
    (CVE-2016-9297, bsc#1010161)
    + Initialize doubledata at line 3693 to NULL to please MSVC 2013
    + Prevent reading ColorMap or TransferFunction if
    BitsPerPixel > 24, so as to avoid huge memory allocation and
    file read attempts
    + Reject images with OJPEG compression that have no
    TileOffsets/StripOffsets tag, when OJPEG compression is
    disabled. Prevent null pointer dereference in
    TIFFReadRawStrip1() and other functions that expect
    td_stripbytecount to be non NULL. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2585
    + When compiled with DEFER_STRILE_LOAD, fix regression, when
    reading a one-strip file without a StripByteCounts tag.
    + Workaround false positive warning of Clang Static Analyzer
    about null pointer dereference in TIFFCheckDirOffset().
  * libtiff/tif_dirwrite.c
    + Avoid null pointer dereference on td_stripoffset when writing
    directory, if FIELD_STRIPOFFSETS was artificially set for a
    hack case in OJPEG case. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2500
    (CVE-2014-8127, bsc#914890, duplicate: CVE-2016-3658,
    bsc#974840)
    + Fix truncation to 32 bit of file offsets in TIFFLinkDirectory()
    and TIFFWriteDirectorySec() when aligning directory offsets on
    an even offset (affects BigTIFF).
  * libtiff/tif_dumpmode.c
    + DumpModeEncode() should return 0 in case of failure so that
    the above mentionned functions detect the error.
  * libtiff/tif_fax3.c
    + remove dead assignment in Fax3PutEOLgdal().
  * libtiff/tif_fax3.h
    + make Param member of TIFFFaxTabEnt structure a uint16 to
    reduce size of the binary.
  * libtiff/tif_getimage.c
    + Fix out-of-bound reads in TIFFRGBAImage interface in case of
    unsupported values of SamplesPerPixel/ExtraSamples for
    LogLUV/CIELab. Add explicit call to TIFFRGBAImageOK() in
    TIFFRGBAImageBegin(). Fix CVE-2015-8665 and CVE-2015-8683.
    + Fix some benign warnings which appear in 64-bit compilation
    under Microsoft Visual Studio of the form "Arithmetic
    overflow: 32-bit value is shifted, then cast to 64-bit value.
    Results might not be an expected value."
    + TIFFRGBAImageOK: Reject attempts to read floating point images.
  * libtiff/tif_luv.c
    + Fix potential out-of-bound writes in decode functions in non
    debug builds by replacing assert()s by regular if checks
    (http://bugzilla.maptools.org/show_bug.cgi?id=2522). Fix
    potential out-of-bound reads in case of short input data.
    + Validate that for COMPRESSION_SGILOG and PHOTOMETRIC_LOGL,
    there is only one sample per pixel. Avoid potential invalid
    memory write on corrupted/unexpected images when using the
    TIFFRGBAImageBegin() interface
  * libtiff/tif_next.c
    + Fix potential out-of-bound write in NeXTDecode()
    (http://bugzilla.maptools.org/show_bug.cgi?id=2508)
  * libtiff/tif_pixarlog.c
    + Avoid zlib error messages to pass a NULL string to %%s
    formatter, which is undefined behaviour in sprintf().
    + Fix out-of-bounds write vulnerabilities in heap allocated
    buffers. Reported as MSVR 35094.
    + Fix potential buffer write overrun in PixarLogDecode() on
    corrupted/unexpected images (CVE-2016-5875, bsc#987351)
    + Fix write buffer overflow in PixarLogEncode if more input
    samples are provided than expected by PixarLogSetupEncode.
    Idea based on libtiff-CVE-2016-3990.patch from
    libtiff-4.0.3-25.el7_2.src.rpm, but with different and simpler
    check. (http://bugzilla.maptools.org/show_bug.cgi?id=2544,
    bsc#975069)
  * libtiff/tif_predict.c
    + PredictorSetup: Enforce bits-per-sample requirements of
    floating point predictor (3). Fixes CVE-2016-3622 "Divide By
    Zero in the tiff2rgba tool." (bsc#974449)
  * libtiff/tif_predict.h, libtiff/tif_predict.c
    + Replace assertions by runtime checks to avoid assertions in
    debug mode, or buffer overflows in release mode. Can happen
    when dealing with unusual tile size like YCbCr with
    subsampling. Reported as MSVR 35105.
  * libtiff/tif_read.c
    + Fix out-of-bounds read on memory-mapped files in
    TIFFReadRawStrip1() and TIFFReadRawTile1() when stripoffset
    is beyond tmsize_t max value
    + Make TIFFReadEncodedStrip() and TIFFReadEncodedTile() directly
    use user provided buffer when no compression (and other
    conditions) to save a memcpy().
  * libtiff/tif_strip.c
    + Make TIFFNumberOfStrips() return the td->td_nstrips value when
    it is non-zero, instead of recomputing it. This is needed in
    TIFF_STRIPCHOP mode where td_nstrips is modified. Fixes a read
    outsize of array in tiffsplit (or other utilities using
    TIFFNumberOfStrips()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2587
    (CVE-2016-9273, bsc#1010163)
  * libtiff/tif_write.c
    + Fix issue in error code path of TIFFFlushData1() that didn't
    reset the tif_rawcc and tif_rawcp members. I'm not completely
    sure if that could happen in practice outside of the odd
    behaviour of t2p_seekproc() of tiff2pdf). The report points
    that a better fix could be to check the return value of
    TIFFFlushData1() in places where it isn't done currently, but
    it seems this patch is enough. Reported as MSVR 35095.
    + Make TIFFWriteEncodedStrip() and TIFFWriteEncodedTile()
    directly use user provided buffer when no compression to save
    a memcpy().
    + TIFFWriteEncodedStrip() and TIFFWriteEncodedTile() should
    return -1 in case of failure of tif_encodestrip() as documented
  * tools/fax2tiff.c
    + Fix segfault when specifying -r without argument. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2572
  * tools/Makefile.am
    + The libtiff tools bmp2tiff, gif2tiff, ras2tiff, sgi2tiff,
    sgisv, and ycbcr are completely removed from the distribution.
    The libtiff tools rgb2ycbcr and thumbnail are only built in
    the build tree for testing. Old files are put in new 'archive'
    subdirectory of the source repository, but not in
    distribution archives. These changes are made in order to
    lessen the maintenance burden.
  * tools/rgb2ycbcr.c
    + Validate values of -v and -h parameters to avoid potential
    divide by zero. Fixes CVE-2016-3623, bsc#974618
    (http://bugzilla.maptools.org/show_bug.cgi?id=2569)
  * tools/tiff2bw.c
    + Fix weight computation that could result of color value
    overflow (no security implication). Fix
    http://bugzilla.maptools.org/show_bug.cgi?id=2550.
  * tools/tiff2pdf.c
    + Avoid undefined behaviour related to overlapping of source and
    destination buffer in memcpy() call in
    t2p_sample_rgbaa_to_rgb() Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2577
    + Fix out-of-bounds write vulnerabilities in heap allocate buffer
    in t2p_process_jpeg_strip(). Reported as MSVR 35098.
    + Fix potential integer overflows on 32 bit builds in
    t2p_read_tiff_size() Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2576
    + Fix read -largely- outsize of buffer in
    t2p_readwrite_pdf_image_tile(), causing crash, when reading a
    JPEG compressed image with TIFFTAG_JPEGTABLES length being one.
    Reported as MSVR 35101. CVE-2016-9453, bsc#1011107
    + Fix write buffer overflow of 2 bytes on JPEG compressed images.
    Reported as TALOS-CAN-0187, CVE-2016-5652, bsc#1007280. Also
    prevents writing 2 extra uninitialized bytes to the file
    stream.
  * tools/tiff2rgba.c
    + Fix integer overflow in size of allocated buffer, when -b mode
    is enabled, that could result in out-of-bounds write. Based
    initially on patch tiff-CVE-2016-3945.patch from
    libtiff-4.0.3-25.el7_2.src.rpm, with correction for invalid
    tests that rejected valid files.
    (http://bugzilla.maptools.org/show_bug.cgi?id=2545, bsc#974614)
  * tools/tiffcp.c
    + Fix out-of-bounds write on tiled images with odd tile width vs
    image width. Reported as MSVR 35103.
    + Fix read of undefined variable in case of missing required
    tags. Found on test case of MSVR 35100.
  * tools/tiffcrop.c
    + Avoid access outside of stack allocated array on a tiled
    separate TIFF with more than 8 samples per pixel.
    (CVE-2016-5321, CVE-2016-5323,
    http://bugzilla.maptools.org/show_bug.cgi?id=2558,
    http://bugzilla.maptools.org/show_bug.cgi?id=2559, bsc#984813,
    bsc#984815)
    + Fix memory leak in (recent) error code path. Fixes Coverity
    1394415.
    + Fix multiple uint32 overflows in writeBufferToSeparateStrips(),
    writeBufferToContigTiles() and writeBufferToSeparateTiles()
    that could cause heap buffer overflows. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2592
    + Fix out-of-bound read of up to 3 bytes in
    readContigTilesIntoBuffer(). Reported as MSVR 35092.
    + Fix out-of-bounds write in loadImage(). From patch
    libtiff-CVE-2016-3991.patch from
    libtiff-4.0.3-25.el7_2.src.rpm
    (http://bugzilla.maptools.org/show_bug.cgi?id=2543, bsc#975070)
    + Fix read of undefined buffer in readContigStripsIntoBuffer()
    due to uint16 overflow. Reported as MSVR 35100.
    + Fix various out-of-bounds write vulnerabilities in heap or
    stack allocated buffers. Reported as MSVR 35093, MSVR 35096
    and MSVR 35097.
    + readContigTilesIntoBuffer: Fix signed/unsigned comparison
    warning.
  * tools/tiffdump.c
    + Fix a few misaligned 64-bit reads warned by -fsanitize
    + ReadDirectory: Remove uint32 cast to_TIFFmalloc() argument
    which resulted in Coverity report. Added more mutiplication
    overflow checks
  * tools/tiffinfo.c
    + Fix out-of-bound read on some tiled images.
    (http://bugzilla.maptools.org/show_bug.cgi?id=2517)
    + TIFFReadContigTileData: Fix signed/unsigned comparison warning.
    + TIFFReadSeparateTileData: Fix signed/unsigned comparison
    warning.
- Removed patches:
  * tiff-4.0.4-uninitialized_mem_NeXTDecode.patch
  * tiff-4.0.6-CVE-2015-8782.patch
  * tiff-4.0.6-CVE-2016-3186.patch
  * tiff-4.0.6-CVE-2016-3623.patch
  * tiff-4.0.6-CVE-2016-3945.patch
  * tiff-4.0.6-CVE-2016-3990.patch
  * tiff-4.0.6-CVE-2016-3991.patch
  * tiff-4.0.6-libtiff-tif_getimage.c-TIFFRGBAImageOK-Reject-attemp.patch
  * tiff-4.0.6-libtiff-tif_luv.c-validate-that-for-COMPRESSION_SGIL.patch
  * tiff-4.0.6-libtiff-tif_pixarlog.c-fix-potential-buffer-write-ov.patch
  * tiff-4.0.6-libtiff-tif_read.c-make-TIFFReadEncodedStrip-and.patch
  * tiff-4.0.6-tools-tiffcrop.c-fix-various-out-of-bounds-write-vul.patch
  - Fixed in the upsteam release
- Changed patch:
  * tiff-4.0.6-CVE-2015-7554.patch -> tiff-4.0.7-CVE-2015-7554.patch
  - Rediffed to the changed context
* Thu Oct  6 2016 fstrba@suse.com
- Added patches:
  * tiff-4.0.6-tools-tiffcrop.c-fix-various-out-of-bounds-write-vul.patch
  - Upstream fixes for MSVR 35093, MSVR 35094, MSVR 35095,
    MSVR 35096, MSVR 35097, MSVR 35098.
  * tiff-4.0.6-libtiff-tif_getimage.c-TIFFRGBAImageOK-Reject-attemp.patch
  - Enforce bits-per-sample requirements of floating point
    predictor. Fixes CVE-2016-3622 [bsc#974449]
* Thu Sep  1 2016 fstrba@suse.com
- Added patches:
  * tiff-4.0.6-CVE-2016-3623.patch
  * tiff-4.0.6-CVE-2016-3945.patch
  * tiff-4.0.6-CVE-2016-3990.patch
  * tiff-4.0.6-CVE-2016-3991.patch
  - Upstream commits to fix CVE-2016-3623 [bsc#974618],
    CVE-2016-3945 [bsc#974614], CVE-2016-3990 [bsc#975069],
    CVE-2016-3991 [bsc#975070]
* Tue Jul 12 2016 fstrba@suse.com
- Added patches:
  * tiff-4.0.6-libtiff-tif_luv.c-validate-that-for-COMPRESSION_SGIL.patch
  * tiff-4.0.6-libtiff-tif_pixarlog.c-fix-potential-buffer-write-ov.patch
  * tiff-4.0.6-libtiff-tif_read.c-make-TIFFReadEncodedStrip-and.patch
  - Upstream commits to fix CVE-2016-5314 [bsc#984831],
    CVE-2016-5316 [bsc#984837], CVE-2016-5317 [bsc#984842],
    CVE-2016-5320 [bsc#984808] and CVE-2016-5875 [bsc#987351]
* Wed Apr  6 2016 fstrba@suse.com
- Added patch:
  * tiff-4.0.6-CVE-2016-3186.patch
  - fix CVE-2016-3186: buffer overflow in gif2tiff [bsc#973340]
* Mon Feb  1 2016 fstrba@suse.com
- Added patch:
  * tiff-4.0.6-CVE-2015-8782.patch
  - fix CVE-2015-8781, CVE-2015-8782, CVE-2015-8783: Out-of-bounds
    writes for invalid images (upstream bug #2522) [bsc#964225]
* Wed Jan 13 2016 fstrba@suse.com
- Added patch:
  * tiff-4.0.6-CVE-2015-7554.patch
  - fix CVE-2015-7554: Out-of-bounds Write in the thumbnail and
    tiffcmp tools (upsteam bug #2499) [bsc#960341]
* Mon Jan 11 2016 kstreitova@suse.com
- Added patch:
  * tiff-4.0.4-uninitialized_mem_NeXTDecode.patch
  - fix uninitialized memory in NeXTDecode (upstream bug #2508)
    [bsc#942690]
* Tue Dec  8 2015 p.drouand@gmail.com
- Update to version 4.0.6
  * Supports CMake 2.8.9 and later.
  * Add missing file which wasn't being distributed, causing unit
    tests to fail.
  * Make shared/static library building configurable.
  * CMake reads all version information directly from configure.ac
    to avoid duplication of values.
  * CMake builds are now included in 'distcheck' target.
  * Autotools 'make distcheck' now tests the CMake-based build if
    CMake is available.
  * Fixes to avoid undefined behaviour of signed types (C standard
    compliance).
  * Fixes to avoid possible isses when casting to unsigned char.
  * Fixes to avoid undefined behaviour with shifts.
  * Fix generation of output with 16 bit or 32 bit integer, when
    byte swapping is needed, in horizontal predictor (#2521).
  * Fix decoding when there is a single pixel to decode
    (unlikely case...) and byte swapping is involved.
  * Add add explicit masking with 0xff before casting to uchar in
    floating-point horizontal differencing and accumulation routines.
  * Eliminate requirement for and use of 64-bit constant values.
  * tiffgt : Silence glut API deprecation warnings on MacOS X.
  * fax2ps : Detect failure to write to temporary file.
- Changes from version 4.0.5
  * Support for configure/build using CMake.
  * Support for large (> 2GB) files under Microsoft Windows.
  * Configuration and building using CMake is now supported under
    Microsoft Windows and on Unix-type systems.
  * Test for and use fseeko() if it is available. This allows supporting
    large files on Unix-type systems with a 32-bit 'long' type and a
    64-bit 'off_t' type.
  * tiffiop.h: Macros added to use 64-bit equivalents for all standard
    I/O and POSIX APIs used by libtiff and its tools which are limited
    to 2GB in Windows builds. Note that these 64-bit equivalents were
    introduced by the CRT provided with Visual Studio 2005 and if the
    necessary CRT is not installed on the target computer, the program
    will not run. The wrapper macros will not be activated unless the
    definition _MSC_VER is at least 1400 or __MSVCRT_VERSION__ is at
    least 0x800.
  * tif_unix.c: Updated to support large files under Microsoft Windows.
    This makes tif_unix.c a completely viable candidate for use under
    Windows (in spite of its name) if the CRT is modern enough. Please
    note that tif_win32.c already supported large files, but only
    'tiffinfo' and 'tiffdump' made any provision to support large files
    under Windows.
  * _tiffReadProc() and _tiffWriteProc() are modified to chunk I/O to a
    maximum size of 2GB for extremely large I/O requests. This surmounts
    limitations in the Microsoft Windows read() and write() APIs (which
    are limited to the range of a 32-bit 'int'), and may avoid poor
    behavior with extremely large I/O requests on other systems.
  * Updated to use I/O wrapper macros from tiffiop.h in order to
    support large files under Microsoft Windows.
* Tue Aug  4 2015 kstreitova@suse.com
- use spec-cleaner
* Wed Jul  1 2015 pgajdos@suse.com
- update to 4.0.4
  D    tiff-4.0.3-double-free.patch
  D    tiff-handle-TIFFTAG_CONSECUTIVEBADFAXLINES.patch
  D    tiff-4.0.3-CVE-2013-1961.patch
  D    erouault.2862.patch
  D    bfriesen.2805.patch
  D    tiff-4.0.3-CVE-2013-4232.patch
  D    tiff-4.0.3-CVE-2013-4244.patch
  D    erouault.2861.patch
  D    erouault.2857.patch
  D    erouault.2856.patch
  D    erouault.2859.patch
  D    tiff-4.0.3-CVE-2012-4564.patch
  D    tiff-4.0.3-tiff2pdf-colors.patch
  D    erouault.2876.patch
  D    erouault.2860.patch
  D    tiff-dither-malloc-check.patch
  D    tiff-4.0.3-CVE-2013-1960.patch
  D    erouault.2858.patch
  D    tiff-handle-TIFFTAG_PREDICTOR.patch
  D    tiff-4.0.3-CVE-2013-4231.patch
  D    tiff-4.0.3-CVE-2013-4243.patch
  D    erouault.2863.patch
  D    tiff-4.0.3-test-jpeg-turbo.patch
* Thu Feb 26 2015 pgajdos@suse.com
- security update: CVE-2014-9655, CVE-2014-8127, CVE-2014-8128,
    CVE-2014-8129, CVE-2014-8130, CVE-2015-1547
    bnc#914890, bnc#916925, bnc#916927
  + erouault.2856.patch
  + erouault.2857.patch
  + erouault.2858.patch
  + erouault.2859.patch
  + erouault.2860.patch
  + erouault.2861.patch
  + erouault.2862.patch
  + erouault.2863.patch
  + erouault.2876.patch
  + bfriesen.2805.patch
  + tiff-handle-TIFFTAG_CONSECUTIVEBADFAXLINES.patch
  + tiff-handle-TIFFTAG_PREDICTOR.patch
  + tiff-dither-malloc-check.patch
* Mon Dec 22 2014 meissner@suse.com
- build with PIE
* Wed Aug 21 2013 pgajdos@suse.com
- security update
  * CVE-2013-4232.patch [bnc#834477]
  * CVE-2013-4231.patch [bnc#834477]
  * CVE-2013-4244.patch [bnc#834788]
  * CVE-2013-4243.patch [bnc#834779]
* Wed Jun 26 2013 pgajdos@suse.com
- tiff2pdf: introduced warning when the compression isn't lzw or
  none [bnc#819142]
- tiff2pdf: fixed crash [bnc#821872]
* Tue Apr 30 2013 pgajdos@suse.com
- security update
  * CVE-2013-1961.patch [bnc#818117]
  * CVE-2013-1960.patch [bnc#817573]
* Fri Apr  5 2013 idonmez@suse.com
- Add Source URL, see https://en.opensuse.org/SourceUrls
* Mon Nov  5 2012 pgajdos@suse.com
- updated to 4.0.3:
  * Add some TIFF/FX support in libtiff.
  * Fix bug rewriting image tiles in a compressed file.
  * Fix read past end of data buffer.
  * etc., see ChangeLog
- removed upstreamed patches:
  * bigendian.patch
  * dont-fancy-upsampling.patch
  * CVE-2012-3401.patch
- new patch:
  * test-jpeg-turbo.patch
  * CVE-2012-4564.patch [bnc#787892]
* Mon Jul 23 2012 pgajdos@suse.com
-  fixed CVE-2012-3401 [bnc#770816]
* Thu Jun 28 2012 meissner@suse.com
- RGBA is packed in host order, use the right macros to unpack
  and verify in raw_decode test.
* Wed Jun 20 2012 pgajdos@suse.com
- updated to 4.0.2: [bnc#767852] [bnc#767854]
    tif_getimage.c: added support for _SEPARATED CMYK images.
    tif_getimage.c: Added support for greyscale + alpha.
    Added TIFFCreateCustomDirectory() and TIFFCreateEXIFDirectory() functions.
    tif_print.c: Lots of fixes around printing corrupt or hostile input.
    Improve handling of corrupt ycbcrsubsampling values.
    tif_unix.c: use strerror to get meaningful error messages.
    tif_jpeg.c: fix serious bugs in JPEGDecodeRaw().
    tif_jpeg.c: Fix size overflow (zdi-can-1221,CVE-2012-1173).
    tiff2pdf: Defend against integer overflows while calculating required
    buffer sizes (CVE-2012-2113).
* Tue Apr 10 2012 brian@aljex.com
- Fix building on older targets from SUSE 10.0 to current.
- Add jbig support
* Thu Mar 29 2012 idonmez@suse.com
- Add lzma support
- Implement %%check
- Drop visibility patch because it breaks compilation
* Wed Mar 28 2012 i@marguerite.su
- change package name libtiff4 to libtiff5.
  library number is 5 actually.
* Wed Mar 28 2012 i@marguerite.su
- Update to 4.0.1
  * configure.ac
  - Add libtiff private dependency on -llzma for pkg-config
  - Add support for using library symbol versioning on
    ELF systems with the GNU linker.
  * libtiff/tif_win32.c: Eliminate some minor 64-bit warnings in
    tif_win32.c
  * libtiff/tif_jpeg.c: Extra caution for case where sp is NULL.
  * libtiff/tif_dir.c, libtiff/tif_dirread.c: Extra caution around
    assumption tag fetching is always successful.
  * libtiff/tiffio.h: Use double-underbar syntax in GCC printf
    attribute specification to lessen the risk of accidental macro
    substitution.
  * Update automake used to 1.11.3.
* Wed Mar 28 2012 cfarrell@suse.com
- license update: HPND
  tiff license most akin to spdx recognised
  http://www.spdx.org/licenses/HPND
* Tue Jan 10 2012 crrodriguez@opensuse.org
- remove libjpeg-devel and zlib-devel from libtiff-devel
  requires as they are _not_ required to use the library.
  Now, this _will_ break packages with wrong buildrequires
  for good.
* Tue Jan 10 2012 crrodriguez@opensuse.org
- Hide private symbols using gcc visibility, this has been
  applied only to functions that the source code clearly states
  that are internal to the library.
- Run spec cleaner
* Wed Nov 23 2011 coolo@suse.com
- add libtool as buildrequire to avoid implicit dependency
* Fri Aug  5 2011 crrodriguez@opensuse.org
- Do not use -fno-strict-aliasing, no longer needed
  and will probably slow down the code.
- Fix self-obsoletion warning
* Thu Apr 14 2011 pgajdos@suse.cz
- updated to 3.9.5:
  * fixed integer overflow CVE-2010-4665
  * fixed buffer overflow in ojpeg decoder
  * upstreamed:
  - oob-read.patch
  - CVE-2011-0192.patch
  - getimage-64bit.patch
  - CVE-2011-1167.patch
  - scanlinesize.patch
* Thu Mar 31 2011 pgajdos@suse.cz
- fixed regression caused by previous update [bnc#682871]
  * modified CVE-2011-0192.patch
- fixed buffer overflow in thunder decoder [bnc#683337]
  * added CVE-2011-1167.patch
* Thu Feb 17 2011 pgajdos@suse.cz
- fixed buffer overflow [bnc#672510]
  * CVE-2011-0192.patch
* Mon Sep  6 2010 pgajdos@suse.cz
- fixed "Possibly exploitable memory corruption issue in libtiff"
  (see http://bugzilla.maptools.org/show_bug.cgi?id=2228)
  [bnc#624215]
  * scanlinesize.patch
- fixed crash while using libjpeg7 and higher
  * dont-fancy-upsampling.patch
* Mon Jul 12 2010 pgajdos@suse.cz
- updated to 3.9.4: fixes CVE-2010-2065 -- obsoletes
  * integer-overflow.patch
  * NULL-deref.patch
- fixes CVE-2010-2067
* Wed Jun 23 2010 pgajdos@suse.cz
- fixed CVE-2010-2065
  * integer-overflow.patch
  * NULL-deref.patch
-  fixed out of bounds read
  * oob-read.patch
-  fixed CVE-2010-2233
  * getimage-64bit.patch
- [bnc#612879]
* Mon Apr 26 2010 pgajdos@suse.cz
- fixed tiff2pdf output [bnc#599475]
* Fri Mar 26 2010 pgajdos@suse.cz
- fixed typo
* Tue Mar 16 2010 pgajdos@suse.cz
- updated to 3.9.2: fixed many CVE's and obsoletes almost all
  our patches (see ChangeLog for details)
* Tue Dec 15 2009 jengelh@medozas.de
- add baselibs.conf as a source
- enable parallel building
* Thu Aug  6 2009 pgajdos@suse.cz
- fixed integer overflows [bnc#519796]
  * CVE-2009-2347.patch
* Thu Jul  2 2009 nadvornik@suse.cz
- fixed lzw overflow CVE-2009-2285 [bnc#518698]
* Wed Feb  4 2009 nadvornik@suse.cz
- fixed an endless loop on invalid images
  (bnc#444079) CVE-2008-1586
* Tue Jan 13 2009 olh@suse.de
- obsolete old libtiff-64bit on ppc64 (bnc#437293)
* Wed Jan  7 2009 olh@suse.de
- obsolete old -XXbit packages (bnc#437293)
* Sun Sep  7 2008 schwab@suse.de
- Fix conflicting options.
* Tue Aug 19 2008 nadvornik@suse.cz
- fixed buffer overflows in LZW code (CVE-2008-2327) [bnc#414946]
* Sun May 18 2008 coolo@suse.de
- fix rename of xxbit packages
* Thu Apr 10 2008 ro@suse.de
- added baselibs.conf file to build xxbit packages
  for multilib support
* Fri Jul 27 2007 ro@suse.de
- add provides and obsoletes for libtiff to libtiff3 package
* Thu Jul 19 2007 nadvornik@suse.cz
- renamed libtiff to libtiff3
- do not package static libraries
- added zlib-devel to BuildRequires
* Mon Jun 12 2006 nadvornik@suse.cz
- fixed a typo in the previous change [#179051]
* Fri Jun  2 2006 nadvornik@suse.cz
- fixed buffer overflow in tiffsplit (CVE-2006-2656) [#179051]
- fixed buffer overflow in tiff2pdf [#179587]
* Wed Apr 12 2006 nadvornik@suse.cz
- updated to 3.8.2 [#165237]
  * bugfix release
  * fixed several segfaults caused by incorrect tiff data
* Tue Feb  7 2006 nadvornik@suse.cz
- fixed crash on certain tiff images CVE-2006-0405 [#145757]
* Wed Jan 25 2006 mls@suse.de
- converted neededforbuild to BuildRequires
* Thu Jan 12 2006 nadvornik@suse.cz
- compile with -fstack-protector
* Tue Jan  3 2006 nadvornik@suse.cz
- updated to 3.8.0:
  * Read-only support for custom directories (e.g. EXIF directory)
  * Preliminary support for MS MDI format
* Mon Oct 10 2005 nadvornik@suse.cz
- built with -fno-strict-aliasing
* Fri Jul 15 2005 nadvornik@suse.cz
- updated to 3.7.3
* Tue May 24 2005 nadvornik@suse.cz
- updated to 3.7.2
- fixed 64bit bug in ppm2tiff [#85440]
- fixed buffer overflow in BitsPerSample [#82787]
* Thu Feb 17 2005 nadvornik@suse.cz
- fixed reading of alpha channel
* Sun Jan 16 2005 ro@suse.de
- added c++ to neededforbuild
* Fri Jan  7 2005 nadvornik@suse.cz
- use typedef int int32 on all architectures
* Wed Jan  5 2005 nadvornik@suse.cz
- disabled c++ API as it would add a dependency on c++ libraries
* Mon Jan  3 2005 nadvornik@suse.cz
- updated to 3.7.1: bugfix release
* Wed Dec 15 2004 nadvornik@suse.cz
- added README.SUSE pointing to the documentation [#48601]
- moved man3 to devel subpackage
* Fri Oct 22 2004 nadvornik@suse.cz
- updated to 3.7.0 - security fixes are included in mainstream
* Wed Oct 20 2004 meissner@suse.de
- Initialize ycbcrsubsampling to be not 0 in case
  of bad tiffs to avoid denial of service by divison/0.
* Tue Oct 12 2004 nadvornik@suse.cz
- do not call TIFFTileSize with uninitialized values [#44635]
* Thu Oct  7 2004 pmladek@suse.cz
- fixed much more buffer overflows (the older tiff-alt-bound-CheckMalloc.patch
  is included in the new libtiff-3.6.1-alt-bound.patch now) [#44635]
* Thu Sep 30 2004 nadvornik@suse.cz
- fixed more buffer overflows [#44635]
* Tue Sep 21 2004 nadvornik@suse.cz
- fixed multiple buffer overflows - CAN-2004-0803 [#44635]
- disabled old jpeg support because of security problems [#45116]
* Tue Aug 31 2004 nadvornik@suse.cz
- added LZW support
* Wed Aug 25 2004 kukuk@suse.de
- Create -devel subpackage
- Add libjpeg-devel to neededforbuild
- Avoid /bin/sh in PreRequires
* Fri Jul  2 2004 max@suse.de
- port.h is needed as well.
* Thu May  6 2004 max@suse.de
- Install private headers (tif_dir.h, tiffiop.h).
* Tue Apr 27 2004 nadvornik@suse.cz
- fixed tif_fax3 from cvs [#39515]
* Mon Feb  9 2004 nadvornik@suse.cz
- updated to 3.6.1
- fixed dangerous compiler warnings
* Sat Jan 10 2004 adrian@suse.de
- add %%defattr and %%run_ldconfig
* Tue May 20 2003 ro@suse.de
- remove cvs subdirs
* Sat Jul 27 2002 kukuk@suse.de
- Provide libtiff-devel in libtiff [Bug #17260]
* Fri Jul 26 2002 adrian@suse.de
- fix neededforbuild
* Wed Jul  3 2002 nadvornik@suse.cz
- fixed segfault in fax2tiff [bug #16818]
- fixed size of int32 on 64bit architectures
* Tue Jun 25 2002 ro@suse.de
- fixed directory permissions
* Wed Jun 19 2002 nadvornik@suse.cz
- compiled with OJPEG_SUPPORT [bug #16408]
* Thu Apr 18 2002 kukuk@suse.de
- Fix to compile on lib64 architectures
* Wed Feb  6 2002 coolo@suse.de
- use %%_libdir
* Thu Jan 24 2002 okir@suse.de
- Fixed a tempfile race in fax2ps
* Tue Dec 11 2001 nadvornik@suse.cz
- updated to 3.5.7: bugfix release
* Wed May  9 2001 mfabian@suse.de
- bzip2 sources
* Thu Mar 15 2001 schwab@suse.de
- Fix for ia64.
* Fri May 26 2000 bubnikv@suse.cz
- sorted
* Thu May 25 2000 schwab@suse.de
- Fix dso configure check for ia64.
* Thu May 11 2000 nadvornik@suse.cz
- update to 3.5.5
- added BuildRoot
* Tue Jan 25 2000 ro@suse.de
- manpages to /usr/share using macro
* Mon Jan  3 2000 schwab@suse.de
- Update to 3.5.4 (Y2K fix)
* Mon Sep 13 1999 bs@suse.de
- ran old prepare_spec on spec file to switch to new prepare_spec.
* Wed Jan 13 1999 ro@suse.de
- respect systems where libc is libc.so.6.1 (alpha)
* Wed Nov 25 1998 ro@suse.de
- update to 3.4 (final) named 3.4.final for rpm
- moved from /usr/X11R6 to /usr
* Wed Jul 29 1998 werner@suse.de
- Link shared libs explicit with -lc
* Tue May 12 1998 ro@suse.de
- extracted package from libgr / build from own sources