Patches applied

2 files changed, 41 insertions, 10 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 3546338a32de..87bd37052243 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,7 +1,7 @@
 pkgbase = libtiff-lerc
 	pkgdesc = Library for manipulation of TIFF images
 	pkgver = 4.4.0
-	pkgrel = 1
+	pkgrel = 2
 	url = http://www.simplesystems.org/libtiff/
 	arch = x86_64
 	license = custom
@@ -10,18 +10,23 @@ pkgbase = libtiff-lerc
 	makedepends = mesa
 	makedepends = jbigkit
 	depends = glibc
-	depends = libjpeg
+	depends = libjpeg-turbo
 	depends = libjpeg.so
 	depends = zlib
 	depends = xz
 	depends = zstd
 	depends = lerc
 	optdepends = freeglut: for using tiffgt
-	provides = libtiff=4.3.0
+	provides = libtiff=4.4.0
 	provides = libtiff.so
 	provides = libtiffxx.so
 	conflicts = libtiff
+	options = debug
 	source = https://download.osgeo.org/libtiff/tiff-4.4.0.tar.gz
+	source = libtiff-lerc-4.4.0-fpe_tiffcrop.patch::https://gitlab.com/libtiff/libtiff/-/commit/dd1bcc7abb26094e93636e85520f0d8f81ab0fab.patch
+	source = libtiff-lerc-4.4.0-CVE-2022-34526.patch::https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990.patch
 	sha256sums = 917223b37538959aca3b790d2d73aa6e626b688e02dcda272aec24c2f498abed
+	sha256sums = 049875c6eddef8d0d653ad069fea7483f7b9b1dc2aad8780784301fb3e34b561
+	sha256sums = 10220d1eecc00f830a1814c0b74388e68c4f0a38ec173038d6e5e8a6ad3cc97f
 
 pkgname = libtiff-lerc
diff --git a/PKGBUILD b/PKGBUILD
index 1a0c62e199be..34e1600b9d97 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -4,25 +4,51 @@
 
 pkgname=libtiff-lerc
 pkgver=4.4.0
-pkgrel=1
+pkgrel=2
 pkgdesc='Library for manipulation of TIFF images'
 url='http://www.simplesystems.org/libtiff/'
 arch=('x86_64')
 license=('custom')
-depends=('glibc' 'libjpeg' 'libjpeg.so' 'zlib' 'xz' 'zstd' 'lerc')
+depends=('glibc' 'libjpeg-turbo' 'libjpeg.so' 'zlib' 'xz' 'zstd' 'lerc')
 makedepends=('freeglut' 'glu' 'mesa' 'jbigkit')
 optdepends=('freeglut: for using tiffgt')
-provides=('libtiff=4.3.0' 'libtiff.so' 'libtiffxx.so')
+provides=('libtiff=4.4.0' 'libtiff.so' 'libtiffxx.so')
 conflicts=('libtiff')
-source=(https://download.osgeo.org/libtiff/tiff-${pkgver}.tar.gz)
-sha256sums=('917223b37538959aca3b790d2d73aa6e626b688e02dcda272aec24c2f498abed')
+options=(debug)
+source=(
+  https://download.osgeo.org/libtiff/tiff-${pkgver}.tar.gz
+  # fix CVE-2022-2056 / CVE-2022-2057 / CVE-2022-2058: https://bugs.archlinux.org/task/75360
+  $pkgname-4.4.0-fpe_tiffcrop.patch::https://gitlab.com/libtiff/libtiff/-/commit/dd1bcc7abb26094e93636e85520f0d8f81ab0fab.patch
+  # fix CVE-2022-34526: https://bugs.archlinux.org/task/75608
+  $pkgname-4.4.0-CVE-2022-34526.patch::https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990.patch
+)
+sha256sums=(
+            '917223b37538959aca3b790d2d73aa6e626b688e02dcda272aec24c2f498abed'
+            '049875c6eddef8d0d653ad069fea7483f7b9b1dc2aad8780784301fb3e34b561'
+            '10220d1eecc00f830a1814c0b74388e68c4f0a38ec173038d6e5e8a6ad3cc97f'
+)
+
+prepare() {
+  cd tiff-${pkgver}
+  # apply patch from the source array (should be a pacman feature)
+  local src
+  for src in "${source[@]}"; do
+    src="${src%%::*}"
+    src="${src##*/}"
+    [[ $src = *.patch ]] || continue
+    echo "Applying patch $src..."
+    patch -Np1 < "../$src"
+  done
+}
+
 
 build() {
   cd tiff-${pkgver}
   ./configure \
     --prefix=/usr \
-	  --sysconfdir=/etc \
-	  --mandir=/usr/share/man \
+    --sysconfdir=/etc \
+    --enable-ld-version-script \
+    --mandir=/usr/share/man \
     --with-docdir=/usr/share/doc/${pkgname}
   sed -i -e 's/ -shared / -Wl,-O1,--as-needed\0/g' libtool
   make