libtiff: fix CVE-2016-3186

libtiff/PKGBUILD

@@ -1,6 +1,6 @@
 pkgname=libtiff
 pkgver=4.0.6
-pkgrel=1
+pkgrel=2
 pkgdesc='Library for manipulation of TIFF images'
 arch=('x86_64')
 url="http://www.remotesensing.org/libtiff/"
@@ -8,9 +8,15 @@ license=('custom')
 depends=('libjpeg-turbo' 'zlib' 'xz')
 makedepends=('freeglut' 'glu' 'mesa' 'jbigkit')
 optdepends=('freeglut: for using tiffgt')
-options=('!libtool')
-source=("ftp://ftp.remotesensing.org/pub/libtiff/tiff-${pkgver}.tar.gz")
-sha1sums=('280e27704eaca5f592b82e71ac0c78b87395e2de')
+source=("ftp://ftp.remotesensing.org/pub/libtiff/tiff-${pkgver}.tar.gz"
+        'tiff-4.0.6-buffer-overflow.patch')
+sha1sums=('280e27704eaca5f592b82e71ac0c78b87395e2de'
+          '3fecfb52f78e1798439707210bdc352b2b710860')
+
+prepare() {
+   cd tiff-${pkgver}
+   patch -Np1 -i ${srcdir}/tiff-4.0.6-buffer-overflow.patch
+}
 
 build() {
     cd tiff-${pkgver}

libtiff/tiff-4.0.6-buffer-overflow.patch

@@ -0,0 +1,11 @@
+--- tiff-4.0.6/tools/gif2tiff.c	2016-04-06 15:43:01.586048341 +0200
++++ tiff-4.0.6/tools/gif2tiff.c	2016-04-06 15:48:05.523207710 +0200
+@@ -349,7 +349,7 @@
+     int status = 1;
+ 
+     (void) getc(infile);
+-    while ((count = getc(infile)) && count <= 255)
++    while ((count = getc(infile)) && count >= 0 && count <= 255)
+         if (fread(buf, 1, count, infile) != (size_t) count) {
+             fprintf(stderr, "short read from file %s (%s)\n",
+                     filename, strerror(errno));