tiff: patch CVE-2025-9165

Pick commit mentioned in NVD report.

(From OE-Core rev: af4a1f0140fc7739b1bd6e39be1df28681628312)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>

1 files changed, 29 insertions, 0 deletions

diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2025-9165.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2025-9165.patch
new file mode 100644
index 0000000000..560229284c
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2025-9165.patch
@@ -0,0 +1,29 @@
+From ed141286a37f6e5ddafb5069347ff5d587e7a4e0 Mon Sep 17 00:00:00 2001
+From: Su_Laus <sulau@freenet.de>
+Date: Fri, 8 Aug 2025 21:35:30 +0200
+Subject: [PATCH] tiffcmp: fix memory leak when second file cannot be opened.
+
+Closes #728, #729
+
+CVE: CVE-2025-9165
+Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/ed141286a37f6e5ddafb5069347ff5d587e7a4e0]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ tools/tiffcmp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/tiffcmp.c b/tools/tiffcmp.c
+index 529c1cdc..88d9470f 100644
+--- a/tools/tiffcmp.c
++++ b/tools/tiffcmp.c
+@@ -105,7 +105,10 @@ int main(int argc, char *argv[])
+         return (2);
+     tif2 = TIFFOpen(argv[optind + 1], "r");
+     if (tif2 == NULL)
++    {
++        TIFFClose(tif1);
+         return (2);
++    }
+     dirnum = 0;
+     while (tiffcmp(tif1, tif2))
+     {