From 0ac97aa7a5bffddd88f7cdbe517264e9db3f5bd5 Mon Sep 17 00:00:00 2001
From: Lee Howard <faxguy@howardsilvan.com>
Date: Fri, 5 Sep 2025 21:42:35 +0000
Subject: [PATCH] tiffcrop: fix double-free and memory leak exposed by issue
 #721

Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/0ac97aa7a5bffddd88f7cdbe517264e9db3f5bd5]
CVE: CVE-2025-8961
CVE: CVE-2025-61145
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 tools/tiffcrop.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index e16bc2d..c7d2553 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -929,6 +929,7 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf,
 		      TIFFError("readContigTilesIntoBuffer",
                                 "Unable to extract row %"PRIu32" from tile %"PRIu32,
 				row, TIFFCurrentTile(in));
+		      _TIFFfree(tilebuf);
 		      return 1;
 		      }
 		    break;
@@ -943,6 +944,7 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf,
 		        TIFFError("readContigTilesIntoBuffer",
                                   "Unable to extract row %"PRIu32" from tile %"PRIu32,
 				  row, TIFFCurrentTile(in));
+		        _TIFFfree(tilebuf);
 		        return 1;
 		        }
 		      break;
@@ -957,6 +959,7 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf,
 		        TIFFError("readContigTilesIntoBuffer",
                                   "Unable to extract row %"PRIu32" from tile %"PRIu32,
 			  	  row, TIFFCurrentTile(in));
+		        _TIFFfree(tilebuf);
 		        return 1;
 		        }
 	            break;
@@ -969,6 +972,7 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf,
 		      TIFFError("readContigTilesIntoBuffer",
                                 "Unable to extract row %"PRIu32" from tile %"PRIu32,
 		  	        row, TIFFCurrentTile(in));
+		      _TIFFfree(tilebuf);
 		      return 1;
 		      }
 		    break;
@@ -983,10 +987,12 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf,
 		      TIFFError("readContigTilesIntoBuffer",
                                 "Unable to extract row %"PRIu32" from tile %"PRIu32,
 			        row, TIFFCurrentTile(in));
+		      _TIFFfree(tilebuf);
 		      return 1;
 		      }
 		    break;
             default: TIFFError("readContigTilesIntoBuffer", "Unsupported bit depth %"PRIu16, bps);
+		     _TIFFfree(tilebuf);
 		     return 1;
 	    }
           }
@@ -2535,7 +2541,7 @@ main(int argc, char* argv[])
     }
 
   /* If we did not use the read buffer as the crop buffer */
-  if (read_buff)
+  if (read_buff && read_buff != crop_buff)
     _TIFFfree(read_buff);
 
   if (crop_buff)
-- 
2.25.1

