From 4d28af5fe61b1760f10981f5072ff1e6fd44f210 Mon Sep 17 00:00:00 2001
From: Lee Howard <faxguy@howardsilvan.com>
Date: Fri, 5 Sep 2025 21:44:49 +0000
Subject: [PATCH] tiffcrop: avoid nullptr dereference

Fixes #734

CVE: CVE-2025-61143
Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/4d28af5fe61b1760f10981f5072ff1e6fd44f210]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 tools/tiffcrop.c   | 2 +-
 tools/tiffdither.c | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index ae414efc..1cbb49b6 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -2561,7 +2561,7 @@ main(int argc, char* argv[])
 
     if (dump.outfile != NULL)
       {
-      dump_info (dump.outfile, dump.format, "", "Completed run for %s", TIFFFileName(out));
+      dump_info (dump.outfile, dump.format, "", "Completed run for %s", out ? TIFFFileName(out) : "(not opened)");
       fclose (dump.outfile);
       }
     }
diff --git a/tools/tiffdither.c b/tools/tiffdither.c
index 3c64fdc0..405527c7 100644
--- a/tools/tiffdither.c
+++ b/tools/tiffdither.c
@@ -84,6 +84,11 @@ fsdither(TIFF* in, TIFF* out)
 	    fprintf(stderr, "Out of memory.\n");
 	    goto skip_on_error;
 	}
+	if (imagewidth > TIFFScanlineSize(in))
+	{
+	    fprintf(stderr, "Image width exceeds scanline size.\n");
+	    goto skip_on_error;
+	}
 
 	/*
 	 * Get first line
