From bf18393ed339d43bd5433e9a9386e4aaefe2a49e Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Mon, 30 Jan 2023 22:03:18 +0100
Subject: [PATCH] libtiff: add patch for CVE-2022-48281

Upstream issue:
https://gitlab.com/libtiff/libtiff/-/issues/488
---
 .../libraries/libtiff/4.4.0-CVE-2022-48281.patch | 16 ++++++++++++++++
 pkgs/development/libraries/libtiff/default.nix   |  1 +
 2 files changed, 17 insertions(+)
 create mode 100644 pkgs/development/libraries/libtiff/4.4.0-CVE-2022-48281.patch

diff --git a/pkgs/development/libraries/libtiff/4.4.0-CVE-2022-48281.patch b/pkgs/development/libraries/libtiff/4.4.0-CVE-2022-48281.patch
new file mode 100644
index 000000000000..53a885fd0a25
--- /dev/null
+++ b/pkgs/development/libraries/libtiff/4.4.0-CVE-2022-48281.patch
@@ -0,0 +1,16 @@
+Based on upstream d1b6b9c1b3cae2d9e37754506c1ad8f4f7b646b5, adjusted for
+formatting differences in 4.4.0
+
+diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
+index 5ebb30ae..698fb1cb 100644
+--- a/tools/tiffcrop.c
++++ b/tools/tiffcrop.c
+@@ -7735,7 +7735,7 @@ processCropSelections(struct image_data *image, struct crop_mask *crop,
+         crop_buff = (unsigned char *)limitMalloc(cropsize + NUM_BUFF_OVERSIZE_BYTES);
+       else
+         {
+-        prev_cropsize = seg_buffs[0].size;
++        prev_cropsize = seg_buffs[i].size;
+         if (prev_cropsize < cropsize)
+           {
+           next_buff = _TIFFrealloc(crop_buff, cropsize + NUM_BUFF_OVERSIZE_BYTES);
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 579abd2c7661..45a4681f05bb 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be.patch";
       sha256 = "sha256-pgItgS+UhMjoSjkDJH5y7iGFZ+yxWKqlL7BdT2mFcH0=";
     })
+    ./4.4.0-CVE-2022-48281.patch
   ];
 
   postPatch = ''