kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Patch for CVE-2019-12973

Browse source
This commit is contained in:
sevan 2020-01-07 20:19:45 +00:00
parent eada88da55
commit fd8ce7cdfa
3 changed files with 81 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
graphics/openjpeg/Makefile
View file

@ -1,7 +1,7 @@
# $NetBSD: Makefile,v 1.18 2019/11/26 23:10:22 sevan Exp $
# $NetBSD: Makefile,v 1.19 2020/01/07 20:19:45 sevan Exp $
DISTNAME= openjpeg-2.3.1
PKGREVISION= 1
PKGREVISION= 2
CATEGORIES= graphics
MASTER_SITES= ${MASTER_SITE_GITHUB:=uclouvain/}
GITHUB_TAG= v${PKGVERSION_NOREV}

3
graphics/openjpeg/distinfo
View file

@ -1,4 +1,4 @@
$NetBSD: distinfo,v 1.16 2019/11/26 23:24:25 sevan Exp $
$NetBSD: distinfo,v 1.17 2020/01/07 20:19:45 sevan Exp $
SHA1 (openjpeg-2.3.1.tar.gz) = 38321fa9730252039ad0b7f247a160a8164f5871
RMD160 (openjpeg-2.3.1.tar.gz) = 31b75aa70f5d26dd1b7e374a9e4b6be1842fefe7
@ -6,6 +6,7 @@ SHA512 (openjpeg-2.3.1.tar.gz) = 339fbc899bddf2393d214df71ed5d6070a3a76b933b1e75
Size (openjpeg-2.3.1.tar.gz) = 2214401 bytes
SHA1 (patch-CMakeLists.txt) = 3738946db63df4d623c6ce486bd22fa4d57336e2
SHA1 (patch-src_bin_jp2_CMakeLists.txt) = c9f709c23d6bab7a3c705640d66a00ec90ddabc7
SHA1 (patch-src_bin_jp2_convertbmp.c) = bceb4a99820568386e48eb00ab13ab9987d1e86a
SHA1 (patch-src_lib_openjp2_CMakeLists.txt) = d839121ec2d008e5d3e1676d3e7ac3642bc946f7
SHA1 (patch-src_lib_openjp2_opj__config__private.h.cmake.in) = fc0c170789dbe0a2ebc9dce0ef0d21aa6b2edd49
SHA1 (patch-src_lib_openmj2_t2.c) = a4ce0faa349f1a23453ef7632fbcc3af2d045337

77
graphics/openjpeg/patches/patch-src_bin_jp2_convertbmp.c Normal file
View file

@ -0,0 +1,77 @@
$NetBSD: patch-src_bin_jp2_convertbmp.c,v 1.1 2020/01/07 20:19:46 sevan Exp $
CVE-2019-12973
https://github.com/uclouvain/openjpeg/pull/1185
https://nvd.nist.gov/vuln/detail/CVE-2019-12973
--- src/bin/jp2/convertbmp.c.orig 2020-01-07 11:06:41.960834648 +0000
+++ src/bin/jp2/convertbmp.c
@@ -632,12 +632,18 @@ static OPJ_BOOL bmp_read_rle4_data(FILE*
while (y < height) {
int c = getc(IN);
if (c == EOF) {
- break;
+ return OPJ_FALSE;
}
if (c) { /* encoded mode */
- int j;
- OPJ_UINT8 c1 = (OPJ_UINT8)getc(IN);
+ int j, c1_int;
+ OPJ_UINT8 c1;
+
+ c1_int = getc(IN);
+ if (c1_int == EOF) {
+ return OPJ_FALSE;
+ }
+ c1 = (OPJ_UINT8)c1_int;
for (j = 0; (j < c) && (x < width) &&
((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
@@ -646,7 +652,7 @@ static OPJ_BOOL bmp_read_rle4_data(FILE*
} else { /* absolute mode */
c = getc(IN);
if (c == EOF) {
- break;
+ return OPJ_FALSE;
}
if (c == 0x00) { /* EOL */
@@ -657,8 +663,14 @@ static OPJ_BOOL bmp_read_rle4_data(FILE*
break;
} else if (c == 0x02) { /* MOVE by dxdy */
c = getc(IN);
+ if (c == EOF) {
+ return OPJ_FALSE;
+ }
x += (OPJ_UINT32)c;
c = getc(IN);
+ if (c == EOF) {
+ return OPJ_FALSE;
+ }
y += (OPJ_UINT32)c;
pix = pData + y * stride + x;
} else { /* 03 .. 255 : absolute mode */
@@ -668,12 +680,20 @@ static OPJ_BOOL bmp_read_rle4_data(FILE*
for (j = 0; (j < c) && (x < width) &&
((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
if ((j & 1) == 0) {
- c1 = (OPJ_UINT8)getc(IN);
+ int c1_int;
+ c1_int = getc(IN);
+ if (c1_int == EOF) {
+ return OPJ_FALSE;
+ }
+ c1 = (OPJ_UINT8)c1_int;
}
*pix = (OPJ_UINT8)((j & 1) ? (c1 & 0x0fU) : ((c1 >> 4) & 0x0fU));
}
if (((c & 3) == 1) || ((c & 3) == 2)) { /* skip padding byte */
- getc(IN);
+ c = getc(IN);
+ if (c == EOF) {
+ return OPJ_FALSE;
+ }
}
}
}