packages/openjpeg2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!111 fix CVE-2021-3575

Browse Source 
From: @zppzhangpan 
Reviewed-by: @t_feng 
Signed-off-by: @t_feng
This commit is contained in:
openeuler-ci-bot 2024-10-31 09:23:36 +00:00 committed by Gitee
commit 8224414333
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
3 changed files with 49 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
backport-CVE-2021-3575.patch Normal file
View File

@ -0,0 +1,43 @@
From 7bd884f8750892de4f50bf4642fcfbe7011c6bdf Mon Sep 17 00:00:00 2001
From: Even Rouault <even.rouault@spatialys.com>
Date: Sun, 18 Feb 2024 17:02:25 +0100
Subject: [PATCH] opj_decompress: fix off-by-one read heap-buffer-overflow in
sycc420_to_rgb() when x0 and y0 are odd (CVE-2021-3575, fixes #1347)
Reference:https://github.com/uclouvain/openjpeg/commit/7bd884f8750892de4f50bf4642fcfbe7011c6bdf
Conflict:NA
---
src/bin/common/color.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/src/bin/common/color.c b/src/bin/common/color.c
index 27f15f137..ae5d648da 100644
--- a/src/bin/common/color.c
+++ b/src/bin/common/color.c
@@ -358,7 +358,15 @@ static void sycc420_to_rgb(opj_image_t *img)
if (i < loopmaxh) {
size_t j;
- for (j = 0U; j < (maxw & ~(size_t)1U); j += 2U) {
+ if (offx > 0U) {
+ sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b);
+ ++y;
+ ++r;
+ ++g;
+ ++b;
+ }
+
+ for (j = 0U; j < (loopmaxw & ~(size_t)1U); j += 2U) {
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++y;
@@ -375,7 +383,7 @@ static void sycc420_to_rgb(opj_image_t *img)
++cb;
++cr;
}
- if (j < maxw) {
+ if (j < loopmaxw) {
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
}
}

22
heap-buffer-overflow.patch
View File

@ -1,22 +0,0 @@
diff -rupN --no-dereference openjpeg-2.4.0/src/bin/common/color.c openjpeg-2.4.0-new/src/bin/common/color.c
--- openjpeg-2.4.0/src/bin/common/color.c 2020-12-28 21:59:39.000000000 +0100
+++ openjpeg-2.4.0-new/src/bin/common/color.c 2021-05-27 23:46:46.961130438 +0200
@@ -368,12 +368,15 @@ static void sycc420_to_rgb(opj_image_t *
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
- ++y;
+ if (*y != img->comps[0].data[loopmaxh])
+ ++y;
++r;
++g;
++b;
- ++cb;
- ++cr;
+ if (*cb != img->comps[1].data[loopmaxh])
+ ++cb;
+ if (*cr != img->comps[2].data[loopmaxh])
+ ++cr;
}
if (j < maxw) {
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);

9
openjpeg2.spec
View File

@ -2,15 +2,15 @@
Name: openjpeg2
Version: 2.5.0
Release: 4
Release: 5
Summary: C-Library for JPEG 2000
License: BSD and MIT
URL: https://github.com/uclouvain/openjpeg
Source0: https://github.com/uclouvain/openjpeg/archive/v%{version}/openjpeg-%{version}.tar.gz
Patch0: openjpeg2_opj2.patch
Patch1: heap-buffer-overflow.patch
Patch2: backport-CVE-2023-39328.patch
Patch1: backport-CVE-2023-39328.patch
Patch2: backport-CVE-2021-3575.patch
BuildRequires: cmake gcc-c++ make zlib-devel libpng-devel libtiff-devel lcms2-devel doxygen java-devel
BuildRequires: jbigkit-devel libjpeg-turbo-devel
@ -101,6 +101,9 @@ mv %{buildroot}%{_mandir}/man1/opj_dump.1 %{buildroot}%{_mandir}/man1/opj2_dump.
%{_bindir}/opj2_dump
%changelog
* Tue Oct 29 2024 zhangpan <zhangpan103@h-partners.com> - 2.5.0-5
- fix CVE-2021-3575
* Thu Jul 11 2024 xinghe <xinghe2@h-partners.com> - 2.5.0-4
- Type:cves
- ID:CVE-2023-39328