rpms
/
compat-exiv2-026
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import compat-exiv2-026-0.26-6.el8

This commit is contained in:
CentOS Sources 2021-08-24 22:24:45 +00:00 committed by Andrew Lukoshko
parent f9f5ffbbaf
commit 8f92e14f18
3 changed files with 78 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
SOURCES/exiv2-CVE-2021-37618.patch Normal file
View File

@ -0,0 +1,37 @@
From dbf472751fc8b87ea7d1de02f54eaf64233a2fb6 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Mon, 5 Jul 2021 10:40:03 +0100
Subject: [PATCH 2/2] Better bounds checking in Jp2Image::printStructure
---
src/jp2image.cpp | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/jp2image.cpp b/src/jp2image.cpp
index 43c93d7..a8c37e8 100644
--- a/src/jp2image.cpp
+++ b/src/jp2image.cpp
@@ -42,6 +42,7 @@ EXIV2_RCSID("@(#) $Id$")
#include "futils.hpp"
#include "types.hpp"
#include "safe_op.hpp"
+#include "enforce.hpp"
// + standard includes
#include <string>
@@ -511,6 +512,7 @@ namespace Exiv2
if(subBox.type == kJp2BoxTypeColorHeader)
{
long pad = 3 ; // don't know why there are 3 padding bytes
+ enforce(data.size_ >= pad, kerCorruptedMetadata);
if ( bPrint ) {
out << " | pad:" ;
for ( int i = 0 ; i < 3 ; i++ ) out<< " " << (int) data.pData_[i];
@@ -521,6 +523,7 @@ namespace Exiv2
}
DataBuf icc(iccLength);
+ enforce(iccLength <= data.size_ - pad, kerCorruptedMetadata);
if ( bICC ) out.write((const char*)icc.pData_,icc.size_);
}
lf(out,bLF);

30
SOURCES/exiv2-CVE-2021-37619.patch Normal file
View File

@ -0,0 +1,30 @@
From 9be257340193dbe3fb810aa33531c40ae9df6414 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Wed, 30 Jun 2021 16:47:50 +0100
Subject: [PATCH 2/2] Fix incorrect loop condition.
---
src/jp2image.cpp | 6 ++++--
.../bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py | 11 +++++------
2 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/src/jp2image.cpp b/src/jp2image.cpp
index 2cd0a89..58ad5c6 100644
--- a/src/jp2image.cpp
+++ b/src/jp2image.cpp
@@ -619,11 +619,13 @@ namespace Exiv2
char* p = (char*) boxBuf.pData_;
bool bWroteColor = false ;
- while ( count < length || !bWroteColor ) {
+ while ( count < length && !bWroteColor ) {
Jp2BoxHeader* pSubBox = (Jp2BoxHeader*) (p+count) ;
// copy data. pointer could be into a memory mapped file which we will decode!
- Jp2BoxHeader subBox = *pSubBox ;
+ // pSubBox isn't always an aligned pointer, so use memcpy to do the copy.
+ Jp2BoxHeader subBox;
+ memcpy(&subBox, pSubBox, sizeof(Jp2BoxHeader));
Jp2BoxHeader newBox = subBox;
if ( count < length ) {

13
SPECS/compat-exiv2-026.spec
View File

@ -1,6 +1,6 @@
Name: compat-exiv2-026
Version: 0.26
Release: 5%{?dist}
Release: 6%{?dist}
Summary: Compatibility package with the exiv2 library in version 0.26
License: GPLv2+
@ -34,6 +34,8 @@ Patch26: exiv2-CVE-2018-8977.patch
Patch27: exiv2-CVE-2018-16336.patch
Patch28: exiv2-CVE-2021-31291.patch
Patch29: exiv2-CVE-2021-31292.patch
Patch30: exiv2-CVE-2021-37618.patch
Patch31: exiv2-CVE-2021-37619.patch
## upstreamable patches
@ -98,7 +100,14 @@ rm -rf mv %{buildroot}%{_libdir}/libexiv2.so
%changelog
* Thu Aug 05 2021 Jan Grulich <jgrulich@redhat.com> - 0.26-11
* Wed Aug 18 2021 Jan Grulich <jgrulich@redhat.com> - 0.26-6
- Fix out-of-bounds read in Exiv2::Jp2Image::printStructure
Resolves: bz#1993283
- Fix out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header
Resolves: bz#1993246
* Thu Aug 05 2021 Jan Grulich <jgrulich@redhat.com> - 0.26-4
- Fix heap-based buffer overflow vulnerability in jp2image.cpp that may lead to DoS
Resolves: bz#1990398