rpms/exempi
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2020-18652

Browse Source 
Resolves: RHEL-5416
This commit is contained in:
Matej Mužila 2024-01-08 19:21:44 +01:00
parent 3d458b0bde
commit c16215f843
2 changed files with 45 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
0002-CVE-20220-18652-Bug-12-Invalid-WebP-cause-memory-ove.patch Normal file
View File

@ -0,0 +1,38 @@
From a3b1e52e5a5836fe1fd07013a2a098518b1801de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hubert=20Figui=C3=A8re?= <hub@figuiere.net>
Date: Sat, 27 Jul 2019 20:42:51 -0400
Subject: [PATCH] (CVE-20220-18652) Bug #12 - Invalid WebP cause memory
overflow.
https://gitlab.freedesktop.org/libopenraw/exempi/issues/12
(cherry picked from commit acee2894ceb91616543927c2a6e45050c60f98f7)
---
XMPFiles/source/FormatSupport/WEBP_Support.cpp | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/XMPFiles/source/FormatSupport/WEBP_Support.cpp b/XMPFiles/source/FormatSupport/WEBP_Support.cpp
index ffaf220..0d4b81d 100644
--- a/XMPFiles/source/FormatSupport/WEBP_Support.cpp
+++ b/XMPFiles/source/FormatSupport/WEBP_Support.cpp
@@ -120,10 +120,16 @@ VP8XChunk::VP8XChunk(Container* parent)
this->data.assign(this->size, 0);
XMP_Uns8* bitstream =
(XMP_Uns8*)parent->chunks[WEBP_CHUNK_IMAGE][0]->data.data();
+ XMP_Uns32 width = 0;
+ XMP_Uns32 height = 0;
// See bug https://bugs.freedesktop.org/show_bug.cgi?id=105247
// bitstream could be NULL.
- XMP_Uns32 width = bitstream ? ((bitstream[7] << 8) | bitstream[6]) & 0x3fff : 0;
- XMP_Uns32 height = bitstream ? ((bitstream[9] << 8) | bitstream[8]) & 0x3fff : 0;
+ // See bug https://gitlab.freedesktop.org/libopenraw/exempi/issues/12
+ // image chunk data could be too short (must be 10)
+ if (parent->chunks[WEBP_CHUNK_IMAGE][0]->data.size() >= 10 && bitstream) {
+ width = ((bitstream[7] << 8) | bitstream[6]) & 0x3fff;
+ height = ((bitstream[9] << 8) | bitstream[8]) & 0x3fff;
+ }
this->width(width);
this->height(height);
parent->vp8x = this;
--
2.41.0

8
exempi.spec
View File

@ -1,13 +1,14 @@
Summary: Library for easy parsing of XMP metadata
Name: exempi
Version: 2.4.5
Release: 3%{?dist}
Release: 4%{?dist}
License: BSD
Group: System Environment/Libraries
URL: http://libopenraw.freedesktop.org/wiki/Exempi
Source0: http://libopenraw.freedesktop.org/download/%{name}-%{version}.tar.bz2
Patch0: CVE-2018-12648.patch
Patch0001: 0001-CVE-2020-18651-Issue-13-Fix-a-buffer-a-overflow-in-I.patch
Patch0002: 0002-CVE-20220-18652-Bug-12-Invalid-WebP-cause-memory-ove.patch
BuildRequires: gcc-c++
BuildRequires: boost-devel expat-devel zlib-devel pkgconfig
# Work around for aarch64 support (https://bugzilla.redhat.com/show_bug.cgi?id=925327)
@ -33,6 +34,7 @@ developing with exempi.
%setup -q
%patch0 -p1
%patch1 -p1
%patch2 -p1
%build
libtoolize -vi
@ -71,6 +73,10 @@ rm -rf %{buildroot}%{_libdir}/*.a
%{_libdir}/pkgconfig/*.pc
%changelog
* Mon Jan 08 2024 Matej Mužila <mmuzila@redhat.com> - 2.4.5-4
- Fix CVE-2020-18652
- Resolves: RHEL-5416
* Mon Jan 08 2024 Matej Mužila <mmuzila@redhat.com> - 2.4.5-3
- Fix CVE-2020-18651
- Resolves: RHEL-5415