rpms/exempi
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

merge into: rpms:c10s
Branches Tags
rpms:c8
rpms:c10s
rpms:c8-beta
rpms:c8s
rpms:c9
rpms:c9-beta
rpms:c9s
rpms:imports/c10s/exempi-2.6.4-7.el10
rpms:imports/c10s/exempi-2.6.4-6.el10
rpms:imports/c8/exempi-2.4.5-4.el8
rpms:imports/c9/exempi-2.6.0-0.2.20211007gite23c213.el9
rpms:imports/c9-beta/exempi-2.6.0-0.2.20211007gite23c213.el9
rpms:imports/c9-beta/exempi-2.5.1-8.el9
rpms:imports/c8-beta/exempi-2.4.5-2.el8
rpms:imports/c8/exempi-2.4.5-2.el8
...
pull from: rpms:c8
Branches Tags
rpms:c10s
rpms:c8
rpms:c8-beta
rpms:c8s
rpms:c9
rpms:c9-beta
rpms:c9s
rpms:imports/c10s/exempi-2.6.4-7.el10
rpms:imports/c10s/exempi-2.6.4-6.el10
rpms:imports/c8/exempi-2.4.5-4.el8
rpms:imports/c9/exempi-2.6.0-0.2.20211007gite23c213.el9
rpms:imports/c9-beta/exempi-2.6.0-0.2.20211007gite23c213.el9
rpms:imports/c9-beta/exempi-2.5.1-8.el9
rpms:imports/c8-beta/exempi-2.4.5-2.el8
rpms:imports/c8/exempi-2.4.5-2.el8

No commits in common. "c10s" and "c8" have entirely different histories.
c10s ... c8

6 changed files with 154 additions and 125 deletions
Show Stats Expand all files Collapse all files

17
.gitignore vendored
View File

@ -1,16 +1 @@
exempi-2.1.1.tar.gz SOURCES/exempi-2.4.5.tar.bz2
/exempi-2.2.0.tar.bz2
/exempi-2.2.1.tar.bz2
/exempi-2.3.0.tar.bz2
/exempi-2.4.0.tar.bz2
/exempi-2.4.1.tar.bz2
/exempi-2.4.2.tar.bz2
/exempi-2.4.4.tar.bz2
/exempi-2.4.5.tar.bz2
/exempi-2.5.1.tar.bz2
/exempi-2062d44dadbc603524ed0ffdb752070455b7e7fa.tar.bz2
/exempi-e23c21380f467f1f1c9dc397e0a08405fb4afa7a.tar.bz2
/exempi-2.6.1.tar.bz2
/exempi-2.6.2.tar.bz2
/exempi-2.6.3.tar.bz2
/exempi-2.6.4.tar.bz2

41
SOURCES/0001-CVE-2020-18651-Issue-13-Fix-a-buffer-a-overflow-in-I.patch Normal file
View File

@ -0,0 +1,41 @@
From 4f583ff12989f7cea1f81bd2751c321030f1bdbf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hubert=20Figui=C3=A8re?= <hub@figuiere.net>
Date: Sun, 28 Jul 2019 10:15:19 -0400
Subject: [PATCH] (CVE-2020-18651) Issue #13 - Fix a buffer a overflow in ID3
support
https://gitlab.freedesktop.org/libopenraw/exempi/issues/13
(cherry picked from commit fdd4765a699f9700850098b43b9798b933acb32f)
---
XMPFiles/source/FormatSupport/ID3_Support.cpp | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/XMPFiles/source/FormatSupport/ID3_Support.cpp b/XMPFiles/source/FormatSupport/ID3_Support.cpp
index dd19c16..4619079 100644
--- a/XMPFiles/source/FormatSupport/ID3_Support.cpp
+++ b/XMPFiles/source/FormatSupport/ID3_Support.cpp
@@ -669,6 +669,10 @@ bool ID3v2Frame::getFrameValue ( XMP_Uns8 majorVersion, XMP_Uns32 logicalID, std
std::string tmp ( this->content, this->contentSize );
bool bigEndian = true; // assume for now (if no BOM follows)
+ if (pos + 2 > this->contentSize) {
+ // No enough for the string
+ break;
+ }
if ( GetUns16BE ( &this->content[pos] ) == 0xFEFF ) {
pos += 2;
bigEndian = true;
@@ -686,6 +690,10 @@ bool ID3v2Frame::getFrameValue ( XMP_Uns8 majorVersion, XMP_Uns32 logicalID, std
{
if ( commMode && (! advancePastCOMMDescriptor ( pos )) ) return false; // not a frame of interest!
+ if (pos + 4 > this->contentSize) {
+ // No enough for the string
+ break;
+ }
if ( (GetUns32BE ( &this->content[pos]) & 0xFFFFFF00 ) == 0xEFBBBF00 ) {
pos += 3; // swallow any BOM, just in case
}
--
2.41.0

38
SOURCES/0002-CVE-20220-18652-Bug-12-Invalid-WebP-cause-memory-ove.patch Normal file
View File

@ -0,0 +1,38 @@
From a3b1e52e5a5836fe1fd07013a2a098518b1801de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hubert=20Figui=C3=A8re?= <hub@figuiere.net>
Date: Sat, 27 Jul 2019 20:42:51 -0400
Subject: [PATCH] (CVE-20220-18652) Bug #12 - Invalid WebP cause memory
overflow.
https://gitlab.freedesktop.org/libopenraw/exempi/issues/12
(cherry picked from commit acee2894ceb91616543927c2a6e45050c60f98f7)
---
XMPFiles/source/FormatSupport/WEBP_Support.cpp | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/XMPFiles/source/FormatSupport/WEBP_Support.cpp b/XMPFiles/source/FormatSupport/WEBP_Support.cpp
index ffaf220..0d4b81d 100644
--- a/XMPFiles/source/FormatSupport/WEBP_Support.cpp
+++ b/XMPFiles/source/FormatSupport/WEBP_Support.cpp
@@ -120,10 +120,16 @@ VP8XChunk::VP8XChunk(Container* parent)
this->data.assign(this->size, 0);
XMP_Uns8* bitstream =
(XMP_Uns8*)parent->chunks[WEBP_CHUNK_IMAGE][0]->data.data();
+ XMP_Uns32 width = 0;
+ XMP_Uns32 height = 0;
// See bug https://bugs.freedesktop.org/show_bug.cgi?id=105247
// bitstream could be NULL.
- XMP_Uns32 width = bitstream ? ((bitstream[7] << 8) | bitstream[6]) & 0x3fff : 0;
- XMP_Uns32 height = bitstream ? ((bitstream[9] << 8) | bitstream[8]) & 0x3fff : 0;
+ // See bug https://gitlab.freedesktop.org/libopenraw/exempi/issues/12
+ // image chunk data could be too short (must be 10)
+ if (parent->chunks[WEBP_CHUNK_IMAGE][0]->data.size() >= 10 && bitstream) {
+ width = ((bitstream[7] << 8) | bitstream[6]) & 0x3fff;
+ height = ((bitstream[9] << 8) | bitstream[8]) & 0x3fff;
+ }
this->width(width);
this->height(height);
parent->vp8x = this;
--
2.41.0

43
SOURCES/CVE-2018-12648.patch Normal file
View File

@ -0,0 +1,43 @@
From 487f4136013d9fa3351b863e5f861463a1cbddcf Mon Sep 17 00:00:00 2001
From: Victor Rodriguez <victor.rodriguez.bahena@intel.com>
Date: Sat, 18 Aug 2018 13:54:55 +0000
Subject: [PATCH] Issue #9 - Fix null-pointer-dereference (CVE-2018-12648)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The WEBP::GetLE32 function in
XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a
NULL pointer dereference.
https://bugs.freedesktop.org/show_bug.cgi?id=106981
https://gitlab.freedesktop.org/libopenraw/exempi/issues/9
Signed-off-by: Victor Rodriguez <victor.rodriguez.bahena@intel.com>
Signed-off-by: Hubert Figuière <hub@figuiere.net>
---
XMPFiles/source/FormatSupport/WEBP_Support.cpp | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/XMPFiles/source/FormatSupport/WEBP_Support.cpp b/XMPFiles/source/FormatSupport/WEBP_Support.cpp
index ffaf220..4fe705b 100644
--- a/XMPFiles/source/FormatSupport/WEBP_Support.cpp
+++ b/XMPFiles/source/FormatSupport/WEBP_Support.cpp
@@ -160,9 +160,11 @@ bool VP8XChunk::xmp()
}
void VP8XChunk::xmp(bool hasXMP)
{
- XMP_Uns32 flags = GetLE32(&this->data[0]);
- flags ^= (-hasXMP ^ flags) & (1 << XMP_FLAG_BIT);
- PutLE32(&this->data[0], flags);
+ if (&this->data[0] != NULL) {
+ XMP_Uns32 flags = GetLE32(&this->data[0]);
+ flags ^= (-hasXMP ^ flags) & (1 << XMP_FLAG_BIT);
+ PutLE32(&this->data[0], flags);
+ }
}
Container::Container(WEBP_MetaHandler* handler) : Chunk(NULL, handler)
--
2.17.1

139
exempi.spec → SPECS/exempi.spec
View File

@ -1,15 +1,18 @@
Summary: Library for easy parsing of XMP metadata Summary: Library for easy parsing of XMP metadata
Name: exempi Name: exempi
Version: 2.6.4 Version: 2.4.5
Release: 7%{?dist} Release: 4%{?dist}
License: BSD-3-Clause License: BSD
Group: System Environment/Libraries
URL: http://libopenraw.freedesktop.org/wiki/Exempi URL: http://libopenraw.freedesktop.org/wiki/Exempi
Source0: https://gitlab.freedesktop.org/libopenraw/%{name}/-/archive/%{version}/%{name}-%{version}.tar.bz2 Source0: http://libopenraw.freedesktop.org/download/%{name}-%{version}.tar.bz2
Patch0: CVE-2018-12648.patch
Patch0001: 0001-CVE-2020-18651-Issue-13-Fix-a-buffer-a-overflow-in-I.patch
Patch0002: 0002-CVE-20220-18652-Bug-12-Invalid-WebP-cause-memory-ove.patch
BuildRequires: gcc-c++ BuildRequires: gcc-c++
BuildRequires: boost-devel expat-devel zlib-devel pkgconfig BuildRequires: boost-devel expat-devel zlib-devel pkgconfig
# Work around for aarch64 support (https://bugzilla.redhat.com/show_bug.cgi?id=925327) # Work around for aarch64 support (https://bugzilla.redhat.com/show_bug.cgi?id=925327)
BuildRequires: autoconf automake libtool BuildRequires: autoconf automake libtool
BuildRequires: make
Provides: bundled(md5-polstra) Provides: bundled(md5-polstra)
%description %description
@ -19,6 +22,7 @@ It includes XMPCore and XMPFiles.
%package devel %package devel
Summary: Headers for developing programs that will use %{name} Summary: Headers for developing programs that will use %{name}
Group: Development/Libraries
Requires: %{name} = %{version}-%{release} Requires: %{name} = %{version}-%{release}
Requires: pkgconfig Requires: pkgconfig
@ -27,11 +31,14 @@ This package contains the libraries and header files needed for
developing with exempi. developing with exempi.
%prep %prep
%autosetup -p1 %setup -q
%patch0 -p1
%patch1 -p1
%patch2 -p1
%build %build
libtoolize -vi libtoolize -vi
NOCONFIGURE=1 ./autogen.sh ./autogen.sh
# BanEntityUsage needed for #888765 # BanEntityUsage needed for #888765
%configure CPPFLAGS="-I%{_includedir} -fno-strict-aliasing -DBanAllEntityUsage=1" %configure CPPFLAGS="-I%{_includedir} -fno-strict-aliasing -DBanAllEntityUsage=1"
@ -39,128 +46,44 @@ NOCONFIGURE=1 ./autogen.sh
sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
%make_build make %{?_smp_mflags} V=1
%check %check
%ifarch s390x
# testcore test fails on big endian arches since exempi 2.5.2:
# https://gitlab.freedesktop.org/libopenraw/exempi/-/issues/23
make check || [ "$(grep '^FAIL:' exempi/test-suite.log)" = "FAIL: tests/testcore" ]
%else
make check make check
%endif
%install %install
%make_install make DESTDIR=%{buildroot} install
rm -rf %{buildroot}%{_libdir}/*.la rm -rf %{buildroot}%{_libdir}/*.la
rm -rf %{buildroot}%{_libdir}/*.a rm -rf %{buildroot}%{_libdir}/*.a
%post -p /sbin/ldconfig
%postun -p /sbin/ldconfig
%files %files
%license COPYING %doc AUTHORS ChangeLog COPYING README
%doc AUTHORS ChangeLog README.md
%{_bindir}/exempi %{_bindir}/exempi
%{_libdir}/libexempi.so.8* %{_libdir}/*.so.*
%{_mandir}/man1/exempi.1* %{_mandir}/man1/exempi.1*
%files devel %files devel
%{_includedir}/exempi-2.0/ %{_includedir}/exempi-2.0/
%{_libdir}/libexempi.so %{_libdir}/*.so
%{_libdir}/pkgconfig/*.pc %{_libdir}/pkgconfig/*.pc
%changelog %changelog
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 2.6.4-7 * Mon Jan 08 2024 Matej Mužila <mmuzila@redhat.com> - 2.4.5-4
- Bump release for October 2024 mass rebuild: - Fix CVE-2020-18652
Resolves: RHEL-64018 - Resolves: RHEL-5416
* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 2.6.4-6 * Mon Jan 08 2024 Matej Mužila <mmuzila@redhat.com> - 2.4.5-3
- Bump release for June 2024 mass rebuild - Fix CVE-2020-18651
- Resolves: RHEL-5415
* Mon Jan 29 2024 Matej Mužila <mmuzila@redhat.com> - 2.6.4-5 * Wed Sep 26 2018 Nikola Forró <nforro@redhat.com> - 2.4.5-2
- migrated to SPDX license
* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.4-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Mon Jul 10 2023 Nikola Forró <nforro@redhat.com> - 2.6.4-1
- Update to version 2.6.4
Resolves #2221013
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Mon Dec 12 2022 Nikola Forró <nforro@redhat.com> - 2.6.3-1
- Update to version 2.6.3
Resolves #2152330
* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Mon Jun 27 2022 Nikola Forró <nforro@redhat.com> - 2.6.2-1
- Update to version 2.6.2
Resolves #2101146
* Mon Feb 14 2022 Nikola Forró <nforro@redhat.com> - 2.6.1-1
- Update to version 2.6.1
Resolves #1850332
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.0-0.2.20211007gite23c213
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
* Thu Oct 07 2021 Nikola Forró <nforro@redhat.com> - 2.6.0-0.1.20211007gite23c213
- Update to (unreleased) version 2.6.0 to resolve licensing issues
and not to deviate from upstream
* Fri Sep 17 2021 Nikola Forró <nforro@redhat.com> - 2.5.3-0.1.20210917git2062d44
- Update to (unreleased) version 2.5.3 to resolve licensing issues
* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.5.1-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.5.1-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Tue Jul 28 2020 Jeff Law <law@redhat.com> - 2.5.1-5
- Force C++14 as this code is not C++17 ready
* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.5.1-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue Jul 14 2020 Tom Stellard <tstellar@redhat.com> - 2.5.1-3
- Use make macros
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.5.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Fri Aug 30 2019 Nikola Forró <nforro@redhat.com> - 2.5.1-1
- Update to version 2.5.1
Resolves #1747391
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.5-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.5-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Tue Oct 9 2018 Owen Taylor <otaylor@redhat.com> - 2.4.5-5
- Set NOCONFIGURE when running autogen.sh to avoid running configure twice
* Wed Sep 26 2018 Nikola Forró <nforro@redhat.com> - 2.4.5-4
- Fix CVE-2018-12648 - Fix CVE-2018-12648
Resolves #1594643 Resolves #1594644
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.5-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Thu Jun 28 2018 Nikola Forró <nforro@redhat.com> - 2.4.5-2
- Remove ldconfig from scriptlets
* Tue Mar 13 2018 Nikola Forró <nforro@redhat.com> - 2.4.5-1 * Tue Mar 13 2018 Nikola Forró <nforro@redhat.com> - 2.4.5-1
- Update to version 2.4.5 - Update to version 2.4.5

1
sources
View File

@ -1 +0,0 @@
SHA512 (exempi-2.6.4.tar.bz2) = 20d5689346f89bacaeedf1c48e725d5f3aead399786c93858886bfced6341f58bb70cfe43da255f931cce21d86cee3c7cb4d0b074f6d4a77dc8cec56f533f380