From 85a20e3e608016f6313f3b98db0bd4c74330aff8 Mon Sep 17 00:00:00 2001
From: Jiri Popelka <jpopelka@redhat.com>
Date: Thu, 4 Dec 2014 15:49:08 +0100
Subject: [PATCH] CVE-2014-9029 (#1170650)

---
 jasper-CVE-2014-9029.patch | 29 +++++++++++++++++++++++++++++
 jasper.spec                |  9 ++++++++-
 2 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 jasper-CVE-2014-9029.patch

diff --git a/jasper-CVE-2014-9029.patch b/jasper-CVE-2014-9029.patch
new file mode 100644
index 0000000..98a2035
--- /dev/null
+++ b/jasper-CVE-2014-9029.patch
@@ -0,0 +1,29 @@
+--- jasper-1.900.1.orig/src/libjasper/jpc/jpc_dec.c	2014-11-27 12:45:44.000000000 +0100
++++ jasper-1.900.1/src/libjasper/jpc/jpc_dec.c	2014-11-27 12:44:58.000000000 +0100
+@@ -1281,7 +1281,7 @@ static int jpc_dec_process_coc(jpc_dec_t
+ 	jpc_coc_t *coc = &ms->parms.coc;
+ 	jpc_dec_tile_t *tile;
+ 
+-	if (JAS_CAST(int, coc->compno) > dec->numcomps) {
++	if (JAS_CAST(int, coc->compno) >= dec->numcomps) {
+ 		jas_eprintf("invalid component number in COC marker segment\n");
+ 		return -1;
+ 	}
+@@ -1307,7 +1307,7 @@ static int jpc_dec_process_rgn(jpc_dec_t
+ 	jpc_rgn_t *rgn = &ms->parms.rgn;
+ 	jpc_dec_tile_t *tile;
+ 
+-	if (JAS_CAST(int, rgn->compno) > dec->numcomps) {
++	if (JAS_CAST(int, rgn->compno) >= dec->numcomps) {
+ 		jas_eprintf("invalid component number in RGN marker segment\n");
+ 		return -1;
+ 	}
+@@ -1356,7 +1356,7 @@ static int jpc_dec_process_qcc(jpc_dec_t
+ 	jpc_qcc_t *qcc = &ms->parms.qcc;
+ 	jpc_dec_tile_t *tile;
+ 
+-	if (JAS_CAST(int, qcc->compno) > dec->numcomps) {
++	if (JAS_CAST(int, qcc->compno) >= dec->numcomps) {
+ 		jas_eprintf("invalid component number in QCC marker segment\n");
+ 		return -1;
+ 	}
diff --git a/jasper.spec b/jasper.spec
index c5009a1..13672a2 100644
--- a/jasper.spec
+++ b/jasper.spec
@@ -7,7 +7,7 @@ Summary: Implementation of the JPEG-2000 standard, Part 1
 Name:    jasper
 Group:   System Environment/Libraries
 Version: 1.900.1
-Release: 24%{?dist}
+Release: 25%{?dist}
 
 License: JasPer
 URL:     http://www.ece.uvic.ca/~frodo/jasper/
@@ -32,6 +32,8 @@ Patch7: jasper-pkgconfig.patch
 
 Patch8: jasper-1.900.1-CVE-2011-4516-CVE-2011-4517-CERT-VU-887409.patch
 
+Patch9: jasper-CVE-2014-9029.patch
+
 # Issues found by static analysis of code
 Patch10: jasper-1.900.1-Coverity-BAD_SIZEOF.patch
 Patch11: jasper-1.900.1-Coverity-CHECKED_RETURN.patch
@@ -93,6 +95,7 @@ Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 %patch6 -p1 -b .CVE-2008-3522
 %patch7 -p1 -b .pkgconfig
 %patch8 -p1 -b .CVE-2011-4516-4517
+%patch9 -p1 -b .CVE-2014-9029
 
 %patch10 -p1 -b .BAD_SIZEOF
 %patch11 -p1 -b .CHECKED_RETURN
@@ -170,6 +173,10 @@ make check
 
 
 %changelog
+* Thu Dec 04 2014 Jiri Popelka <jpopelka@redhat.com> - 1.900.1-25
+- CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
+                  marker segment decoders (#1170650)
+
 * Mon Mar 25 2013 Jiri Popelka <jpopelka@redhat.com> - 1.900.1-24
 - added --force option to autoreconf (#925604)