From dc98110bccea833f62d1918ba27ece0449fec862 Mon Sep 17 00:00:00 2001 From: Rex Dieter Date: Wed, 15 Sep 2021 13:00:47 -0500 Subject: [PATCH] 0.6.23 (#2003457) --- .gitignore | 1 + CVE-2020-0181-CVE-2020-0198.patch | 58 ------------------------------- CVE-2020-0452.patch | 32 ----------------- libexif.spec | 18 +++++----- sources | 2 +- 5 files changed, 11 insertions(+), 100 deletions(-) delete mode 100644 CVE-2020-0181-CVE-2020-0198.patch delete mode 100644 CVE-2020-0452.patch diff --git a/.gitignore b/.gitignore index b234d86..5115b3f 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ libexif-docs.tar.gz /libexif-0.6.21.tar.bz2 /libexif-libexif-0_6_22-release.tar.gz /libexif-0_6_22-release.tar.gz +/libexif-0_6_23-release.tar.gz diff --git a/CVE-2020-0181-CVE-2020-0198.patch b/CVE-2020-0181-CVE-2020-0198.patch deleted file mode 100644 index e0358c2..0000000 --- a/CVE-2020-0181-CVE-2020-0198.patch +++ /dev/null @@ -1,58 +0,0 @@ -From ce03ad7ef4e8aeefce79192bf5b6f69fae396f0c Mon Sep 17 00:00:00 2001 -From: Marcus Meissner -Date: Mon, 8 Jun 2020 17:27:06 +0200 -Subject: [PATCH] fixed another unsigned integer overflow - -first fixed by google in android fork, -https://android.googlesource.com/platform/external/libexif/+/1e187b62682ffab5003c702657d6d725b4278f16%5E%21/#F0 - -(use a more generic overflow check method, also check second overflow instance.) - -https://security-tracker.debian.org/tracker/CVE-2020-0198 ---- - libexif/exif-data.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/libexif/exif-data.c b/libexif/exif-data.c -index 8b280d3..b495726 100644 ---- a/libexif/exif-data.c -+++ b/libexif/exif-data.c -@@ -47,6 +47,8 @@ - #undef JPEG_MARKER_APP1 - #define JPEG_MARKER_APP1 0xe1 - -+#define CHECKOVERFLOW(offset,datasize,structsize) (( offset >= datasize) || (structsize > datasize) || (offset > datasize - structsize )) -+ - static const unsigned char ExifHeader[] = {0x45, 0x78, 0x69, 0x66, 0x00, 0x00}; - - struct _ExifDataPrivate -@@ -327,7 +329,7 @@ exif_data_load_data_thumbnail (ExifData *data, const unsigned char *d, - exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail offset (%u).", o); - return; - } -- if (s > ds - o) { -+ if (CHECKOVERFLOW(o,ds,s)) { - exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail size (%u), max would be %u.", s, ds-o); - return; - } -@@ -420,9 +422,9 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd, - } - - /* Read the number of entries */ -- if ((offset + 2 < offset) || (offset + 2 < 2) || (offset + 2 > ds)) { -+ if (CHECKOVERFLOW(offset, ds, 2)) { - exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", -- "Tag data past end of buffer (%u > %u)", offset+2, ds); -+ "Tag data past end of buffer (%u+2 > %u)", offset, ds); - return; - } - n = exif_get_short (d + offset, data->priv->order); -@@ -431,7 +433,7 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd, - offset += 2; - - /* Check if we have enough data. */ -- if (offset + 12 * n > ds) { -+ if (CHECKOVERFLOW(offset, ds, 12*n)) { - n = (ds - offset) / 12; - exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", - "Short data; only loading %hu entries...", n); diff --git a/CVE-2020-0452.patch b/CVE-2020-0452.patch deleted file mode 100644 index 4a499ff..0000000 --- a/CVE-2020-0452.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 9266d14b5ca4e29b970fa03272318e5f99386e06 Mon Sep 17 00:00:00 2001 -From: Marcus Meissner -Date: Thu, 5 Nov 2020 09:50:08 +0100 -Subject: [PATCH] fixed a incorrect overflow check that could be optimized - away. - -inspired by: -https://android.googlesource.com/platform/external/libexif/+/8e7345f3bc0bad06ac369d6cbc1124c8ceaf7d4b - -https://source.android.com/security/bulletin/2020-11-01 - -CVE-2020-0452 ---- - NEWS | 3 ++- - libexif/exif-entry.c | 4 ++-- - 2 files changed, 4 insertions(+), 3 deletions(-) - -diff --git a/libexif/exif-entry.c b/libexif/exif-entry.c -index 3fc0ff9..4b866ce 100644 ---- a/libexif/exif-entry.c -+++ b/libexif/exif-entry.c -@@ -1371,8 +1371,8 @@ exif_entry_get_value (ExifEntry *e, char *val, unsigned int maxlen) - { - unsigned char *utf16; - -- /* Sanity check the size to prevent overflow */ -- if (e->size+sizeof(uint16_t)+1 < e->size) break; -+ /* Sanity check the size to prevent overflow. Note EXIF files are 64kb at most. */ -+ if (e->size >= 65536 - sizeof(uint16_t)*2) break; - - /* The tag may not be U+0000-terminated , so make a local - U+0000-terminated copy before converting it */ diff --git a/libexif.spec b/libexif.spec index 8189e3b..a0aa5f5 100644 --- a/libexif.spec +++ b/libexif.spec @@ -1,24 +1,19 @@ Summary: Library for extracting extra information from image files Name: libexif -Version: 0.6.22 -Release: 5%{?dist} +Version: 0.6.23 +Release: 1%{?dist} License: LGPLv2+ URL: https://libexif.github.io/ %global tarball_version %(echo %{version} | sed -e 's|\\.|_|g') Source0: https://github.com/libexif/libexif/archive/libexif-%{tarball_version}-release.tar.gz -# https://github.com/libexif/libexif/commit/ce03ad7ef4e8aeefce79192bf5b6f69fae396f0c -Patch0: CVE-2020-0181-CVE-2020-0198.patch -# https://github.com/libexif/libexif/commit/9266d14b5ca4e29b970fa03272318e5f99386e06 -Patch1: CVE-2020-0452.patch - BuildRequires: autoconf BuildRequires: automake BuildRequires: doxygen BuildRequires: gettext-devel BuildRequires: libtool BuildRequires: pkgconfig -BuildRequires: make +BuildRequires: make %description Most digital cameras produce EXIF files, which are JPEG files with @@ -63,8 +58,10 @@ iconv -f latin1 -t utf-8 < COPYING > COPYING.utf8; cp COPYING.utf8 COPYING iconv -f latin1 -t utf-8 < README > README.utf8; cp README.utf8 README %find_lang libexif-12 + %check -make check +%make_build check + %ldconfig_scriptlets @@ -83,6 +80,9 @@ make check %changelog +* Wed Sep 15 2021 Rex Dieter - 0.6.23-1 +- 0.6.23 (#2003457) + * Thu Jul 22 2021 Fedora Release Engineering - 0.6.22-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild diff --git a/sources b/sources index ed29e3f..05dd5b5 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (libexif-0_6_22-release.tar.gz) = 6c63abe2734c9e83fb04adb00bdd77f687165007c0efd0279df26c101363b990604050c430c7dd73dfa8735dd2fd196334d321bdb114d4869998f21e7bed5b43 +SHA512 (libexif-0_6_23-release.tar.gz) = 9fa2e124d6a5787fd1c6101be9c345e699bc074026f7c0e1d0c8dc202b922e749a76d7a9d4dd7afe880a7e2ff8ac029590b9957743962dbc0e17320c21afd22d