From 0a516418785f657efa2781d340016ddee8e13022 Mon Sep 17 00:00:00 2001 From: Sandro Mani Date: Thu, 27 May 2021 23:47:11 +0200 Subject: [PATCH] Apply proposed patches for CVE-2021-29338 and a heap buffer overflow (#1957616) --- CVE-2021-29338.patch | 147 +++++++++++++++++++++++++++++++++++++ heap-buffer-overflow.patch | 22 ++++++ openjpeg2.spec | 12 ++- openjpeg2_opj2.patch | 2 +- 4 files changed, 181 insertions(+), 2 deletions(-) create mode 100644 CVE-2021-29338.patch create mode 100644 heap-buffer-overflow.patch diff --git a/CVE-2021-29338.patch b/CVE-2021-29338.patch new file mode 100644 index 0000000..373f6d6 --- /dev/null +++ b/CVE-2021-29338.patch @@ -0,0 +1,147 @@ +diff -rupN --no-dereference openjpeg-2.4.0/src/bin/jp2/opj_compress.c openjpeg-2.4.0-new/src/bin/jp2/opj_compress.c +--- openjpeg-2.4.0/src/bin/jp2/opj_compress.c 2020-12-28 21:59:39.000000000 +0100 ++++ openjpeg-2.4.0-new/src/bin/jp2/opj_compress.c 2021-05-27 23:46:46.916130437 +0200 +@@ -543,8 +543,8 @@ static char * get_file_name(char *name) + static char get_next_file(int imageno, dircnt_t *dirptr, img_fol_t *img_fol, + opj_cparameters_t *parameters) + { +- char image_filename[OPJ_PATH_LEN], infilename[OPJ_PATH_LEN], +- outfilename[OPJ_PATH_LEN], temp_ofname[OPJ_PATH_LEN]; ++ char image_filename[OPJ_PATH_LEN], infilename[OPJ_PATH_LEN * 2], ++ outfilename[OPJ_PATH_LEN * 2], temp_ofname[OPJ_PATH_LEN]; + char *temp_p, temp1[OPJ_PATH_LEN] = ""; + + strcpy(image_filename, dirptr->filename[imageno]); +@@ -553,7 +553,7 @@ static char get_next_file(int imageno, d + if (parameters->decod_format == -1) { + return 1; + } +- sprintf(infilename, "%s/%s", img_fol->imgdirpath, image_filename); ++ snprintf(infilename, OPJ_PATH_LEN * 2, "%s/%s", img_fol->imgdirpath, image_filename); + if (opj_strcpy_s(parameters->infile, sizeof(parameters->infile), + infilename) != 0) { + return 1; +@@ -566,7 +566,7 @@ static char get_next_file(int imageno, d + sprintf(temp1, ".%s", temp_p); + } + if (img_fol->set_out_format == 1) { +- sprintf(outfilename, "%s/%s.%s", img_fol->imgdirpath, temp_ofname, ++ snprintf(outfilename, OPJ_PATH_LEN * 2, "%s/%s.%s", img_fol->imgdirpath, temp_ofname, + img_fol->out_format); + if (opj_strcpy_s(parameters->outfile, sizeof(parameters->outfile), + outfilename) != 0) { +@@ -1910,9 +1910,9 @@ int main(int argc, char **argv) + num_images = get_num_images(img_fol.imgdirpath); + dirptr = (dircnt_t*)malloc(sizeof(dircnt_t)); + if (dirptr) { +- dirptr->filename_buf = (char*)malloc(num_images * OPJ_PATH_LEN * sizeof( ++ dirptr->filename_buf = (char*)calloc(num_images, OPJ_PATH_LEN * sizeof( + char)); /* Stores at max 10 image file names*/ +- dirptr->filename = (char**) malloc(num_images * sizeof(char*)); ++ dirptr->filename = (char**) calloc(num_images, sizeof(char*)); + if (!dirptr->filename_buf) { + ret = 0; + goto fin; +diff -rupN --no-dereference openjpeg-2.4.0/src/bin/jp2/opj_decompress.c openjpeg-2.4.0-new/src/bin/jp2/opj_decompress.c +--- openjpeg-2.4.0/src/bin/jp2/opj_decompress.c 2020-12-28 21:59:39.000000000 +0100 ++++ openjpeg-2.4.0-new/src/bin/jp2/opj_decompress.c 2021-05-27 23:46:46.916130437 +0200 +@@ -455,13 +455,13 @@ const char* path_separator = "/"; + char get_next_file(int imageno, dircnt_t *dirptr, img_fol_t *img_fol, + opj_decompress_parameters *parameters) + { +- char image_filename[OPJ_PATH_LEN], infilename[OPJ_PATH_LEN], +- outfilename[OPJ_PATH_LEN], temp_ofname[OPJ_PATH_LEN]; ++ char image_filename[OPJ_PATH_LEN], infilename[OPJ_PATH_LEN * 2], ++ outfilename[OPJ_PATH_LEN * 2], temp_ofname[OPJ_PATH_LEN]; + char *temp_p, temp1[OPJ_PATH_LEN] = ""; + + strcpy(image_filename, dirptr->filename[imageno]); + fprintf(stderr, "File Number %d \"%s\"\n", imageno, image_filename); +- sprintf(infilename, "%s%s%s", img_fol->imgdirpath, path_separator, ++ snprintf(infilename, OPJ_PATH_LEN * 2, "%s%s%s", img_fol->imgdirpath, path_separator, + image_filename); + parameters->decod_format = infile_format(infilename); + if (parameters->decod_format == -1) { +@@ -479,7 +479,7 @@ char get_next_file(int imageno, dircnt_t + sprintf(temp1, ".%s", temp_p); + } + if (img_fol->set_out_format == 1) { +- sprintf(outfilename, "%s/%s.%s", img_fol->imgdirpath, temp_ofname, ++ snprintf(outfilename, OPJ_PATH_LEN * 2, "%s/%s.%s", img_fol->imgdirpath, temp_ofname, + img_fol->out_format); + if (opj_strcpy_s(parameters->outfile, sizeof(parameters->outfile), + outfilename) != 0) { +@@ -1357,14 +1357,13 @@ int main(int argc, char **argv) + return EXIT_FAILURE; + } + /* Stores at max 10 image file names */ +- dirptr->filename_buf = (char*)malloc(sizeof(char) * +- (size_t)num_images * OPJ_PATH_LEN); ++ dirptr->filename_buf = calloc((size_t) num_images, sizeof(char) * OPJ_PATH_LEN); + if (!dirptr->filename_buf) { + failed = 1; + goto fin; + } + +- dirptr->filename = (char**) malloc((size_t)num_images * sizeof(char*)); ++ dirptr->filename = (char**) calloc((size_t) num_images, sizeof(char*)); + + if (!dirptr->filename) { + failed = 1; +diff -rupN --no-dereference openjpeg-2.4.0/src/bin/jp2/opj_dump.c openjpeg-2.4.0-new/src/bin/jp2/opj_dump.c +--- openjpeg-2.4.0/src/bin/jp2/opj_dump.c 2020-12-28 21:59:39.000000000 +0100 ++++ openjpeg-2.4.0-new/src/bin/jp2/opj_dump.c 2021-05-27 23:46:46.917130437 +0200 +@@ -201,8 +201,8 @@ static int get_file_format(const char *f + static char get_next_file(int imageno, dircnt_t *dirptr, img_fol_t *img_fol, + opj_dparameters_t *parameters) + { +- char image_filename[OPJ_PATH_LEN], infilename[OPJ_PATH_LEN], +- outfilename[OPJ_PATH_LEN], temp_ofname[OPJ_PATH_LEN]; ++ char image_filename[OPJ_PATH_LEN], infilename[OPJ_PATH_LEN * 2], ++ outfilename[OPJ_PATH_LEN * 2], temp_ofname[OPJ_PATH_LEN]; + char *temp_p, temp1[OPJ_PATH_LEN] = ""; + + strcpy(image_filename, dirptr->filename[imageno]); +@@ -211,7 +211,7 @@ static char get_next_file(int imageno, d + if (parameters->decod_format == -1) { + return 1; + } +- sprintf(infilename, "%s/%s", img_fol->imgdirpath, image_filename); ++ snprintf(infilename, OPJ_PATH_LEN * 2, "%s/%s", img_fol->imgdirpath, image_filename); + if (opj_strcpy_s(parameters->infile, sizeof(parameters->infile), + infilename) != 0) { + return 1; +@@ -224,7 +224,7 @@ static char get_next_file(int imageno, d + sprintf(temp1, ".%s", temp_p); + } + if (img_fol->set_out_format == 1) { +- sprintf(outfilename, "%s/%s.%s", img_fol->imgdirpath, temp_ofname, ++ snprintf(outfilename, OPJ_PATH_LEN * 2, "%s/%s.%s", img_fol->imgdirpath, temp_ofname, + img_fol->out_format); + if (opj_strcpy_s(parameters->outfile, sizeof(parameters->outfile), + outfilename) != 0) { +@@ -457,7 +457,7 @@ int main(int argc, char *argv[]) + opj_codestream_info_v2_t* cstr_info = NULL; + opj_codestream_index_t* cstr_index = NULL; + +- OPJ_INT32 num_images, imageno; ++ int num_images, imageno; + img_fol_t img_fol; + dircnt_t *dirptr = NULL; + +@@ -486,13 +486,13 @@ int main(int argc, char *argv[]) + if (!dirptr) { + return EXIT_FAILURE; + } +- dirptr->filename_buf = (char*)malloc((size_t)num_images * OPJ_PATH_LEN * sizeof( ++ dirptr->filename_buf = (char*) calloc((size_t) num_images, OPJ_PATH_LEN * sizeof( + char)); /* Stores at max 10 image file names*/ + if (!dirptr->filename_buf) { + free(dirptr); + return EXIT_FAILURE; + } +- dirptr->filename = (char**) malloc((size_t)num_images * sizeof(char*)); ++ dirptr->filename = (char**) calloc((size_t) num_images, sizeof(char*)); + + if (!dirptr->filename) { + goto fails; diff --git a/heap-buffer-overflow.patch b/heap-buffer-overflow.patch new file mode 100644 index 0000000..6dcd51a --- /dev/null +++ b/heap-buffer-overflow.patch @@ -0,0 +1,22 @@ +diff -rupN --no-dereference openjpeg-2.4.0/src/bin/common/color.c openjpeg-2.4.0-new/src/bin/common/color.c +--- openjpeg-2.4.0/src/bin/common/color.c 2020-12-28 21:59:39.000000000 +0100 ++++ openjpeg-2.4.0-new/src/bin/common/color.c 2021-05-27 23:46:46.961130438 +0200 +@@ -368,12 +368,15 @@ static void sycc420_to_rgb(opj_image_t * + + sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b); + +- ++y; ++ if (*y != img->comps[0].data[loopmaxh]) ++ ++y; + ++r; + ++g; + ++b; +- ++cb; +- ++cr; ++ if (*cb != img->comps[1].data[loopmaxh]) ++ ++cb; ++ if (*cr != img->comps[2].data[loopmaxh]) ++ ++cr; + } + if (j < maxw) { + sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b); diff --git a/openjpeg2.spec b/openjpeg2.spec index c8718bd..466de92 100644 --- a/openjpeg2.spec +++ b/openjpeg2.spec @@ -8,7 +8,7 @@ Name: openjpeg2 Version: 2.4.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: C-Library for JPEG 2000 # windirent.h is MIT, the rest is BSD @@ -22,6 +22,13 @@ Source1: data.tar.xz # Rename tool names to avoid conflicts with openjpeg-1.x Patch0: openjpeg2_opj2.patch +# Backport proposed patch for CVE-2021-29338 +# See https://github.com/uclouvain/openjpeg/issues/1338 +# and https://github.com/uclouvain/openjpeg/pull/1346 +Patch1: CVE-2021-29338.patch +# Backport proposed patch for heap buffer overflow (#1957616) +# See https://github.com/uclouvain/openjpeg/issues/1347 +Patch2: heap-buffer-overflow.patch BuildRequires: cmake @@ -324,6 +331,9 @@ chmod +x %{buildroot}%{_bindir}/opj2_jpip_viewer %changelog +* Thu May 27 2021 Sandro Mani - 2.4.0-3 +- Apply proposed patches for CVE-2021-29338 and a heap buffer overflow (#1957616) + * Tue Jan 26 2021 Fedora Release Engineering - 2.4.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/openjpeg2_opj2.patch b/openjpeg2_opj2.patch index 3cbf8c3..e38c818 100644 --- a/openjpeg2_opj2.patch +++ b/openjpeg2_opj2.patch @@ -1,6 +1,6 @@ diff -rupN --no-dereference openjpeg-2.4.0/src/bin/jp2/CMakeLists.txt openjpeg-2.4.0-new/src/bin/jp2/CMakeLists.txt --- openjpeg-2.4.0/src/bin/jp2/CMakeLists.txt 2020-12-28 21:59:39.000000000 +0100 -+++ openjpeg-2.4.0-new/src/bin/jp2/CMakeLists.txt 2020-12-29 15:45:09.466819414 +0100 ++++ openjpeg-2.4.0-new/src/bin/jp2/CMakeLists.txt 2021-05-27 23:46:46.878130437 +0200 @@ -44,6 +44,8 @@ endif() # Loop over all executables: foreach(exe opj_decompress opj_compress opj_dump)