diff --git a/.gitignore b/.gitignore index 8f0e7de..99766a1 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ /openjpeg-2.0.0.tar.gz /openjpeg-2.1.0.tar.gz /version.2.1.tar.gz +/openjpeg-2.1.1.tar.gz diff --git a/0fa5a17c98c4b8f9ee2286f4f0a50cf52a5fccb0.patch b/0fa5a17c98c4b8f9ee2286f4f0a50cf52a5fccb0.patch deleted file mode 100644 index f96751e..0000000 --- a/0fa5a17c98c4b8f9ee2286f4f0a50cf52a5fccb0.patch +++ /dev/null @@ -1,33 +0,0 @@ -diff -rupN openjpeg-version.2.1/src/lib/openjp2/j2k.c openjpeg-version.2.1-new/src/lib/openjp2/j2k.c ---- openjpeg-version.2.1/src/lib/openjp2/j2k.c 2015-10-01 18:38:24.990369074 +0200 -+++ openjpeg-version.2.1-new/src/lib/openjp2/j2k.c 2015-10-01 18:38:36.166536063 +0200 -@@ -7156,6 +7156,12 @@ static OPJ_BOOL opj_j2k_copy_default_tcp - /* Initialize some values of the current tile coding parameters*/ - l_tcp->ppt = 0; - l_tcp->ppt_data = 00; -+ /* Remove memory not owned by this tile in case of early error return. */ -+ l_tcp->m_mct_decoding_matrix = 00; -+ l_tcp->m_nb_max_mct_records = 0; -+ l_tcp->m_mct_records = 00; -+ l_tcp->m_nb_max_mcc_records = 0; -+ l_tcp->m_mcc_records = 00; - /* Reconnect the tile-compo coding parameters pointer to the current tile coding parameters*/ - l_tcp->tccps = l_current_tccp; - -@@ -7193,6 +7199,8 @@ static OPJ_BOOL opj_j2k_copy_default_tcp - - ++l_src_mct_rec; - ++l_dest_mct_rec; -+ /* Update with each pass to free exactly what has been allocated on early return. */ -+ l_tcp->m_nb_max_mct_records += 1; - } - - /* Get the mcc_record of the dflt_tile_cp and copy them into the current tile cp*/ -@@ -7202,6 +7210,7 @@ static OPJ_BOOL opj_j2k_copy_default_tcp - return OPJ_FALSE; - } - memcpy(l_tcp->m_mcc_records,l_default_tcp->m_mcc_records,l_mcc_records_size); -+ l_tcp->m_nb_max_mcc_records = l_default_tcp->m_nb_max_mcc_records; - - /* Copy the mcc record data from dflt_tile_cp to the current tile*/ - l_src_mcc_rec = l_default_tcp->m_mcc_records; diff --git a/940100c28ae28931722290794889cf84a92c5f6f.patch b/940100c28ae28931722290794889cf84a92c5f6f.patch deleted file mode 100644 index fabae95..0000000 --- a/940100c28ae28931722290794889cf84a92c5f6f.patch +++ /dev/null @@ -1,34 +0,0 @@ -diff -rupN openjpeg-version.2.1/src/lib/openjp2/j2k.c openjpeg-version.2.1-new/src/lib/openjp2/j2k.c ---- openjpeg-version.2.1/src/lib/openjp2/j2k.c 2014-04-29 14:58:10.000000000 +0200 -+++ openjpeg-version.2.1-new/src/lib/openjp2/j2k.c 2015-09-15 18:12:52.394986909 +0200 -@@ -5526,8 +5526,7 @@ OPJ_BOOL opj_j2k_write_mco( opj_j2k_ - assert(p_stream != 00); - - l_tcp =&(p_j2k->m_cp.tcps[p_j2k->m_current_tile_number]); -- l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data; -- -+ - l_mco_size = 5 + l_tcp->m_nb_mcc_records; - if (l_mco_size > p_j2k->m_specific_param.m_encoder.m_header_tile_data_size) { - -@@ -5542,6 +5541,8 @@ OPJ_BOOL opj_j2k_write_mco( opj_j2k_ - p_j2k->m_specific_param.m_encoder.m_header_tile_data = new_header_tile_data; - p_j2k->m_specific_param.m_encoder.m_header_tile_data_size = l_mco_size; - } -+ l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data; -+ - - opj_write_bytes(l_current_data,J2K_MS_MCO,2); /* MCO */ - l_current_data += 2; -@@ -5553,10 +5554,9 @@ OPJ_BOOL opj_j2k_write_mco( opj_j2k_ - ++l_current_data; - - l_mcc_record = l_tcp->m_mcc_records; -- for (i=0;im_nb_mcc_records;++i) { -+ for (i=0;im_nb_mcc_records;++i) { - opj_write_bytes(l_current_data,l_mcc_record->m_index,1);/* Imco -> use the mcc indicated by 1*/ - ++l_current_data; -- - ++l_mcc_record; - } - diff --git a/openjpeg2.spec b/openjpeg2.spec index d9dc3ae..8d14358 100644 --- a/openjpeg2.spec +++ b/openjpeg2.spec @@ -1,39 +1,24 @@ -%global upname openjpeg -%global upver 2.1 - # Conformance tests disabled by default since it requires 1 GB of test data #global runcheck 1 #global optional_components 1 -#global master 1 - Name: openjpeg2 -Version: 2.1.0 -Release: 8%{?dist} +Version: 2.1.1 +Release: 1%{?dist} Summary: C-Library for JPEG 2000 # windirent.h is MIT, the rest is BSD License: BSD and MIT URL: https://github.com/uclouvain/openjpeg -%if 0%{?master} -Source0: https://github.com/uclouvain/openjpeg/archive/master.tar.gz -%else -Source0: https://github.com/uclouvain/openjpeg/archive/version.%{upver}.tar.gz -%endif +Source0: https://github.com/uclouvain/openjpeg/archive/v%{version}/openjpeg-%{version}.tar.gz %if 0%{?runcheck} -# svn checkout http://openjpeg.googlecode.com/svn/data -Source1: data.tar.xz +# git clone git@github.com:uclouvain/openjpeg-data.git +Source1: data.tar.xz %endif # Remove bundled libraries Patch0: openjpeg2_remove-thirdparty.patch -# Bigendian fixes -Patch1: openjpeg2_bigendian.patch -# Backport fix for use after free vulnerability (#1263359) -Patch2: 940100c28ae28931722290794889cf84a92c5f6f.patch -# Backport fix for possible double-free (#1267983) -Patch3: 0fa5a17c98c4b8f9ee2286f4f0a50cf52a5fccb0.patch BuildRequires: cmake BuildRequires: zlib-devel @@ -208,15 +193,8 @@ OpenJPEG2 JP3D module command line tools %prep -%if 0%{?master} -%setup -q -n %{upname}-master %{?runcheck:-a 1} -%else -%setup -q -n %{upname}-version.%{upver} %{?runcheck:-a 1} -%endif +%setup -q -n openjpeg-%{version} %{?runcheck:-a 1} %patch0 -p1 -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 # Remove all third party libraries just to be sure rm -rf thirdparty @@ -234,7 +212,7 @@ pushd %{_target_platform} .. popd -make VERBOSE=1 -C %{_target_platform} %{?_smp_mflags} +%make_build VERBOSE=1 -C %{_target_platform} %install @@ -276,7 +254,7 @@ make test -C %{_target_platform} %files %{!?_licensedir:%global license %doc} %license LICENSE -%doc AUTHORS NEWS README THANKS +%doc AUTHORS.md NEWS.md README.md THANKS.md %{_libdir}/libopenjp2.so.* %{_mandir}/man3/libopenjp2.3* @@ -346,6 +324,10 @@ make test -C %{_target_platform} %changelog +* Wed Jul 06 2016 Sandro Mani - 2.1.1-1 +- Update to 2.1.1 +- Fixes: CVE-2016-3183, CVE-2016-3181, CVE-2016-3182, CVE-2016-4796, CVE-2016-4797, CVE-2015-8871 + * Thu Feb 04 2016 Fedora Release Engineering - 2.1.0-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild diff --git a/openjpeg2_bigendian.patch b/openjpeg2_bigendian.patch deleted file mode 100644 index 81c99fa..0000000 --- a/openjpeg2_bigendian.patch +++ /dev/null @@ -1,34 +0,0 @@ -From e1992c3e5ddeeea784e931ebd74414e47ab6c167 Mon Sep 17 00:00:00 2001 -From: Sandro Mani -Date: Thu, 25 Jun 2015 22:42:56 +0200 -Subject: [PATCH] Fix opj_write_bytes_BE - ---- - src/lib/openjp2/cio.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/lib/openjp2/cio.c b/src/lib/openjp2/cio.c -index c455bf7..c6f778c 100644 ---- a/src/lib/openjp2/cio.c -+++ b/src/lib/openjp2/cio.c -@@ -46,7 +46,7 @@ - - void opj_write_bytes_BE (OPJ_BYTE * p_buffer, OPJ_UINT32 p_value, OPJ_UINT32 p_nb_bytes) - { -- const OPJ_BYTE * l_data_ptr = ((const OPJ_BYTE *) &p_value) + p_nb_bytes; -+ const OPJ_BYTE * l_data_ptr = ((const OPJ_BYTE *) &p_value)+sizeof(OPJ_UINT32)-p_nb_bytes; - - assert(p_nb_bytes > 0 && p_nb_bytes <= sizeof(OPJ_UINT32)); - -@@ -72,7 +72,7 @@ void opj_read_bytes_BE(const OPJ_BYTE * p_buffer, OPJ_UINT32 * p_value, OPJ_UINT - assert(p_nb_bytes > 0 && p_nb_bytes <= sizeof(OPJ_UINT32)); - - *p_value = 0; -- memcpy(l_data_ptr+4-p_nb_bytes,p_buffer,p_nb_bytes); -+ memcpy(l_data_ptr+sizeof(OPJ_UINT32)-p_nb_bytes,p_buffer,p_nb_bytes); - } - - void opj_read_bytes_LE(const OPJ_BYTE * p_buffer, OPJ_UINT32 * p_value, OPJ_UINT32 p_nb_bytes) --- -2.4.4 - diff --git a/openjpeg2_remove-thirdparty.patch b/openjpeg2_remove-thirdparty.patch index 3cfc3ff..6987fc2 100644 --- a/openjpeg2_remove-thirdparty.patch +++ b/openjpeg2_remove-thirdparty.patch @@ -1,7 +1,7 @@ -diff -rupN openjpeg-2.1.0/CMakeLists.txt openjpeg-2.1.0-new/CMakeLists.txt ---- openjpeg-2.1.0/CMakeLists.txt 2014-04-29 09:15:05.000000000 +0200 -+++ openjpeg-2.1.0-new/CMakeLists.txt 2014-05-23 13:12:19.513936024 +0200 -@@ -249,7 +249,6 @@ if(BUILD_CODEC OR BUILD_MJ2) +diff -rupN openjpeg-2.1.1/CMakeLists.txt openjpeg-2.1.1-new/CMakeLists.txt +--- openjpeg-2.1.1/CMakeLists.txt 2016-07-05 16:54:17.000000000 +0200 ++++ openjpeg-2.1.1-new/CMakeLists.txt 2016-07-06 09:38:26.083029127 +0200 +@@ -270,7 +270,6 @@ if(BUILD_CODEC OR BUILD_MJ2) # OFF: It will only build 3rd party libs if they are not found on the system # ON: 3rd party libs will ALWAYS be build, and used option(BUILD_THIRDPARTY "Build the thirdparty executables if it is needed" OFF) diff --git a/sources b/sources index 2a4823d..cd89bee 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -3e1c451c087f8462955426da38aa3b3d version.2.1.tar.gz +0cc4b2aee0a9b6e9e21b7abcd201a3ec openjpeg-2.1.1.tar.gz