From 35be8d73cef9bc2ec4f44f22bbb99d6f84312c9c Mon Sep 17 00:00:00 2001 From: Natanael Copa Date: Wed, 14 Oct 2015 08:45:12 +0000 Subject: main/openjpg: security fix for CVE-2015-6581 also add upstream fix a potensial use-after-free ref #4752 fixes #4753 --- main/openjpeg/APKBUILD | 16 +++++++++--- main/openjpeg/CVE-2015-6581.patch | 44 +++++++++++++++++++++++++++++++++ main/openjpeg/fix-use-after-free.patch | 45 ++++++++++++++++++++++++++++++++++ 3 files changed, 101 insertions(+), 4 deletions(-) create mode 100644 main/openjpeg/CVE-2015-6581.patch create mode 100644 main/openjpeg/fix-use-after-free.patch (limited to 'main') diff --git a/main/openjpeg/APKBUILD b/main/openjpeg/APKBUILD index fe107f92c9..9e340a68ed 100644 --- a/main/openjpeg/APKBUILD +++ b/main/openjpeg/APKBUILD @@ -2,7 +2,7 @@ # Maintainer: pkgname=openjpeg pkgver=2.1.0 -pkgrel=0 +pkgrel=1 pkgdesc="Open-source implementation of JPEG2000 image codec" url="http://www.openjpeg.org/" arch="all" @@ -13,6 +13,8 @@ makedepends="$depends_dev libpng-dev tiff-dev lcms-dev doxygen cmake" install="" subpackages="$pkgname-dev $pkgname-tools" source="http://downloads.sourceforge.net/project/openjpeg.mirror/$pkgver/openjpeg-$pkgver.tar.gz + CVE-2015-6581.patch + fix-use-after-free.patch " _builddir="${srcdir}/$pkgname-$pkgver" @@ -48,6 +50,12 @@ tools() { mv "$pkgdir"/usr/bin "$subpkgdir"/usr/ } -md5sums="f6419fcc233df84f9a81eb36633c6db6 openjpeg-2.1.0.tar.gz" -sha256sums="1232bb814fd88d8ed314c94f0bfebb03de8559583a33abbe8c64ef3fc0a8ff03 openjpeg-2.1.0.tar.gz" -sha512sums="3da84d7828a82c738f6ea5fe776c989283ba257cc6884aebfc090cee7e33c88471dee1a93f4a87a300b11f43b98f6624b838171f06227add24afcb1d57208df1 openjpeg-2.1.0.tar.gz" +md5sums="f6419fcc233df84f9a81eb36633c6db6 openjpeg-2.1.0.tar.gz +c4d44799e0f048d4e8ea63dc66c043c2 CVE-2015-6581.patch +5dfdfba1783e5f62a4270b0a3681e77f fix-use-after-free.patch" +sha256sums="1232bb814fd88d8ed314c94f0bfebb03de8559583a33abbe8c64ef3fc0a8ff03 openjpeg-2.1.0.tar.gz +bb970ede0eeb5b2b849fe4a6ec93114bb8887160fdf06cc77f179866b5fc9ad8 CVE-2015-6581.patch +fc7205e89cc8221511d8bd056254b56445ff872b3fd217bfb6295f3989b2c9cc fix-use-after-free.patch" +sha512sums="3da84d7828a82c738f6ea5fe776c989283ba257cc6884aebfc090cee7e33c88471dee1a93f4a87a300b11f43b98f6624b838171f06227add24afcb1d57208df1 openjpeg-2.1.0.tar.gz +cf6b65b955de0de29af6b6be4d09c172a153f881be07e3e80435fdcdfe3fae07c4e11138ba76fb62f2ec1adb8043d580b4bfcf5e0807e82ec36307b0cb18f67f CVE-2015-6581.patch +a1cebeb7933bf10b47ebe420b71c0e2a83eb269028cf42aae08eb9b8a36b19df4c94c91ae1ef3d13e0a284f34ac0bd989e56f8071f0c0a3ca0326cc8d2502d91 fix-use-after-free.patch" diff --git a/main/openjpeg/CVE-2015-6581.patch b/main/openjpeg/CVE-2015-6581.patch new file mode 100644 index 0000000000..e1ff602196 --- /dev/null +++ b/main/openjpeg/CVE-2015-6581.patch @@ -0,0 +1,44 @@ +From 0fa5a17c98c4b8f9ee2286f4f0a50cf52a5fccb0 Mon Sep 17 00:00:00 2001 +From: Matthieu Darbois +Date: Tue, 19 May 2015 21:57:27 +0000 +Subject: [PATCH] [trunk] Correct potential double free on malloc failure in + opj_j2k_copy_default_tcp_and_create_tcp (fixes issue 492) + +--- + src/lib/openjp2/j2k.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c +index 8c62a39..cbdd368 100644 +--- a/src/lib/openjp2/j2k.c ++++ b/src/lib/openjp2/j2k.c +@@ -7365,6 +7365,12 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd ( opj_j2k_t * p_j2 + l_tcp->cod = 0; + l_tcp->ppt = 0; + l_tcp->ppt_data = 00; ++ /* Remove memory not owned by this tile in case of early error return. */ ++ l_tcp->m_mct_decoding_matrix = 00; ++ l_tcp->m_nb_max_mct_records = 0; ++ l_tcp->m_mct_records = 00; ++ l_tcp->m_nb_max_mcc_records = 0; ++ l_tcp->m_mcc_records = 00; + /* Reconnect the tile-compo coding parameters pointer to the current tile coding parameters*/ + l_tcp->tccps = l_current_tccp; + +@@ -7402,6 +7408,8 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd ( opj_j2k_t * p_j2 + + ++l_src_mct_rec; + ++l_dest_mct_rec; ++ /* Update with each pass to free exactly what has been allocated on early return. */ ++ l_tcp->m_nb_max_mct_records += 1; + } + + /* Get the mcc_record of the dflt_tile_cp and copy them into the current tile cp*/ +@@ -7411,6 +7419,7 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd ( opj_j2k_t * p_j2 + return OPJ_FALSE; + } + memcpy(l_tcp->m_mcc_records,l_default_tcp->m_mcc_records,l_mcc_records_size); ++ l_tcp->m_nb_max_mcc_records = l_default_tcp->m_nb_max_mcc_records; + + /* Copy the mcc record data from dflt_tile_cp to the current tile*/ + l_src_mcc_rec = l_default_tcp->m_mcc_records; diff --git a/main/openjpeg/fix-use-after-free.patch b/main/openjpeg/fix-use-after-free.patch new file mode 100644 index 0000000000..6dbffbae30 --- /dev/null +++ b/main/openjpeg/fix-use-after-free.patch @@ -0,0 +1,45 @@ +From 940100c28ae28931722290794889cf84a92c5f6f Mon Sep 17 00:00:00 2001 +From: mayeut +Date: Sun, 6 Sep 2015 17:24:03 +0200 +Subject: [PATCH] Fix potential use-after-free in opj_j2k_write_mco function + +Fixes #563 +--- + src/lib/openjp2/j2k.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c +index 19a48f5..d487d89 100644 +--- a/src/lib/openjp2/j2k.c ++++ b/src/lib/openjp2/j2k.c +@@ -5559,8 +5559,7 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k, + assert(p_stream != 00); + + l_tcp =&(p_j2k->m_cp.tcps[p_j2k->m_current_tile_number]); +- l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data; +- ++ + l_mco_size = 5 + l_tcp->m_nb_mcc_records; + if (l_mco_size > p_j2k->m_specific_param.m_encoder.m_header_tile_data_size) { + +@@ -5575,6 +5574,8 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k, + p_j2k->m_specific_param.m_encoder.m_header_tile_data = new_header_tile_data; + p_j2k->m_specific_param.m_encoder.m_header_tile_data_size = l_mco_size; + } ++ l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data; ++ + + opj_write_bytes(l_current_data,J2K_MS_MCO,2); /* MCO */ + l_current_data += 2; +@@ -5586,10 +5587,9 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k, + ++l_current_data; + + l_mcc_record = l_tcp->m_mcc_records; +- for (i=0;im_nb_mcc_records;++i) { ++ for (i=0;im_nb_mcc_records;++i) { + opj_write_bytes(l_current_data,l_mcc_record->m_index,1);/* Imco -> use the mcc indicated by 1*/ + ++l_current_data; +- + ++l_mcc_record; + } + -- cgit v1.2.3