main/openjpg: security fix for CVE-2015-6581

also add upstream fix a potensial use-after-free

ref #4752
fixes #4753

3 files changed, 101 insertions, 4 deletions

diff --git a/main/openjpeg/APKBUILD b/main/openjpeg/APKBUILD
index fe107f92c9..9e340a68ed 100644
--- a/main/openjpeg/APKBUILD
+++ b/main/openjpeg/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer:
 pkgname=openjpeg
 pkgver=2.1.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Open-source implementation of JPEG2000 image codec"
 url="http://www.openjpeg.org/"
 arch="all"
@@ -13,6 +13,8 @@ makedepends="$depends_dev libpng-dev tiff-dev lcms-dev doxygen cmake"
 install=""
 subpackages="$pkgname-dev $pkgname-tools"
 source="http://downloads.sourceforge.net/project/openjpeg.mirror/$pkgver/openjpeg-$pkgver.tar.gz
+	CVE-2015-6581.patch
+	fix-use-after-free.patch
 	"
 
 _builddir="${srcdir}/$pkgname-$pkgver"
@@ -48,6 +50,12 @@ tools() {
 	mv "$pkgdir"/usr/bin "$subpkgdir"/usr/
 }
 
-md5sums="f6419fcc233df84f9a81eb36633c6db6  openjpeg-2.1.0.tar.gz"
-sha256sums="1232bb814fd88d8ed314c94f0bfebb03de8559583a33abbe8c64ef3fc0a8ff03  openjpeg-2.1.0.tar.gz"
-sha512sums="3da84d7828a82c738f6ea5fe776c989283ba257cc6884aebfc090cee7e33c88471dee1a93f4a87a300b11f43b98f6624b838171f06227add24afcb1d57208df1  openjpeg-2.1.0.tar.gz"
+md5sums="f6419fcc233df84f9a81eb36633c6db6  openjpeg-2.1.0.tar.gz
+c4d44799e0f048d4e8ea63dc66c043c2  CVE-2015-6581.patch
+5dfdfba1783e5f62a4270b0a3681e77f  fix-use-after-free.patch"
+sha256sums="1232bb814fd88d8ed314c94f0bfebb03de8559583a33abbe8c64ef3fc0a8ff03  openjpeg-2.1.0.tar.gz
+bb970ede0eeb5b2b849fe4a6ec93114bb8887160fdf06cc77f179866b5fc9ad8  CVE-2015-6581.patch
+fc7205e89cc8221511d8bd056254b56445ff872b3fd217bfb6295f3989b2c9cc  fix-use-after-free.patch"
+sha512sums="3da84d7828a82c738f6ea5fe776c989283ba257cc6884aebfc090cee7e33c88471dee1a93f4a87a300b11f43b98f6624b838171f06227add24afcb1d57208df1  openjpeg-2.1.0.tar.gz
+cf6b65b955de0de29af6b6be4d09c172a153f881be07e3e80435fdcdfe3fae07c4e11138ba76fb62f2ec1adb8043d580b4bfcf5e0807e82ec36307b0cb18f67f  CVE-2015-6581.patch
+a1cebeb7933bf10b47ebe420b71c0e2a83eb269028cf42aae08eb9b8a36b19df4c94c91ae1ef3d13e0a284f34ac0bd989e56f8071f0c0a3ca0326cc8d2502d91  fix-use-after-free.patch"
diff --git a/main/openjpeg/CVE-2015-6581.patch b/main/openjpeg/CVE-2015-6581.patch
new file mode 100644
index 0000000000..e1ff602196
--- /dev/null
+++ b/main/openjpeg/CVE-2015-6581.patch
@@ -0,0 +1,44 @@
+From 0fa5a17c98c4b8f9ee2286f4f0a50cf52a5fccb0 Mon Sep 17 00:00:00 2001
+From: Matthieu Darbois <mayeut@users.noreply.github.com>
+Date: Tue, 19 May 2015 21:57:27 +0000
+Subject: [PATCH] [trunk] Correct potential double free on malloc failure in
+ opj_j2k_copy_default_tcp_and_create_tcp (fixes issue 492)
+
+---
+ src/lib/openjp2/j2k.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c
+index 8c62a39..cbdd368 100644
+--- a/src/lib/openjp2/j2k.c
++++ b/src/lib/openjp2/j2k.c
+@@ -7365,6 +7365,12 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd (       opj_j2k_t * p_j2
+                 l_tcp->cod = 0;
+                 l_tcp->ppt = 0;
+                 l_tcp->ppt_data = 00;
++                /* Remove memory not owned by this tile in case of early error return. */
++                l_tcp->m_mct_decoding_matrix = 00;
++                l_tcp->m_nb_max_mct_records = 0;
++                l_tcp->m_mct_records = 00;
++                l_tcp->m_nb_max_mcc_records = 0;
++                l_tcp->m_mcc_records = 00;
+                 /* Reconnect the tile-compo coding parameters pointer to the current tile coding parameters*/
+                 l_tcp->tccps = l_current_tccp;
+ 
+@@ -7402,6 +7408,8 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd (       opj_j2k_t * p_j2
+ 
+                         ++l_src_mct_rec;
+                         ++l_dest_mct_rec;
++                        /* Update with each pass to free exactly what has been allocated on early return. */
++                        l_tcp->m_nb_max_mct_records += 1;
+                 }
+ 
+                 /* Get the mcc_record of the dflt_tile_cp and copy them into the current tile cp*/
+@@ -7411,6 +7419,7 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd (       opj_j2k_t * p_j2
+                         return OPJ_FALSE;
+                 }
+                 memcpy(l_tcp->m_mcc_records,l_default_tcp->m_mcc_records,l_mcc_records_size);
++                l_tcp->m_nb_max_mcc_records = l_default_tcp->m_nb_max_mcc_records;
+ 
+                 /* Copy the mcc record data from dflt_tile_cp to the current tile*/
+                 l_src_mcc_rec = l_default_tcp->m_mcc_records;
diff --git a/main/openjpeg/fix-use-after-free.patch b/main/openjpeg/fix-use-after-free.patch
new file mode 100644
index 0000000000..6dbffbae30
--- /dev/null
+++ b/main/openjpeg/fix-use-after-free.patch
@@ -0,0 +1,45 @@
+From 940100c28ae28931722290794889cf84a92c5f6f Mon Sep 17 00:00:00 2001
+From: mayeut <mayeut@users.noreply.github.com>
+Date: Sun, 6 Sep 2015 17:24:03 +0200
+Subject: [PATCH] Fix potential use-after-free in opj_j2k_write_mco function
+
+Fixes #563
+---
+ src/lib/openjp2/j2k.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c
+index 19a48f5..d487d89 100644
+--- a/src/lib/openjp2/j2k.c
++++ b/src/lib/openjp2/j2k.c
+@@ -5559,8 +5559,7 @@ static OPJ_BOOL opj_j2k_write_mco(     opj_j2k_t *p_j2k,
+         assert(p_stream != 00);
+ 
+         l_tcp =&(p_j2k->m_cp.tcps[p_j2k->m_current_tile_number]);
+-        l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data;
+-
++	
+         l_mco_size = 5 + l_tcp->m_nb_mcc_records;
+         if (l_mco_size > p_j2k->m_specific_param.m_encoder.m_header_tile_data_size) {
+ 
+@@ -5575,6 +5574,8 @@ static OPJ_BOOL opj_j2k_write_mco(     opj_j2k_t *p_j2k,
+                 p_j2k->m_specific_param.m_encoder.m_header_tile_data = new_header_tile_data;
+                 p_j2k->m_specific_param.m_encoder.m_header_tile_data_size = l_mco_size;
+         }
++        l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data;
++
+ 
+         opj_write_bytes(l_current_data,J2K_MS_MCO,2);                   /* MCO */
+         l_current_data += 2;
+@@ -5586,10 +5587,9 @@ static OPJ_BOOL opj_j2k_write_mco(     opj_j2k_t *p_j2k,
+         ++l_current_data;
+ 
+         l_mcc_record = l_tcp->m_mcc_records;
+-        for     (i=0;i<l_tcp->m_nb_mcc_records;++i) {
++        for (i=0;i<l_tcp->m_nb_mcc_records;++i) {
+                 opj_write_bytes(l_current_data,l_mcc_record->m_index,1);/* Imco -> use the mcc indicated by 1*/
+                 ++l_current_data;
+-
+                 ++l_mcc_record;
+         }
+