helium-3rd-party/meta-openembedded
1
0
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-04-02 02:49:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

jasper: patch CVE-2025-8836

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-8836

Pick the patch mentioned in the details of the above link.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This commit is contained in:
Gyorgy Sarvari 2025-10-09 20:10:06 +02:00
parent 9ed43a962b
commit 90bc4f0011
2 changed files with 81 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
meta-oe/recipes-graphics/jasper/jasper/0001-Fixes-401.patch Normal file
View File

@ -0,0 +1,80 @@
From 1d4faf90eb0e89b5e10804af00cfe9cb9b48a087 Mon Sep 17 00:00:00 2001
From: Michael Adams <mdadams@ece.uvic.ca>
Date: Sat, 2 Aug 2025 18:00:39 -0700
Subject: [PATCH] Fixes #401.
JPEG-2000 (JPC) Encoder:
- Added some missing range checking on several coding parameters
(e.g., precint width/height and codeblock width/height).
CVE: CVE-2025-8836
Upstream-Status: Backport [https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
src/libjasper/jpc/jpc_enc.c | 30 ++++++++++++++++++++++++------
src/libjasper/jpc/jpc_t2dec.c | 3 ++-
2 files changed, 26 insertions(+), 7 deletions(-)
create mode 100644 data/test/other/poc_401.pnm
diff --git a/src/libjasper/jpc/jpc_enc.c b/src/libjasper/jpc/jpc_enc.c
index 041c030..e910a86 100644
--- a/src/libjasper/jpc/jpc_enc.c
+++ b/src/libjasper/jpc/jpc_enc.c
@@ -484,18 +484,36 @@ static jpc_enc_cp_t *cp_create(const char *optstr, jas_image_t *image)
cp->tileheight = atoi(jas_tvparser_getval(tvp));
break;
case OPT_PRCWIDTH:
- prcwidthexpn = jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
+ i = atoi(jas_tvparser_getval(tvp));
+ if (i <= 0) {
+ jas_logerrorf("invalid precinct width (%d)\n", i);
+ goto error;
+ }
+ prcwidthexpn = jpc_floorlog2(i);
break;
case OPT_PRCHEIGHT:
- prcheightexpn = jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
+ i = atoi(jas_tvparser_getval(tvp));
+ if (i <= 0) {
+ jas_logerrorf("invalid precinct height (%d)\n", i);
+ goto error;
+ }
+ prcheightexpn = jpc_floorlog2(i);
break;
case OPT_CBLKWIDTH:
- tccp->cblkwidthexpn =
- jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
+ i = atoi(jas_tvparser_getval(tvp));
+ if (i <= 0) {
+ jas_logerrorf("invalid code block width (%d)\n", i);
+ goto error;
+ }
+ tccp->cblkwidthexpn = jpc_floorlog2(i);
break;
case OPT_CBLKHEIGHT:
- tccp->cblkheightexpn =
- jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
+ i = atoi(jas_tvparser_getval(tvp));
+ if (i <= 0) {
+ jas_logerrorf("invalid code block height (%d)\n", i);
+ goto error;
+ }
+ tccp->cblkheightexpn = jpc_floorlog2(i);
break;
case OPT_MODE:
if ((tagid = jas_taginfo_nonull(jas_taginfos_lookup(modetab,
diff --git a/src/libjasper/jpc/jpc_t2dec.c b/src/libjasper/jpc/jpc_t2dec.c
index de77623..1eff88a 100644
--- a/src/libjasper/jpc/jpc_t2dec.c
+++ b/src/libjasper/jpc/jpc_t2dec.c
@@ -348,7 +348,8 @@ static int jpc_dec_decodepkt(jpc_dec_t *dec, jas_stream_t *pkthdrstream, jas_str
const unsigned n = JAS_MIN((unsigned)numnewpasses, maxpasses);
mycounter += n;
numnewpasses -= n;
- if ((len = jpc_bitstream_getbits(inb, cblk->numlenbits + jpc_floorlog2(n))) < 0) {
+ if ((len = jpc_bitstream_getbits(inb,
+ cblk->numlenbits + jpc_floorlog2(n))) < 0) {
jpc_bitstream_close(inb);
jas_logerrorf("cannot get bits\n");
return -1;

1
meta-oe/recipes-graphics/jasper/jasper_4.2.4.bb
View File

@ -5,6 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=a80440d1d8f17d041c71c7271d6e06eb"
SRC_URI = "https://github.com/jasper-software/${BPN}/releases/download/version-${PV}/${BP}.tar.gz \
file://0001-Fixes-400.patch \
file://0001-Fixes-401.patch \
"
SRC_URI[sha256sum] = "6a597613d8d84c500b5b83bf0eec06cd3707c23d19957f70354ac2394c9914e7"