helium-3rd-party/meta-openembedded
1
0
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-04-02 02:49:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

exiv2: patch CVE-2021-37615 and CVE-2021-37616

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-37615
https://nvd.nist.gov/vuln/detail/CVE-2021-37616

Backport the patches from the PR that is referenced by the NVD advisory.
Both CVEs are fixed by the same PR.

Note that the patch that added a regression test is not included. This
is because it contains a binary patch, which seems to be impossible
to apply with all patchtools during do_patch. Though it is not included
in this patch, it was applied manually during prepration, and all ptests
(including the new regression test) passed successfully.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This commit is contained in:
Gyorgy Sarvari 2026-02-28 21:24:25 +01:00
parent 77c9119674
commit f104fc88bb
3 changed files with 224 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
meta-oe/recipes-support/exiv2/exiv2/CVE-2021-37615-1.patch Normal file
View File

@ -0,0 +1,80 @@
From 8e7363ed17e9c3377e7cec1b3d05841e339fc555 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Fri, 2 Jul 2021 17:19:58 +0100
Subject: [PATCH] Throw exception if lens info wasn't found.
CVE: CVE-2021-37615 CVE-2021-37616
Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/98fb218475948cbaef9549f7de3e9bbe9cc80e16]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
src/pentaxmn_int.cpp | 36 ++++++++++++++++++++++--------------
1 file changed, 22 insertions(+), 14 deletions(-)
diff --git a/src/pentaxmn_int.cpp b/src/pentaxmn_int.cpp
index de1ba75..3dac885 100644
--- a/src/pentaxmn_int.cpp
+++ b/src/pentaxmn_int.cpp
@@ -1216,6 +1216,25 @@ namespace Exiv2 {
return result;
}
+ // Exception thrown by findLensInfo when the lens info can't be found.
+ class LensInfoNotFound : public std::exception {
+ public:
+ LensInfoNotFound() {}
+ };
+
+ // Throws std::exception if the LensInfo can't be found.
+ static ExifData::const_iterator findLensInfo(const ExifData* metadata) {
+ const ExifData::const_iterator dngLensInfo = metadata->findKey(ExifKey("Exif.PentaxDng.LensInfo"));
+ if (dngLensInfo != metadata->end()) {
+ return dngLensInfo;
+ }
+ const ExifData::const_iterator lensInfo = metadata->findKey(ExifKey("Exif.Pentax.LensInfo"));
+ if (lensInfo != metadata->end()) {
+ return lensInfo;
+ }
+ throw LensInfoNotFound();
+ }
+
//! resolveLens0x32c print lens in human format
std::ostream& resolveLens0x32c(std::ostream& os, const Value& value,
const ExifData* metadata)
@@ -1251,12 +1270,7 @@ namespace Exiv2 {
try {
unsigned long index = 0;
- // http://www.sno.phy.queensu.ca/~phil/exiftool/TagNames/Pentax.html#LensData
- const ExifData::const_iterator lensInfo = metadata->findKey(ExifKey("Exif.PentaxDng.LensInfo")) != metadata->end()
- ? metadata->findKey(ExifKey("Exif.PentaxDng.LensInfo"))
- : metadata->findKey(ExifKey("Exif.Pentax.LensInfo"))
- ;
- if ( lensInfo == metadata->end() ) return EXV_PRINT_COMBITAG_MULTI(pentaxLensType, 2, 1, 2)(os, value, metadata);
+ const ExifData::const_iterator lensInfo = findLensInfo(metadata);
if ( lensInfo->count() < 5 ) return EXV_PRINT_COMBITAG_MULTI(pentaxLensType, 2, 1, 2)(os, value, metadata);
if ( value.count() == 2 ) {
@@ -1310,10 +1324,7 @@ namespace Exiv2 {
try {
unsigned long index = 0;
- const ExifData::const_iterator lensInfo = metadata->findKey(ExifKey("Exif.PentaxDng.LensInfo")) != metadata->end()
- ? metadata->findKey(ExifKey("Exif.PentaxDng.LensInfo"))
- : metadata->findKey(ExifKey("Exif.Pentax.LensInfo"))
- ;
+ const ExifData::const_iterator lensInfo = findLensInfo(metadata);
if ( value.count() == 4 ) {
std::string model = getKeyString("Exif.Image.Model" ,metadata);
if ( model.find("PENTAX K-3")==0 && lensInfo->count() == 128 && lensInfo->toLong(1) == 168 && lensInfo->toLong(2) == 144 ) index = 7;
@@ -1338,10 +1349,7 @@ namespace Exiv2 {
try {
unsigned long index = 0;
- const ExifData::const_iterator lensInfo = metadata->findKey(ExifKey("Exif.PentaxDng.LensInfo")) != metadata->end()
- ? metadata->findKey(ExifKey("Exif.PentaxDng.LensInfo"))
- : metadata->findKey(ExifKey("Exif.Pentax.LensInfo"))
- ;
+ const ExifData::const_iterator lensInfo = findLensInfo(metadata);
if ( value.count() == 4 ) {
std::string model = getKeyString("Exif.Image.Model" ,metadata);
if ( model.find("PENTAX K-3")==0 && lensInfo->count() == 128 && lensInfo->toLong(1) == 131 && lensInfo->toLong(2) == 128 )

142
meta-oe/recipes-support/exiv2/exiv2/CVE-2021-37615-2.patch Normal file
View File

@ -0,0 +1,142 @@
From 93f866b969b4e998b43839119ae6c912ddc6e901 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Sat, 3 Jul 2021 22:36:53 +0100
Subject: [PATCH] Check that findKey didn't return end().
CVE: CVE-2021-37615 CVE-2021-37616
Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/c2b52119d4f8d9ecb02056698fc8f6afd793db5e]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
src/convert.cpp | 33 ++++++++++++++++++---------------
src/crwimage_int.cpp | 12 ++++++++++--
src/exif.cpp | 4 ++--
src/iptc.cpp | 4 ++--
src/xmp.cpp | 4 ++--
5 files changed, 34 insertions(+), 23 deletions(-)
diff --git a/src/convert.cpp b/src/convert.cpp
index 25fb587..63fa4ea 100644
--- a/src/convert.cpp
+++ b/src/convert.cpp
@@ -665,16 +665,17 @@ namespace Exiv2 {
if (subsecTag) {
ExifData::iterator subsec_pos = exifData_->findKey(ExifKey(subsecTag));
- if ( subsec_pos != exifData_->end()
- && subsec_pos->typeId() == asciiString) {
- std::string ss = subsec_pos->toString();
- if (!ss.empty()) {
- bool ok = false;
- stringTo<long>(ss, ok);
- if (ok) subsec = std::string(".") + ss;
+ if (subsec_pos != exifData_->end()) {
+ if (subsec_pos->typeId() == asciiString) {
+ std::string ss = subsec_pos->toString();
+ if (!ss.empty()) {
+ bool ok = false;
+ stringTo<long>(ss, ok);
+ if (ok) subsec = std::string(".") + ss;
+ }
}
+ if (erase_) exifData_->erase(subsec_pos);
}
- if (erase_) exifData_->erase(subsec_pos);
}
if (subsec.size() > 10) subsec = subsec.substr(0, 10);
@@ -1027,18 +1028,20 @@ namespace Exiv2 {
#endif
}
pos = xmpData_->findKey(XmpKey(std::string(from) + "/exif:RedEyeMode"));
- if (pos != xmpData_->end() && pos->count() > 0) {
- int red = pos->toLong();
- if (pos->value().ok())
- value |= (red & 1) << 6;
+ if (pos != xmpData_->end()) {
+ if (pos->count() > 0) {
+ int red = pos->toLong();
+ if (pos->value().ok())
+ value |= (red & 1) << 6;
#ifndef SUPPRESS_WARNINGS
- else
- EXV_WARNING << "Failed to convert " << std::string(from) + "/exif:RedEyeMode" << " to " << to << "\n";
+ else
+ EXV_WARNING << "Failed to convert " << std::string(from) + "/exif:RedEyeMode" << " to " << to << "\n";
#endif
+ }
+ if (erase_) xmpData_->erase(pos);
}
(*exifData_)[to] = value;
- if (erase_) xmpData_->erase(pos);
}
void Converter::cnvXmpGPSCoord(const char* from, const char* to)
diff --git a/src/crwimage_int.cpp b/src/crwimage_int.cpp
index 4ccea63..570de75 100644
--- a/src/crwimage_int.cpp
+++ b/src/crwimage_int.cpp
@@ -1084,8 +1084,16 @@ namespace Exiv2 {
if (ed2 != edEnd) size += ed2->size();
if (size != 0) {
DataBuf buf(size);
- if (ed1 != edEnd) ed1->copy(buf.pData_, pHead->byteOrder());
- if (ed2 != edEnd) ed2->copy(buf.pData_ + ed1->size(), pHead->byteOrder());
+ long pos = 0;
+ if (ed1 != edEnd) {
+ ed1->copy(buf.pData_, pHead->byteOrder());
+ pos += ed1->size();
+ }
+ if (ed2 != edEnd) {
+ ed2->copy(buf.pData_ + pos, pHead->byteOrder());
+ pos += ed2->size();
+ }
+ assert(pos == size);
pHead->add(pCrwMapping->crwTagId_, pCrwMapping->crwDir_, buf);
}
else {
diff --git a/src/exif.cpp b/src/exif.cpp
index de93980..d312292 100644
--- a/src/exif.cpp
+++ b/src/exif.cpp
@@ -564,8 +564,8 @@ namespace Exiv2 {
ExifKey exifKey(key);
iterator pos = findKey(exifKey);
if (pos == end()) {
- add(Exifdatum(exifKey));
- pos = findKey(exifKey);
+ exifMetadata_.push_back(Exifdatum(exifKey));
+ return exifMetadata_.back();
}
return *pos;
}
diff --git a/src/iptc.cpp b/src/iptc.cpp
index 8e54b9c..c710f0f 100644
--- a/src/iptc.cpp
+++ b/src/iptc.cpp
@@ -269,8 +269,8 @@ namespace Exiv2 {
IptcKey iptcKey(key);
iterator pos = findKey(iptcKey);
if (pos == end()) {
- add(Iptcdatum(iptcKey));
- pos = findKey(iptcKey);
+ iptcMetadata_.push_back(Iptcdatum(iptcKey));
+ return iptcMetadata_.back();
}
return *pos;
}
diff --git a/src/xmp.cpp b/src/xmp.cpp
index 0b7ade0..03ce7e0 100644
--- a/src/xmp.cpp
+++ b/src/xmp.cpp
@@ -313,8 +313,8 @@ namespace Exiv2 {
XmpKey xmpKey(key);
iterator pos = findKey(xmpKey);
if (pos == end()) {
- add(Xmpdatum(xmpKey));
- pos = findKey(xmpKey);
+ xmpMetadata_.push_back(Xmpdatum(xmpKey));
+ return xmpMetadata_.back();
}
return *pos;
}

2
meta-oe/recipes-support/exiv2/exiv2_0.27.3.bb
View File

@ -22,6 +22,8 @@ SRC_URI = "https://github.com/Exiv2/${BPN}/releases/download/v${PV}/${BP}-Source
file://CVE-2021-34334-4.patch \
file://CVE-2021-34335-1.patch \
file://CVE-2021-34335-2.patch \
file://CVE-2021-37615-1.patch \
file://CVE-2021-37615-2.patch \
"
SRC_URI[sha256sum] = "a79f5613812aa21755d578a297874fb59a85101e793edc64ec2c6bd994e3e778"