CVE-2024-56827:
A flaw was found in the OpenJPEG project. A heap buffer overflow
condition may be triggered when certain options are specified while
using the opj_decompress utility. This can lead to an application crash
or other undefined behavior.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-56827]
[https://github.com/uclouvain/openjpeg/issues/1564]
Upstream patches:
[e492644fbd]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2024-56826:
A flaw was found in the OpenJPEG project. A heap buffer overflow
condition may be triggered when certain options are specified while
using the opj_decompress utility. This can lead to an application crash
or other undefined behavior.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-56826]
[https://github.com/uclouvain/openjpeg/issues/1563]
Upstream patches:
[98592ee6d6]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The command "bitbake universe -c fetch" currently throws a ton of warnings
as there are many 'impossible' dependencies.
In some cases these variants may never have worked and were just added by copy
and paste of recipes. In some cases they once clearly did work but became
broken somewhere along the way. Users may also be carrying local bbappend files
which add further BBCLASSEXTEND.
Having universe fetch work without warnings is desireable so clean up the broken
variants. Anyone actually needing something dropped here can propose adding it
and the correct functional dependencies back quite easily. This also then
ensures we're not carrying or fixing things nobody uses.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9962d57f7c235873de0a0bb192b5f56747762fc7)
Backport:
* Updated paths to follow PV changes
* Adapted modified recipes to the ones generating warnings
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This CVE is patched in our version of openjpeg. The NVD database doesn't
include a version range this is why it's still reported.
Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
CVE: CVE-2022-1122
The defect is undergoing reanalysis and there may be follow-up commits.
Ref:
* https://github.com/uclouvain/openjpeg/issues/1368
Signed-off-by: Nicolas Marguet <nicolas.marguet@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This patch updates SRC_URIs using git to include branch=master if no branch is set
and also to use protocol=https for github urls as generated by the conversion script
in OE-Core.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This is the result of automated script (0.9.1) conversion:
oe-core/scripts/contrib/convert-overrides.py .
converting the metadata to use ":" as the override character instead of "_".
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
CVE-2020-15389.patch
CVE-2020-6851.patch
CVE-2020-8112.patch
Removed since these are included in 2.4.0.
Fixed an error where openjpeg.h could not be found.
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The License of openjpeg is BSD-2-Clause.
Signed-off-by: Christophe Priouzeau <christophe.priouzeau@st.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrading fixes CVE-2018-21010 and incorporates other bug fixes
from upstream.
The source upgrade to 2.3.1 changed the way include directories are
identified, so the patch 0001-Ensure-cmake-files-are-installed-at-common-location.patch
is no longer needed to help poppler find cmake files.
The contents of /usr/lib/openjpeg-2.3 were added to the FILES
list since poppler needs them to build.
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* Move *,cmake from ${libdir}/cmake to ${libdir}/cmake/<name-and-version>
That is standard location cmake files are installed.
* Do not export executables - they will not be found in dependant's sysroot
Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The cmake.bbclass in oe-core now ensures that ${libdir}/cmake and
${datadir}/cmake end up in the dev package, so recipes no longer need to
provide custom packaging rules to handles these files.
http://git.openembedded.org/openembedded-core/commit/?id=d91dc4666683a96e9d03cbbd21b8a546f9069c93
Originally-conceived-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Rename the download file to avoid collisions in DL_DIR.
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
As the package maintainer said, this is mostly a release with:
"the huge amount of critical bug fixes brought to the library since 2 years"
The full list of bugs fixed and other changes is here:
https://github.com/uclouvain/openjpeg/blob/openjpeg-2.1/CHANGELOG.md
The homepage link was broken so that was fixed.
The project also moved to github and does not appear
to provide tarballs other than via github archives so
the SRC_URI was updated.
An explicit dependency on zlib was added even though cmake was finding
the sysroot version.
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
When MACHINE=qemux86-64 and enable multilib:
ERROR: QA Issue: openjpeg: Files/directories were installed but not
shipped in any package:
/usr/lib
/usr/lib/libopenjp2.so
/usr/lib/libopenjp2.so.2.1.0
/usr/lib/libopenjp2.so.7
/usr/lib/.debug
/usr/lib/pkgconfig
/usr/lib/.debug/libopenjp2.so.2.1.0
/usr/lib/pkgconfig/libopenjp2.pc
Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install. [installed-vs-shipped]
Pass the correct libdir configuration option to cmake.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
