Attachment 200585 Details for Bug 234473 – openjpeg.patch

[patch] openjpeg.patch

openjpeg.patch (text/plain), 3.32 KB, created by Andres Montalban on 2018-12-28 18:40:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andres Montalban

Created: 2018-12-28 18:40:25 UTC

Size: 3.32 KB

patch

obsolete

>diff -urN openjpeg.orig/Makefile openjpeg/Makefile
>--- openjpeg.orig/Makefile	2018-09-24 18:54:18.000000000 +0000
>+++ openjpeg/Makefile	2018-12-28 18:05:32.625766000 +0000
>@@ -3,7 +3,7 @@
> 
> PORTNAME=	openjpeg
> PORTVERSION=	2.3.0
>-PORTREVISION=	2
>+PORTREVISION=	3
> DISTVERSIONPREFIX=	v
> CATEGORIES=	graphics
> 
>diff -urN openjpeg.orig/files/patch-src-bin-jp2-convertbmp.c openjpeg/files/patch-src-bin-jp2-convertbmp.c
>--- openjpeg.orig/files/patch-src-bin-jp2-convertbmp.c	2018-09-24 18:54:18.000000000 +0000
>+++ openjpeg/files/patch-src-bin-jp2-convertbmp.c	2018-12-28 18:13:10.760361000 +0000
>@@ -2,9 +2,13 @@
> 
> Obtained from:	https://github.com/uclouvain/openjpeg/commit/ca16fe55014c57090dd97369256c7657aeb25975
> 
>---- src/bin/jp2/convertbmp.c.orig	2017-10-04 22:23:14 UTC
>-+++ src/bin/jp2/convertbmp.c
>-@@ -435,16 +435,31 @@ static OPJ_BOOL bmp_read_info_header(FIL
>+Fix CVE-2018-6616
>+
>+Obtained from:	https://github.com/uclouvain/openjpeg/commit/8ee335227bbcaf1614124046aa25e53d67b11ec3
>+
>+--- src/bin/jp2/convertbmp.c.orig	2018-12-28 16:22:32.277376000 +0000
>++++ src/bin/jp2/convertbmp.c	2018-12-28 16:22:48.328712000 +0000
>+@@ -435,16 +435,31 @@
>          header->biRedMask |= (OPJ_UINT32)getc(IN) << 16;
>          header->biRedMask |= (OPJ_UINT32)getc(IN) << 24;
>  
>@@ -36,7 +40,62 @@
>          header->biAlphaMask  = (OPJ_UINT32)getc(IN);
>          header->biAlphaMask |= (OPJ_UINT32)getc(IN) << 8;
>          header->biAlphaMask |= (OPJ_UINT32)getc(IN) << 16;
>-@@ -831,6 +846,12 @@ opj_image_t* bmptoimage(const char *file
>+@@ -519,14 +534,14 @@
>+ static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData,
>+                                    OPJ_UINT32 stride, OPJ_UINT32 width, OPJ_UINT32 height)
>+ {
>+-    OPJ_UINT32 x, y;
>++    OPJ_UINT32 x, y, written;
>+     OPJ_UINT8 *pix;
>+     const OPJ_UINT8 *beyond;
>+ 
>+     beyond = pData + stride * height;
>+     pix = pData;
>+ 
>+-    x = y = 0U;
>++    x = y = written = 0U;
>+     while (y < height) {
>+         int c = getc(IN);
>+         if (c == EOF) {
>+@@ -546,6 +561,7 @@
>+             for (j = 0; (j < c) && (x < width) &&
>+                     ((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
>+                 *pix = c1;
>++                written++;
>+             }
>+         } else {
>+             c = getc(IN);
>+@@ -583,6 +599,7 @@
>+                     }
>+                     c1 = (OPJ_UINT8)c1_int;
>+                     *pix = c1;
>++                    written++;
>+                 }
>+                 if ((OPJ_UINT32)c & 1U) { /* skip padding byte */
>+                     c = getc(IN);
>+@@ -593,6 +610,12 @@
>+             }
>+         }
>+     }/* while() */
>++
>++    if (written != width * height) {
>++        fprintf(stderr, "warning, image's actual size does not match advertized one\n");
>++        return OPJ_FALSE;
>++    }
>++
>+     return OPJ_TRUE;
>+ }
>+ 
>+@@ -748,7 +771,7 @@
>+         fclose(IN);
>+         return NULL;
>+     }
>+-    pData = (OPJ_UINT8 *) calloc(1, stride * Info_h.biHeight * sizeof(OPJ_UINT8));
>++    pData = (OPJ_UINT8 *) calloc(1, sizeof(OPJ_UINT8) * stride * Info_h.biHeight);
>+     if (pData == NULL) {
>+         fclose(IN);
>+         return NULL;
>+@@ -831,6 +854,12 @@
>          bmpmask32toimage(pData, stride, image, 0x00FF0000U, 0x0000FF00U, 0x000000FFU,
>                           0x00000000U);
>      } else if (Info_h.biBitCount == 32 && Info_h.biCompression == 3) { /* bitmask */

Actions: View | Diff

Attachments on bug 234473: 200585 | 200586