* [gentoo-commits] repo/gentoo:master commit in: media-libs/jbig2dec/, media-libs/jbig2dec/files/
@ 2017-05-30 19:36 Andreas Hüttel
0 siblings, 0 replies; 2+ messages in thread
From: Andreas Hüttel @ 2017-05-30 19:36 UTC (permalink / raw
To: gentoo-commits
commit: 93ef99f17ee716bb4e5d10add0b0ab6184c80600
Author: Andreas K. Hüttel <dilfridge <AT> gentoo <DOT> org>
AuthorDate: Tue May 30 19:35:59 2017 +0000
Commit: Andreas Hüttel <dilfridge <AT> gentoo <DOT> org>
CommitDate: Tue May 30 19:35:59 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=93ef99f1
media-libs/jbig2dec: Revision bump for bug 620202
Package-Manager: Portage-2.3.6, Repoman-2.3.2
.../files/jbig2dec-0.13-CVE-2017-9216.patch | 31 ++++++++++++++
media-libs/jbig2dec/jbig2dec-0.13-r2.ebuild | 49 ++++++++++++++++++++++
2 files changed, 80 insertions(+)
diff --git a/media-libs/jbig2dec/files/jbig2dec-0.13-CVE-2017-9216.patch b/media-libs/jbig2dec/files/jbig2dec-0.13-CVE-2017-9216.patch
new file mode 100644
index 00000000000..789ed6c9656
--- /dev/null
+++ b/media-libs/jbig2dec/files/jbig2dec-0.13-CVE-2017-9216.patch
@@ -0,0 +1,31 @@
+From 3ebffb1d96ba0cacec23016eccb4047dab365853 Mon Sep 17 00:00:00 2001
+From: Shailesh Mistry <shailesh.mistry@hotmail.co.uk>
+Date: Wed, 24 May 2017 19:29:57 +0100
+Subject: [PATCH] Bug 697934: Fix SEGV due to error code being ignored.
+
+The return code from jbig2_decode_text_region was being ignored so the
+code continued to try and parse the invalid file using incomplete/empty
+structures.
+---
+ jbig2dec/jbig2_symbol_dict.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/jbig2_symbol_dict.c b/jbig2_symbol_dict.c
+index 3cc1731..672425d 100644
+--- a/jbig2_symbol_dict.c
++++ b/jbig2_symbol_dict.c
+@@ -493,8 +493,10 @@ jbig2_decode_symbol_dict(Jbig2Ctx *ctx,
+ }
+
+ /* multiple symbols are handled as a text region */
+- jbig2_decode_text_region(ctx, segment, tparams, (const Jbig2SymbolDict * const *)refagg_dicts,
++ code = jbig2_decode_text_region(ctx, segment, tparams, (const Jbig2SymbolDict * const *)refagg_dicts,
+ n_refagg_dicts, image, data, size, GR_stats, as, ws);
++ if (code < 0)
++ goto cleanup4;
+
+ SDNEWSYMS->glyphs[NSYMSDECODED] = image;
+ refagg_dicts[0]->glyphs[params->SDNUMINSYMS + NSYMSDECODED] = jbig2_image_clone(ctx, SDNEWSYMS->glyphs[NSYMSDECODED]);
+--
+2.9.1
+
diff --git a/media-libs/jbig2dec/jbig2dec-0.13-r2.ebuild b/media-libs/jbig2dec/jbig2dec-0.13-r2.ebuild
new file mode 100644
index 00000000000..16b53ba954a
--- /dev/null
+++ b/media-libs/jbig2dec/jbig2dec-0.13-r2.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+DESCRIPTION="A decoder implementation of the JBIG2 image compression format"
+HOMEPAGE="http://ghostscript.com/jbig2dec.html"
+SRC_URI="http://downloads.ghostscript.com/public/${PN}/${P}.tar.gz
+ test? ( http://jbig2dec.sourceforge.net/ubc/jb2streams.zip )"
+
+LICENSE="AGPL-3"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~x86-solaris"
+IUSE="png static-libs test"
+
+RDEPEND="png? ( media-libs/libpng:0= )"
+DEPEND="${RDEPEND}
+ test? ( app-arch/unzip )"
+
+RESTRICT="test"
+# bug 324275
+
+DOCS="CHANGES README"
+
+PATCHES=(
+ "${FILESDIR}/${P}-CVE-2016-9601.patch"
+ "${FILESDIR}/${P}-CVE-2017-9216.patch"
+)
+
+src_prepare() {
+ default
+
+ if use test; then
+ mkdir "${WORKDIR}/ubc" || die
+ mv -v "${WORKDIR}"/*.jb2 "${WORKDIR}/ubc/" || die
+ mv -v "${WORKDIR}"/*.bmp "${WORKDIR}/ubc/" || die
+ fi
+}
+
+src_configure() {
+ econf \
+ $(use_enable static-libs static) \
+ $(use_with png libpng)
+}
+
+src_install() {
+ default
+ find "${ED}" -name '*.la' -exec rm {} + || die
+}
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: media-libs/jbig2dec/, media-libs/jbig2dec/files/
@ 2017-06-09 23:49 Andreas Hüttel
0 siblings, 0 replies; 2+ messages in thread
From: Andreas Hüttel @ 2017-06-09 23:49 UTC (permalink / raw
To: gentoo-commits
commit: f8d0fa98dc2921fd3c0ddb62b193a787644020c2
Author: Andreas K. Hüttel <dilfridge <AT> gentoo <DOT> org>
AuthorDate: Fri Jun 9 23:49:30 2017 +0000
Commit: Andreas Hüttel <dilfridge <AT> gentoo <DOT> org>
CommitDate: Fri Jun 9 23:49:30 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f8d0fa98
media-libs/jbig2dec: Revision bump for bug 616464
Package-Manager: Portage-2.3.6, Repoman-2.3.2
.../files/jbig2dec-0.13-CVE-2017-7885.patch | 29 ++++++++++++
.../files/jbig2dec-0.13-CVE-2017-7975.patch | 31 +++++++++++++
.../files/jbig2dec-0.13-CVE-2017-7976.patch | 29 ++++++++++++
media-libs/jbig2dec/jbig2dec-0.13-r3.ebuild | 52 ++++++++++++++++++++++
4 files changed, 141 insertions(+)
diff --git a/media-libs/jbig2dec/files/jbig2dec-0.13-CVE-2017-7885.patch b/media-libs/jbig2dec/files/jbig2dec-0.13-CVE-2017-7885.patch
new file mode 100644
index 00000000000..e8ffccd4534
--- /dev/null
+++ b/media-libs/jbig2dec/files/jbig2dec-0.13-CVE-2017-7885.patch
@@ -0,0 +1,29 @@
+From b184e783702246e154294326d03d9abda669fcfa Mon Sep 17 00:00:00 2001
+From: Shailesh Mistry <shailesh.mistry@hotmail.co.uk>
+Date: Wed, 3 May 2017 22:06:01 +0100
+Subject: [PATCH] Bug 697703: Prevent integer overflow vulnerability.
+
+Add extra check for the offset being greater than the size
+of the image and hence reading off the end of the buffer.
+
+Thank you to Dai Ge for finding this issue and suggesting a patch.
+---
+ jbig2dec/jbig2_symbol_dict.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/jbig2dec/jbig2_symbol_dict.c b/jbig2dec/jbig2_symbol_dict.c
+index 4acaba9d0..36225cb1f 100644
+--- a/jbig2_symbol_dict.c
++++ b/jbig2_symbol_dict.c
+@@ -629,7 +629,7 @@ jbig2_decode_symbol_dict(Jbig2Ctx *ctx,
+ byte *dst = image->data;
+
+ /* SumatraPDF: prevent read access violation */
+- if (size - jbig2_huffman_offset(hs) < image->height * stride) {
++ if ((size - jbig2_huffman_offset(hs) < image->height * stride) || (size < jbig2_huffman_offset(hs))) {
+ jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number, "not enough data for decoding (%d/%d)", image->height * stride,
+ size - jbig2_huffman_offset(hs));
+ jbig2_image_release(ctx, image);
+--
+2.13.1
+
diff --git a/media-libs/jbig2dec/files/jbig2dec-0.13-CVE-2017-7975.patch b/media-libs/jbig2dec/files/jbig2dec-0.13-CVE-2017-7975.patch
new file mode 100644
index 00000000000..d5e62762b9a
--- /dev/null
+++ b/media-libs/jbig2dec/files/jbig2dec-0.13-CVE-2017-7975.patch
@@ -0,0 +1,31 @@
+From 5e57e483298dae8b8d4ec9aab37a526736ac2e97 Mon Sep 17 00:00:00 2001
+From: Shailesh Mistry <shailesh.mistry@hotmail.co.uk>
+Date: Wed, 26 Apr 2017 22:12:14 +0100
+Subject: [PATCH] Bug 697693: Prevent SEGV due to integer overflow.
+
+While building a Huffman table, the start and end points were susceptible
+to integer overflow.
+
+Thank you to Jiaqi for finding this issue and suggesting a patch.
+---
+ jbig2dec/jbig2_huffman.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/jbig2dec/jbig2_huffman.c b/jbig2dec/jbig2_huffman.c
+index 511e46170..b4189a12c 100644
+--- a/jbig2_huffman.c
++++ b/jbig2_huffman.c
+@@ -421,8 +421,8 @@ jbig2_build_huffman_table(Jbig2Ctx *ctx, const Jbig2HuffmanParams *params)
+
+ if (PREFLEN == CURLEN) {
+ int RANGELEN = lines[CURTEMP].RANGELEN;
+- int start_j = CURCODE << shift;
+- int end_j = (CURCODE + 1) << shift;
++ uint32_t start_j = CURCODE << shift;
++ uint32_t end_j = (CURCODE + 1) << shift;
+ byte eflags = 0;
+
+ if (end_j > max_j) {
+--
+2.13.1
+
diff --git a/media-libs/jbig2dec/files/jbig2dec-0.13-CVE-2017-7976.patch b/media-libs/jbig2dec/files/jbig2dec-0.13-CVE-2017-7976.patch
new file mode 100644
index 00000000000..c6dbd182c61
--- /dev/null
+++ b/media-libs/jbig2dec/files/jbig2dec-0.13-CVE-2017-7976.patch
@@ -0,0 +1,29 @@
+From ed6c5133a1004ce8d38f1b44de85a7186feda95e Mon Sep 17 00:00:00 2001
+From: Shailesh Mistry <shailesh.mistry@hotmail.co.uk>
+Date: Wed, 10 May 2017 17:50:39 +0100
+Subject: [PATCH] Bug 697683: Bounds check before reading from image source
+ data.
+
+Add extra check to prevent reading off the end of the image source
+data buffer.
+
+Thank you to Dai Ge for finding this issue and suggesting a patch.
+---
+ jbig2dec/jbig2_image.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+Backported dilfridge@g.o
+
+diff -ruN jbig2dec-0.13.orig/jbig2_image.c jbig2dec-0.13/jbig2_image.c
+--- jbig2dec-0.13.orig/jbig2_image.c 2017-06-10 01:41:16.207939489 +0200
++++ jbig2dec-0.13/jbig2_image.c 2017-06-10 01:46:28.009952461 +0200
+@@ -256,7 +256,8 @@
+ /* general OR case */
+ s = ss;
+ d = dd = dst->data + y * dst->stride + leftbyte;
+- if (d < dst->data || leftbyte > dst->stride || h * dst->stride < 0 || d - leftbyte + h * dst->stride > dst->data + dst->height * dst->stride) {
++ if (d < dst->data || leftbyte > dst->stride || d - leftbyte + h * dst->stride > dst->data + dst->height * dst->stride ||
++ s - leftbyte + (h - 1) * src->stride + rightbyte > src->data + src->height * src->stride) {
+ return jbig2_error(ctx, JBIG2_SEVERITY_FATAL, -1, "preventing heap overflow in jbig2_image_compose");
+ }
+ if (leftbyte == rightbyte) {
diff --git a/media-libs/jbig2dec/jbig2dec-0.13-r3.ebuild b/media-libs/jbig2dec/jbig2dec-0.13-r3.ebuild
new file mode 100644
index 00000000000..5d681123a46
--- /dev/null
+++ b/media-libs/jbig2dec/jbig2dec-0.13-r3.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+DESCRIPTION="A decoder implementation of the JBIG2 image compression format"
+HOMEPAGE="http://ghostscript.com/jbig2dec.html"
+SRC_URI="http://downloads.ghostscript.com/public/${PN}/${P}.tar.gz
+ test? ( http://jbig2dec.sourceforge.net/ubc/jb2streams.zip )"
+
+LICENSE="AGPL-3"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~x86-solaris"
+IUSE="png static-libs test"
+
+RDEPEND="png? ( media-libs/libpng:0= )"
+DEPEND="${RDEPEND}
+ test? ( app-arch/unzip )"
+
+RESTRICT="test"
+# bug 324275
+
+DOCS="CHANGES README"
+
+PATCHES=(
+ "${FILESDIR}/${P}-CVE-2016-9601.patch"
+ "${FILESDIR}/${P}-CVE-2017-9216.patch"
+ "${FILESDIR}/${P}-CVE-2017-7885.patch"
+ "${FILESDIR}/${P}-CVE-2017-7975.patch"
+# "${FILESDIR}/${P}-CVE-2017-7976.patch"
+)
+
+src_prepare() {
+ default
+
+ if use test; then
+ mkdir "${WORKDIR}/ubc" || die
+ mv -v "${WORKDIR}"/*.jb2 "${WORKDIR}/ubc/" || die
+ mv -v "${WORKDIR}"/*.bmp "${WORKDIR}/ubc/" || die
+ fi
+}
+
+src_configure() {
+ econf \
+ $(use_enable static-libs static) \
+ $(use_with png libpng)
+}
+
+src_install() {
+ default
+ find "${ED}" -name '*.la' -exec rm {} + || die
+}
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-06-09 23:49 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-05-30 19:36 [gentoo-commits] repo/gentoo:master commit in: media-libs/jbig2dec/, media-libs/jbig2dec/files/ Andreas Hüttel
-- strict thread matches above, loose matches on Subject: below --
2017-06-09 23:49 Andreas Hüttel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox