diff options
author | Vijay Anusuri <vanusuri@mvista.com> | 2023-06-23 11:18:48 +0530 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2023-07-04 05:37:07 -1000 |
commit | a84a25acc54aff716a3c255ccca9c5025ee26547 (patch) | |
tree | 3924f3364ee741659e0d3fa2bc0bd645ce9d7f46 | |
parent | c8f5ff0ffe6b11e3b50656438136ee08c9616ab2 (diff) | |
download | poky-a84a25acc54aff716a3c255ccca9c5025ee26547.tar.gz |
libjpeg-turbo: CVE-2020-35538 Null pointer dereference in jcopy_sample_rows() function
Upstream-Status: Backport
[https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9120a247436e84c0b4eea828cb11e8f665fcde30
&
https://github.com/libjpeg-turbo/libjpeg-turbo/commit/a46c111d9f3642f0ef3819e7298846ccc61869e0]
(From OE-Core rev: 345ffb433060f017d212135a5b2383017f32d321)
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
-rw-r--r-- | meta/recipes-graphics/jpeg/files/CVE-2020-35538-1.patch | 457 | ||||
-rw-r--r-- | meta/recipes-graphics/jpeg/files/CVE-2020-35538-2.patch | 400 | ||||
-rw-r--r-- | meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb | 2 |
3 files changed, 859 insertions, 0 deletions
diff --git a/meta/recipes-graphics/jpeg/files/CVE-2020-35538-1.patch b/meta/recipes-graphics/jpeg/files/CVE-2020-35538-1.patch new file mode 100644 index 0000000000..8a52ed01e9 --- /dev/null +++ b/meta/recipes-graphics/jpeg/files/CVE-2020-35538-1.patch | |||
@@ -0,0 +1,457 @@ | |||
1 | From 9120a247436e84c0b4eea828cb11e8f665fcde30 Mon Sep 17 00:00:00 2001 | ||
2 | From: DRC <information@libjpeg-turbo.org> | ||
3 | Date: Thu, 23 Jul 2020 21:24:38 -0500 | ||
4 | Subject: [PATCH] Fix jpeg_skip_scanlines() segfault w/merged upsamp | ||
5 | |||
6 | The additional segfault mentioned in #244 was due to the fact that | ||
7 | the merged upsamplers use a different private structure than the | ||
8 | non-merged upsamplers. jpeg_skip_scanlines() was assuming the latter, so | ||
9 | when merged upsampling was enabled, jpeg_skip_scanlines() clobbered one | ||
10 | of the IDCT method pointers in the merged upsampler's private structure. | ||
11 | |||
12 | For reasons unknown, the test image in #441 did not encounter this | ||
13 | segfault (too small?), but it encountered an issue similar to the one | ||
14 | fixed in 5bc43c7821df982f65aa1c738f67fbf7cba8bd69, whereby it was | ||
15 | necessary to set up a dummy postprocessing function in | ||
16 | read_and_discard_scanlines() when merged upsampling was enabled. | ||
17 | Failing to do so caused either a segfault in merged_2v_upsample() (due | ||
18 | to a NULL pointer being passed to jcopy_sample_rows()) or an error | ||
19 | ("Corrupt JPEG data: premature end of data segment"), depending on the | ||
20 | number of scanlines skipped and whether the first scanline skipped was | ||
21 | an odd- or even-numbered row. | ||
22 | |||
23 | Fixes #441 | ||
24 | Fixes #244 (for real this time) | ||
25 | |||
26 | Upstream-Status: Backport [https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9120a247436e84c0b4eea828cb11e8f665fcde30] | ||
27 | CVE: CVE-2020-35538 | ||
28 | Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> | ||
29 | --- | ||
30 | ChangeLog.md | 7 +++++ | ||
31 | jdapistd.c | 72 ++++++++++++++++++++++++++++++++++++++++++++++------ | ||
32 | jdmerge.c | 46 +++++++-------------------------- | ||
33 | jdmerge.h | 47 ++++++++++++++++++++++++++++++++++ | ||
34 | jdmrg565.c | 10 ++++---- | ||
35 | jdmrgext.c | 6 ++--- | ||
36 | 6 files changed, 135 insertions(+), 53 deletions(-) | ||
37 | create mode 100644 jdmerge.h | ||
38 | |||
39 | diff --git a/ChangeLog.md b/ChangeLog.md | ||
40 | index 2ebfe71..19d18fa 100644 | ||
41 | --- a/ChangeLog.md | ||
42 | +++ b/ChangeLog.md | ||
43 | @@ -54,6 +54,13 @@ a 16-bit binary PGM file into an RGB image buffer. | ||
44 | generated when using the `tjLoadImage()` function to load a 16-bit binary PPM | ||
45 | file into an extended RGB image buffer. | ||
46 | |||
47 | +2. Fixed segfaults or "Corrupt JPEG data: premature end of data segment" errors | ||
48 | +in `jpeg_skip_scanlines()` that occurred when decompressing 4:2:2 or 4:2:0 JPEG | ||
49 | +images using the merged (non-fancy) upsampling algorithms (that is, when | ||
50 | +setting `cinfo.do_fancy_upsampling` to `FALSE`.) 2.0.0[6] was a similar fix, | ||
51 | +but it did not cover all cases. | ||
52 | + | ||
53 | + | ||
54 | 2.0.3 | ||
55 | ===== | ||
56 | |||
57 | diff --git a/jdapistd.c b/jdapistd.c | ||
58 | index 2c808fa..91da642 100644 | ||
59 | --- a/jdapistd.c | ||
60 | +++ b/jdapistd.c | ||
61 | @@ -4,7 +4,7 @@ | ||
62 | * This file was part of the Independent JPEG Group's software: | ||
63 | * Copyright (C) 1994-1996, Thomas G. Lane. | ||
64 | * libjpeg-turbo Modifications: | ||
65 | - * Copyright (C) 2010, 2015-2018, D. R. Commander. | ||
66 | + * Copyright (C) 2010, 2015-2018, 2020, D. R. Commander. | ||
67 | * Copyright (C) 2015, Google, Inc. | ||
68 | * For conditions of distribution and use, see the accompanying README.ijg | ||
69 | * file. | ||
70 | @@ -21,6 +21,8 @@ | ||
71 | #include "jinclude.h" | ||
72 | #include "jdmainct.h" | ||
73 | #include "jdcoefct.h" | ||
74 | +#include "jdmaster.h" | ||
75 | +#include "jdmerge.h" | ||
76 | #include "jdsample.h" | ||
77 | #include "jmemsys.h" | ||
78 | |||
79 | @@ -304,6 +306,16 @@ noop_quantize(j_decompress_ptr cinfo, JSAMPARRAY input_buf, | ||
80 | } | ||
81 | |||
82 | |||
83 | +/* Dummy postprocessing function used by jpeg_skip_scanlines() */ | ||
84 | +LOCAL(void) | ||
85 | +noop_post_process (j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
86 | + JDIMENSION *in_row_group_ctr, | ||
87 | + JDIMENSION in_row_groups_avail, JSAMPARRAY output_buf, | ||
88 | + JDIMENSION *out_row_ctr, JDIMENSION out_rows_avail) | ||
89 | +{ | ||
90 | +} | ||
91 | + | ||
92 | + | ||
93 | /* | ||
94 | * In some cases, it is best to call jpeg_read_scanlines() and discard the | ||
95 | * output, rather than skipping the scanlines, because this allows us to | ||
96 | @@ -316,11 +328,17 @@ LOCAL(void) | ||
97 | read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
98 | { | ||
99 | JDIMENSION n; | ||
100 | + my_master_ptr master = (my_master_ptr)cinfo->master; | ||
101 | void (*color_convert) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
102 | JDIMENSION input_row, JSAMPARRAY output_buf, | ||
103 | int num_rows) = NULL; | ||
104 | void (*color_quantize) (j_decompress_ptr cinfo, JSAMPARRAY input_buf, | ||
105 | JSAMPARRAY output_buf, int num_rows) = NULL; | ||
106 | + void (*post_process_data) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
107 | + JDIMENSION *in_row_group_ctr, | ||
108 | + JDIMENSION in_row_groups_avail, | ||
109 | + JSAMPARRAY output_buf, JDIMENSION *out_row_ctr, | ||
110 | + JDIMENSION out_rows_avail) = NULL; | ||
111 | |||
112 | if (cinfo->cconvert && cinfo->cconvert->color_convert) { | ||
113 | color_convert = cinfo->cconvert->color_convert; | ||
114 | @@ -332,6 +350,12 @@ read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
115 | cinfo->cquantize->color_quantize = noop_quantize; | ||
116 | } | ||
117 | |||
118 | + if (master->using_merged_upsample && cinfo->post && | ||
119 | + cinfo->post->post_process_data) { | ||
120 | + post_process_data = cinfo->post->post_process_data; | ||
121 | + cinfo->post->post_process_data = noop_post_process; | ||
122 | + } | ||
123 | + | ||
124 | for (n = 0; n < num_lines; n++) | ||
125 | jpeg_read_scanlines(cinfo, NULL, 1); | ||
126 | |||
127 | @@ -340,6 +364,9 @@ read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
128 | |||
129 | if (color_quantize) | ||
130 | cinfo->cquantize->color_quantize = color_quantize; | ||
131 | + | ||
132 | + if (post_process_data) | ||
133 | + cinfo->post->post_process_data = post_process_data; | ||
134 | } | ||
135 | |||
136 | |||
137 | @@ -382,7 +409,7 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
138 | { | ||
139 | my_main_ptr main_ptr = (my_main_ptr)cinfo->main; | ||
140 | my_coef_ptr coef = (my_coef_ptr)cinfo->coef; | ||
141 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
142 | + my_master_ptr master = (my_master_ptr)cinfo->master; | ||
143 | JDIMENSION i, x; | ||
144 | int y; | ||
145 | JDIMENSION lines_per_iMCU_row, lines_left_in_iMCU_row, lines_after_iMCU_row; | ||
146 | @@ -445,8 +472,16 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
147 | main_ptr->buffer_full = FALSE; | ||
148 | main_ptr->rowgroup_ctr = 0; | ||
149 | main_ptr->context_state = CTX_PREPARE_FOR_IMCU; | ||
150 | - upsample->next_row_out = cinfo->max_v_samp_factor; | ||
151 | - upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
152 | + if (master->using_merged_upsample) { | ||
153 | + my_merged_upsample_ptr upsample = | ||
154 | + (my_merged_upsample_ptr)cinfo->upsample; | ||
155 | + upsample->spare_full = FALSE; | ||
156 | + upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
157 | + } else { | ||
158 | + my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
159 | + upsample->next_row_out = cinfo->max_v_samp_factor; | ||
160 | + upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
161 | + } | ||
162 | } | ||
163 | |||
164 | /* Skipping is much simpler when context rows are not required. */ | ||
165 | @@ -458,8 +493,16 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
166 | cinfo->output_scanline += lines_left_in_iMCU_row; | ||
167 | main_ptr->buffer_full = FALSE; | ||
168 | main_ptr->rowgroup_ctr = 0; | ||
169 | - upsample->next_row_out = cinfo->max_v_samp_factor; | ||
170 | - upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
171 | + if (master->using_merged_upsample) { | ||
172 | + my_merged_upsample_ptr upsample = | ||
173 | + (my_merged_upsample_ptr)cinfo->upsample; | ||
174 | + upsample->spare_full = FALSE; | ||
175 | + upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
176 | + } else { | ||
177 | + my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
178 | + upsample->next_row_out = cinfo->max_v_samp_factor; | ||
179 | + upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
180 | + } | ||
181 | } | ||
182 | } | ||
183 | |||
184 | @@ -494,7 +537,14 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
185 | cinfo->output_iMCU_row += lines_to_skip / lines_per_iMCU_row; | ||
186 | increment_simple_rowgroup_ctr(cinfo, lines_to_read); | ||
187 | } | ||
188 | - upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
189 | + if (master->using_merged_upsample) { | ||
190 | + my_merged_upsample_ptr upsample = | ||
191 | + (my_merged_upsample_ptr)cinfo->upsample; | ||
192 | + upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
193 | + } else { | ||
194 | + my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
195 | + upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
196 | + } | ||
197 | return num_lines; | ||
198 | } | ||
199 | |||
200 | @@ -535,7 +585,13 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
201 | * bit odd, since "rows_to_go" seems to be redundantly keeping track of | ||
202 | * output_scanline. | ||
203 | */ | ||
204 | - upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
205 | + if (master->using_merged_upsample) { | ||
206 | + my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample; | ||
207 | + upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
208 | + } else { | ||
209 | + my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
210 | + upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
211 | + } | ||
212 | |||
213 | /* Always skip the requested number of lines. */ | ||
214 | return num_lines; | ||
215 | diff --git a/jdmerge.c b/jdmerge.c | ||
216 | index dff5a35..833ad67 100644 | ||
217 | --- a/jdmerge.c | ||
218 | +++ b/jdmerge.c | ||
219 | @@ -5,7 +5,7 @@ | ||
220 | * Copyright (C) 1994-1996, Thomas G. Lane. | ||
221 | * libjpeg-turbo Modifications: | ||
222 | * Copyright 2009 Pierre Ossman <ossman@cendio.se> for Cendio AB | ||
223 | - * Copyright (C) 2009, 2011, 2014-2015, D. R. Commander. | ||
224 | + * Copyright (C) 2009, 2011, 2014-2015, 2020, D. R. Commander. | ||
225 | * Copyright (C) 2013, Linaro Limited. | ||
226 | * For conditions of distribution and use, see the accompanying README.ijg | ||
227 | * file. | ||
228 | @@ -40,41 +40,13 @@ | ||
229 | #define JPEG_INTERNALS | ||
230 | #include "jinclude.h" | ||
231 | #include "jpeglib.h" | ||
232 | +#include "jdmerge.h" | ||
233 | #include "jsimd.h" | ||
234 | #include "jconfigint.h" | ||
235 | |||
236 | #ifdef UPSAMPLE_MERGING_SUPPORTED | ||
237 | |||
238 | |||
239 | -/* Private subobject */ | ||
240 | - | ||
241 | -typedef struct { | ||
242 | - struct jpeg_upsampler pub; /* public fields */ | ||
243 | - | ||
244 | - /* Pointer to routine to do actual upsampling/conversion of one row group */ | ||
245 | - void (*upmethod) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
246 | - JDIMENSION in_row_group_ctr, JSAMPARRAY output_buf); | ||
247 | - | ||
248 | - /* Private state for YCC->RGB conversion */ | ||
249 | - int *Cr_r_tab; /* => table for Cr to R conversion */ | ||
250 | - int *Cb_b_tab; /* => table for Cb to B conversion */ | ||
251 | - JLONG *Cr_g_tab; /* => table for Cr to G conversion */ | ||
252 | - JLONG *Cb_g_tab; /* => table for Cb to G conversion */ | ||
253 | - | ||
254 | - /* For 2:1 vertical sampling, we produce two output rows at a time. | ||
255 | - * We need a "spare" row buffer to hold the second output row if the | ||
256 | - * application provides just a one-row buffer; we also use the spare | ||
257 | - * to discard the dummy last row if the image height is odd. | ||
258 | - */ | ||
259 | - JSAMPROW spare_row; | ||
260 | - boolean spare_full; /* T if spare buffer is occupied */ | ||
261 | - | ||
262 | - JDIMENSION out_row_width; /* samples per output row */ | ||
263 | - JDIMENSION rows_to_go; /* counts rows remaining in image */ | ||
264 | -} my_upsampler; | ||
265 | - | ||
266 | -typedef my_upsampler *my_upsample_ptr; | ||
267 | - | ||
268 | #define SCALEBITS 16 /* speediest right-shift on some machines */ | ||
269 | #define ONE_HALF ((JLONG)1 << (SCALEBITS - 1)) | ||
270 | #define FIX(x) ((JLONG)((x) * (1L << SCALEBITS) + 0.5)) | ||
271 | @@ -189,7 +161,7 @@ typedef my_upsampler *my_upsample_ptr; | ||
272 | LOCAL(void) | ||
273 | build_ycc_rgb_table(j_decompress_ptr cinfo) | ||
274 | { | ||
275 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
276 | + my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample; | ||
277 | int i; | ||
278 | JLONG x; | ||
279 | SHIFT_TEMPS | ||
280 | @@ -232,7 +204,7 @@ build_ycc_rgb_table(j_decompress_ptr cinfo) | ||
281 | METHODDEF(void) | ||
282 | start_pass_merged_upsample(j_decompress_ptr cinfo) | ||
283 | { | ||
284 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
285 | + my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample; | ||
286 | |||
287 | /* Mark the spare buffer empty */ | ||
288 | upsample->spare_full = FALSE; | ||
289 | @@ -254,7 +226,7 @@ merged_2v_upsample(j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
290 | JDIMENSION *out_row_ctr, JDIMENSION out_rows_avail) | ||
291 | /* 2:1 vertical sampling case: may need a spare row. */ | ||
292 | { | ||
293 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
294 | + my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample; | ||
295 | JSAMPROW work_ptrs[2]; | ||
296 | JDIMENSION num_rows; /* number of rows returned to caller */ | ||
297 | |||
298 | @@ -305,7 +277,7 @@ merged_1v_upsample(j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
299 | JDIMENSION *out_row_ctr, JDIMENSION out_rows_avail) | ||
300 | /* 1:1 vertical sampling case: much easier, never need a spare row. */ | ||
301 | { | ||
302 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
303 | + my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample; | ||
304 | |||
305 | /* Just do the upsampling. */ | ||
306 | (*upsample->upmethod) (cinfo, input_buf, *in_row_group_ctr, | ||
307 | @@ -566,11 +538,11 @@ h2v2_merged_upsample_565D(j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
308 | GLOBAL(void) | ||
309 | jinit_merged_upsampler(j_decompress_ptr cinfo) | ||
310 | { | ||
311 | - my_upsample_ptr upsample; | ||
312 | + my_merged_upsample_ptr upsample; | ||
313 | |||
314 | - upsample = (my_upsample_ptr) | ||
315 | + upsample = (my_merged_upsample_ptr) | ||
316 | (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE, | ||
317 | - sizeof(my_upsampler)); | ||
318 | + sizeof(my_merged_upsampler)); | ||
319 | cinfo->upsample = (struct jpeg_upsampler *)upsample; | ||
320 | upsample->pub.start_pass = start_pass_merged_upsample; | ||
321 | upsample->pub.need_context_rows = FALSE; | ||
322 | diff --git a/jdmerge.h b/jdmerge.h | ||
323 | new file mode 100644 | ||
324 | index 0000000..b583396 | ||
325 | --- /dev/null | ||
326 | +++ b/jdmerge.h | ||
327 | @@ -0,0 +1,47 @@ | ||
328 | +/* | ||
329 | + * jdmerge.h | ||
330 | + * | ||
331 | + * This file was part of the Independent JPEG Group's software: | ||
332 | + * Copyright (C) 1994-1996, Thomas G. Lane. | ||
333 | + * libjpeg-turbo Modifications: | ||
334 | + * Copyright (C) 2020, D. R. Commander. | ||
335 | + * For conditions of distribution and use, see the accompanying README.ijg | ||
336 | + * file. | ||
337 | + */ | ||
338 | + | ||
339 | +#define JPEG_INTERNALS | ||
340 | +#include "jpeglib.h" | ||
341 | + | ||
342 | +#ifdef UPSAMPLE_MERGING_SUPPORTED | ||
343 | + | ||
344 | + | ||
345 | +/* Private subobject */ | ||
346 | + | ||
347 | +typedef struct { | ||
348 | + struct jpeg_upsampler pub; /* public fields */ | ||
349 | + | ||
350 | + /* Pointer to routine to do actual upsampling/conversion of one row group */ | ||
351 | + void (*upmethod) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
352 | + JDIMENSION in_row_group_ctr, JSAMPARRAY output_buf); | ||
353 | + | ||
354 | + /* Private state for YCC->RGB conversion */ | ||
355 | + int *Cr_r_tab; /* => table for Cr to R conversion */ | ||
356 | + int *Cb_b_tab; /* => table for Cb to B conversion */ | ||
357 | + JLONG *Cr_g_tab; /* => table for Cr to G conversion */ | ||
358 | + JLONG *Cb_g_tab; /* => table for Cb to G conversion */ | ||
359 | + | ||
360 | + /* For 2:1 vertical sampling, we produce two output rows at a time. | ||
361 | + * We need a "spare" row buffer to hold the second output row if the | ||
362 | + * application provides just a one-row buffer; we also use the spare | ||
363 | + * to discard the dummy last row if the image height is odd. | ||
364 | + */ | ||
365 | + JSAMPROW spare_row; | ||
366 | + boolean spare_full; /* T if spare buffer is occupied */ | ||
367 | + | ||
368 | + JDIMENSION out_row_width; /* samples per output row */ | ||
369 | + JDIMENSION rows_to_go; /* counts rows remaining in image */ | ||
370 | +} my_merged_upsampler; | ||
371 | + | ||
372 | +typedef my_merged_upsampler *my_merged_upsample_ptr; | ||
373 | + | ||
374 | +#endif /* UPSAMPLE_MERGING_SUPPORTED */ | ||
375 | diff --git a/jdmrg565.c b/jdmrg565.c | ||
376 | index 1b87e37..53f1e16 100644 | ||
377 | --- a/jdmrg565.c | ||
378 | +++ b/jdmrg565.c | ||
379 | @@ -5,7 +5,7 @@ | ||
380 | * Copyright (C) 1994-1996, Thomas G. Lane. | ||
381 | * libjpeg-turbo Modifications: | ||
382 | * Copyright (C) 2013, Linaro Limited. | ||
383 | - * Copyright (C) 2014-2015, 2018, D. R. Commander. | ||
384 | + * Copyright (C) 2014-2015, 2018, 2020, D. R. Commander. | ||
385 | * For conditions of distribution and use, see the accompanying README.ijg | ||
386 | * file. | ||
387 | * | ||
388 | @@ -19,7 +19,7 @@ h2v1_merged_upsample_565_internal(j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
389 | JDIMENSION in_row_group_ctr, | ||
390 | JSAMPARRAY output_buf) | ||
391 | { | ||
392 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
393 | + my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample; | ||
394 | register int y, cred, cgreen, cblue; | ||
395 | int cb, cr; | ||
396 | register JSAMPROW outptr; | ||
397 | @@ -90,7 +90,7 @@ h2v1_merged_upsample_565D_internal(j_decompress_ptr cinfo, | ||
398 | JDIMENSION in_row_group_ctr, | ||
399 | JSAMPARRAY output_buf) | ||
400 | { | ||
401 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
402 | + my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample; | ||
403 | register int y, cred, cgreen, cblue; | ||
404 | int cb, cr; | ||
405 | register JSAMPROW outptr; | ||
406 | @@ -163,7 +163,7 @@ h2v2_merged_upsample_565_internal(j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
407 | JDIMENSION in_row_group_ctr, | ||
408 | JSAMPARRAY output_buf) | ||
409 | { | ||
410 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
411 | + my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample; | ||
412 | register int y, cred, cgreen, cblue; | ||
413 | int cb, cr; | ||
414 | register JSAMPROW outptr0, outptr1; | ||
415 | @@ -259,7 +259,7 @@ h2v2_merged_upsample_565D_internal(j_decompress_ptr cinfo, | ||
416 | JDIMENSION in_row_group_ctr, | ||
417 | JSAMPARRAY output_buf) | ||
418 | { | ||
419 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
420 | + my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample; | ||
421 | register int y, cred, cgreen, cblue; | ||
422 | int cb, cr; | ||
423 | register JSAMPROW outptr0, outptr1; | ||
424 | diff --git a/jdmrgext.c b/jdmrgext.c | ||
425 | index b1c27df..c9a44d8 100644 | ||
426 | --- a/jdmrgext.c | ||
427 | +++ b/jdmrgext.c | ||
428 | @@ -4,7 +4,7 @@ | ||
429 | * This file was part of the Independent JPEG Group's software: | ||
430 | * Copyright (C) 1994-1996, Thomas G. Lane. | ||
431 | * libjpeg-turbo Modifications: | ||
432 | - * Copyright (C) 2011, 2015, D. R. Commander. | ||
433 | + * Copyright (C) 2011, 2015, 2020, D. R. Commander. | ||
434 | * For conditions of distribution and use, see the accompanying README.ijg | ||
435 | * file. | ||
436 | * | ||
437 | @@ -25,7 +25,7 @@ h2v1_merged_upsample_internal(j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
438 | JDIMENSION in_row_group_ctr, | ||
439 | JSAMPARRAY output_buf) | ||
440 | { | ||
441 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
442 | + my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample; | ||
443 | register int y, cred, cgreen, cblue; | ||
444 | int cb, cr; | ||
445 | register JSAMPROW outptr; | ||
446 | @@ -97,7 +97,7 @@ h2v2_merged_upsample_internal(j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
447 | JDIMENSION in_row_group_ctr, | ||
448 | JSAMPARRAY output_buf) | ||
449 | { | ||
450 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
451 | + my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample; | ||
452 | register int y, cred, cgreen, cblue; | ||
453 | int cb, cr; | ||
454 | register JSAMPROW outptr0, outptr1; | ||
455 | -- | ||
456 | 2.25.1 | ||
457 | |||
diff --git a/meta/recipes-graphics/jpeg/files/CVE-2020-35538-2.patch b/meta/recipes-graphics/jpeg/files/CVE-2020-35538-2.patch new file mode 100644 index 0000000000..f86175dff0 --- /dev/null +++ b/meta/recipes-graphics/jpeg/files/CVE-2020-35538-2.patch | |||
@@ -0,0 +1,400 @@ | |||
1 | From a46c111d9f3642f0ef3819e7298846ccc61869e0 Mon Sep 17 00:00:00 2001 | ||
2 | From: DRC <information@libjpeg-turbo.org> | ||
3 | Date: Mon, 27 Jul 2020 14:21:23 -0500 | ||
4 | Subject: [PATCH] Further jpeg_skip_scanlines() fixes | ||
5 | |||
6 | - Introduce a partial image decompression regression test script that | ||
7 | validates the correctness of jpeg_skip_scanlines() and | ||
8 | jpeg_crop_scanlines() for a variety of cropping regions and libjpeg | ||
9 | settings. | ||
10 | |||
11 | This regression test catches the following issues: | ||
12 | #182, fixed in 5bc43c7 | ||
13 | #237, fixed in 6e95c08 | ||
14 | #244, fixed in 398c1e9 | ||
15 | #441, fully fixed in this commit | ||
16 | |||
17 | It does not catch the following issues: | ||
18 | #194, fixed in 773040f | ||
19 | #244 (additional segfault), fixed in | ||
20 | 9120a24 | ||
21 | |||
22 | - Modify the libjpeg-turbo regression test suite (make test) so that it | ||
23 | checks for the issue reported in #441 (segfault in | ||
24 | jpeg_skip_scanlines() when used with 4:2:0 merged upsampling/color | ||
25 | conversion.) | ||
26 | |||
27 | - Fix issues in jpeg_skip_scanlines() that caused incorrect output with | ||
28 | h2v2 (4:2:0) merged upsampling/color conversion. The previous commit | ||
29 | fixed the segfault reported in #441, but that was a symptom of a | ||
30 | larger problem. Because merged 4:2:0 upsampling uses a "spare row" | ||
31 | buffer, it is necessary to allow the upsampler to run when skipping | ||
32 | rows (fancy 4:2:0 upsampling, which uses context rows, also requires | ||
33 | this.) Otherwise, if skipping starts at an odd-numbered row, the | ||
34 | output image will be incorrect. | ||
35 | |||
36 | - Throw an error if jpeg_skip_scanlines() is called with two-pass color | ||
37 | quantization enabled. With two-pass color quantization, the first | ||
38 | pass occurs within jpeg_start_decompress(), so subsequent calls to | ||
39 | jpeg_skip_scanlines() interfere with the multipass state and prevent | ||
40 | the second pass from occurring during subsequent calls to | ||
41 | jpeg_read_scanlines(). | ||
42 | |||
43 | Upstream-Status: Backport [https://github.com/libjpeg-turbo/libjpeg-turbo/commit/a46c111d9f3642f0ef3819e7298846ccc61869e0] | ||
44 | CVE: CVE-2020-35538 | ||
45 | Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> | ||
46 | --- | ||
47 | CMakeLists.txt | 9 +++-- | ||
48 | ChangeLog.md | 15 +++++--- | ||
49 | croptest.in | 95 ++++++++++++++++++++++++++++++++++++++++++++++++++ | ||
50 | jdapistd.c | 70 +++++++++++-------------------------- | ||
51 | libjpeg.txt | 6 ++-- | ||
52 | 5 files changed, 136 insertions(+), 59 deletions(-) | ||
53 | create mode 100755 croptest.in | ||
54 | |||
55 | diff --git a/CMakeLists.txt b/CMakeLists.txt | ||
56 | index aee74c9..de451f4 100644 | ||
57 | --- a/CMakeLists.txt | ||
58 | +++ b/CMakeLists.txt | ||
59 | @@ -753,7 +753,7 @@ else() | ||
60 | set(MD5_PPM_3x2_IFAST fd283664b3b49127984af0a7f118fccd) | ||
61 | set(MD5_JPEG_420_ISLOW_ARI e986fb0a637a8d833d96e8a6d6d84ea1) | ||
62 | set(MD5_JPEG_444_ISLOW_PROGARI 0a8f1c8f66e113c3cf635df0a475a617) | ||
63 | - set(MD5_PPM_420M_IFAST_ARI 72b59a99bcf1de24c5b27d151bde2437) | ||
64 | + set(MD5_PPM_420M_IFAST_ARI 57251da28a35b46eecb7177d82d10e0e) | ||
65 | set(MD5_JPEG_420_ISLOW 9a68f56bc76e466aa7e52f415d0f4a5f) | ||
66 | set(MD5_PPM_420M_ISLOW_2_1 9f9de8c0612f8d06869b960b05abf9c9) | ||
67 | set(MD5_PPM_420M_ISLOW_15_8 b6875bc070720b899566cc06459b63b7) | ||
68 | @@ -1131,7 +1131,7 @@ foreach(libtype ${TEST_LIBTYPES}) | ||
69 | |||
70 | if(WITH_ARITH_DEC) | ||
71 | # CC: RGB->YCC SAMP: h2v2 merged IDCT: ifast ENT: arith | ||
72 | - add_bittest(djpeg 420m-ifast-ari "-fast;-ppm" | ||
73 | + add_bittest(djpeg 420m-ifast-ari "-fast;-skip;1,20;-ppm" | ||
74 | testout_420m_ifast_ari.ppm ${TESTIMAGES}/testimgari.jpg | ||
75 | ${MD5_PPM_420M_IFAST_ARI}) | ||
76 | |||
77 | @@ -1266,6 +1266,11 @@ endforeach() | ||
78 | add_custom_target(testclean COMMAND ${CMAKE_COMMAND} -P | ||
79 | ${CMAKE_CURRENT_SOURCE_DIR}/cmakescripts/testclean.cmake) | ||
80 | |||
81 | +configure_file(croptest.in croptest @ONLY) | ||
82 | +add_custom_target(croptest | ||
83 | + COMMAND echo croptest | ||
84 | + COMMAND ${BASH} ${CMAKE_CURRENT_BINARY_DIR}/croptest) | ||
85 | + | ||
86 | if(WITH_TURBOJPEG) | ||
87 | configure_file(tjbenchtest.in tjbenchtest @ONLY) | ||
88 | configure_file(tjexampletest.in tjexampletest @ONLY) | ||
89 | diff --git a/ChangeLog.md b/ChangeLog.md | ||
90 | index 19d18fa..4562eff 100644 | ||
91 | --- a/ChangeLog.md | ||
92 | +++ b/ChangeLog.md | ||
93 | @@ -54,11 +54,16 @@ a 16-bit binary PGM file into an RGB image buffer. | ||
94 | generated when using the `tjLoadImage()` function to load a 16-bit binary PPM | ||
95 | file into an extended RGB image buffer. | ||
96 | |||
97 | -2. Fixed segfaults or "Corrupt JPEG data: premature end of data segment" errors | ||
98 | -in `jpeg_skip_scanlines()` that occurred when decompressing 4:2:2 or 4:2:0 JPEG | ||
99 | -images using the merged (non-fancy) upsampling algorithms (that is, when | ||
100 | -setting `cinfo.do_fancy_upsampling` to `FALSE`.) 2.0.0[6] was a similar fix, | ||
101 | -but it did not cover all cases. | ||
102 | +2. Fixed or worked around multiple issues with `jpeg_skip_scanlines()`: | ||
103 | + | ||
104 | + - Fixed segfaults or "Corrupt JPEG data: premature end of data segment" | ||
105 | +errors in `jpeg_skip_scanlines()` that occurred when decompressing 4:2:2 or | ||
106 | +4:2:0 JPEG images using merged (non-fancy) upsampling/color conversion (that | ||
107 | +is, when setting `cinfo.do_fancy_upsampling` to `FALSE`.) 2.0.0[6] was a | ||
108 | +similar fix, but it did not cover all cases. | ||
109 | + - `jpeg_skip_scanlines()` now throws an error if two-pass color | ||
110 | +quantization is enabled. Two-pass color quantization never worked properly | ||
111 | +with `jpeg_skip_scanlines()`, and the issues could not readily be fixed. | ||
112 | |||
113 | |||
114 | 2.0.3 | ||
115 | diff --git a/croptest.in b/croptest.in | ||
116 | new file mode 100755 | ||
117 | index 0000000..7e3c293 | ||
118 | --- /dev/null | ||
119 | +++ b/croptest.in | ||
120 | @@ -0,0 +1,95 @@ | ||
121 | +#!/bin/bash | ||
122 | + | ||
123 | +set -u | ||
124 | +set -e | ||
125 | +trap onexit INT | ||
126 | +trap onexit TERM | ||
127 | +trap onexit EXIT | ||
128 | + | ||
129 | +onexit() | ||
130 | +{ | ||
131 | + if [ -d $OUTDIR ]; then | ||
132 | + rm -rf $OUTDIR | ||
133 | + fi | ||
134 | +} | ||
135 | + | ||
136 | +runme() | ||
137 | +{ | ||
138 | + echo \*\*\* $* | ||
139 | + $* | ||
140 | +} | ||
141 | + | ||
142 | +IMAGE=vgl_6548_0026a.bmp | ||
143 | +WIDTH=128 | ||
144 | +HEIGHT=95 | ||
145 | +IMGDIR=@CMAKE_CURRENT_SOURCE_DIR@/testimages | ||
146 | +OUTDIR=`mktemp -d /tmp/__croptest_output.XXXXXX` | ||
147 | +EXEDIR=@CMAKE_CURRENT_BINARY_DIR@ | ||
148 | + | ||
149 | +if [ -d $OUTDIR ]; then | ||
150 | + rm -rf $OUTDIR | ||
151 | +fi | ||
152 | +mkdir -p $OUTDIR | ||
153 | + | ||
154 | +exec >$EXEDIR/croptest.log | ||
155 | + | ||
156 | +echo "============================================================" | ||
157 | +echo "$IMAGE ($WIDTH x $HEIGHT)" | ||
158 | +echo "============================================================" | ||
159 | +echo | ||
160 | + | ||
161 | +for PROGARG in "" -progressive; do | ||
162 | + | ||
163 | + cp $IMGDIR/$IMAGE $OUTDIR | ||
164 | + basename=`basename $IMAGE .bmp` | ||
165 | + echo "------------------------------------------------------------" | ||
166 | + echo "Generating test images" | ||
167 | + echo "------------------------------------------------------------" | ||
168 | + echo | ||
169 | + runme $EXEDIR/cjpeg $PROGARG -grayscale -outfile $OUTDIR/${basename}_GRAY.jpg $IMGDIR/${basename}.bmp | ||
170 | + runme $EXEDIR/cjpeg $PROGARG -sample 2x2 -outfile $OUTDIR/${basename}_420.jpg $IMGDIR/${basename}.bmp | ||
171 | + runme $EXEDIR/cjpeg $PROGARG -sample 2x1 -outfile $OUTDIR/${basename}_422.jpg $IMGDIR/${basename}.bmp | ||
172 | + runme $EXEDIR/cjpeg $PROGARG -sample 1x2 -outfile $OUTDIR/${basename}_440.jpg $IMGDIR/${basename}.bmp | ||
173 | + runme $EXEDIR/cjpeg $PROGARG -sample 1x1 -outfile $OUTDIR/${basename}_444.jpg $IMGDIR/${basename}.bmp | ||
174 | + echo | ||
175 | + | ||
176 | + for NSARG in "" -nosmooth; do | ||
177 | + | ||
178 | + for COLORSARG in "" "-colors 256 -dither none -onepass"; do | ||
179 | + | ||
180 | + for Y in {0..16}; do | ||
181 | + | ||
182 | + for H in {1..16}; do | ||
183 | + | ||
184 | + X=$(( (Y*16)%128 )) | ||
185 | + W=$(( WIDTH-X-7 )) | ||
186 | + if [ $Y -le 15 ]; then | ||
187 | + CROPSPEC="${W}x${H}+${X}+${Y}" | ||
188 | + else | ||
189 | + Y2=$(( HEIGHT-H )); | ||
190 | + CROPSPEC="${W}x${H}+${X}+${Y2}" | ||
191 | + fi | ||
192 | + | ||
193 | + echo "------------------------------------------------------------" | ||
194 | + echo $PROGARG $NSARG $COLORSARG -crop $CROPSPEC | ||
195 | + echo "------------------------------------------------------------" | ||
196 | + echo | ||
197 | + for samp in GRAY 420 422 440 444; do | ||
198 | + $EXEDIR/djpeg $NSARG $COLORSARG -rgb -outfile $OUTDIR/${basename}_${samp}_full.ppm $OUTDIR/${basename}_${samp}.jpg | ||
199 | + convert -crop $CROPSPEC $OUTDIR/${basename}_${samp}_full.ppm $OUTDIR/${basename}_${samp}_ref.ppm | ||
200 | + runme $EXEDIR/djpeg $NSARG $COLORSARG -crop $CROPSPEC -rgb -outfile $OUTDIR/${basename}_${samp}.ppm $OUTDIR/${basename}_${samp}.jpg | ||
201 | + runme cmp $OUTDIR/${basename}_${samp}.ppm $OUTDIR/${basename}_${samp}_ref.ppm | ||
202 | + done | ||
203 | + echo | ||
204 | + | ||
205 | + done | ||
206 | + | ||
207 | + done | ||
208 | + | ||
209 | + done | ||
210 | + | ||
211 | + done | ||
212 | + | ||
213 | +done | ||
214 | + | ||
215 | +echo SUCCESS! | ||
216 | diff --git a/jdapistd.c b/jdapistd.c | ||
217 | index 91da642..c502909 100644 | ||
218 | --- a/jdapistd.c | ||
219 | +++ b/jdapistd.c | ||
220 | @@ -306,16 +306,6 @@ noop_quantize(j_decompress_ptr cinfo, JSAMPARRAY input_buf, | ||
221 | } | ||
222 | |||
223 | |||
224 | -/* Dummy postprocessing function used by jpeg_skip_scanlines() */ | ||
225 | -LOCAL(void) | ||
226 | -noop_post_process (j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
227 | - JDIMENSION *in_row_group_ctr, | ||
228 | - JDIMENSION in_row_groups_avail, JSAMPARRAY output_buf, | ||
229 | - JDIMENSION *out_row_ctr, JDIMENSION out_rows_avail) | ||
230 | -{ | ||
231 | -} | ||
232 | - | ||
233 | - | ||
234 | /* | ||
235 | * In some cases, it is best to call jpeg_read_scanlines() and discard the | ||
236 | * output, rather than skipping the scanlines, because this allows us to | ||
237 | @@ -329,16 +319,12 @@ read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
238 | { | ||
239 | JDIMENSION n; | ||
240 | my_master_ptr master = (my_master_ptr)cinfo->master; | ||
241 | + JSAMPARRAY scanlines = NULL; | ||
242 | void (*color_convert) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
243 | JDIMENSION input_row, JSAMPARRAY output_buf, | ||
244 | int num_rows) = NULL; | ||
245 | void (*color_quantize) (j_decompress_ptr cinfo, JSAMPARRAY input_buf, | ||
246 | JSAMPARRAY output_buf, int num_rows) = NULL; | ||
247 | - void (*post_process_data) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf, | ||
248 | - JDIMENSION *in_row_group_ctr, | ||
249 | - JDIMENSION in_row_groups_avail, | ||
250 | - JSAMPARRAY output_buf, JDIMENSION *out_row_ctr, | ||
251 | - JDIMENSION out_rows_avail) = NULL; | ||
252 | |||
253 | if (cinfo->cconvert && cinfo->cconvert->color_convert) { | ||
254 | color_convert = cinfo->cconvert->color_convert; | ||
255 | @@ -350,23 +336,19 @@ read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
256 | cinfo->cquantize->color_quantize = noop_quantize; | ||
257 | } | ||
258 | |||
259 | - if (master->using_merged_upsample && cinfo->post && | ||
260 | - cinfo->post->post_process_data) { | ||
261 | - post_process_data = cinfo->post->post_process_data; | ||
262 | - cinfo->post->post_process_data = noop_post_process; | ||
263 | + if (master->using_merged_upsample && cinfo->max_v_samp_factor == 2) { | ||
264 | + my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample; | ||
265 | + scanlines = &upsample->spare_row; | ||
266 | } | ||
267 | |||
268 | for (n = 0; n < num_lines; n++) | ||
269 | - jpeg_read_scanlines(cinfo, NULL, 1); | ||
270 | + jpeg_read_scanlines(cinfo, scanlines, 1); | ||
271 | |||
272 | if (color_convert) | ||
273 | cinfo->cconvert->color_convert = color_convert; | ||
274 | |||
275 | if (color_quantize) | ||
276 | cinfo->cquantize->color_quantize = color_quantize; | ||
277 | - | ||
278 | - if (post_process_data) | ||
279 | - cinfo->post->post_process_data = post_process_data; | ||
280 | } | ||
281 | |||
282 | |||
283 | @@ -380,6 +362,12 @@ increment_simple_rowgroup_ctr(j_decompress_ptr cinfo, JDIMENSION rows) | ||
284 | { | ||
285 | JDIMENSION rows_left; | ||
286 | my_main_ptr main_ptr = (my_main_ptr)cinfo->main; | ||
287 | + my_master_ptr master = (my_master_ptr)cinfo->master; | ||
288 | + | ||
289 | + if (master->using_merged_upsample && cinfo->max_v_samp_factor == 2) { | ||
290 | + read_and_discard_scanlines(cinfo, rows); | ||
291 | + return; | ||
292 | + } | ||
293 | |||
294 | /* Increment the counter to the next row group after the skipped rows. */ | ||
295 | main_ptr->rowgroup_ctr += rows / cinfo->max_v_samp_factor; | ||
296 | @@ -410,11 +398,16 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
297 | my_main_ptr main_ptr = (my_main_ptr)cinfo->main; | ||
298 | my_coef_ptr coef = (my_coef_ptr)cinfo->coef; | ||
299 | my_master_ptr master = (my_master_ptr)cinfo->master; | ||
300 | + my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
301 | JDIMENSION i, x; | ||
302 | int y; | ||
303 | JDIMENSION lines_per_iMCU_row, lines_left_in_iMCU_row, lines_after_iMCU_row; | ||
304 | JDIMENSION lines_to_skip, lines_to_read; | ||
305 | |||
306 | + /* Two-pass color quantization is not supported. */ | ||
307 | + if (cinfo->quantize_colors && cinfo->two_pass_quantize) | ||
308 | + ERREXIT(cinfo, JERR_NOTIMPL); | ||
309 | + | ||
310 | if (cinfo->global_state != DSTATE_SCANNING) | ||
311 | ERREXIT1(cinfo, JERR_BAD_STATE, cinfo->global_state); | ||
312 | |||
313 | @@ -472,13 +465,7 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
314 | main_ptr->buffer_full = FALSE; | ||
315 | main_ptr->rowgroup_ctr = 0; | ||
316 | main_ptr->context_state = CTX_PREPARE_FOR_IMCU; | ||
317 | - if (master->using_merged_upsample) { | ||
318 | - my_merged_upsample_ptr upsample = | ||
319 | - (my_merged_upsample_ptr)cinfo->upsample; | ||
320 | - upsample->spare_full = FALSE; | ||
321 | - upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
322 | - } else { | ||
323 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
324 | + if (!master->using_merged_upsample) { | ||
325 | upsample->next_row_out = cinfo->max_v_samp_factor; | ||
326 | upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
327 | } | ||
328 | @@ -493,13 +480,7 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
329 | cinfo->output_scanline += lines_left_in_iMCU_row; | ||
330 | main_ptr->buffer_full = FALSE; | ||
331 | main_ptr->rowgroup_ctr = 0; | ||
332 | - if (master->using_merged_upsample) { | ||
333 | - my_merged_upsample_ptr upsample = | ||
334 | - (my_merged_upsample_ptr)cinfo->upsample; | ||
335 | - upsample->spare_full = FALSE; | ||
336 | - upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
337 | - } else { | ||
338 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
339 | + if (!master->using_merged_upsample) { | ||
340 | upsample->next_row_out = cinfo->max_v_samp_factor; | ||
341 | upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
342 | } | ||
343 | @@ -537,14 +518,8 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
344 | cinfo->output_iMCU_row += lines_to_skip / lines_per_iMCU_row; | ||
345 | increment_simple_rowgroup_ctr(cinfo, lines_to_read); | ||
346 | } | ||
347 | - if (master->using_merged_upsample) { | ||
348 | - my_merged_upsample_ptr upsample = | ||
349 | - (my_merged_upsample_ptr)cinfo->upsample; | ||
350 | - upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
351 | - } else { | ||
352 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
353 | + if (!master->using_merged_upsample) | ||
354 | upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
355 | - } | ||
356 | return num_lines; | ||
357 | } | ||
358 | |||
359 | @@ -585,13 +560,8 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines) | ||
360 | * bit odd, since "rows_to_go" seems to be redundantly keeping track of | ||
361 | * output_scanline. | ||
362 | */ | ||
363 | - if (master->using_merged_upsample) { | ||
364 | - my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample; | ||
365 | + if (!master->using_merged_upsample) | ||
366 | upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
367 | - } else { | ||
368 | - my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample; | ||
369 | - upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline; | ||
370 | - } | ||
371 | |||
372 | /* Always skip the requested number of lines. */ | ||
373 | return num_lines; | ||
374 | diff --git a/libjpeg.txt b/libjpeg.txt | ||
375 | index c50cf90..c233ecb 100644 | ||
376 | --- a/libjpeg.txt | ||
377 | +++ b/libjpeg.txt | ||
378 | @@ -3,7 +3,7 @@ USING THE IJG JPEG LIBRARY | ||
379 | This file was part of the Independent JPEG Group's software: | ||
380 | Copyright (C) 1994-2013, Thomas G. Lane, Guido Vollbeding. | ||
381 | libjpeg-turbo Modifications: | ||
382 | -Copyright (C) 2010, 2014-2018, D. R. Commander. | ||
383 | +Copyright (C) 2010, 2014-2018, 2020, D. R. Commander. | ||
384 | Copyright (C) 2015, Google, Inc. | ||
385 | For conditions of distribution and use, see the accompanying README.ijg file. | ||
386 | |||
387 | @@ -750,7 +750,9 @@ multiple rows in the JPEG image. | ||
388 | |||
389 | Suspending data sources are not supported by this function. Calling | ||
390 | jpeg_skip_scanlines() with a suspending data source will result in undefined | ||
391 | -behavior. | ||
392 | +behavior. Two-pass color quantization is also not supported by this function. | ||
393 | +Calling jpeg_skip_scanlines() with two-pass color quantization enabled will | ||
394 | +result in an error. | ||
395 | |||
396 | jpeg_skip_scanlines() will not allow skipping past the bottom of the image. If | ||
397 | the value of num_lines is large enough to skip past the bottom of the image, | ||
398 | -- | ||
399 | 2.25.1 | ||
400 | |||
diff --git a/meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb b/meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb index 6575582b0c..630b20300f 100644 --- a/meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb +++ b/meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb | |||
@@ -14,6 +14,8 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BPN}-${PV}.tar.gz \ | |||
14 | file://0001-libjpeg-turbo-fix-package_qa-error.patch \ | 14 | file://0001-libjpeg-turbo-fix-package_qa-error.patch \ |
15 | file://CVE-2020-13790.patch \ | 15 | file://CVE-2020-13790.patch \ |
16 | file://CVE-2021-46822.patch \ | 16 | file://CVE-2021-46822.patch \ |
17 | file://CVE-2020-35538-1.patch \ | ||
18 | file://CVE-2020-35538-2.patch \ | ||
17 | " | 19 | " |
18 | 20 | ||
19 | SRC_URI[md5sum] = "d01d9e0c28c27bc0de9f4e2e8ff49855" | 21 | SRC_URI[md5sum] = "d01d9e0c28c27bc0de9f4e2e8ff49855" |