summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSana Kazi <sanakazisk19@gmail.com>2022-03-22 17:33:24 +0530
committerArmin Kuster <akuster808@gmail.com>2022-03-27 08:18:20 -0700
commit86b864a4d8c28185a4a464583fb86f73aa22847a (patch)
tree2552b19c9b345eb38b59c236a9680f5ceae9408d
parent4f701b46551d7a68aaed2c59943007f1e685c800 (diff)
downloadmeta-openembedded-86b864a4d8c28185a4a464583fb86f73aa22847a.tar.gz
openjpeg: Fix multiple CVE
Add patch to fix below CVE: CVE-2019-12973 CVE-2020-15389 CVE-2020-27814 CVE-2020-27823 CVE-2020-27824 CVE-2020-27841 CVE-2020-27842 CVE-2020-27843 CVE-2020-27845 Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2019-12973-1.patch72
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2019-12973-2.patch86
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-15389.patch43
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-1.patch29
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-2.patch27
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-3.patch30
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-4.patch27
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27823.patch29
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27824.patch24
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27841.patch238
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27842.patch31
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27843.patch31
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27845.patch74
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg_2.3.1.bb13
14 files changed, 754 insertions, 0 deletions
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2019-12973-1.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2019-12973-1.patch
new file mode 100644
index 0000000000..98988e686e
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2019-12973-1.patch
@@ -0,0 +1,72 @@
1From 21399f6b7d318fcdf4406d5e88723c4922202aa3 Mon Sep 17 00:00:00 2001
2From: Young Xiao <YangX92@hotmail.com>
3Date: Sat, 16 Mar 2019 19:57:27 +0800
4Subject: [PATCH] convertbmp: detect invalid file dimensions early
5
6width/length dimensions read from bmp headers are not necessarily
7valid. For instance they may have been maliciously set to very large
8values with the intention to cause DoS (large memory allocation, stack
9overflow). In these cases we want to detect the invalid size as early
10as possible.
11
12This commit introduces a counter which verifies that the number of
13written bytes corresponds to the advertized width/length.
14
15See commit 8ee335227bbc for details.
16
17Signed-off-by: Young Xiao <YangX92@hotmail.com>
18
19Upstream-Status: Backport [https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openjpeg2/2.3.1-1ubuntu4.20.04.1/openjpeg2_2.3.1-1ubuntu4.20.04.1.debian.tar.xz]
20CVE: CVE-2019-12973
21Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
22---
23 src/bin/jp2/convertbmp.c | 10 ++++++++--
24 1 file changed, 8 insertions(+), 2 deletions(-)
25
26diff --git a/src/bin/jp2/convertbmp.c b/src/bin/jp2/convertbmp.c
27index 0af52f816..ec34f535b 100644
28--- a/src/bin/jp2/convertbmp.c
29+++ b/src/bin/jp2/convertbmp.c
30@@ -622,13 +622,13 @@ static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData,
31 static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
32 OPJ_UINT32 stride, OPJ_UINT32 width, OPJ_UINT32 height)
33 {
34- OPJ_UINT32 x, y;
35+ OPJ_UINT32 x, y, written;
36 OPJ_UINT8 *pix;
37 const OPJ_UINT8 *beyond;
38
39 beyond = pData + stride * height;
40 pix = pData;
41- x = y = 0U;
42+ x = y = written = 0U;
43 while (y < height) {
44 int c = getc(IN);
45 if (c == EOF) {
46@@ -642,6 +642,7 @@ static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
47 for (j = 0; (j < c) && (x < width) &&
48 ((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
49 *pix = (OPJ_UINT8)((j & 1) ? (c1 & 0x0fU) : ((c1 >> 4) & 0x0fU));
50+ written++;
51 }
52 } else { /* absolute mode */
53 c = getc(IN);
54@@ -671,6 +672,7 @@ static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
55 c1 = (OPJ_UINT8)getc(IN);
56 }
57 *pix = (OPJ_UINT8)((j & 1) ? (c1 & 0x0fU) : ((c1 >> 4) & 0x0fU));
58+ written++;
59 }
60 if (((c & 3) == 1) || ((c & 3) == 2)) { /* skip padding byte */
61 getc(IN);
62@@ -678,6 +680,10 @@ static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
63 }
64 }
65 } /* while(y < height) */
66+ if (written != width * height) {
67+ fprintf(stderr, "warning, image's actual size does not match advertized one\n");
68+ return OPJ_FALSE;
69+ }
70 return OPJ_TRUE;
71 }
72
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2019-12973-2.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2019-12973-2.patch
new file mode 100644
index 0000000000..2177bfdbdb
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2019-12973-2.patch
@@ -0,0 +1,86 @@
1From 3aef207f90e937d4931daf6d411e092f76d82e66 Mon Sep 17 00:00:00 2001
2From: Young Xiao <YangX92@hotmail.com>
3Date: Sat, 16 Mar 2019 20:09:59 +0800
4Subject: [PATCH] bmp_read_rle4_data(): avoid potential infinite loop
5
6Upstream-Status: Backport [https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openjpeg2/2.3.1-1ubuntu4.20.04.1/openjpeg2_2.3.1-1ubuntu4.20.04.1.debian.tar.xz]
7CVE: CVE-2019-12973
8Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
9---
10 src/bin/jp2/convertbmp.c | 32 ++++++++++++++++++++++++++------
11 1 file changed, 26 insertions(+), 6 deletions(-)
12
13diff --git a/src/bin/jp2/convertbmp.c b/src/bin/jp2/convertbmp.c
14index ec34f535b..2fc4e9bc4 100644
15--- a/src/bin/jp2/convertbmp.c
16+++ b/src/bin/jp2/convertbmp.c
17@@ -632,12 +632,18 @@ static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
18 while (y < height) {
19 int c = getc(IN);
20 if (c == EOF) {
21- break;
22+ return OPJ_FALSE;
23 }
24
25 if (c) { /* encoded mode */
26- int j;
27- OPJ_UINT8 c1 = (OPJ_UINT8)getc(IN);
28+ int j, c1_int;
29+ OPJ_UINT8 c1;
30+
31+ c1_int = getc(IN);
32+ if (c1_int == EOF) {
33+ return OPJ_FALSE;
34+ }
35+ c1 = (OPJ_UINT8)c1_int;
36
37 for (j = 0; (j < c) && (x < width) &&
38 ((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
39@@ -647,7 +653,7 @@ static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
40 } else { /* absolute mode */
41 c = getc(IN);
42 if (c == EOF) {
43- break;
44+ return OPJ_FALSE;
45 }
46
47 if (c == 0x00) { /* EOL */
48@@ -658,8 +664,14 @@ static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
49 break;
50 } else if (c == 0x02) { /* MOVE by dxdy */
51 c = getc(IN);
52+ if (c == EOF) {
53+ return OPJ_FALSE;
54+ }
55 x += (OPJ_UINT32)c;
56 c = getc(IN);
57+ if (c == EOF) {
58+ return OPJ_FALSE;
59+ }
60 y += (OPJ_UINT32)c;
61 pix = pData + y * stride + x;
62 } else { /* 03 .. 255 : absolute mode */
63@@ -669,13 +681,21 @@ static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
64 for (j = 0; (j < c) && (x < width) &&
65 ((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
66 if ((j & 1) == 0) {
67- c1 = (OPJ_UINT8)getc(IN);
68+ int c1_int;
69+ c1_int = getc(IN);
70+ if (c1_int == EOF) {
71+ return OPJ_FALSE;
72+ }
73+ c1 = (OPJ_UINT8)c1_int;
74 }
75 *pix = (OPJ_UINT8)((j & 1) ? (c1 & 0x0fU) : ((c1 >> 4) & 0x0fU));
76 written++;
77 }
78 if (((c & 3) == 1) || ((c & 3) == 2)) { /* skip padding byte */
79- getc(IN);
80+ c = getc(IN);
81+ if (c == EOF) {
82+ return OPJ_FALSE;
83+ }
84 }
85 }
86 }
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-15389.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-15389.patch
new file mode 100644
index 0000000000..f22e153b52
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-15389.patch
@@ -0,0 +1,43 @@
1From e8e258ab049240c2dd1f1051b4e773b21e2d3dc0 Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Sun, 28 Jun 2020 14:19:59 +0200
4Subject: [PATCH] opj_decompress: fix double-free on input directory with mix
5 of valid and invalid images (CVE-2020-15389)
6
7Fixes #1261
8
9Credits to @Ruia-ruia for reporting and analysis.
10
11Upstream-Status: Backport [https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openjpeg2/2.3.1-1ubuntu4.20.04.1/openjpeg2_2.3.1-1ubuntu4.20.04.1.debian.tar.xz]
12CVE: CVE-2020-15389
13Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
14---
15 src/bin/jp2/opj_decompress.c | 8 ++++----
16 1 file changed, 4 insertions(+), 4 deletions(-)
17
18diff --git a/src/bin/jp2/opj_decompress.c b/src/bin/jp2/opj_decompress.c
19index 7eeb0952f..2634907f0 100644
20--- a/src/bin/jp2/opj_decompress.c
21+++ b/src/bin/jp2/opj_decompress.c
22@@ -1316,10 +1316,6 @@ static opj_image_t* upsample_image_components(opj_image_t* original)
23 int main(int argc, char **argv)
24 {
25 opj_decompress_parameters parameters; /* decompression parameters */
26- opj_image_t* image = NULL;
27- opj_stream_t *l_stream = NULL; /* Stream */
28- opj_codec_t* l_codec = NULL; /* Handle to a decompressor */
29- opj_codestream_index_t* cstr_index = NULL;
30
31 OPJ_INT32 num_images, imageno;
32 img_fol_t img_fol;
33@@ -1393,6 +1389,10 @@ int main(int argc, char **argv)
34
35 /*Decoding image one by one*/
36 for (imageno = 0; imageno < num_images ; imageno++) {
37+ opj_image_t* image = NULL;
38+ opj_stream_t *l_stream = NULL; /* Stream */
39+ opj_codec_t* l_codec = NULL; /* Handle to a decompressor */
40+ opj_codestream_index_t* cstr_index = NULL;
41
42 if (!parameters.quiet) {
43 fprintf(stderr, "\n");
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-1.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-1.patch
new file mode 100644
index 0000000000..da06db6db7
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-1.patch
@@ -0,0 +1,29 @@
1From eaa098b59b346cb88e4d10d505061f669d7134fc Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Mon, 23 Nov 2020 13:49:05 +0100
4Subject: [PATCH] Encoder: grow buffer size in
5 opj_tcd_code_block_enc_allocate_data() to avoid write heap buffer overflow in
6 opj_mqc_flush (fixes #1283)
7
8Upstream-Status: Backport [https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openjpeg2/2.3.1-1ubuntu4.20.04.1/openjpeg2_2.3.1-1ubuntu4.20.04.1.debian.tar.xz]
9CVE: CVE-2020-27814
10Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
11---
12 src/lib/openjp2/tcd.c | 4 +++-
13 1 file changed, 3 insertions(+), 1 deletion(-)
14
15--- a/src/lib/openjp2/tcd.c
16+++ b/src/lib/openjp2/tcd.c
17@@ -1235,9 +1235,11 @@ static OPJ_BOOL opj_tcd_code_block_enc_a
18
19 /* +1 is needed for https://github.com/uclouvain/openjpeg/issues/835 */
20 /* and actually +2 required for https://github.com/uclouvain/openjpeg/issues/982 */
21+ /* and +7 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 3) */
22+ /* and +26 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 7) */
23 /* TODO: is there a theoretical upper-bound for the compressed code */
24 /* block size ? */
25- l_data_size = 2 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
26+ l_data_size = 26 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
27 (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));
28
29 if (l_data_size > p_code_block->data_size) {
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-2.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-2.patch
new file mode 100644
index 0000000000..9c5894c720
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-2.patch
@@ -0,0 +1,27 @@
1From 15cf3d95814dc931ca0ecb132f81cb152e051bae Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Mon, 23 Nov 2020 18:14:02 +0100
4Subject: [PATCH] Encoder: grow again buffer size in
5 opj_tcd_code_block_enc_allocate_data() (fixes #1283)
6
7Upstream-Status: Backport [https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openjpeg2/2.3.1-1ubuntu4.20.04.1/openjpeg2_2.3.1-1ubuntu4.20.04.1.debian.tar.xz]
8CVE: CVE-2020-27814
9Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
10---
11 src/lib/openjp2/tcd.c | 3 ++-
12 1 file changed, 2 insertions(+), 1 deletion(-)
13
14--- a/src/lib/openjp2/tcd.c
15+++ b/src/lib/openjp2/tcd.c
16@@ -1237,9 +1237,10 @@ static OPJ_BOOL opj_tcd_code_block_enc_a
17 /* and actually +2 required for https://github.com/uclouvain/openjpeg/issues/982 */
18 /* and +7 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 3) */
19 /* and +26 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 7) */
20+ /* and +28 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 44) */
21 /* TODO: is there a theoretical upper-bound for the compressed code */
22 /* block size ? */
23- l_data_size = 26 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
24+ l_data_size = 28 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
25 (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));
26
27 if (l_data_size > p_code_block->data_size) {
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-3.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-3.patch
new file mode 100644
index 0000000000..1eb030af46
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-3.patch
@@ -0,0 +1,30 @@
1From 649298dcf84b2f20cfe458d887c1591db47372a6 Mon Sep 17 00:00:00 2001
2From: yuan <zodf0055980@gmail.com>
3Date: Wed, 25 Nov 2020 20:41:39 +0800
4Subject: [PATCH] Encoder: grow again buffer size in
5 opj_tcd_code_block_enc_allocate_data() (fixes #1283)
6
7Upstream-Status: Backport [https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openjpeg2/2.3.1-1ubuntu4.20.04.1/openjpeg2_2.3.1-1ubuntu4.20.04.1.debian.tar.xz]
8CVE: CVE-2020-27814
9Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
10---
11 src/lib/openjp2/tcd.c | 6 ++++--
12 1 file changed, 4 insertions(+), 2 deletions(-)
13
14--- a/src/lib/openjp2/tcd.c
15+++ b/src/lib/openjp2/tcd.c
16@@ -1238,10 +1238,12 @@ static OPJ_BOOL opj_tcd_code_block_enc_a
17 /* and +7 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 3) */
18 /* and +26 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 7) */
19 /* and +28 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 44) */
20+ /* and +33 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 4) */
21+ /* and +63 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 4 -IMF 2K) */
22 /* TODO: is there a theoretical upper-bound for the compressed code */
23 /* block size ? */
24- l_data_size = 28 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
25- (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));
26+ l_data_size = 63 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
27+ (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));
28
29 if (l_data_size > p_code_block->data_size) {
30 if (p_code_block->data) {
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-4.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-4.patch
new file mode 100644
index 0000000000..1c267c313b
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27814-4.patch
@@ -0,0 +1,27 @@
1From 4ce7d285a55d29b79880d0566d4b010fe1907aa9 Mon Sep 17 00:00:00 2001
2From: yuan <zodf0055980@gmail.com>
3Date: Fri, 4 Dec 2020 19:00:22 +0800
4Subject: [PATCH] Encoder: grow again buffer size in
5 opj_tcd_code_block_enc_allocate_data() (fixes #1283)
6
7Upstream-Status: Backport [https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openjpeg2/2.3.1-1ubuntu4.20.04.1/openjpeg2_2.3.1-1ubuntu4.20.04.1.debian.tar.xz]
8CVE: CVE-2020-27814
9Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
10---
11 src/lib/openjp2/tcd.c | 3 ++-
12 1 file changed, 2 insertions(+), 1 deletion(-)
13
14--- a/src/lib/openjp2/tcd.c
15+++ b/src/lib/openjp2/tcd.c
16@@ -1240,9 +1240,10 @@ static OPJ_BOOL opj_tcd_code_block_enc_a
17 /* and +28 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 44) */
18 /* and +33 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 4) */
19 /* and +63 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 4 -IMF 2K) */
20+ /* and +74 for https://github.com/uclouvain/openjpeg/issues/1283 (-M 4 -n 8 -s 7,7 -I) */
21 /* TODO: is there a theoretical upper-bound for the compressed code */
22 /* block size ? */
23- l_data_size = 63 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
24+ l_data_size = 74 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
25 (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));
26
27 if (l_data_size > p_code_block->data_size) {
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27823.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27823.patch
new file mode 100644
index 0000000000..e4373d0d32
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27823.patch
@@ -0,0 +1,29 @@
1From b2072402b7e14d22bba6fb8cde2a1e9996e9a919 Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Mon, 30 Nov 2020 22:31:51 +0100
4Subject: [PATCH] pngtoimage(): fix wrong computation of x1,y1 if -d option is
5 used, that would result in a heap buffer overflow (fixes #1284)
6
7Upstream-Status: Backport [https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openjpeg2/2.3.1-1ubuntu4.20.04.1/openjpeg2_2.3.1-1ubuntu4.20.04.1.debian.tar.xz]
8CVE: CVE-2020-27823
9Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
10---
11 src/bin/jp2/convertpng.c | 4 ++--
12 1 file changed, 2 insertions(+), 2 deletions(-)
13
14diff --git a/src/bin/jp2/convertpng.c b/src/bin/jp2/convertpng.c
15index 328c91beb..00f596e27 100644
16--- a/src/bin/jp2/convertpng.c
17+++ b/src/bin/jp2/convertpng.c
18@@ -223,9 +223,9 @@ opj_image_t *pngtoimage(const char *read_idf, opj_cparameters_t * params)
19 image->x0 = (OPJ_UINT32)params->image_offset_x0;
20 image->y0 = (OPJ_UINT32)params->image_offset_y0;
21 image->x1 = (OPJ_UINT32)(image->x0 + (width - 1) * (OPJ_UINT32)
22- params->subsampling_dx + 1 + image->x0);
23+ params->subsampling_dx + 1);
24 image->y1 = (OPJ_UINT32)(image->y0 + (height - 1) * (OPJ_UINT32)
25- params->subsampling_dy + 1 + image->y0);
26+ params->subsampling_dy + 1);
27
28 row32s = (OPJ_INT32 *)malloc((size_t)width * nr_comp * sizeof(OPJ_INT32));
29 if (row32s == NULL) {
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27824.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27824.patch
new file mode 100644
index 0000000000..5f3deb4dda
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27824.patch
@@ -0,0 +1,24 @@
1From 6daf5f3e1ec6eff03b7982889874a3de6617db8d Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Mon, 30 Nov 2020 22:37:07 +0100
4Subject: [PATCH] Encoder: avoid global buffer overflow on irreversible
5 conversion when too many decomposition levels are specified (fixes #1286)
6
7Upstream-Status: Backport [https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openjpeg2/2.3.1-1ubuntu4.20.04.1/openjpeg2_2.3.1-1ubuntu4.20.04.1.debian.tar.xz]
8CVE: CVE-2020-27824
9Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
10---
11 src/lib/openjp2/dwt.c | 2 +-
12 1 file changed, 1 insertion(+), 1 deletion(-)
13
14--- a/src/lib/openjp2/dwt.c
15+++ b/src/lib/openjp2/dwt.c
16@@ -1293,7 +1293,7 @@ void opj_dwt_calc_explicit_stepsizes(opj
17 if (tccp->qntsty == J2K_CCP_QNTSTY_NOQNT) {
18 stepsize = 1.0;
19 } else {
20- OPJ_FLOAT64 norm = opj_dwt_norms_real[orient][level];
21+ OPJ_FLOAT64 norm = opj_dwt_getnorm_real(level, orient);
22 stepsize = (1 << (gain)) / norm;
23 }
24 opj_dwt_encode_stepsize((OPJ_INT32) floor(stepsize * 8192.0),
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27841.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27841.patch
new file mode 100644
index 0000000000..db6d12dc2c
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27841.patch
@@ -0,0 +1,238 @@
1From 00383e162ae2f8fc951f5745bf1011771acb8dce Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Wed, 2 Dec 2020 14:02:17 +0100
4Subject: [PATCH] pi.c: avoid out of bounds access with POC (refs
5 https://github.com/uclouvain/openjpeg/issues/1293#issuecomment-737122836)
6
7Upstream-Status: Backport [https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openjpeg2/2.3.1-1ubuntu4.20.04.1/openjpeg2_2.3.1-1ubuntu4.20.04.1.debian.tar.xz]
8CVE: CVE-2020-27841
9Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
10---
11 src/lib/openjp2/pi.c | 49 +++++++++++++++++++++++++++++---------------
12 src/lib/openjp2/pi.h | 10 +++++++--
13 src/lib/openjp2/t2.c | 4 ++--
14 3 files changed, 42 insertions(+), 21 deletions(-)
15
16--- a/src/lib/openjp2/pi.c
17+++ b/src/lib/openjp2/pi.c
18@@ -192,10 +192,12 @@ static void opj_get_all_encoding_paramet
19 * @param p_image the image used to initialize the packet iterator (in fact only the number of components is relevant.
20 * @param p_cp the coding parameters.
21 * @param tileno the index of the tile from which creating the packet iterator.
22+ * @param manager Event manager
23 */
24 static opj_pi_iterator_t * opj_pi_create(const opj_image_t *p_image,
25 const opj_cp_t *p_cp,
26- OPJ_UINT32 tileno);
27+ OPJ_UINT32 tileno,
28+ opj_event_mgr_t* manager);
29 /**
30 * FIXME DOC
31 */
32@@ -230,12 +232,6 @@ static OPJ_BOOL opj_pi_check_next_level(
33 ==========================================================
34 */
35
36-static void opj_pi_emit_error(opj_pi_iterator_t * pi, const char* msg)
37-{
38- (void)pi;
39- (void)msg;
40-}
41-
42 static OPJ_BOOL opj_pi_next_lrcp(opj_pi_iterator_t * pi)
43 {
44 opj_pi_comp_t *comp = NULL;
45@@ -272,7 +268,7 @@ static OPJ_BOOL opj_pi_next_lrcp(opj_pi_
46 /* include should be resized when a POC arises, or */
47 /* the POC should be rejected */
48 if (index >= pi->include_size) {
49- opj_pi_emit_error(pi, "Invalid access to pi->include");
50+ opj_event_msg(pi->manager, EVT_ERROR, "Invalid access to pi->include");
51 return OPJ_FALSE;
52 }
53 if (!pi->include[index]) {
54@@ -318,7 +314,7 @@ static OPJ_BOOL opj_pi_next_rlcp(opj_pi_
55 index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno *
56 pi->step_c + pi->precno * pi->step_p;
57 if (index >= pi->include_size) {
58- opj_pi_emit_error(pi, "Invalid access to pi->include");
59+ opj_event_msg(pi->manager, EVT_ERROR, "Invalid access to pi->include");
60 return OPJ_FALSE;
61 }
62 if (!pi->include[index]) {
63@@ -449,7 +445,7 @@ static OPJ_BOOL opj_pi_next_rpcl(opj_pi_
64 index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno *
65 pi->step_c + pi->precno * pi->step_p;
66 if (index >= pi->include_size) {
67- opj_pi_emit_error(pi, "Invalid access to pi->include");
68+ opj_event_msg(pi->manager, EVT_ERROR, "Invalid access to pi->include");
69 return OPJ_FALSE;
70 }
71 if (!pi->include[index]) {
72@@ -473,6 +469,13 @@ static OPJ_BOOL opj_pi_next_pcrl(opj_pi_
73 opj_pi_resolution_t *res = NULL;
74 OPJ_UINT32 index = 0;
75
76+ if (pi->poc.compno0 >= pi->numcomps ||
77+ pi->poc.compno1 >= pi->numcomps + 1) {
78+ opj_event_msg(pi->manager, EVT_ERROR,
79+ "opj_pi_next_pcrl(): invalid compno0/compno1");
80+ return OPJ_FALSE;
81+ }
82+
83 if (!pi->first) {
84 comp = &pi->comps[pi->compno];
85 goto LABEL_SKIP;
86@@ -580,7 +583,7 @@ static OPJ_BOOL opj_pi_next_pcrl(opj_pi_
87 index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno *
88 pi->step_c + pi->precno * pi->step_p;
89 if (index >= pi->include_size) {
90- opj_pi_emit_error(pi, "Invalid access to pi->include");
91+ opj_event_msg(pi->manager, EVT_ERROR, "Invalid access to pi->include");
92 return OPJ_FALSE;
93 }
94 if (!pi->include[index]) {
95@@ -604,6 +607,13 @@ static OPJ_BOOL opj_pi_next_cprl(opj_pi_
96 opj_pi_resolution_t *res = NULL;
97 OPJ_UINT32 index = 0;
98
99+ if (pi->poc.compno0 >= pi->numcomps ||
100+ pi->poc.compno1 >= pi->numcomps + 1) {
101+ opj_event_msg(pi->manager, EVT_ERROR,
102+ "opj_pi_next_cprl(): invalid compno0/compno1");
103+ return OPJ_FALSE;
104+ }
105+
106 if (!pi->first) {
107 comp = &pi->comps[pi->compno];
108 goto LABEL_SKIP;
109@@ -708,7 +718,7 @@ static OPJ_BOOL opj_pi_next_cprl(opj_pi_
110 index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno *
111 pi->step_c + pi->precno * pi->step_p;
112 if (index >= pi->include_size) {
113- opj_pi_emit_error(pi, "Invalid access to pi->include");
114+ opj_event_msg(pi->manager, EVT_ERROR, "Invalid access to pi->include");
115 return OPJ_FALSE;
116 }
117 if (!pi->include[index]) {
118@@ -981,7 +991,8 @@ static void opj_get_all_encoding_paramet
119
120 static opj_pi_iterator_t * opj_pi_create(const opj_image_t *image,
121 const opj_cp_t *cp,
122- OPJ_UINT32 tileno)
123+ OPJ_UINT32 tileno,
124+ opj_event_mgr_t* manager)
125 {
126 /* loop*/
127 OPJ_UINT32 pino, compno;
128@@ -1015,6 +1026,8 @@ static opj_pi_iterator_t * opj_pi_create
129 l_current_pi = l_pi;
130 for (pino = 0; pino < l_poc_bound ; ++pino) {
131
132+ l_current_pi->manager = manager;
133+
134 l_current_pi->comps = (opj_pi_comp_t*) opj_calloc(image->numcomps,
135 sizeof(opj_pi_comp_t));
136 if (! l_current_pi->comps) {
137@@ -1352,7 +1365,8 @@ static OPJ_BOOL opj_pi_check_next_level(
138 */
139 opj_pi_iterator_t *opj_pi_create_decode(opj_image_t *p_image,
140 opj_cp_t *p_cp,
141- OPJ_UINT32 p_tile_no)
142+ OPJ_UINT32 p_tile_no,
143+ opj_event_mgr_t* manager)
144 {
145 OPJ_UINT32 numcomps = p_image->numcomps;
146
147@@ -1407,7 +1421,7 @@ opj_pi_iterator_t *opj_pi_create_decode(
148 }
149
150 /* memory allocation for pi */
151- l_pi = opj_pi_create(p_image, p_cp, p_tile_no);
152+ l_pi = opj_pi_create(p_image, p_cp, p_tile_no, manager);
153 if (!l_pi) {
154 opj_free(l_tmp_data);
155 opj_free(l_tmp_ptr);
156@@ -1552,7 +1566,8 @@ opj_pi_iterator_t *opj_pi_create_decode(
157 opj_pi_iterator_t *opj_pi_initialise_encode(const opj_image_t *p_image,
158 opj_cp_t *p_cp,
159 OPJ_UINT32 p_tile_no,
160- J2K_T2_MODE p_t2_mode)
161+ J2K_T2_MODE p_t2_mode,
162+ opj_event_mgr_t* manager)
163 {
164 OPJ_UINT32 numcomps = p_image->numcomps;
165
166@@ -1606,7 +1621,7 @@ opj_pi_iterator_t *opj_pi_initialise_enc
167 }
168
169 /* memory allocation for pi*/
170- l_pi = opj_pi_create(p_image, p_cp, p_tile_no);
171+ l_pi = opj_pi_create(p_image, p_cp, p_tile_no, manager);
172 if (!l_pi) {
173 opj_free(l_tmp_data);
174 opj_free(l_tmp_ptr);
175--- a/src/lib/openjp2/pi.h
176+++ b/src/lib/openjp2/pi.h
177@@ -107,6 +107,8 @@ typedef struct opj_pi_iterator {
178 OPJ_INT32 x, y;
179 /** FIXME DOC*/
180 OPJ_UINT32 dx, dy;
181+ /** event manager */
182+ opj_event_mgr_t* manager;
183 } opj_pi_iterator_t;
184
185 /** @name Exported functions */
186@@ -119,13 +121,15 @@ typedef struct opj_pi_iterator {
187 * @param cp the coding parameters.
188 * @param tileno index of the tile being encoded.
189 * @param t2_mode the type of pass for generating the packet iterator
190+ * @param manager Event manager
191 *
192 * @return a list of packet iterator that points to the first packet of the tile (not true).
193 */
194 opj_pi_iterator_t *opj_pi_initialise_encode(const opj_image_t *image,
195 opj_cp_t *cp,
196 OPJ_UINT32 tileno,
197- J2K_T2_MODE t2_mode);
198+ J2K_T2_MODE t2_mode,
199+ opj_event_mgr_t* manager);
200
201 /**
202 * Updates the encoding parameters of the codec.
203@@ -161,12 +165,14 @@ Create a packet iterator for Decoder
204 @param image Raw image for which the packets will be listed
205 @param cp Coding parameters
206 @param tileno Number that identifies the tile for which to list the packets
207+@param manager Event manager
208 @return Returns a packet iterator that points to the first packet of the tile
209 @see opj_pi_destroy
210 */
211 opj_pi_iterator_t *opj_pi_create_decode(opj_image_t * image,
212 opj_cp_t * cp,
213- OPJ_UINT32 tileno);
214+ OPJ_UINT32 tileno,
215+ opj_event_mgr_t* manager);
216 /**
217 * Destroys a packet iterator array.
218 *
219--- a/src/lib/openjp2/t2.c
220+++ b/src/lib/openjp2/t2.c
221@@ -244,7 +244,7 @@ OPJ_BOOL opj_t2_encode_packets(opj_t2_t*
222 l_image->numcomps : 1;
223 OPJ_UINT32 l_nb_pocs = l_tcp->numpocs + 1;
224
225- l_pi = opj_pi_initialise_encode(l_image, l_cp, p_tile_no, p_t2_mode);
226+ l_pi = opj_pi_initialise_encode(l_image, l_cp, p_tile_no, p_t2_mode, p_manager);
227 if (!l_pi) {
228 return OPJ_FALSE;
229 }
230@@ -405,7 +405,7 @@ OPJ_BOOL opj_t2_decode_packets(opj_tcd_t
231 #endif
232
233 /* create a packet iterator */
234- l_pi = opj_pi_create_decode(l_image, l_cp, p_tile_no);
235+ l_pi = opj_pi_create_decode(l_image, l_cp, p_tile_no, p_manager);
236 if (!l_pi) {
237 return OPJ_FALSE;
238 }
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27842.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27842.patch
new file mode 100644
index 0000000000..6984aa8602
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27842.patch
@@ -0,0 +1,31 @@
1From fbd30b064f8f9607d500437b6fedc41431fd6cdc Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Tue, 1 Dec 2020 19:51:35 +0100
4Subject: [PATCH] opj_t2_encode_packet(): avoid out of bound access of #1294,
5 but likely not the proper fix
6
7Upstream-Status: Backport [https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openjpeg2/2.3.1-1ubuntu4.20.04.1/openjpeg2_2.3.1-1ubuntu4.20.04.1.debian.tar.xz]
8CVE: CVE-2020-27842
9Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
10---
11 src/lib/openjp2/t2.c | 9 +++++++++
12 1 file changed, 9 insertions(+)
13
14--- a/src/lib/openjp2/t2.c
15+++ b/src/lib/openjp2/t2.c
16@@ -711,6 +711,15 @@ static OPJ_BOOL opj_t2_encode_packet(OPJ
17 continue;
18 }
19
20+ /* Avoid out of bounds access of https://github.com/uclouvain/openjpeg/issues/1294 */
21+ /* but likely not a proper fix. */
22+ if (precno >= res->pw * res->ph) {
23+ opj_event_msg(p_manager, EVT_ERROR,
24+ "opj_t2_encode_packet(): accessing precno=%u >= %u\n",
25+ precno, res->pw * res->ph);
26+ return OPJ_FALSE;
27+ }
28+
29 prc = &band->precincts[precno];
30 opj_tgt_reset(prc->incltree);
31 opj_tgt_reset(prc->imsbtree);
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27843.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27843.patch
new file mode 100644
index 0000000000..53c86ea5e4
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27843.patch
@@ -0,0 +1,31 @@
1From 38d661a3897052c7ff0b39b30c29cb067e130121 Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Wed, 2 Dec 2020 13:13:26 +0100
4Subject: [PATCH] opj_t2_encode_packet(): avoid out of bound access of #1297,
5 but likely not the proper fix
6
7Upstream-Status: Backport [https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openjpeg2/2.3.1-1ubuntu4.20.04.1/openjpeg2_2.3.1-1ubuntu4.20.04.1.debian.tar.xz]
8CVE: CVE-2020-27843
9Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
10---
11 src/lib/openjp2/t2.c | 9 +++++++++
12 1 file changed, 9 insertions(+)
13
14--- a/src/lib/openjp2/t2.c
15+++ b/src/lib/openjp2/t2.c
16@@ -787,6 +787,15 @@ static OPJ_BOOL opj_t2_encode_packet(OPJ
17 continue;
18 }
19
20+ /* Avoid out of bounds access of https://github.com/uclouvain/openjpeg/issues/1297 */
21+ /* but likely not a proper fix. */
22+ if (precno >= res->pw * res->ph) {
23+ opj_event_msg(p_manager, EVT_ERROR,
24+ "opj_t2_encode_packet(): accessing precno=%u >= %u\n",
25+ precno, res->pw * res->ph);
26+ return OPJ_FALSE;
27+ }
28+
29 prc = &band->precincts[precno];
30 l_nb_blocks = prc->cw * prc->ch;
31 cblk = prc->cblks.enc;
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27845.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27845.patch
new file mode 100644
index 0000000000..a1aa49a217
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2020-27845.patch
@@ -0,0 +1,74 @@
1From 8f5aff1dff510a964d3901d0fba281abec98ab63 Mon Sep 17 00:00:00 2001
2From: Even Rouault <even.rouault@spatialys.com>
3Date: Fri, 4 Dec 2020 20:45:25 +0100
4Subject: [PATCH] pi.c: avoid out of bounds access with POC (fixes #1302)
5
6Upstream-Status: Backport [https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openjpeg2/2.3.1-1ubuntu4.20.04.1/openjpeg2_2.3.1-1ubuntu4.20.04.1.debian.tar.xz]
7CVE: CVE-2020-27845
8Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
9---
10 src/lib/openjp2/pi.c | 25 +++++++++++++++++++++++--
11 1 file changed, 23 insertions(+), 2 deletions(-)
12
13--- a/src/lib/openjp2/pi.c
14+++ b/src/lib/openjp2/pi.c
15@@ -238,6 +238,13 @@ static OPJ_BOOL opj_pi_next_lrcp(opj_pi_
16 opj_pi_resolution_t *res = NULL;
17 OPJ_UINT32 index = 0;
18
19+ if (pi->poc.compno0 >= pi->numcomps ||
20+ pi->poc.compno1 >= pi->numcomps + 1) {
21+ opj_event_msg(pi->manager, EVT_ERROR,
22+ "opj_pi_next_lrcp(): invalid compno0/compno1\n");
23+ return OPJ_FALSE;
24+ }
25+
26 if (!pi->first) {
27 comp = &pi->comps[pi->compno];
28 res = &comp->resolutions[pi->resno];
29@@ -291,6 +298,13 @@ static OPJ_BOOL opj_pi_next_rlcp(opj_pi_
30 opj_pi_resolution_t *res = NULL;
31 OPJ_UINT32 index = 0;
32
33+ if (pi->poc.compno0 >= pi->numcomps ||
34+ pi->poc.compno1 >= pi->numcomps + 1) {
35+ opj_event_msg(pi->manager, EVT_ERROR,
36+ "opj_pi_next_rlcp(): invalid compno0/compno1\n");
37+ return OPJ_FALSE;
38+ }
39+
40 if (!pi->first) {
41 comp = &pi->comps[pi->compno];
42 res = &comp->resolutions[pi->resno];
43@@ -337,6 +351,13 @@ static OPJ_BOOL opj_pi_next_rpcl(opj_pi_
44 opj_pi_resolution_t *res = NULL;
45 OPJ_UINT32 index = 0;
46
47+ if (pi->poc.compno0 >= pi->numcomps ||
48+ pi->poc.compno1 >= pi->numcomps + 1) {
49+ opj_event_msg(pi->manager, EVT_ERROR,
50+ "opj_pi_next_rpcl(): invalid compno0/compno1\n");
51+ return OPJ_FALSE;
52+ }
53+
54 if (!pi->first) {
55 goto LABEL_SKIP;
56 } else {
57@@ -472,7 +493,7 @@ static OPJ_BOOL opj_pi_next_pcrl(opj_pi_
58 if (pi->poc.compno0 >= pi->numcomps ||
59 pi->poc.compno1 >= pi->numcomps + 1) {
60 opj_event_msg(pi->manager, EVT_ERROR,
61- "opj_pi_next_pcrl(): invalid compno0/compno1");
62+ "opj_pi_next_pcrl(): invalid compno0/compno1\n");
63 return OPJ_FALSE;
64 }
65
66@@ -610,7 +631,7 @@ static OPJ_BOOL opj_pi_next_cprl(opj_pi_
67 if (pi->poc.compno0 >= pi->numcomps ||
68 pi->poc.compno1 >= pi->numcomps + 1) {
69 opj_event_msg(pi->manager, EVT_ERROR,
70- "opj_pi_next_cprl(): invalid compno0/compno1");
71+ "opj_pi_next_cprl(): invalid compno0/compno1\n");
72 return OPJ_FALSE;
73 }
74
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg_2.3.1.bb b/meta-oe/recipes-graphics/openjpeg/openjpeg_2.3.1.bb
index 2fdcec0ec2..218dc911fe 100644
--- a/meta-oe/recipes-graphics/openjpeg/openjpeg_2.3.1.bb
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg_2.3.1.bb
@@ -8,8 +8,21 @@ DEPENDS = "libpng tiff lcms zlib"
8SRC_URI = " \ 8SRC_URI = " \
9 git://github.com/uclouvain/openjpeg.git;branch=master;protocol=https \ 9 git://github.com/uclouvain/openjpeg.git;branch=master;protocol=https \
10 file://0002-Do-not-ask-cmake-to-export-binaries-they-don-t-make-.patch \ 10 file://0002-Do-not-ask-cmake-to-export-binaries-they-don-t-make-.patch \
11 file://CVE-2019-12973-1.patch \
12 file://CVE-2019-12973-2.patch \
11 file://CVE-2020-6851.patch \ 13 file://CVE-2020-6851.patch \
12 file://CVE-2020-8112.patch \ 14 file://CVE-2020-8112.patch \
15 file://CVE-2020-15389.patch \
16 file://CVE-2020-27814-1.patch \
17 file://CVE-2020-27814-2.patch \
18 file://CVE-2020-27814-3.patch \
19 file://CVE-2020-27814-4.patch \
20 file://CVE-2020-27823.patch \
21 file://CVE-2020-27824.patch \
22 file://CVE-2020-27841.patch \
23 file://CVE-2020-27842.patch \
24 file://CVE-2020-27843.patch \
25 file://CVE-2020-27845.patch \
13" 26"
14SRCREV = "57096325457f96d8cd07bd3af04fe81d7a2ba788" 27SRCREV = "57096325457f96d8cd07bd3af04fe81d7a2ba788"
15S = "${WORKDIR}/git" 28S = "${WORKDIR}/git"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-06-30 03:42:23 +0000