summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-oe/recipes-graphics/jasper/jasper/0001-Fixes-400.patch173
-rw-r--r--meta-oe/recipes-graphics/jasper/jasper_4.2.4.bb4
2 files changed, 176 insertions, 1 deletions
diff --git a/meta-oe/recipes-graphics/jasper/jasper/0001-Fixes-400.patch b/meta-oe/recipes-graphics/jasper/jasper/0001-Fixes-400.patch
new file mode 100644
index 0000000000..0e7cd01b59
--- /dev/null
+++ b/meta-oe/recipes-graphics/jasper/jasper/0001-Fixes-400.patch
@@ -0,0 +1,173 @@
1From 8c6da904432451aec2a9e4d6169ad771dbe72820 Mon Sep 17 00:00:00 2001
2From: Michael Adams <mdadams@ece.uvic.ca>
3Date: Tue, 29 Jul 2025 20:16:35 -0700
4Subject: [PATCH] Fixes #400.
5
6Added a check for a missing color component in the jas_image_chclrspc
7function.
8
9CVE: CVE-2025-8835
10Upstream-Status: Backport [https://github.com/jasper-software/jasper/commit/bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52]
11
12Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
13---
14 src/libjasper/base/jas_image.c | 72 ++++++++++++++++++++++++++++-----
15 1 file changed, 61 insertions(+), 11 deletions(-)
16 create mode 100644 data/test/other/poc_400.pnm
17
18diff --git a/src/libjasper/base/jas_image.c b/src/libjasper/base/jas_image.c
19index 1ed0905..c8aa42b 100644
20--- a/src/libjasper/base/jas_image.c
21+++ b/src/libjasper/base/jas_image.c
22@@ -118,6 +118,8 @@ static void jas_image_calcbbox2(const jas_image_t *image,
23 jas_image_coord_t *bry);
24 static void jas_image_fmtinfo_init(jas_image_fmtinfo_t *fmtinfo);
25 static void jas_image_fmtinfo_cleanup(jas_image_fmtinfo_t *fmtinfo);
26+static jas_cmcmptfmt_t* jas_cmcmptfmt_array_create(int n);
27+static void jas_cmcmptfmt_array_destroy(jas_cmcmptfmt_t* cmptfmts, int n);
28
29 /******************************************************************************\
30 * Create and destroy operations.
31@@ -413,6 +415,36 @@ static void jas_image_cmpt_destroy(jas_image_cmpt_t *cmpt)
32 jas_free(cmpt);
33 }
34
35+static jas_cmcmptfmt_t* jas_cmcmptfmt_array_create(int n)
36+{
37+ jas_cmcmptfmt_t* cmptfmts;
38+ JAS_LOGDEBUGF(10, "jas_cmcmptfmt_array_create(%d)\n", n);
39+ if (!(cmptfmts = jas_alloc2(n, sizeof(jas_cmcmptfmt_t)))) {
40+ return 0;
41+ }
42+ for (int i = 0; i < n; ++i) {
43+ cmptfmts[i].buf = 0;
44+ }
45+ JAS_LOGDEBUGF(10, "jas_cmcmptfmt_array_create(%d) returning %p\n", n,
46+ JAS_CAST(void *, cmptfmts));
47+ return cmptfmts;
48+}
49+
50+static void jas_cmcmptfmt_array_destroy(jas_cmcmptfmt_t* cmptfmts, int n)
51+{
52+ assert(cmptfmts);
53+ assert(n > 0);
54+ JAS_LOGDEBUGF(10, "jas_cmcmptfmt_array_destroy(%p, %d)\n",
55+ JAS_CAST(void *, cmptfmts), n);
56+ for (int i = 0; i < n; ++i) {
57+ if (cmptfmts[i].buf) {
58+ jas_free(cmptfmts[i].buf);
59+ }
60+ cmptfmts[i].buf = 0;
61+ }
62+ jas_free(cmptfmts);
63+}
64+
65 /******************************************************************************\
66 * Load and save operations.
67 \******************************************************************************/
68@@ -1588,12 +1620,15 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
69 jas_cmcmptfmt_t *incmptfmts;
70 jas_cmcmptfmt_t *outcmptfmts;
71
72+ assert(image);
73+ assert(outprof);
74+
75 #if 0
76 jas_eprintf("IMAGE\n");
77 jas_image_dump(image, stderr);
78 #endif
79
80- if (image->numcmpts_ == 0) {
81+ if (!jas_image_numcmpts(image)) {
82 /*
83 can't work with a file with no components;
84 continuing would crash because we'd attempt to
85@@ -1604,6 +1639,8 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
86
87 outimage = 0;
88 xform = 0;
89+ incmptfmts = 0;
90+ outcmptfmts = 0;
91 if (!(inimage = jas_image_copy(image))) {
92 goto error;
93 }
94@@ -1694,16 +1731,22 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
95 }
96
97 inpixmap.numcmpts = numinclrchans;
98- if (!(incmptfmts = jas_alloc2(numinclrchans, sizeof(jas_cmcmptfmt_t)))) {
99+ assert(numinclrchans != 0);
100+ if (!(incmptfmts = jas_cmcmptfmt_array_create(numinclrchans))) {
101 // formerly call to abort()
102 goto error;
103 }
104 inpixmap.cmptfmts = incmptfmts;
105 for (unsigned i = 0; i < numinclrchans; ++i) {
106 const int j = jas_image_getcmptbytype(inimage, JAS_IMAGE_CT_COLOR(i));
107+ if (j < 0) {
108+ jas_logerrorf("missing color component %d\n", i);
109+ goto error;
110+ }
111 if (!(incmptfmts[i].buf = jas_alloc2(width, sizeof(long)))) {
112 goto error;
113 }
114+ assert(j >= 0 && j < jas_image_numcmpts(inimage));
115 incmptfmts[i].prec = jas_image_cmptprec(inimage, j);
116 incmptfmts[i].sgnd = jas_image_cmptsgnd(inimage, j);
117 incmptfmts[i].width = width;
118@@ -1711,7 +1754,7 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
119 }
120
121 outpixmap.numcmpts = numoutclrchans;
122- if (!(outcmptfmts = jas_alloc2(numoutclrchans, sizeof(jas_cmcmptfmt_t)))) {
123+ if (!(outcmptfmts = jas_cmcmptfmt_array_create(numoutclrchans))) {
124 // formerly call to abort()
125 goto error;
126 }
127@@ -1719,9 +1762,14 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
128
129 for (unsigned i = 0; i < numoutclrchans; ++i) {
130 const int j = jas_image_getcmptbytype(outimage, JAS_IMAGE_CT_COLOR(i));
131+ if (j < 0) {
132+ jas_logerrorf("missing color component %d\n", i);
133+ goto error;
134+ }
135 if (!(outcmptfmts[i].buf = jas_alloc2(width, sizeof(long)))) {
136 goto error;
137 }
138+ assert(j >= 0 && j < jas_image_numcmpts(outimage));
139 outcmptfmts[i].prec = jas_image_cmptprec(outimage, j);
140 outcmptfmts[i].sgnd = jas_image_cmptsgnd(outimage, j);
141 outcmptfmts[i].width = width;
142@@ -1746,14 +1794,8 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
143 }
144 }
145
146- for (unsigned i = 0; i < numoutclrchans; ++i) {
147- jas_free(outcmptfmts[i].buf);
148- }
149- jas_free(outcmptfmts);
150- for (unsigned i = 0; i < numinclrchans; ++i) {
151- jas_free(incmptfmts[i].buf);
152- }
153- jas_free(incmptfmts);
154+ jas_cmcmptfmt_array_destroy(outcmptfmts, numoutclrchans);
155+ jas_cmcmptfmt_array_destroy(incmptfmts, numinclrchans);
156 jas_cmxform_destroy(xform);
157 jas_image_destroy(inimage);
158
159@@ -1765,6 +1807,14 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
160 #endif
161 return outimage;
162 error:
163+ if (incmptfmts) {
164+ assert(numinclrchans);
165+ jas_cmcmptfmt_array_destroy(incmptfmts, numinclrchans);
166+ }
167+ if (outcmptfmts) {
168+ assert(numoutclrchans);
169+ jas_cmcmptfmt_array_destroy(outcmptfmts, numoutclrchans);
170+ }
171 if (xform) {
172 jas_cmxform_destroy(xform);
173 }
diff --git a/meta-oe/recipes-graphics/jasper/jasper_4.2.4.bb b/meta-oe/recipes-graphics/jasper/jasper_4.2.4.bb
index 4796a85190..a2950dbe55 100644
--- a/meta-oe/recipes-graphics/jasper/jasper_4.2.4.bb
+++ b/meta-oe/recipes-graphics/jasper/jasper_4.2.4.bb
@@ -3,7 +3,9 @@ HOMEPAGE = "https://jasper-software.github.io/jasper/"
3LICENSE = "MIT" 3LICENSE = "MIT"
4LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=a80440d1d8f17d041c71c7271d6e06eb" 4LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=a80440d1d8f17d041c71c7271d6e06eb"
5 5
6SRC_URI = "https://github.com/jasper-software/${BPN}/releases/download/version-${PV}/${BP}.tar.gz" 6SRC_URI = "https://github.com/jasper-software/${BPN}/releases/download/version-${PV}/${BP}.tar.gz \
7 file://0001-Fixes-400.patch \
8 "
7SRC_URI[sha256sum] = "6a597613d8d84c500b5b83bf0eec06cd3707c23d19957f70354ac2394c9914e7" 9SRC_URI[sha256sum] = "6a597613d8d84c500b5b83bf0eec06cd3707c23d19957f70354ac2394c9914e7"
8 10
9CVE_STATUS[CVE-2015-8751] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." 11CVE_STATUS[CVE-2015-8751] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-09 16:33:17 +0000