summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-oe/recipes-graphics/jasper/jasper/CVE-2025-8835.patch170
-rw-r--r--meta-oe/recipes-graphics/jasper/jasper_2.0.33.bb1
2 files changed, 171 insertions, 0 deletions
diff --git a/meta-oe/recipes-graphics/jasper/jasper/CVE-2025-8835.patch b/meta-oe/recipes-graphics/jasper/jasper/CVE-2025-8835.patch
new file mode 100644
index 0000000000..d781d24361
--- /dev/null
+++ b/meta-oe/recipes-graphics/jasper/jasper/CVE-2025-8835.patch
@@ -0,0 +1,170 @@
1From 8c72f24556b2418f5689713eb706014423473a73 Mon Sep 17 00:00:00 2001
2From: Michael Adams <mdadams@ece.uvic.ca>
3Date: Tue, 29 Jul 2025 20:16:35 -0700
4Subject: [PATCH] Fixes #400.
5
6Added a check for a missing color component in the jas_image_chclrspc
7function.
8
9CVE: CVE-2025-8835
10Upstream-Status: Backport [https://github.com/jasper-software/jasper/commit/bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52]
11
12Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
13---
14 src/libjasper/base/jas_image.c | 73 ++++++++++++++++++++++++++++------
15 1 file changed, 61 insertions(+), 12 deletions(-)
16
17diff --git a/src/libjasper/base/jas_image.c b/src/libjasper/base/jas_image.c
18index 68a94e1..bfbf9e5 100644
19--- a/src/libjasper/base/jas_image.c
20+++ b/src/libjasper/base/jas_image.c
21@@ -112,7 +112,8 @@ static long convert(long val, bool oldsgnd, unsigned oldprec, bool newsgnd,
22 unsigned newprec);
23 static void jas_image_calcbbox2(const jas_image_t *image, jas_image_coord_t *tlx,
24 jas_image_coord_t *tly, jas_image_coord_t *brx, jas_image_coord_t *bry);
25-
26+static jas_cmcmptfmt_t* jas_cmcmptfmt_array_create(int n);
27+static void jas_cmcmptfmt_array_destroy(jas_cmcmptfmt_t* cmptfmts, int n);
28 /******************************************************************************\
29 * Global data.
30 \******************************************************************************/
31@@ -409,6 +410,36 @@ static void jas_image_cmpt_destroy(jas_image_cmpt_t *cmpt)
32 jas_free(cmpt);
33 }
34
35+static jas_cmcmptfmt_t* jas_cmcmptfmt_array_create(int n)
36+{
37+ jas_cmcmptfmt_t* cmptfmts;
38+ JAS_DBGLOG(10, ("jas_cmcmptfmt_array_create(%d)\n", n));
39+ if (!(cmptfmts = jas_alloc2(n, sizeof(jas_cmcmptfmt_t)))) {
40+ return 0;
41+ }
42+ for (int i = 0; i < n; ++i) {
43+ cmptfmts[i].buf = 0;
44+ }
45+ JAS_DBGLOG(10, ("jas_cmcmptfmt_array_create(%d) returning %p\n", n,
46+ JAS_CAST(void *, cmptfmts)));
47+ return cmptfmts;
48+}
49+
50+static void jas_cmcmptfmt_array_destroy(jas_cmcmptfmt_t* cmptfmts, int n)
51+{
52+ assert(cmptfmts);
53+ assert(n > 0);
54+ JAS_DBGLOG(10, ("jas_cmcmptfmt_array_destroy(%p, %d)\n",
55+ JAS_CAST(void *, cmptfmts), n));
56+ for (int i = 0; i < n; ++i) {
57+ if (cmptfmts[i].buf) {
58+ jas_free(cmptfmts[i].buf);
59+ }
60+ cmptfmts[i].buf = 0;
61+ }
62+ jas_free(cmptfmts);
63+}
64+
65 /******************************************************************************\
66 * Load and save operations.
67 \******************************************************************************/
68@@ -1470,12 +1501,15 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image, const jas_cmprof_t *outprof,
69 jas_cmcmptfmt_t *incmptfmts;
70 jas_cmcmptfmt_t *outcmptfmts;
71
72+ assert(image);
73+ assert(outprof);
74+
75 #if 0
76 jas_eprintf("IMAGE\n");
77 jas_image_dump(image, stderr);
78 #endif
79
80- if (image->numcmpts_ == 0)
81+ if (!jas_image_numcmpts(image))
82 /* can't work with a file with no components;
83 continuing would crash because we'd attempt to
84 obtain information about the first component */
85@@ -1483,6 +1517,8 @@ jas_image_dump(image, stderr);
86
87 outimage = 0;
88 xform = 0;
89+ incmptfmts = 0;
90+ outcmptfmts = 0;
91 if (!(inimage = jas_image_copy(image)))
92 goto error;
93 image = 0;
94@@ -1565,15 +1601,21 @@ jas_image_dump(image, stderr);
95 }
96
97 inpixmap.numcmpts = numinclrchans;
98- if (!(incmptfmts = jas_alloc2(numinclrchans, sizeof(jas_cmcmptfmt_t)))) {
99+ assert(numinclrchans != 0);
100+ if (!(incmptfmts = jas_cmcmptfmt_array_create(numinclrchans))) {
101 abort();
102 }
103 inpixmap.cmptfmts = incmptfmts;
104 for (unsigned i = 0; i < numinclrchans; ++i) {
105 const int j = jas_image_getcmptbytype(inimage, JAS_IMAGE_CT_COLOR(i));
106+ if (j < 0) {
107+ jas_eprintf("missing color component %d\n", i);
108+ goto error;
109+ }
110 if (!(incmptfmts[i].buf = jas_alloc2(width, sizeof(long)))) {
111 goto error;
112 }
113+ assert(j >= 0 && j < jas_image_numcmpts(inimage));
114 incmptfmts[i].prec = jas_image_cmptprec(inimage, j);
115 incmptfmts[i].sgnd = jas_image_cmptsgnd(inimage, j);
116 incmptfmts[i].width = width;
117@@ -1581,15 +1623,20 @@ jas_image_dump(image, stderr);
118 }
119
120 outpixmap.numcmpts = numoutclrchans;
121- if (!(outcmptfmts = jas_alloc2(numoutclrchans, sizeof(jas_cmcmptfmt_t)))) {
122+ if (!(outcmptfmts = jas_cmcmptfmt_array_create(numoutclrchans))) {
123 abort();
124 }
125 outpixmap.cmptfmts = outcmptfmts;
126
127 for (unsigned i = 0; i < numoutclrchans; ++i) {
128 const int j = jas_image_getcmptbytype(outimage, JAS_IMAGE_CT_COLOR(i));
129+ if (j < 0) {
130+ jas_eprintf("missing color component %d\n", i);
131+ goto error;
132+ }
133 if (!(outcmptfmts[i].buf = jas_alloc2(width, sizeof(long))))
134 goto error;
135+ assert(j >= 0 && j < jas_image_numcmpts(outimage));
136 outcmptfmts[i].prec = jas_image_cmptprec(outimage, j);
137 outcmptfmts[i].sgnd = jas_image_cmptsgnd(outimage, j);
138 outcmptfmts[i].width = width;
139@@ -1612,14 +1659,8 @@ jas_image_dump(image, stderr);
140 }
141 }
142
143- for (unsigned i = 0; i < numoutclrchans; ++i) {
144- jas_free(outcmptfmts[i].buf);
145- }
146- jas_free(outcmptfmts);
147- for (unsigned i = 0; i < numinclrchans; ++i) {
148- jas_free(incmptfmts[i].buf);
149- }
150- jas_free(incmptfmts);
151+ jas_cmcmptfmt_array_destroy(outcmptfmts, numoutclrchans);
152+ jas_cmcmptfmt_array_destroy(incmptfmts, numinclrchans);
153 jas_cmxform_destroy(xform);
154 jas_image_destroy(inimage);
155
156@@ -1631,6 +1672,14 @@ jas_image_dump(outimage, stderr);
157 #endif
158 return outimage;
159 error:
160+ if (incmptfmts) {
161+ assert(numinclrchans);
162+ jas_cmcmptfmt_array_destroy(incmptfmts, numinclrchans);
163+ }
164+ if (outcmptfmts) {
165+ assert(numoutclrchans);
166+ jas_cmcmptfmt_array_destroy(outcmptfmts, numoutclrchans);
167+ }
168 if (xform)
169 jas_cmxform_destroy(xform);
170 if (inimage)
diff --git a/meta-oe/recipes-graphics/jasper/jasper_2.0.33.bb b/meta-oe/recipes-graphics/jasper/jasper_2.0.33.bb
index 522adba93d..c314da539f 100644
--- a/meta-oe/recipes-graphics/jasper/jasper_2.0.33.bb
+++ b/meta-oe/recipes-graphics/jasper/jasper_2.0.33.bb
@@ -5,6 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=a80440d1d8f17d041c71c7271d6e06eb"
5 5
6SRC_URI = "git://github.com/jasper-software/jasper.git;protocol=https;branch=master \ 6SRC_URI = "git://github.com/jasper-software/jasper.git;protocol=https;branch=master \
7 file://CVE-2023-51257.patch \ 7 file://CVE-2023-51257.patch \
8 file://CVE-2025-8835.patch \
8 " 9 "
9SRCREV = "fe00207dc10db1d7cc6f2757961c5c6bdfd10973" 10SRCREV = "fe00207dc10db1d7cc6f2757961c5c6bdfd10973"
10 11
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-18 07:39:21 +0000