summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
authorVijay Anusuri <vanusuri@mvista.com>2023-06-23 11:18:48 +0530
committerSteve Sakoman <steve@sakoman.com>2023-07-04 05:37:07 -1000
commita84a25acc54aff716a3c255ccca9c5025ee26547 (patch)
tree3924f3364ee741659e0d3fa2bc0bd645ce9d7f46 /meta
parentc8f5ff0ffe6b11e3b50656438136ee08c9616ab2 (diff)
downloadpoky-a84a25acc54aff716a3c255ccca9c5025ee26547.tar.gz
libjpeg-turbo: CVE-2020-35538 Null pointer dereference in jcopy_sample_rows() function
Upstream-Status: Backport [https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9120a247436e84c0b4eea828cb11e8f665fcde30 & https://github.com/libjpeg-turbo/libjpeg-turbo/commit/a46c111d9f3642f0ef3819e7298846ccc61869e0] (From OE-Core rev: 345ffb433060f017d212135a5b2383017f32d321) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-graphics/jpeg/files/CVE-2020-35538-1.patch457
-rw-r--r--meta/recipes-graphics/jpeg/files/CVE-2020-35538-2.patch400
-rw-r--r--meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb2
3 files changed, 859 insertions, 0 deletions
diff --git a/meta/recipes-graphics/jpeg/files/CVE-2020-35538-1.patch b/meta/recipes-graphics/jpeg/files/CVE-2020-35538-1.patch
new file mode 100644
index 0000000000..8a52ed01e9
--- /dev/null
+++ b/meta/recipes-graphics/jpeg/files/CVE-2020-35538-1.patch
@@ -0,0 +1,457 @@
1From 9120a247436e84c0b4eea828cb11e8f665fcde30 Mon Sep 17 00:00:00 2001
2From: DRC <information@libjpeg-turbo.org>
3Date: Thu, 23 Jul 2020 21:24:38 -0500
4Subject: [PATCH] Fix jpeg_skip_scanlines() segfault w/merged upsamp
5
6The additional segfault mentioned in #244 was due to the fact that
7the merged upsamplers use a different private structure than the
8non-merged upsamplers. jpeg_skip_scanlines() was assuming the latter, so
9when merged upsampling was enabled, jpeg_skip_scanlines() clobbered one
10of the IDCT method pointers in the merged upsampler's private structure.
11
12For reasons unknown, the test image in #441 did not encounter this
13segfault (too small?), but it encountered an issue similar to the one
14fixed in 5bc43c7821df982f65aa1c738f67fbf7cba8bd69, whereby it was
15necessary to set up a dummy postprocessing function in
16read_and_discard_scanlines() when merged upsampling was enabled.
17Failing to do so caused either a segfault in merged_2v_upsample() (due
18to a NULL pointer being passed to jcopy_sample_rows()) or an error
19("Corrupt JPEG data: premature end of data segment"), depending on the
20number of scanlines skipped and whether the first scanline skipped was
21an odd- or even-numbered row.
22
23Fixes #441
24Fixes #244 (for real this time)
25
26Upstream-Status: Backport [https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9120a247436e84c0b4eea828cb11e8f665fcde30]
27CVE: CVE-2020-35538
28Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
29---
30 ChangeLog.md | 7 +++++
31 jdapistd.c | 72 ++++++++++++++++++++++++++++++++++++++++++++++------
32 jdmerge.c | 46 +++++++--------------------------
33 jdmerge.h | 47 ++++++++++++++++++++++++++++++++++
34 jdmrg565.c | 10 ++++----
35 jdmrgext.c | 6 ++---
36 6 files changed, 135 insertions(+), 53 deletions(-)
37 create mode 100644 jdmerge.h
38
39diff --git a/ChangeLog.md b/ChangeLog.md
40index 2ebfe71..19d18fa 100644
41--- a/ChangeLog.md
42+++ b/ChangeLog.md
43@@ -54,6 +54,13 @@ a 16-bit binary PGM file into an RGB image buffer.
44 generated when using the `tjLoadImage()` function to load a 16-bit binary PPM
45 file into an extended RGB image buffer.
46
47+2. Fixed segfaults or "Corrupt JPEG data: premature end of data segment" errors
48+in `jpeg_skip_scanlines()` that occurred when decompressing 4:2:2 or 4:2:0 JPEG
49+images using the merged (non-fancy) upsampling algorithms (that is, when
50+setting `cinfo.do_fancy_upsampling` to `FALSE`.) 2.0.0[6] was a similar fix,
51+but it did not cover all cases.
52+
53+
54 2.0.3
55 =====
56
57diff --git a/jdapistd.c b/jdapistd.c
58index 2c808fa..91da642 100644
59--- a/jdapistd.c
60+++ b/jdapistd.c
61@@ -4,7 +4,7 @@
62 * This file was part of the Independent JPEG Group's software:
63 * Copyright (C) 1994-1996, Thomas G. Lane.
64 * libjpeg-turbo Modifications:
65- * Copyright (C) 2010, 2015-2018, D. R. Commander.
66+ * Copyright (C) 2010, 2015-2018, 2020, D. R. Commander.
67 * Copyright (C) 2015, Google, Inc.
68 * For conditions of distribution and use, see the accompanying README.ijg
69 * file.
70@@ -21,6 +21,8 @@
71 #include "jinclude.h"
72 #include "jdmainct.h"
73 #include "jdcoefct.h"
74+#include "jdmaster.h"
75+#include "jdmerge.h"
76 #include "jdsample.h"
77 #include "jmemsys.h"
78
79@@ -304,6 +306,16 @@ noop_quantize(j_decompress_ptr cinfo, JSAMPARRAY input_buf,
80 }
81
82
83+/* Dummy postprocessing function used by jpeg_skip_scanlines() */
84+LOCAL(void)
85+noop_post_process (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
86+ JDIMENSION *in_row_group_ctr,
87+ JDIMENSION in_row_groups_avail, JSAMPARRAY output_buf,
88+ JDIMENSION *out_row_ctr, JDIMENSION out_rows_avail)
89+{
90+}
91+
92+
93 /*
94 * In some cases, it is best to call jpeg_read_scanlines() and discard the
95 * output, rather than skipping the scanlines, because this allows us to
96@@ -316,11 +328,17 @@ LOCAL(void)
97 read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
98 {
99 JDIMENSION n;
100+ my_master_ptr master = (my_master_ptr)cinfo->master;
101 void (*color_convert) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
102 JDIMENSION input_row, JSAMPARRAY output_buf,
103 int num_rows) = NULL;
104 void (*color_quantize) (j_decompress_ptr cinfo, JSAMPARRAY input_buf,
105 JSAMPARRAY output_buf, int num_rows) = NULL;
106+ void (*post_process_data) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
107+ JDIMENSION *in_row_group_ctr,
108+ JDIMENSION in_row_groups_avail,
109+ JSAMPARRAY output_buf, JDIMENSION *out_row_ctr,
110+ JDIMENSION out_rows_avail) = NULL;
111
112 if (cinfo->cconvert && cinfo->cconvert->color_convert) {
113 color_convert = cinfo->cconvert->color_convert;
114@@ -332,6 +350,12 @@ read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
115 cinfo->cquantize->color_quantize = noop_quantize;
116 }
117
118+ if (master->using_merged_upsample && cinfo->post &&
119+ cinfo->post->post_process_data) {
120+ post_process_data = cinfo->post->post_process_data;
121+ cinfo->post->post_process_data = noop_post_process;
122+ }
123+
124 for (n = 0; n < num_lines; n++)
125 jpeg_read_scanlines(cinfo, NULL, 1);
126
127@@ -340,6 +364,9 @@ read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
128
129 if (color_quantize)
130 cinfo->cquantize->color_quantize = color_quantize;
131+
132+ if (post_process_data)
133+ cinfo->post->post_process_data = post_process_data;
134 }
135
136
137@@ -382,7 +409,7 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
138 {
139 my_main_ptr main_ptr = (my_main_ptr)cinfo->main;
140 my_coef_ptr coef = (my_coef_ptr)cinfo->coef;
141- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
142+ my_master_ptr master = (my_master_ptr)cinfo->master;
143 JDIMENSION i, x;
144 int y;
145 JDIMENSION lines_per_iMCU_row, lines_left_in_iMCU_row, lines_after_iMCU_row;
146@@ -445,8 +472,16 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
147 main_ptr->buffer_full = FALSE;
148 main_ptr->rowgroup_ctr = 0;
149 main_ptr->context_state = CTX_PREPARE_FOR_IMCU;
150- upsample->next_row_out = cinfo->max_v_samp_factor;
151- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
152+ if (master->using_merged_upsample) {
153+ my_merged_upsample_ptr upsample =
154+ (my_merged_upsample_ptr)cinfo->upsample;
155+ upsample->spare_full = FALSE;
156+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
157+ } else {
158+ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
159+ upsample->next_row_out = cinfo->max_v_samp_factor;
160+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
161+ }
162 }
163
164 /* Skipping is much simpler when context rows are not required. */
165@@ -458,8 +493,16 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
166 cinfo->output_scanline += lines_left_in_iMCU_row;
167 main_ptr->buffer_full = FALSE;
168 main_ptr->rowgroup_ctr = 0;
169- upsample->next_row_out = cinfo->max_v_samp_factor;
170- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
171+ if (master->using_merged_upsample) {
172+ my_merged_upsample_ptr upsample =
173+ (my_merged_upsample_ptr)cinfo->upsample;
174+ upsample->spare_full = FALSE;
175+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
176+ } else {
177+ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
178+ upsample->next_row_out = cinfo->max_v_samp_factor;
179+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
180+ }
181 }
182 }
183
184@@ -494,7 +537,14 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
185 cinfo->output_iMCU_row += lines_to_skip / lines_per_iMCU_row;
186 increment_simple_rowgroup_ctr(cinfo, lines_to_read);
187 }
188- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
189+ if (master->using_merged_upsample) {
190+ my_merged_upsample_ptr upsample =
191+ (my_merged_upsample_ptr)cinfo->upsample;
192+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
193+ } else {
194+ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
195+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
196+ }
197 return num_lines;
198 }
199
200@@ -535,7 +585,13 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
201 * bit odd, since "rows_to_go" seems to be redundantly keeping track of
202 * output_scanline.
203 */
204- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
205+ if (master->using_merged_upsample) {
206+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
207+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
208+ } else {
209+ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
210+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
211+ }
212
213 /* Always skip the requested number of lines. */
214 return num_lines;
215diff --git a/jdmerge.c b/jdmerge.c
216index dff5a35..833ad67 100644
217--- a/jdmerge.c
218+++ b/jdmerge.c
219@@ -5,7 +5,7 @@
220 * Copyright (C) 1994-1996, Thomas G. Lane.
221 * libjpeg-turbo Modifications:
222 * Copyright 2009 Pierre Ossman <ossman@cendio.se> for Cendio AB
223- * Copyright (C) 2009, 2011, 2014-2015, D. R. Commander.
224+ * Copyright (C) 2009, 2011, 2014-2015, 2020, D. R. Commander.
225 * Copyright (C) 2013, Linaro Limited.
226 * For conditions of distribution and use, see the accompanying README.ijg
227 * file.
228@@ -40,41 +40,13 @@
229 #define JPEG_INTERNALS
230 #include "jinclude.h"
231 #include "jpeglib.h"
232+#include "jdmerge.h"
233 #include "jsimd.h"
234 #include "jconfigint.h"
235
236 #ifdef UPSAMPLE_MERGING_SUPPORTED
237
238
239-/* Private subobject */
240-
241-typedef struct {
242- struct jpeg_upsampler pub; /* public fields */
243-
244- /* Pointer to routine to do actual upsampling/conversion of one row group */
245- void (*upmethod) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
246- JDIMENSION in_row_group_ctr, JSAMPARRAY output_buf);
247-
248- /* Private state for YCC->RGB conversion */
249- int *Cr_r_tab; /* => table for Cr to R conversion */
250- int *Cb_b_tab; /* => table for Cb to B conversion */
251- JLONG *Cr_g_tab; /* => table for Cr to G conversion */
252- JLONG *Cb_g_tab; /* => table for Cb to G conversion */
253-
254- /* For 2:1 vertical sampling, we produce two output rows at a time.
255- * We need a "spare" row buffer to hold the second output row if the
256- * application provides just a one-row buffer; we also use the spare
257- * to discard the dummy last row if the image height is odd.
258- */
259- JSAMPROW spare_row;
260- boolean spare_full; /* T if spare buffer is occupied */
261-
262- JDIMENSION out_row_width; /* samples per output row */
263- JDIMENSION rows_to_go; /* counts rows remaining in image */
264-} my_upsampler;
265-
266-typedef my_upsampler *my_upsample_ptr;
267-
268 #define SCALEBITS 16 /* speediest right-shift on some machines */
269 #define ONE_HALF ((JLONG)1 << (SCALEBITS - 1))
270 #define FIX(x) ((JLONG)((x) * (1L << SCALEBITS) + 0.5))
271@@ -189,7 +161,7 @@ typedef my_upsampler *my_upsample_ptr;
272 LOCAL(void)
273 build_ycc_rgb_table(j_decompress_ptr cinfo)
274 {
275- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
276+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
277 int i;
278 JLONG x;
279 SHIFT_TEMPS
280@@ -232,7 +204,7 @@ build_ycc_rgb_table(j_decompress_ptr cinfo)
281 METHODDEF(void)
282 start_pass_merged_upsample(j_decompress_ptr cinfo)
283 {
284- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
285+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
286
287 /* Mark the spare buffer empty */
288 upsample->spare_full = FALSE;
289@@ -254,7 +226,7 @@ merged_2v_upsample(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
290 JDIMENSION *out_row_ctr, JDIMENSION out_rows_avail)
291 /* 2:1 vertical sampling case: may need a spare row. */
292 {
293- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
294+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
295 JSAMPROW work_ptrs[2];
296 JDIMENSION num_rows; /* number of rows returned to caller */
297
298@@ -305,7 +277,7 @@ merged_1v_upsample(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
299 JDIMENSION *out_row_ctr, JDIMENSION out_rows_avail)
300 /* 1:1 vertical sampling case: much easier, never need a spare row. */
301 {
302- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
303+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
304
305 /* Just do the upsampling. */
306 (*upsample->upmethod) (cinfo, input_buf, *in_row_group_ctr,
307@@ -566,11 +538,11 @@ h2v2_merged_upsample_565D(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
308 GLOBAL(void)
309 jinit_merged_upsampler(j_decompress_ptr cinfo)
310 {
311- my_upsample_ptr upsample;
312+ my_merged_upsample_ptr upsample;
313
314- upsample = (my_upsample_ptr)
315+ upsample = (my_merged_upsample_ptr)
316 (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
317- sizeof(my_upsampler));
318+ sizeof(my_merged_upsampler));
319 cinfo->upsample = (struct jpeg_upsampler *)upsample;
320 upsample->pub.start_pass = start_pass_merged_upsample;
321 upsample->pub.need_context_rows = FALSE;
322diff --git a/jdmerge.h b/jdmerge.h
323new file mode 100644
324index 0000000..b583396
325--- /dev/null
326+++ b/jdmerge.h
327@@ -0,0 +1,47 @@
328+/*
329+ * jdmerge.h
330+ *
331+ * This file was part of the Independent JPEG Group's software:
332+ * Copyright (C) 1994-1996, Thomas G. Lane.
333+ * libjpeg-turbo Modifications:
334+ * Copyright (C) 2020, D. R. Commander.
335+ * For conditions of distribution and use, see the accompanying README.ijg
336+ * file.
337+ */
338+
339+#define JPEG_INTERNALS
340+#include "jpeglib.h"
341+
342+#ifdef UPSAMPLE_MERGING_SUPPORTED
343+
344+
345+/* Private subobject */
346+
347+typedef struct {
348+ struct jpeg_upsampler pub; /* public fields */
349+
350+ /* Pointer to routine to do actual upsampling/conversion of one row group */
351+ void (*upmethod) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
352+ JDIMENSION in_row_group_ctr, JSAMPARRAY output_buf);
353+
354+ /* Private state for YCC->RGB conversion */
355+ int *Cr_r_tab; /* => table for Cr to R conversion */
356+ int *Cb_b_tab; /* => table for Cb to B conversion */
357+ JLONG *Cr_g_tab; /* => table for Cr to G conversion */
358+ JLONG *Cb_g_tab; /* => table for Cb to G conversion */
359+
360+ /* For 2:1 vertical sampling, we produce two output rows at a time.
361+ * We need a "spare" row buffer to hold the second output row if the
362+ * application provides just a one-row buffer; we also use the spare
363+ * to discard the dummy last row if the image height is odd.
364+ */
365+ JSAMPROW spare_row;
366+ boolean spare_full; /* T if spare buffer is occupied */
367+
368+ JDIMENSION out_row_width; /* samples per output row */
369+ JDIMENSION rows_to_go; /* counts rows remaining in image */
370+} my_merged_upsampler;
371+
372+typedef my_merged_upsampler *my_merged_upsample_ptr;
373+
374+#endif /* UPSAMPLE_MERGING_SUPPORTED */
375diff --git a/jdmrg565.c b/jdmrg565.c
376index 1b87e37..53f1e16 100644
377--- a/jdmrg565.c
378+++ b/jdmrg565.c
379@@ -5,7 +5,7 @@
380 * Copyright (C) 1994-1996, Thomas G. Lane.
381 * libjpeg-turbo Modifications:
382 * Copyright (C) 2013, Linaro Limited.
383- * Copyright (C) 2014-2015, 2018, D. R. Commander.
384+ * Copyright (C) 2014-2015, 2018, 2020, D. R. Commander.
385 * For conditions of distribution and use, see the accompanying README.ijg
386 * file.
387 *
388@@ -19,7 +19,7 @@ h2v1_merged_upsample_565_internal(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
389 JDIMENSION in_row_group_ctr,
390 JSAMPARRAY output_buf)
391 {
392- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
393+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
394 register int y, cred, cgreen, cblue;
395 int cb, cr;
396 register JSAMPROW outptr;
397@@ -90,7 +90,7 @@ h2v1_merged_upsample_565D_internal(j_decompress_ptr cinfo,
398 JDIMENSION in_row_group_ctr,
399 JSAMPARRAY output_buf)
400 {
401- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
402+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
403 register int y, cred, cgreen, cblue;
404 int cb, cr;
405 register JSAMPROW outptr;
406@@ -163,7 +163,7 @@ h2v2_merged_upsample_565_internal(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
407 JDIMENSION in_row_group_ctr,
408 JSAMPARRAY output_buf)
409 {
410- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
411+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
412 register int y, cred, cgreen, cblue;
413 int cb, cr;
414 register JSAMPROW outptr0, outptr1;
415@@ -259,7 +259,7 @@ h2v2_merged_upsample_565D_internal(j_decompress_ptr cinfo,
416 JDIMENSION in_row_group_ctr,
417 JSAMPARRAY output_buf)
418 {
419- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
420+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
421 register int y, cred, cgreen, cblue;
422 int cb, cr;
423 register JSAMPROW outptr0, outptr1;
424diff --git a/jdmrgext.c b/jdmrgext.c
425index b1c27df..c9a44d8 100644
426--- a/jdmrgext.c
427+++ b/jdmrgext.c
428@@ -4,7 +4,7 @@
429 * This file was part of the Independent JPEG Group's software:
430 * Copyright (C) 1994-1996, Thomas G. Lane.
431 * libjpeg-turbo Modifications:
432- * Copyright (C) 2011, 2015, D. R. Commander.
433+ * Copyright (C) 2011, 2015, 2020, D. R. Commander.
434 * For conditions of distribution and use, see the accompanying README.ijg
435 * file.
436 *
437@@ -25,7 +25,7 @@ h2v1_merged_upsample_internal(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
438 JDIMENSION in_row_group_ctr,
439 JSAMPARRAY output_buf)
440 {
441- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
442+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
443 register int y, cred, cgreen, cblue;
444 int cb, cr;
445 register JSAMPROW outptr;
446@@ -97,7 +97,7 @@ h2v2_merged_upsample_internal(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
447 JDIMENSION in_row_group_ctr,
448 JSAMPARRAY output_buf)
449 {
450- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
451+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
452 register int y, cred, cgreen, cblue;
453 int cb, cr;
454 register JSAMPROW outptr0, outptr1;
455--
4562.25.1
457
diff --git a/meta/recipes-graphics/jpeg/files/CVE-2020-35538-2.patch b/meta/recipes-graphics/jpeg/files/CVE-2020-35538-2.patch
new file mode 100644
index 0000000000..f86175dff0
--- /dev/null
+++ b/meta/recipes-graphics/jpeg/files/CVE-2020-35538-2.patch
@@ -0,0 +1,400 @@
1From a46c111d9f3642f0ef3819e7298846ccc61869e0 Mon Sep 17 00:00:00 2001
2From: DRC <information@libjpeg-turbo.org>
3Date: Mon, 27 Jul 2020 14:21:23 -0500
4Subject: [PATCH] Further jpeg_skip_scanlines() fixes
5
6- Introduce a partial image decompression regression test script that
7 validates the correctness of jpeg_skip_scanlines() and
8 jpeg_crop_scanlines() for a variety of cropping regions and libjpeg
9 settings.
10
11 This regression test catches the following issues:
12 #182, fixed in 5bc43c7
13 #237, fixed in 6e95c08
14 #244, fixed in 398c1e9
15 #441, fully fixed in this commit
16
17 It does not catch the following issues:
18 #194, fixed in 773040f
19 #244 (additional segfault), fixed in
20 9120a24
21
22- Modify the libjpeg-turbo regression test suite (make test) so that it
23 checks for the issue reported in #441 (segfault in
24 jpeg_skip_scanlines() when used with 4:2:0 merged upsampling/color
25 conversion.)
26
27- Fix issues in jpeg_skip_scanlines() that caused incorrect output with
28 h2v2 (4:2:0) merged upsampling/color conversion. The previous commit
29 fixed the segfault reported in #441, but that was a symptom of a
30 larger problem. Because merged 4:2:0 upsampling uses a "spare row"
31 buffer, it is necessary to allow the upsampler to run when skipping
32 rows (fancy 4:2:0 upsampling, which uses context rows, also requires
33 this.) Otherwise, if skipping starts at an odd-numbered row, the
34 output image will be incorrect.
35
36- Throw an error if jpeg_skip_scanlines() is called with two-pass color
37 quantization enabled. With two-pass color quantization, the first
38 pass occurs within jpeg_start_decompress(), so subsequent calls to
39 jpeg_skip_scanlines() interfere with the multipass state and prevent
40 the second pass from occurring during subsequent calls to
41 jpeg_read_scanlines().
42
43Upstream-Status: Backport [https://github.com/libjpeg-turbo/libjpeg-turbo/commit/a46c111d9f3642f0ef3819e7298846ccc61869e0]
44CVE: CVE-2020-35538
45Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
46---
47 CMakeLists.txt | 9 +++--
48 ChangeLog.md | 15 +++++---
49 croptest.in | 95 ++++++++++++++++++++++++++++++++++++++++++++++++++
50 jdapistd.c | 70 +++++++++++--------------------------
51 libjpeg.txt | 6 ++--
52 5 files changed, 136 insertions(+), 59 deletions(-)
53 create mode 100755 croptest.in
54
55diff --git a/CMakeLists.txt b/CMakeLists.txt
56index aee74c9..de451f4 100644
57--- a/CMakeLists.txt
58+++ b/CMakeLists.txt
59@@ -753,7 +753,7 @@ else()
60 set(MD5_PPM_3x2_IFAST fd283664b3b49127984af0a7f118fccd)
61 set(MD5_JPEG_420_ISLOW_ARI e986fb0a637a8d833d96e8a6d6d84ea1)
62 set(MD5_JPEG_444_ISLOW_PROGARI 0a8f1c8f66e113c3cf635df0a475a617)
63- set(MD5_PPM_420M_IFAST_ARI 72b59a99bcf1de24c5b27d151bde2437)
64+ set(MD5_PPM_420M_IFAST_ARI 57251da28a35b46eecb7177d82d10e0e)
65 set(MD5_JPEG_420_ISLOW 9a68f56bc76e466aa7e52f415d0f4a5f)
66 set(MD5_PPM_420M_ISLOW_2_1 9f9de8c0612f8d06869b960b05abf9c9)
67 set(MD5_PPM_420M_ISLOW_15_8 b6875bc070720b899566cc06459b63b7)
68@@ -1131,7 +1131,7 @@ foreach(libtype ${TEST_LIBTYPES})
69
70 if(WITH_ARITH_DEC)
71 # CC: RGB->YCC SAMP: h2v2 merged IDCT: ifast ENT: arith
72- add_bittest(djpeg 420m-ifast-ari "-fast;-ppm"
73+ add_bittest(djpeg 420m-ifast-ari "-fast;-skip;1,20;-ppm"
74 testout_420m_ifast_ari.ppm ${TESTIMAGES}/testimgari.jpg
75 ${MD5_PPM_420M_IFAST_ARI})
76
77@@ -1266,6 +1266,11 @@ endforeach()
78 add_custom_target(testclean COMMAND ${CMAKE_COMMAND} -P
79 ${CMAKE_CURRENT_SOURCE_DIR}/cmakescripts/testclean.cmake)
80
81+configure_file(croptest.in croptest @ONLY)
82+add_custom_target(croptest
83+ COMMAND echo croptest
84+ COMMAND ${BASH} ${CMAKE_CURRENT_BINARY_DIR}/croptest)
85+
86 if(WITH_TURBOJPEG)
87 configure_file(tjbenchtest.in tjbenchtest @ONLY)
88 configure_file(tjexampletest.in tjexampletest @ONLY)
89diff --git a/ChangeLog.md b/ChangeLog.md
90index 19d18fa..4562eff 100644
91--- a/ChangeLog.md
92+++ b/ChangeLog.md
93@@ -54,11 +54,16 @@ a 16-bit binary PGM file into an RGB image buffer.
94 generated when using the `tjLoadImage()` function to load a 16-bit binary PPM
95 file into an extended RGB image buffer.
96
97-2. Fixed segfaults or "Corrupt JPEG data: premature end of data segment" errors
98-in `jpeg_skip_scanlines()` that occurred when decompressing 4:2:2 or 4:2:0 JPEG
99-images using the merged (non-fancy) upsampling algorithms (that is, when
100-setting `cinfo.do_fancy_upsampling` to `FALSE`.) 2.0.0[6] was a similar fix,
101-but it did not cover all cases.
102+2. Fixed or worked around multiple issues with `jpeg_skip_scanlines()`:
103+
104+ - Fixed segfaults or "Corrupt JPEG data: premature end of data segment"
105+errors in `jpeg_skip_scanlines()` that occurred when decompressing 4:2:2 or
106+4:2:0 JPEG images using merged (non-fancy) upsampling/color conversion (that
107+is, when setting `cinfo.do_fancy_upsampling` to `FALSE`.) 2.0.0[6] was a
108+similar fix, but it did not cover all cases.
109+ - `jpeg_skip_scanlines()` now throws an error if two-pass color
110+quantization is enabled. Two-pass color quantization never worked properly
111+with `jpeg_skip_scanlines()`, and the issues could not readily be fixed.
112
113
114 2.0.3
115diff --git a/croptest.in b/croptest.in
116new file mode 100755
117index 0000000..7e3c293
118--- /dev/null
119+++ b/croptest.in
120@@ -0,0 +1,95 @@
121+#!/bin/bash
122+
123+set -u
124+set -e
125+trap onexit INT
126+trap onexit TERM
127+trap onexit EXIT
128+
129+onexit()
130+{
131+ if [ -d $OUTDIR ]; then
132+ rm -rf $OUTDIR
133+ fi
134+}
135+
136+runme()
137+{
138+ echo \*\*\* $*
139+ $*
140+}
141+
142+IMAGE=vgl_6548_0026a.bmp
143+WIDTH=128
144+HEIGHT=95
145+IMGDIR=@CMAKE_CURRENT_SOURCE_DIR@/testimages
146+OUTDIR=`mktemp -d /tmp/__croptest_output.XXXXXX`
147+EXEDIR=@CMAKE_CURRENT_BINARY_DIR@
148+
149+if [ -d $OUTDIR ]; then
150+ rm -rf $OUTDIR
151+fi
152+mkdir -p $OUTDIR
153+
154+exec >$EXEDIR/croptest.log
155+
156+echo "============================================================"
157+echo "$IMAGE ($WIDTH x $HEIGHT)"
158+echo "============================================================"
159+echo
160+
161+for PROGARG in "" -progressive; do
162+
163+ cp $IMGDIR/$IMAGE $OUTDIR
164+ basename=`basename $IMAGE .bmp`
165+ echo "------------------------------------------------------------"
166+ echo "Generating test images"
167+ echo "------------------------------------------------------------"
168+ echo
169+ runme $EXEDIR/cjpeg $PROGARG -grayscale -outfile $OUTDIR/${basename}_GRAY.jpg $IMGDIR/${basename}.bmp
170+ runme $EXEDIR/cjpeg $PROGARG -sample 2x2 -outfile $OUTDIR/${basename}_420.jpg $IMGDIR/${basename}.bmp
171+ runme $EXEDIR/cjpeg $PROGARG -sample 2x1 -outfile $OUTDIR/${basename}_422.jpg $IMGDIR/${basename}.bmp
172+ runme $EXEDIR/cjpeg $PROGARG -sample 1x2 -outfile $OUTDIR/${basename}_440.jpg $IMGDIR/${basename}.bmp
173+ runme $EXEDIR/cjpeg $PROGARG -sample 1x1 -outfile $OUTDIR/${basename}_444.jpg $IMGDIR/${basename}.bmp
174+ echo
175+
176+ for NSARG in "" -nosmooth; do
177+
178+ for COLORSARG in "" "-colors 256 -dither none -onepass"; do
179+
180+ for Y in {0..16}; do
181+
182+ for H in {1..16}; do
183+
184+ X=$(( (Y*16)%128 ))
185+ W=$(( WIDTH-X-7 ))
186+ if [ $Y -le 15 ]; then
187+ CROPSPEC="${W}x${H}+${X}+${Y}"
188+ else
189+ Y2=$(( HEIGHT-H ));
190+ CROPSPEC="${W}x${H}+${X}+${Y2}"
191+ fi
192+
193+ echo "------------------------------------------------------------"
194+ echo $PROGARG $NSARG $COLORSARG -crop $CROPSPEC
195+ echo "------------------------------------------------------------"
196+ echo
197+ for samp in GRAY 420 422 440 444; do
198+ $EXEDIR/djpeg $NSARG $COLORSARG -rgb -outfile $OUTDIR/${basename}_${samp}_full.ppm $OUTDIR/${basename}_${samp}.jpg
199+ convert -crop $CROPSPEC $OUTDIR/${basename}_${samp}_full.ppm $OUTDIR/${basename}_${samp}_ref.ppm
200+ runme $EXEDIR/djpeg $NSARG $COLORSARG -crop $CROPSPEC -rgb -outfile $OUTDIR/${basename}_${samp}.ppm $OUTDIR/${basename}_${samp}.jpg
201+ runme cmp $OUTDIR/${basename}_${samp}.ppm $OUTDIR/${basename}_${samp}_ref.ppm
202+ done
203+ echo
204+
205+ done
206+
207+ done
208+
209+ done
210+
211+ done
212+
213+done
214+
215+echo SUCCESS!
216diff --git a/jdapistd.c b/jdapistd.c
217index 91da642..c502909 100644
218--- a/jdapistd.c
219+++ b/jdapistd.c
220@@ -306,16 +306,6 @@ noop_quantize(j_decompress_ptr cinfo, JSAMPARRAY input_buf,
221 }
222
223
224-/* Dummy postprocessing function used by jpeg_skip_scanlines() */
225-LOCAL(void)
226-noop_post_process (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
227- JDIMENSION *in_row_group_ctr,
228- JDIMENSION in_row_groups_avail, JSAMPARRAY output_buf,
229- JDIMENSION *out_row_ctr, JDIMENSION out_rows_avail)
230-{
231-}
232-
233-
234 /*
235 * In some cases, it is best to call jpeg_read_scanlines() and discard the
236 * output, rather than skipping the scanlines, because this allows us to
237@@ -329,16 +319,12 @@ read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
238 {
239 JDIMENSION n;
240 my_master_ptr master = (my_master_ptr)cinfo->master;
241+ JSAMPARRAY scanlines = NULL;
242 void (*color_convert) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
243 JDIMENSION input_row, JSAMPARRAY output_buf,
244 int num_rows) = NULL;
245 void (*color_quantize) (j_decompress_ptr cinfo, JSAMPARRAY input_buf,
246 JSAMPARRAY output_buf, int num_rows) = NULL;
247- void (*post_process_data) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
248- JDIMENSION *in_row_group_ctr,
249- JDIMENSION in_row_groups_avail,
250- JSAMPARRAY output_buf, JDIMENSION *out_row_ctr,
251- JDIMENSION out_rows_avail) = NULL;
252
253 if (cinfo->cconvert && cinfo->cconvert->color_convert) {
254 color_convert = cinfo->cconvert->color_convert;
255@@ -350,23 +336,19 @@ read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
256 cinfo->cquantize->color_quantize = noop_quantize;
257 }
258
259- if (master->using_merged_upsample && cinfo->post &&
260- cinfo->post->post_process_data) {
261- post_process_data = cinfo->post->post_process_data;
262- cinfo->post->post_process_data = noop_post_process;
263+ if (master->using_merged_upsample && cinfo->max_v_samp_factor == 2) {
264+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
265+ scanlines = &upsample->spare_row;
266 }
267
268 for (n = 0; n < num_lines; n++)
269- jpeg_read_scanlines(cinfo, NULL, 1);
270+ jpeg_read_scanlines(cinfo, scanlines, 1);
271
272 if (color_convert)
273 cinfo->cconvert->color_convert = color_convert;
274
275 if (color_quantize)
276 cinfo->cquantize->color_quantize = color_quantize;
277-
278- if (post_process_data)
279- cinfo->post->post_process_data = post_process_data;
280 }
281
282
283@@ -380,6 +362,12 @@ increment_simple_rowgroup_ctr(j_decompress_ptr cinfo, JDIMENSION rows)
284 {
285 JDIMENSION rows_left;
286 my_main_ptr main_ptr = (my_main_ptr)cinfo->main;
287+ my_master_ptr master = (my_master_ptr)cinfo->master;
288+
289+ if (master->using_merged_upsample && cinfo->max_v_samp_factor == 2) {
290+ read_and_discard_scanlines(cinfo, rows);
291+ return;
292+ }
293
294 /* Increment the counter to the next row group after the skipped rows. */
295 main_ptr->rowgroup_ctr += rows / cinfo->max_v_samp_factor;
296@@ -410,11 +398,16 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
297 my_main_ptr main_ptr = (my_main_ptr)cinfo->main;
298 my_coef_ptr coef = (my_coef_ptr)cinfo->coef;
299 my_master_ptr master = (my_master_ptr)cinfo->master;
300+ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
301 JDIMENSION i, x;
302 int y;
303 JDIMENSION lines_per_iMCU_row, lines_left_in_iMCU_row, lines_after_iMCU_row;
304 JDIMENSION lines_to_skip, lines_to_read;
305
306+ /* Two-pass color quantization is not supported. */
307+ if (cinfo->quantize_colors && cinfo->two_pass_quantize)
308+ ERREXIT(cinfo, JERR_NOTIMPL);
309+
310 if (cinfo->global_state != DSTATE_SCANNING)
311 ERREXIT1(cinfo, JERR_BAD_STATE, cinfo->global_state);
312
313@@ -472,13 +465,7 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
314 main_ptr->buffer_full = FALSE;
315 main_ptr->rowgroup_ctr = 0;
316 main_ptr->context_state = CTX_PREPARE_FOR_IMCU;
317- if (master->using_merged_upsample) {
318- my_merged_upsample_ptr upsample =
319- (my_merged_upsample_ptr)cinfo->upsample;
320- upsample->spare_full = FALSE;
321- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
322- } else {
323- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
324+ if (!master->using_merged_upsample) {
325 upsample->next_row_out = cinfo->max_v_samp_factor;
326 upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
327 }
328@@ -493,13 +480,7 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
329 cinfo->output_scanline += lines_left_in_iMCU_row;
330 main_ptr->buffer_full = FALSE;
331 main_ptr->rowgroup_ctr = 0;
332- if (master->using_merged_upsample) {
333- my_merged_upsample_ptr upsample =
334- (my_merged_upsample_ptr)cinfo->upsample;
335- upsample->spare_full = FALSE;
336- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
337- } else {
338- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
339+ if (!master->using_merged_upsample) {
340 upsample->next_row_out = cinfo->max_v_samp_factor;
341 upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
342 }
343@@ -537,14 +518,8 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
344 cinfo->output_iMCU_row += lines_to_skip / lines_per_iMCU_row;
345 increment_simple_rowgroup_ctr(cinfo, lines_to_read);
346 }
347- if (master->using_merged_upsample) {
348- my_merged_upsample_ptr upsample =
349- (my_merged_upsample_ptr)cinfo->upsample;
350- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
351- } else {
352- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
353+ if (!master->using_merged_upsample)
354 upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
355- }
356 return num_lines;
357 }
358
359@@ -585,13 +560,8 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
360 * bit odd, since "rows_to_go" seems to be redundantly keeping track of
361 * output_scanline.
362 */
363- if (master->using_merged_upsample) {
364- my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
365+ if (!master->using_merged_upsample)
366 upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
367- } else {
368- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
369- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
370- }
371
372 /* Always skip the requested number of lines. */
373 return num_lines;
374diff --git a/libjpeg.txt b/libjpeg.txt
375index c50cf90..c233ecb 100644
376--- a/libjpeg.txt
377+++ b/libjpeg.txt
378@@ -3,7 +3,7 @@ USING THE IJG JPEG LIBRARY
379 This file was part of the Independent JPEG Group's software:
380 Copyright (C) 1994-2013, Thomas G. Lane, Guido Vollbeding.
381 libjpeg-turbo Modifications:
382-Copyright (C) 2010, 2014-2018, D. R. Commander.
383+Copyright (C) 2010, 2014-2018, 2020, D. R. Commander.
384 Copyright (C) 2015, Google, Inc.
385 For conditions of distribution and use, see the accompanying README.ijg file.
386
387@@ -750,7 +750,9 @@ multiple rows in the JPEG image.
388
389 Suspending data sources are not supported by this function. Calling
390 jpeg_skip_scanlines() with a suspending data source will result in undefined
391-behavior.
392+behavior. Two-pass color quantization is also not supported by this function.
393+Calling jpeg_skip_scanlines() with two-pass color quantization enabled will
394+result in an error.
395
396 jpeg_skip_scanlines() will not allow skipping past the bottom of the image. If
397 the value of num_lines is large enough to skip past the bottom of the image,
398--
3992.25.1
400
diff --git a/meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb b/meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb
index 6575582b0c..630b20300f 100644
--- a/meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb
+++ b/meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb
@@ -14,6 +14,8 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BPN}-${PV}.tar.gz \
14 file://0001-libjpeg-turbo-fix-package_qa-error.patch \ 14 file://0001-libjpeg-turbo-fix-package_qa-error.patch \
15 file://CVE-2020-13790.patch \ 15 file://CVE-2020-13790.patch \
16 file://CVE-2021-46822.patch \ 16 file://CVE-2021-46822.patch \
17 file://CVE-2020-35538-1.patch \
18 file://CVE-2020-35538-2.patch \
17 " 19 "
18 20
19SRC_URI[md5sum] = "d01d9e0c28c27bc0de9f4e2e8ff49855" 21SRC_URI[md5sum] = "d01d9e0c28c27bc0de9f4e2e8ff49855"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-11-02 23:37:46 +0000