From 624de33091cba7210f4628f19c803e8bc37b336d Mon Sep 17 00:00:00 2001 From: Franz Pletz Date: Sun, 6 Nov 2016 03:19:46 +0100 Subject: [PATCH] jasper: 1.900.2 -> 1.900.21 (security) Incorporates fixes from all patches for the CVEs listed and some more security-related issues like: http://www.openwall.com/lists/oss-security/2016/11/04/11 --- pkgs/development/libraries/jasper/default.nix | 18 +- .../jasper/jasper-CVE-2014-8137-noabort.diff | 16 - .../jasper/jasper-CVE-2014-8137-variant2.diff | 45 --- .../jasper/jasper-CVE-2014-8138.diff | 16 - .../jasper/jasper-CVE-2014-8157.diff | 12 - .../jasper/jasper-CVE-2014-8158.diff | 329 ------------------ .../jasper/jasper-CVE-2014-9029.diff | 31 -- .../jasper/jasper-CVE-2016-1867.diff | 11 - 8 files changed, 2 insertions(+), 476 deletions(-) delete mode 100644 pkgs/development/libraries/jasper/jasper-CVE-2014-8137-noabort.diff delete mode 100644 pkgs/development/libraries/jasper/jasper-CVE-2014-8137-variant2.diff delete mode 100644 pkgs/development/libraries/jasper/jasper-CVE-2014-8138.diff delete mode 100644 pkgs/development/libraries/jasper/jasper-CVE-2014-8157.diff delete mode 100644 pkgs/development/libraries/jasper/jasper-CVE-2014-8158.diff delete mode 100644 pkgs/development/libraries/jasper/jasper-CVE-2014-9029.diff delete mode 100644 pkgs/development/libraries/jasper/jasper-CVE-2016-1867.diff diff --git a/pkgs/development/libraries/jasper/default.nix b/pkgs/development/libraries/jasper/default.nix index e2061df88f09..895d72dd7a0a 100644 --- a/pkgs/development/libraries/jasper/default.nix +++ b/pkgs/development/libraries/jasper/default.nix @@ -1,27 +1,13 @@ { stdenv, fetchurl, fetchpatch, libjpeg, autoreconfHook }: stdenv.mkDerivation rec { - name = "jasper-1.900.2"; + name = "jasper-1.900.21"; src = fetchurl { url = "http://www.ece.uvic.ca/~mdadams/jasper/software/${name}.tar.gz"; - sha256 = "0bkibjhq3js2ldxa2f9pss84lcx4f5d3v0qis3ifi11ciy7a6c9a"; + sha256 = "1cypmlzq5vmbacsn8n3ls9p7g64scv3fzx88qf8c270dz10s5j79"; }; - patches = [ - ./jasper-CVE-2014-8137-variant2.diff - ./jasper-CVE-2014-8137-noabort.diff - - (fetchpatch { # CVE-2016-2089 - url = "https://github.com/mdadams/jasper/commit/aa6d9c2bbae9155f8e1466295373a68fa97291c3.patch"; - sha256 = "1pxnm86zmbq6brfwsm5wx3iv7s92n4xilc52lzp61q266jmlggrf"; - }) - (fetchpatch { # CVE-2015-5203 - url = "https://github.com/mdadams/jasper/commit/e73bb58f99fec0bf9c5d8866e010fcf736a53b9a.patch"; - sha256 = "1r6hxbnhpnb7q6p2kbdxc1cpph3ic851x2hy477yv5c3qmrbx9bk"; - }) - ]; - # newer reconf to recognize a multiout flag nativeBuildInputs = [ autoreconfHook ]; propagatedBuildInputs = [ libjpeg ]; diff --git a/pkgs/development/libraries/jasper/jasper-CVE-2014-8137-noabort.diff b/pkgs/development/libraries/jasper/jasper-CVE-2014-8137-noabort.diff deleted file mode 100644 index 47b57d5c8098..000000000000 --- a/pkgs/development/libraries/jasper/jasper-CVE-2014-8137-noabort.diff +++ /dev/null @@ -1,16 +0,0 @@ -From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=967284&action=diff - ---- jasper-1.900.1.orig/src/libjasper/jp2/jp2_dec.c 2014-12-11 14:30:54.193209780 +0100 -+++ jasper-1.900.1/src/libjasper/jp2/jp2_dec.c 2014-12-11 14:36:46.313217814 +0100 -@@ -291,7 +291,10 @@ jas_image_t *jp2_decode(jas_stream_t *in - case JP2_COLR_ICC: - iccprof = jas_iccprof_createfrombuf(dec->colr->data.colr.iccp, - dec->colr->data.colr.iccplen); -- assert(iccprof); -+ if (!iccprof) { -+ jas_eprintf("error: failed to parse ICC profile\n"); -+ goto error; -+ } - jas_iccprof_gethdr(iccprof, &icchdr); - jas_eprintf("ICC Profile CS %08x\n", icchdr.colorspc); - jas_image_setclrspc(dec->image, fromiccpcs(icchdr.colorspc)); diff --git a/pkgs/development/libraries/jasper/jasper-CVE-2014-8137-variant2.diff b/pkgs/development/libraries/jasper/jasper-CVE-2014-8137-variant2.diff deleted file mode 100644 index 243300dd70ee..000000000000 --- a/pkgs/development/libraries/jasper/jasper-CVE-2014-8137-variant2.diff +++ /dev/null @@ -1,45 +0,0 @@ -From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=967283&action=diff - ---- jasper-1.900.1.orig/src/libjasper/base/jas_icc.c 2014-12-11 14:06:44.000000000 +0100 -+++ jasper-1.900.1/src/libjasper/base/jas_icc.c 2014-12-11 15:16:37.971272386 +0100 -@@ -1009,7 +1009,6 @@ static int jas_icccurv_input(jas_iccattr - return 0; - - error: -- jas_icccurv_destroy(attrval); - return -1; - } - -@@ -1127,7 +1126,6 @@ static int jas_icctxtdesc_input(jas_icca - #endif - return 0; - error: -- jas_icctxtdesc_destroy(attrval); - return -1; - } - -@@ -1206,8 +1204,6 @@ static int jas_icctxt_input(jas_iccattrv - goto error; - return 0; - error: -- if (txt->string) -- jas_free(txt->string); - return -1; - } - -@@ -1328,7 +1324,6 @@ static int jas_icclut8_input(jas_iccattr - goto error; - return 0; - error: -- jas_icclut8_destroy(attrval); - return -1; - } - -@@ -1497,7 +1492,6 @@ static int jas_icclut16_input(jas_iccatt - goto error; - return 0; - error: -- jas_icclut16_destroy(attrval); - return -1; - } - diff --git a/pkgs/development/libraries/jasper/jasper-CVE-2014-8138.diff b/pkgs/development/libraries/jasper/jasper-CVE-2014-8138.diff deleted file mode 100644 index cbf0899d807a..000000000000 --- a/pkgs/development/libraries/jasper/jasper-CVE-2014-8138.diff +++ /dev/null @@ -1,16 +0,0 @@ -From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=967280&action=diff - ---- jasper-1.900.1.orig/src/libjasper/jp2/jp2_dec.c 2014-12-11 14:06:44.000000000 +0100 -+++ jasper-1.900.1/src/libjasper/jp2/jp2_dec.c 2014-12-11 14:06:26.000000000 +0100 -@@ -386,6 +386,11 @@ jas_image_t *jp2_decode(jas_stream_t *in - /* Determine the type of each component. */ - if (dec->cdef) { - for (i = 0; i < dec->numchans; ++i) { -+ /* Is the channel number reasonable? */ -+ if (dec->cdef->data.cdef.ents[i].channo >= dec->numchans) { -+ jas_eprintf("error: invalid channel number in CDEF box\n"); -+ goto error; -+ } - jas_image_setcmpttype(dec->image, - dec->chantocmptlut[dec->cdef->data.cdef.ents[i].channo], - jp2_getct(jas_image_clrspc(dec->image), diff --git a/pkgs/development/libraries/jasper/jasper-CVE-2014-8157.diff b/pkgs/development/libraries/jasper/jasper-CVE-2014-8157.diff deleted file mode 100644 index ebfc1b2d0f25..000000000000 --- a/pkgs/development/libraries/jasper/jasper-CVE-2014-8157.diff +++ /dev/null @@ -1,12 +0,0 @@ -diff -up jasper-1.900.1/src/libjasper/jpc/jpc_dec.c.CVE-2014-8157 jasper-1.900.1/src/libjasper/jpc/jpc_dec.c ---- jasper-1.900.1/src/libjasper/jpc/jpc_dec.c.CVE-2014-8157 2015-01-19 16:59:36.000000000 +0100 -+++ jasper-1.900.1/src/libjasper/jpc/jpc_dec.c 2015-01-19 17:07:41.609863268 +0100 -@@ -489,7 +489,7 @@ static int jpc_dec_process_sot(jpc_dec_t - dec->curtileendoff = 0; - } - -- if (JAS_CAST(int, sot->tileno) > dec->numtiles) { -+ if (JAS_CAST(int, sot->tileno) >= dec->numtiles) { - jas_eprintf("invalid tile number in SOT marker segment\n"); - return -1; - } diff --git a/pkgs/development/libraries/jasper/jasper-CVE-2014-8158.diff b/pkgs/development/libraries/jasper/jasper-CVE-2014-8158.diff deleted file mode 100644 index ce9e4b497f39..000000000000 --- a/pkgs/development/libraries/jasper/jasper-CVE-2014-8158.diff +++ /dev/null @@ -1,329 +0,0 @@ -diff -up jasper-1.900.1/src/libjasper/jpc/jpc_qmfb.c.CVE-2014-8158 jasper-1.900.1/src/libjasper/jpc/jpc_qmfb.c ---- jasper-1.900.1/src/libjasper/jpc/jpc_qmfb.c.CVE-2014-8158 2015-01-19 17:25:28.730195502 +0100 -+++ jasper-1.900.1/src/libjasper/jpc/jpc_qmfb.c 2015-01-19 17:27:20.214663127 +0100 -@@ -306,11 +306,7 @@ void jpc_qmfb_split_row(jpc_fix_t *a, in - { - - int bufsize = JPC_CEILDIVPOW2(numcols, 1); --#if !defined(HAVE_VLA) - jpc_fix_t splitbuf[QMFB_SPLITBUFSIZE]; --#else -- jpc_fix_t splitbuf[bufsize]; --#endif - jpc_fix_t *buf = splitbuf; - register jpc_fix_t *srcptr; - register jpc_fix_t *dstptr; -@@ -318,7 +314,6 @@ void jpc_qmfb_split_row(jpc_fix_t *a, in - register int m; - int hstartcol; - --#if !defined(HAVE_VLA) - /* Get a buffer. */ - if (bufsize > QMFB_SPLITBUFSIZE) { - if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) { -@@ -326,7 +321,6 @@ void jpc_qmfb_split_row(jpc_fix_t *a, in - abort(); - } - } --#endif - - if (numcols >= 2) { - hstartcol = (numcols + 1 - parity) >> 1; -@@ -360,12 +354,10 @@ void jpc_qmfb_split_row(jpc_fix_t *a, in - } - } - --#if !defined(HAVE_VLA) - /* If the split buffer was allocated on the heap, free this memory. */ - if (buf != splitbuf) { - jas_free(buf); - } --#endif - - } - -@@ -374,11 +366,7 @@ void jpc_qmfb_split_col(jpc_fix_t *a, in - { - - int bufsize = JPC_CEILDIVPOW2(numrows, 1); --#if !defined(HAVE_VLA) - jpc_fix_t splitbuf[QMFB_SPLITBUFSIZE]; --#else -- jpc_fix_t splitbuf[bufsize]; --#endif - jpc_fix_t *buf = splitbuf; - register jpc_fix_t *srcptr; - register jpc_fix_t *dstptr; -@@ -386,7 +374,6 @@ void jpc_qmfb_split_col(jpc_fix_t *a, in - register int m; - int hstartcol; - --#if !defined(HAVE_VLA) - /* Get a buffer. */ - if (bufsize > QMFB_SPLITBUFSIZE) { - if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) { -@@ -394,7 +381,6 @@ void jpc_qmfb_split_col(jpc_fix_t *a, in - abort(); - } - } --#endif - - if (numrows >= 2) { - hstartcol = (numrows + 1 - parity) >> 1; -@@ -428,12 +414,10 @@ void jpc_qmfb_split_col(jpc_fix_t *a, in - } - } - --#if !defined(HAVE_VLA) - /* If the split buffer was allocated on the heap, free this memory. */ - if (buf != splitbuf) { - jas_free(buf); - } --#endif - - } - -@@ -442,11 +426,7 @@ void jpc_qmfb_split_colgrp(jpc_fix_t *a, - { - - int bufsize = JPC_CEILDIVPOW2(numrows, 1); --#if !defined(HAVE_VLA) - jpc_fix_t splitbuf[QMFB_SPLITBUFSIZE * JPC_QMFB_COLGRPSIZE]; --#else -- jpc_fix_t splitbuf[bufsize * JPC_QMFB_COLGRPSIZE]; --#endif - jpc_fix_t *buf = splitbuf; - jpc_fix_t *srcptr; - jpc_fix_t *dstptr; -@@ -457,7 +437,6 @@ void jpc_qmfb_split_colgrp(jpc_fix_t *a, - int m; - int hstartcol; - --#if !defined(HAVE_VLA) - /* Get a buffer. */ - if (bufsize > QMFB_SPLITBUFSIZE) { - if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) { -@@ -465,7 +444,6 @@ void jpc_qmfb_split_colgrp(jpc_fix_t *a, - abort(); - } - } --#endif - - if (numrows >= 2) { - hstartcol = (numrows + 1 - parity) >> 1; -@@ -517,12 +495,10 @@ void jpc_qmfb_split_colgrp(jpc_fix_t *a, - } - } - --#if !defined(HAVE_VLA) - /* If the split buffer was allocated on the heap, free this memory. */ - if (buf != splitbuf) { - jas_free(buf); - } --#endif - - } - -@@ -531,11 +507,7 @@ void jpc_qmfb_split_colres(jpc_fix_t *a, - { - - int bufsize = JPC_CEILDIVPOW2(numrows, 1); --#if !defined(HAVE_VLA) - jpc_fix_t splitbuf[QMFB_SPLITBUFSIZE * JPC_QMFB_COLGRPSIZE]; --#else -- jpc_fix_t splitbuf[bufsize * numcols]; --#endif - jpc_fix_t *buf = splitbuf; - jpc_fix_t *srcptr; - jpc_fix_t *dstptr; -@@ -546,7 +518,6 @@ void jpc_qmfb_split_colres(jpc_fix_t *a, - int m; - int hstartcol; - --#if !defined(HAVE_VLA) - /* Get a buffer. */ - if (bufsize > QMFB_SPLITBUFSIZE) { - if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) { -@@ -554,7 +525,6 @@ void jpc_qmfb_split_colres(jpc_fix_t *a, - abort(); - } - } --#endif - - if (numrows >= 2) { - hstartcol = (numrows + 1 - parity) >> 1; -@@ -606,12 +576,10 @@ void jpc_qmfb_split_colres(jpc_fix_t *a, - } - } - --#if !defined(HAVE_VLA) - /* If the split buffer was allocated on the heap, free this memory. */ - if (buf != splitbuf) { - jas_free(buf); - } --#endif - - } - -@@ -619,18 +587,13 @@ void jpc_qmfb_join_row(jpc_fix_t *a, int - { - - int bufsize = JPC_CEILDIVPOW2(numcols, 1); --#if !defined(HAVE_VLA) - jpc_fix_t joinbuf[QMFB_JOINBUFSIZE]; --#else -- jpc_fix_t joinbuf[bufsize]; --#endif - jpc_fix_t *buf = joinbuf; - register jpc_fix_t *srcptr; - register jpc_fix_t *dstptr; - register int n; - int hstartcol; - --#if !defined(HAVE_VLA) - /* Allocate memory for the join buffer from the heap. */ - if (bufsize > QMFB_JOINBUFSIZE) { - if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) { -@@ -638,7 +601,6 @@ void jpc_qmfb_join_row(jpc_fix_t *a, int - abort(); - } - } --#endif - - hstartcol = (numcols + 1 - parity) >> 1; - -@@ -670,12 +632,10 @@ void jpc_qmfb_join_row(jpc_fix_t *a, int - ++srcptr; - } - --#if !defined(HAVE_VLA) - /* If the join buffer was allocated on the heap, free this memory. */ - if (buf != joinbuf) { - jas_free(buf); - } --#endif - - } - -@@ -684,18 +644,13 @@ void jpc_qmfb_join_col(jpc_fix_t *a, int - { - - int bufsize = JPC_CEILDIVPOW2(numrows, 1); --#if !defined(HAVE_VLA) - jpc_fix_t joinbuf[QMFB_JOINBUFSIZE]; --#else -- jpc_fix_t joinbuf[bufsize]; --#endif - jpc_fix_t *buf = joinbuf; - register jpc_fix_t *srcptr; - register jpc_fix_t *dstptr; - register int n; - int hstartcol; - --#if !defined(HAVE_VLA) - /* Allocate memory for the join buffer from the heap. */ - if (bufsize > QMFB_JOINBUFSIZE) { - if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) { -@@ -703,7 +658,6 @@ void jpc_qmfb_join_col(jpc_fix_t *a, int - abort(); - } - } --#endif - - hstartcol = (numrows + 1 - parity) >> 1; - -@@ -735,12 +689,10 @@ void jpc_qmfb_join_col(jpc_fix_t *a, int - ++srcptr; - } - --#if !defined(HAVE_VLA) - /* If the join buffer was allocated on the heap, free this memory. */ - if (buf != joinbuf) { - jas_free(buf); - } --#endif - - } - -@@ -749,11 +701,7 @@ void jpc_qmfb_join_colgrp(jpc_fix_t *a, - { - - int bufsize = JPC_CEILDIVPOW2(numrows, 1); --#if !defined(HAVE_VLA) - jpc_fix_t joinbuf[QMFB_JOINBUFSIZE * JPC_QMFB_COLGRPSIZE]; --#else -- jpc_fix_t joinbuf[bufsize * JPC_QMFB_COLGRPSIZE]; --#endif - jpc_fix_t *buf = joinbuf; - jpc_fix_t *srcptr; - jpc_fix_t *dstptr; -@@ -763,7 +711,6 @@ void jpc_qmfb_join_colgrp(jpc_fix_t *a, - register int i; - int hstartcol; - --#if !defined(HAVE_VLA) - /* Allocate memory for the join buffer from the heap. */ - if (bufsize > QMFB_JOINBUFSIZE) { - if (!(buf = jas_alloc2(bufsize, JPC_QMFB_COLGRPSIZE * sizeof(jpc_fix_t)))) { -@@ -771,7 +718,6 @@ void jpc_qmfb_join_colgrp(jpc_fix_t *a, - abort(); - } - } --#endif - - hstartcol = (numrows + 1 - parity) >> 1; - -@@ -821,12 +767,10 @@ void jpc_qmfb_join_colgrp(jpc_fix_t *a, - srcptr += JPC_QMFB_COLGRPSIZE; - } - --#if !defined(HAVE_VLA) - /* If the join buffer was allocated on the heap, free this memory. */ - if (buf != joinbuf) { - jas_free(buf); - } --#endif - - } - -@@ -835,11 +779,7 @@ void jpc_qmfb_join_colres(jpc_fix_t *a, - { - - int bufsize = JPC_CEILDIVPOW2(numrows, 1); --#if !defined(HAVE_VLA) - jpc_fix_t joinbuf[QMFB_JOINBUFSIZE * JPC_QMFB_COLGRPSIZE]; --#else -- jpc_fix_t joinbuf[bufsize * numcols]; --#endif - jpc_fix_t *buf = joinbuf; - jpc_fix_t *srcptr; - jpc_fix_t *dstptr; -@@ -849,7 +789,6 @@ void jpc_qmfb_join_colres(jpc_fix_t *a, - register int i; - int hstartcol; - --#if !defined(HAVE_VLA) - /* Allocate memory for the join buffer from the heap. */ - if (bufsize > QMFB_JOINBUFSIZE) { - if (!(buf = jas_alloc3(bufsize, numcols, sizeof(jpc_fix_t)))) { -@@ -857,7 +796,6 @@ void jpc_qmfb_join_colres(jpc_fix_t *a, - abort(); - } - } --#endif - - hstartcol = (numrows + 1 - parity) >> 1; - -@@ -907,12 +845,10 @@ void jpc_qmfb_join_colres(jpc_fix_t *a, - srcptr += numcols; - } - --#if !defined(HAVE_VLA) - /* If the join buffer was allocated on the heap, free this memory. */ - if (buf != joinbuf) { - jas_free(buf); - } --#endif - - } - diff --git a/pkgs/development/libraries/jasper/jasper-CVE-2014-9029.diff b/pkgs/development/libraries/jasper/jasper-CVE-2014-9029.diff deleted file mode 100644 index 01db7f03cdf8..000000000000 --- a/pkgs/development/libraries/jasper/jasper-CVE-2014-9029.diff +++ /dev/null @@ -1,31 +0,0 @@ -From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=961994&action=diff - ---- jasper-1.900.1.orig/src/libjasper/jpc/jpc_dec.c 2014-11-27 12:45:44.000000000 +0100 -+++ jasper-1.900.1/src/libjasper/jpc/jpc_dec.c 2014-11-27 12:44:58.000000000 +0100 -@@ -1281,7 +1281,7 @@ static int jpc_dec_process_coc(jpc_dec_t - jpc_coc_t *coc = &ms->parms.coc; - jpc_dec_tile_t *tile; - -- if (JAS_CAST(int, coc->compno) > dec->numcomps) { -+ if (JAS_CAST(int, coc->compno) >= dec->numcomps) { - jas_eprintf("invalid component number in COC marker segment\n"); - return -1; - } -@@ -1307,7 +1307,7 @@ static int jpc_dec_process_rgn(jpc_dec_t - jpc_rgn_t *rgn = &ms->parms.rgn; - jpc_dec_tile_t *tile; - -- if (JAS_CAST(int, rgn->compno) > dec->numcomps) { -+ if (JAS_CAST(int, rgn->compno) >= dec->numcomps) { - jas_eprintf("invalid component number in RGN marker segment\n"); - return -1; - } -@@ -1356,7 +1356,7 @@ static int jpc_dec_process_qcc(jpc_dec_t - jpc_qcc_t *qcc = &ms->parms.qcc; - jpc_dec_tile_t *tile; - -- if (JAS_CAST(int, qcc->compno) > dec->numcomps) { -+ if (JAS_CAST(int, qcc->compno) >= dec->numcomps) { - jas_eprintf("invalid component number in QCC marker segment\n"); - return -1; - } diff --git a/pkgs/development/libraries/jasper/jasper-CVE-2016-1867.diff b/pkgs/development/libraries/jasper/jasper-CVE-2016-1867.diff deleted file mode 100644 index b2dce8d8e70d..000000000000 --- a/pkgs/development/libraries/jasper/jasper-CVE-2016-1867.diff +++ /dev/null @@ -1,11 +0,0 @@ ---- jasper-1.900.1/src/libjasper/jpc/jpc_t2cod.c 2007-01-19 22:43:07.000000000 +0100 -+++ jasper-1.900.1/src/libjasper/jpc/jpc_t2cod.c 2016-01-14 14:22:24.569056412 +0100 -@@ -429,7 +429,7 @@ - } - - for (pi->compno = pchg->compnostart, pi->picomp = -- &pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend); ++pi->compno, -+ &pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps; ++pi->compno, - ++pi->picomp) { - pirlvl = pi->picomp->pirlvls; - pi->xstep = pi->picomp->hsamp * (1 << (pirlvl->prcwidthexpn + \ No newline at end of file