From b927058237a36b3bd870cff50a4107bfd4a39e41 Mon Sep 17 00:00:00 2001 From: Mark H Weaver Date: Fri, 2 Oct 2015 12:30:41 -0400 Subject: gnu: openjpeg-2.x: Add fix for use-after-free in opj_j2k_write_mco. * gnu/packages/patches/openjpeg-use-after-free-fix.patch: New file. * gnu-system.am (dist_patch_DATA): Add it. * gnu/packages/image.scm (openjpeg, openjpeg-2.0)[source]: Add patch. [home-page]: Update. --- .../patches/openjpeg-use-after-free-fix.patch | 48 ++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 gnu/packages/patches/openjpeg-use-after-free-fix.patch (limited to 'gnu/packages/patches/openjpeg-use-after-free-fix.patch') diff --git a/gnu/packages/patches/openjpeg-use-after-free-fix.patch b/gnu/packages/patches/openjpeg-use-after-free-fix.patch new file mode 100644 index 0000000000..1a9cb1ae1d --- /dev/null +++ b/gnu/packages/patches/openjpeg-use-after-free-fix.patch @@ -0,0 +1,48 @@ +From 940100c28ae28931722290794889cf84a92c5f6f Mon Sep 17 00:00:00 2001 +From: mayeut +Date: Sun, 6 Sep 2015 17:24:03 +0200 +Subject: [PATCH] Fix potential use-after-free in opj_j2k_write_mco function + +Fixes #563 +--- + src/lib/openjp2/j2k.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c +index 19a48f5..d487d89 100644 +--- a/src/lib/openjp2/j2k.c ++++ b/src/lib/openjp2/j2k.c +@@ -5559,8 +5559,7 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k, + assert(p_stream != 00); + + l_tcp =&(p_j2k->m_cp.tcps[p_j2k->m_current_tile_number]); +- l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data; +- ++ + l_mco_size = 5 + l_tcp->m_nb_mcc_records; + if (l_mco_size > p_j2k->m_specific_param.m_encoder.m_header_tile_data_size) { + +@@ -5575,6 +5574,8 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k, + p_j2k->m_specific_param.m_encoder.m_header_tile_data = new_header_tile_data; + p_j2k->m_specific_param.m_encoder.m_header_tile_data_size = l_mco_size; + } ++ l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data; ++ + + opj_write_bytes(l_current_data,J2K_MS_MCO,2); /* MCO */ + l_current_data += 2; +@@ -5586,10 +5587,9 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k, + ++l_current_data; + + l_mcc_record = l_tcp->m_mcc_records; +- for (i=0;im_nb_mcc_records;++i) { ++ for (i=0;im_nb_mcc_records;++i) { + opj_write_bytes(l_current_data,l_mcc_record->m_index,1);/* Imco -> use the mcc indicated by 1*/ + ++l_current_data; +- + ++l_mcc_record; + } + +-- +2.5.0 + -- cgit v1.2.3