diff options
| author | Remi Collet <remi@remirepo.net> | 2021-05-31 14:07:41 +0200 |
|---|---|---|
| committer | Remi Collet <remi@remirepo.net> | 2021-05-31 14:07:41 +0200 |
| commit | ec030379984fe4becf3f014e31e66e2b25539039 (patch) | |
| tree | 1cab3215bbad05c5414e6fa24f059ffe96d27fd1 /openjpeg2_CVE-2020-8112.patch | |
| parent | aa3cad9000d51a3aae7dd04933776c7efd7f3b87 (diff) | |
sync with Fedora
Update to 2.4.0
Apply proposed patches for CVE-2021-29338 and a heap buffer overflow (#1957616)
Diffstat (limited to 'openjpeg2_CVE-2020-8112.patch')
| -rw-r--r-- | openjpeg2_CVE-2020-8112.patch | 30 |
1 files changed, 0 insertions, 30 deletions
diff --git a/openjpeg2_CVE-2020-8112.patch b/openjpeg2_CVE-2020-8112.patch deleted file mode 100644 index dd6e1b9..0000000 --- a/openjpeg2_CVE-2020-8112.patch +++ /dev/null @@ -1,30 +0,0 @@ -diff -rupN --no-dereference openjpeg-2.3.1/src/lib/openjp2/tcd.c openjpeg-2.3.1-new/src/lib/openjp2/tcd.c ---- openjpeg-2.3.1/src/lib/openjp2/tcd.c 2019-04-02 14:45:15.000000000 +0200 -+++ openjpeg-2.3.1-new/src/lib/openjp2/tcd.c 2020-11-28 23:29:38.662863239 +0100 -@@ -905,8 +905,24 @@ static INLINE OPJ_BOOL opj_tcd_init_tile - /* p. 64, B.6, ISO/IEC FDIS15444-1 : 2000 (18 august 2000) */ - l_tl_prc_x_start = opj_int_floordivpow2(l_res->x0, (OPJ_INT32)l_pdx) << l_pdx; - l_tl_prc_y_start = opj_int_floordivpow2(l_res->y0, (OPJ_INT32)l_pdy) << l_pdy; -- l_br_prc_x_end = opj_int_ceildivpow2(l_res->x1, (OPJ_INT32)l_pdx) << l_pdx; -- l_br_prc_y_end = opj_int_ceildivpow2(l_res->y1, (OPJ_INT32)l_pdy) << l_pdy; -+ { -+ OPJ_UINT32 tmp = ((OPJ_UINT32)opj_int_ceildivpow2(l_res->x1, -+ (OPJ_INT32)l_pdx)) << l_pdx; -+ if (tmp > (OPJ_UINT32)INT_MAX) { -+ opj_event_msg(manager, EVT_ERROR, "Integer overflow\n"); -+ return OPJ_FALSE; -+ } -+ l_br_prc_x_end = (OPJ_INT32)tmp; -+ } -+ { -+ OPJ_UINT32 tmp = ((OPJ_UINT32)opj_int_ceildivpow2(l_res->y1, -+ (OPJ_INT32)l_pdy)) << l_pdy; -+ if (tmp > (OPJ_UINT32)INT_MAX) { -+ opj_event_msg(manager, EVT_ERROR, "Integer overflow\n"); -+ return OPJ_FALSE; -+ } -+ l_br_prc_y_end = (OPJ_INT32)tmp; -+ } - /*fprintf(stderr, "\t\t\tprc_x_start=%d, prc_y_start=%d, br_prc_x_end=%d, br_prc_y_end=%d \n", l_tl_prc_x_start, l_tl_prc_y_start, l_br_prc_x_end ,l_br_prc_y_end );*/ - - l_res->pw = (l_res->x0 == l_res->x1) ? 0U : (OPJ_UINT32)(( |