[pkgsrc/trunk]: pkgsrc/graphics/openjpeg Patch for CVE-2019-12973

[sevan <sevan%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/4c58d15699b9
branches:  trunk
changeset: 407610:4c58d15699b9
user:      sevan <sevan%pkgsrc.org@localhost>
date:      Tue Jan 07 20:19:45 2020 +0000

description:
Patch for CVE-2019-12973

diffstat:

 graphics/openjpeg/Makefile                               |   4 +-
 graphics/openjpeg/distinfo                               |   3 +-
 graphics/openjpeg/patches/patch-src_bin_jp2_convertbmp.c |  77 ++++++++++++++++
 3 files changed, 81 insertions(+), 3 deletions(-)

diffs (111 lines):

diff -r a56907d40f26 -r 4c58d15699b9 graphics/openjpeg/Makefile
--- a/graphics/openjpeg/Makefile        Tue Jan 07 18:21:25 2020 +0000
+++ b/graphics/openjpeg/Makefile        Tue Jan 07 20:19:45 2020 +0000
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.18 2019/11/26 23:10:22 sevan Exp $
+# $NetBSD: Makefile,v 1.19 2020/01/07 20:19:45 sevan Exp $
 
 DISTNAME=      openjpeg-2.3.1
-PKGREVISION=   1
+PKGREVISION=   2
 CATEGORIES=    graphics
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=uclouvain/}
 GITHUB_TAG=    v${PKGVERSION_NOREV}
diff -r a56907d40f26 -r 4c58d15699b9 graphics/openjpeg/distinfo
--- a/graphics/openjpeg/distinfo        Tue Jan 07 18:21:25 2020 +0000
+++ b/graphics/openjpeg/distinfo        Tue Jan 07 20:19:45 2020 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.16 2019/11/26 23:24:25 sevan Exp $
+$NetBSD: distinfo,v 1.17 2020/01/07 20:19:45 sevan Exp $
 
 SHA1 (openjpeg-2.3.1.tar.gz) = 38321fa9730252039ad0b7f247a160a8164f5871
 RMD160 (openjpeg-2.3.1.tar.gz) = 31b75aa70f5d26dd1b7e374a9e4b6be1842fefe7
@@ -6,6 +6,7 @@
 Size (openjpeg-2.3.1.tar.gz) = 2214401 bytes
 SHA1 (patch-CMakeLists.txt) = 3738946db63df4d623c6ce486bd22fa4d57336e2
 SHA1 (patch-src_bin_jp2_CMakeLists.txt) = c9f709c23d6bab7a3c705640d66a00ec90ddabc7
+SHA1 (patch-src_bin_jp2_convertbmp.c) = bceb4a99820568386e48eb00ab13ab9987d1e86a
 SHA1 (patch-src_lib_openjp2_CMakeLists.txt) = d839121ec2d008e5d3e1676d3e7ac3642bc946f7
 SHA1 (patch-src_lib_openjp2_opj__config__private.h.cmake.in) = fc0c170789dbe0a2ebc9dce0ef0d21aa6b2edd49
 SHA1 (patch-src_lib_openmj2_t2.c) = a4ce0faa349f1a23453ef7632fbcc3af2d045337
diff -r a56907d40f26 -r 4c58d15699b9 graphics/openjpeg/patches/patch-src_bin_jp2_convertbmp.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/graphics/openjpeg/patches/patch-src_bin_jp2_convertbmp.c  Tue Jan 07 20:19:45 2020 +0000
@@ -0,0 +1,77 @@
+$NetBSD: patch-src_bin_jp2_convertbmp.c,v 1.1 2020/01/07 20:19:46 sevan Exp $
+
+CVE-2019-12973
+https://github.com/uclouvain/openjpeg/pull/1185
+https://nvd.nist.gov/vuln/detail/CVE-2019-12973
+
+--- src/bin/jp2/convertbmp.c.orig      2020-01-07 11:06:41.960834648 +0000
++++ src/bin/jp2/convertbmp.c
+@@ -632,12 +632,18 @@ static OPJ_BOOL bmp_read_rle4_data(FILE*
+     while (y < height) {
+         int c = getc(IN);
+         if (c == EOF) {
+-            break;
++            return OPJ_FALSE;
+         }
+ 
+         if (c) { /* encoded mode */
+-            int j;
+-            OPJ_UINT8 c1 = (OPJ_UINT8)getc(IN);
++            int j, c1_int;
++            OPJ_UINT8 c1;
++
++            c1_int = getc(IN);
++            if (c1_int == EOF) {
++                return OPJ_FALSE;
++            }
++            c1 = (OPJ_UINT8)c1_int;
+ 
+             for (j = 0; (j < c) && (x < width) &&
+                     ((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
+@@ -646,7 +652,7 @@ static OPJ_BOOL bmp_read_rle4_data(FILE*
+         } else { /* absolute mode */
+             c = getc(IN);
+             if (c == EOF) {
+-                break;
++                return OPJ_FALSE;
+             }
+ 
+             if (c == 0x00) { /* EOL */
+@@ -657,8 +663,14 @@ static OPJ_BOOL bmp_read_rle4_data(FILE*
+                 break;
+             } else if (c == 0x02) { /* MOVE by dxdy */
+                 c = getc(IN);
++                if (c == EOF) {
++                    return OPJ_FALSE;
++                }
+                 x += (OPJ_UINT32)c;
+                 c = getc(IN);
++                if (c == EOF) {
++                    return OPJ_FALSE;
++                }
+                 y += (OPJ_UINT32)c;
+                 pix = pData + y * stride + x;
+             } else { /* 03 .. 255 : absolute mode */
+@@ -668,12 +680,20 @@ static OPJ_BOOL bmp_read_rle4_data(FILE*
+                 for (j = 0; (j < c) && (x < width) &&
+                         ((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
+                     if ((j & 1) == 0) {
+-                        c1 = (OPJ_UINT8)getc(IN);
++                        int c1_int;
++                      c1_int = getc(IN);
++                      if (c1_int == EOF) {
++                          return OPJ_FALSE;
++                      }
++                      c1 = (OPJ_UINT8)c1_int;
+                     }
+                     *pix = (OPJ_UINT8)((j & 1) ? (c1 & 0x0fU) : ((c1 >> 4) & 0x0fU));
+                 }
+                 if (((c & 3) == 1) || ((c & 3) == 2)) { /* skip padding byte */
+-                    getc(IN);
++                    c = getc(IN);
++                  if (c == EOF) {
++                      return OPJ_FALSE;
++                  }
+                 }
+             }
+         }