From e6085fea8f551647227020c578e666d7965e1b10 Mon Sep 17 00:00:00 2001 From: pkgagent Date: Thu, 6 Aug 2026 13:45:19 +0800 Subject: [PATCH] Update to 2.5.3 (fixes CVE-2023-39327; mitigates CVE-2023-39328, CVE-2023-39329) --- .gitignore | 3 + fixed-CVE-2021-3575.patch | 40 ------------ fixed-CVE-2024-56826.patch | 122 ------------------------------------- fixed-CVE-2024-56827.patch | 25 -------- fixed-CVE-2025-50952.patch | 26 -------- openjpeg2.spec | 16 +++-- openjpeg2_opj2.patch | 13 ++-- sources | 2 +- 8 files changed, 18 insertions(+), 229 deletions(-) create mode 100644 .gitignore delete mode 100644 fixed-CVE-2021-3575.patch delete mode 100644 fixed-CVE-2024-56826.patch delete mode 100644 fixed-CVE-2024-56827.patch delete mode 100644 fixed-CVE-2025-50952.patch diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..c87eada --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +*.tar.gz +*.tar.xz +*.tar.bz2 diff --git a/fixed-CVE-2021-3575.patch b/fixed-CVE-2021-3575.patch deleted file mode 100644 index bd79821..0000000 --- a/fixed-CVE-2021-3575.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 7bd884f8750892de4f50bf4642fcfbe7011c6bdf Mon Sep 17 00:00:00 2001 -From: Even Rouault -Date: Sun, 18 Feb 2024 17:02:25 +0100 -Subject: [PATCH] opj_decompress: fix off-by-one read heap-buffer-overflow in - sycc420_to_rgb() when x0 and y0 are odd (CVE-2021-3575, fixes #1347) - ---- - src/bin/common/color.c | 12 ++++++++++-- - 1 file changed, 10 insertions(+), 2 deletions(-) - -diff --git a/src/bin/common/color.c b/src/bin/common/color.c -index 27f15f137..ae5d648da 100644 ---- a/src/bin/common/color.c -+++ b/src/bin/common/color.c -@@ -358,7 +358,15 @@ static void sycc420_to_rgb(opj_image_t *img) - if (i < loopmaxh) { - size_t j; - -- for (j = 0U; j < (maxw & ~(size_t)1U); j += 2U) { -+ if (offx > 0U) { -+ sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b); -+ ++y; -+ ++r; -+ ++g; -+ ++b; -+ } -+ -+ for (j = 0U; j < (loopmaxw & ~(size_t)1U); j += 2U) { - sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b); - - ++y; -@@ -375,7 +383,7 @@ static void sycc420_to_rgb(opj_image_t *img) - ++cb; - ++cr; - } -- if (j < maxw) { -+ if (j < loopmaxw) { - sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b); - } - } diff --git a/fixed-CVE-2024-56826.patch b/fixed-CVE-2024-56826.patch deleted file mode 100644 index 1d9d3ab..0000000 --- a/fixed-CVE-2024-56826.patch +++ /dev/null @@ -1,122 +0,0 @@ -From 98592ee6d6904f1b48e8207238779b89a63befa2 Mon Sep 17 00:00:00 2001 -From: Even Rouault -Date: Mon, 25 Nov 2024 23:11:24 +0100 -Subject: [PATCH] sycc422_to_rgb(): fix out-of-bounds read accesses when 2 * - width_component_1_or_2 + 1 == with_component_0 - -Fixes #1563 - -Also adjusts sycc420_to_rgb() for potential similar issue (amending -commit 7bd884f8750892de4f50bf4642fcfbe7011c6bdf) ---- - src/bin/common/color.c | 42 ++++++++++++++++++++++++++++++++---------- - 1 file changed, 32 insertions(+), 10 deletions(-) - -diff --git a/src/bin/common/color.c b/src/bin/common/color.c -index ae5d648da..e4924a152 100644 ---- a/src/bin/common/color.c -+++ b/src/bin/common/color.c -@@ -158,7 +158,7 @@ static void sycc422_to_rgb(opj_image_t *img) - { - int *d0, *d1, *d2, *r, *g, *b; - const int *y, *cb, *cr; -- size_t maxw, maxh, max, offx, loopmaxw; -+ size_t maxw, maxh, max, offx, loopmaxw, comp12w; - int offset, upb; - size_t i; - -@@ -167,6 +167,7 @@ static void sycc422_to_rgb(opj_image_t *img) - upb = (1 << upb) - 1; - - maxw = (size_t)img->comps[0].w; -+ comp12w = (size_t)img->comps[1].w; - maxh = (size_t)img->comps[0].h; - max = maxw * maxh; - -@@ -212,13 +213,19 @@ static void sycc422_to_rgb(opj_image_t *img) - ++cr; - } - if (j < loopmaxw) { -- sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b); -+ if (j / 2 == comp12w) { -+ sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b); -+ } else { -+ sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b); -+ } - ++y; - ++r; - ++g; - ++b; -- ++cb; -- ++cr; -+ if (j / 2 < comp12w) { -+ ++cb; -+ ++cr; -+ } - } - } - -@@ -246,7 +253,7 @@ static void sycc420_to_rgb(opj_image_t *img) - { - int *d0, *d1, *d2, *r, *g, *b, *nr, *ng, *nb; - const int *y, *cb, *cr, *ny; -- size_t maxw, maxh, max, offx, loopmaxw, offy, loopmaxh; -+ size_t maxw, maxh, max, offx, loopmaxw, offy, loopmaxh, comp12w; - int offset, upb; - size_t i; - -@@ -255,6 +262,7 @@ static void sycc420_to_rgb(opj_image_t *img) - upb = (1 << upb) - 1; - - maxw = (size_t)img->comps[0].w; -+ comp12w = (size_t)img->comps[1].w; - maxh = (size_t)img->comps[0].h; - max = maxw * maxh; - -@@ -336,19 +344,29 @@ static void sycc420_to_rgb(opj_image_t *img) - ++cr; - } - if (j < loopmaxw) { -- sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b); -+ if (j / 2 == comp12w) { -+ sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b); -+ } else { -+ sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b); -+ } - ++y; - ++r; - ++g; - ++b; - -- sycc_to_rgb(offset, upb, *ny, *cb, *cr, nr, ng, nb); -+ if (j / 2 == comp12w) { -+ sycc_to_rgb(offset, upb, *ny, 0, 0, nr, ng, nb); -+ } else { -+ sycc_to_rgb(offset, upb, *ny, *cb, *cr, nr, ng, nb); -+ } - ++ny; - ++nr; - ++ng; - ++nb; -- ++cb; -- ++cr; -+ if (j / 2 < comp12w) { -+ ++cb; -+ ++cr; -+ } - } - y += maxw; - r += maxw; -@@ -384,7 +402,11 @@ static void sycc420_to_rgb(opj_image_t *img) - ++cr; - } - if (j < loopmaxw) { -- sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b); -+ if (j / 2 == comp12w) { -+ sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b); -+ } else { -+ sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b); -+ } - } - } - diff --git a/fixed-CVE-2024-56827.patch b/fixed-CVE-2024-56827.patch deleted file mode 100644 index c188581..0000000 --- a/fixed-CVE-2024-56827.patch +++ /dev/null @@ -1,25 +0,0 @@ -From e492644fbded4c820ca55b5e50e598d346e850e8 Mon Sep 17 00:00:00 2001 -From: Even Rouault -Date: Mon, 25 Nov 2024 22:02:54 +0100 -Subject: [PATCH] opj_j2k_add_tlmarker(): validate that current tile-part - number if smaller that total number of tile-parts - -Fixes #1564 ---- - src/lib/openjp2/j2k.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c -index 7dc389fa2..b5903a59c 100644 ---- a/src/lib/openjp2/j2k.c -+++ b/src/lib/openjp2/j2k.c -@@ -8456,7 +8456,8 @@ static OPJ_BOOL opj_j2k_add_tlmarker(OPJ_UINT32 tileno, - if (type == J2K_MS_SOT) { - OPJ_UINT32 l_current_tile_part = cstr_index->tile_index[tileno].current_tpsno; - -- if (cstr_index->tile_index[tileno].tp_index) { -+ if (cstr_index->tile_index[tileno].tp_index && -+ l_current_tile_part < cstr_index->tile_index[tileno].nb_tps) { - cstr_index->tile_index[tileno].tp_index[l_current_tile_part].start_pos = pos; - } - diff --git a/fixed-CVE-2025-50952.patch b/fixed-CVE-2025-50952.patch deleted file mode 100644 index abcaa1b..0000000 --- a/fixed-CVE-2025-50952.patch +++ /dev/null @@ -1,26 +0,0 @@ -From d903fbb4ab9ccf9b96c8bc7398fafc0007505a37 Mon Sep 17 00:00:00 2001 -From: Even Rouault -Date: Sun, 18 Feb 2024 17:17:00 +0100 -Subject: [PATCH] opj_dwt_decode_tile(): avoid potential - UndefinedBehaviorSanitizer 'applying zero offset to null pointer' (fixes - #1505) - ---- - src/lib/openjp2/dwt.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/src/lib/openjp2/dwt.c b/src/lib/openjp2/dwt.c -index abc500eca..6b18c5dd6 100644 ---- a/src/lib/openjp2/dwt.c -+++ b/src/lib/openjp2/dwt.c -@@ -2083,7 +2083,9 @@ static OPJ_BOOL opj_dwt_decode_tile(opj_thread_pool_t* tp, - OPJ_SIZE_T h_mem_size; - int num_threads; - -- if (numres == 1U) { -+ /* Not entirely sure for the return code of w == 0 which is triggered per */ -+ /* https://github.com/uclouvain/openjpeg/issues/1505 */ -+ if (numres == 1U || w == 0) { - return OPJ_TRUE; - } - num_threads = opj_thread_pool_get_thread_count(tp); diff --git a/openjpeg2.spec b/openjpeg2.spec index 0ddf78d..9d4dc56 100644 --- a/openjpeg2.spec +++ b/openjpeg2.spec @@ -5,8 +5,8 @@ Summary: C-Library for JPEG 2000 Name: openjpeg2 -Version: 2.5.0 -Release: 6%{?dist} +Version: 2.5.3 +Release: 1%{?dist} License: BSD and MIT URL: https://github.com/uclouvain/openjpeg Source0: https://github.com/uclouvain/openjpeg/archive/v%{version}/openjpeg-%{version}.tar.gz @@ -15,10 +15,6 @@ Source0: https://github.com/uclouvain/openjpeg/archive/v%{version}/openjp Source1: data.tar.xz %endif -Patch0001: fixed-CVE-2021-3575.patch -Patch0002: fixed-CVE-2024-56826.patch -Patch0003: fixed-CVE-2024-56827.patch -Patch0004: fixed-CVE-2025-50952.patch Patch3000: openjpeg2_opj2.patch BuildRequires: cmake make doxygen gcc gcc-c++ @@ -167,7 +163,6 @@ find thirdparty/ -mindepth 1 -maxdepth 1 -type d -exec rm -rf {} \; %build %cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo \ - -DOPENJPEG_INSTALL_LIB_DIR=%{_lib} \ %if %{with optional_components} -DBUILD_MJ2=ON -DBUILD_JPWL=ON -DBUILD_JPIP=ON -DBUILD_JP3D=ON \ %endif @@ -213,9 +208,8 @@ chmod +x %{buildroot}%{_bindir}/opj2_jpip_viewer %dir %{_includedir}/openjpeg-2.5/ %{_includedir}/openjpeg-2.5/openjpeg.h %{_includedir}/openjpeg-2.5/opj_config.h -%{_includedir}/openjpeg-2.5/opj_stdint.h %{_libdir}/libopenjp2.so -%{_libdir}/openjpeg-2.5/ +%{_libdir}/cmake/openjpeg-2.5/ %{_libdir}/pkgconfig/libopenjp2.pc %files tools @@ -271,6 +265,10 @@ chmod +x %{buildroot}%{_bindir}/opj2_jpip_viewer %endif %changelog +* Thu Aug 06 2026 PkgAgent Robot - 2.5.3-1 +- [Type] security +- [DESC] Update to 2.5.3 (fixes CVE-2023-39327; mitigates CVE-2023-39328, CVE-2023-39329) + * Tue Aug 19 2025 Zidong Huang - 2.5.0-6 - fixed CVE-2025-50952 diff --git a/openjpeg2_opj2.patch b/openjpeg2_opj2.patch index 0ae7f66..eac73f7 100644 --- a/openjpeg2_opj2.patch +++ b/openjpeg2_opj2.patch @@ -1,12 +1,13 @@ -diff -rupN --no-dereference openjpeg-2.5.0/src/bin/jp2/CMakeLists.txt openjpeg-2.5.0-new/src/bin/jp2/CMakeLists.txt ---- openjpeg-2.5.0/src/bin/jp2/CMakeLists.txt 2022-05-13 18:54:29.000000000 +0200 -+++ openjpeg-2.5.0-new/src/bin/jp2/CMakeLists.txt 2022-05-16 10:23:47.026551355 +0200 +diff --git a/src/bin/jp2/CMakeLists.txt b/src/bin/jp2/CMakeLists.txt +index 26156bc..e9fc87e 100644 +--- a/src/bin/jp2/CMakeLists.txt ++++ b/src/bin/jp2/CMakeLists.txt @@ -44,6 +44,8 @@ endif() # Loop over all executables: foreach(exe opj_decompress opj_compress opj_dump) add_executable(${exe} ${exe}.c ${common_SRCS}) + string(REPLACE "opj_" "opj2_" exe2 ${exe}) + set_target_properties(${exe} PROPERTIES OUTPUT_NAME ${exe2}) - if(NOT ${CMAKE_VERSION} VERSION_LESS "2.8.12") - target_compile_options(${exe} PRIVATE ${OPENJP2_COMPILE_OPTIONS}) - endif() + target_compile_options(${exe} PRIVATE ${OPENJP2_COMPILE_OPTIONS}) + target_link_libraries(${exe} ${OPENJPEG_LIBRARY_NAME} + ${PNG_LIBNAME} ${TIFF_LIBNAME} ${LCMS_LIBNAME} diff --git a/sources b/sources index c1152a2..c1e66c4 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (openjpeg-2.5.0.tar.gz) = 08975a2dd79f1e29fd1824249a5fbe66026640ed787b3a3aa8807c2c69f994240ff33e2132f8bf15bbc2202bef7001f98e42d487231d4eebc8e503538658049a +SHA512 (openjpeg-2.5.3.tar.gz) = 22378f5c38c1eb8ade853716897201d8a253024638bdf94fd9851d6a456601071e705c797c5ffeeb6924be14d7356f9a67f15c2b99e96f7d27fc375a9d94505a -- Gitee