mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-23 15:54:21 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/jasper: add patch for CVE-2025-8836

Browse Source 
Fixes the following vulnerability:

- CVE-2025-8836:
    A vulnerability was determined in JasPer up to 4.2.5. Affected by this
    issue is the function jpc_floorlog2 of the file
    src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The
    manipulation leads to reachable assertion. The attack needs to be
    approached locally. The exploit has been disclosed to the public and
    may be used.

For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2025-8836

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2026-02-24 22:14:47 +01:00
parent 7136e0682e
commit 0af8069fc1
2 changed files with 83 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
package/jasper/0003-Fixes-401.patch Normal file
View File

@@ -0,0 +1,80 @@
From 79185d32d7a444abae441935b20ae4676b3513d4 Mon Sep 17 00:00:00 2001
From: Michael Adams <mdadams@ece.uvic.ca>
Date: Sat, 2 Aug 2025 18:00:39 -0700
Subject: [PATCH] Fixes #401.
JPEG-2000 (JPC) Encoder:
- Added some missing range checking on several coding parameters
(e.g., precint width/height and codeblock width/height).
CVE: CVE-2025-8836
Upstream: https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4.patch
[thomas: removed the binary blob, backport, adapt lines]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
src/libjasper/jpc/jpc_enc.c | 30 ++++++++++++++++++++++++------
src/libjasper/jpc/jpc_t2dec.c | 3 ++-
3 files changed, 26 insertions(+), 7 deletions(-)
create mode 100644 data/test/other/poc_401.pnm
diff --git a/src/libjasper/jpc/jpc_enc.c b/src/libjasper/jpc/jpc_enc.c
index 041c030a..e910a863 100644
--- a/src/libjasper/jpc/jpc_enc.c
+++ b/src/libjasper/jpc/jpc_enc.c
@@ -474,18 +474,36 @@ static jpc_enc_cp_t *cp_create(const char *optstr, jas_image_t *image)
cp->tileheight = atoi(jas_tvparser_getval(tvp));
break;
case OPT_PRCWIDTH:
- prcwidthexpn = jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
+ i = atoi(jas_tvparser_getval(tvp));
+ if (i <= 0) {
+ jas_eprintf("invalid precinct width (%d)\n", i);
+ goto error;
+ }
+ prcwidthexpn = jpc_floorlog2(i);
break;
case OPT_PRCHEIGHT:
- prcheightexpn = jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
+ i = atoi(jas_tvparser_getval(tvp));
+ if (i <= 0) {
+ jas_eprintf("invalid precinct height (%d)\n", i);
+ goto error;
+ }
+ prcheightexpn = jpc_floorlog2(i);
break;
case OPT_CBLKWIDTH:
- tccp->cblkwidthexpn =
- jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
+ i = atoi(jas_tvparser_getval(tvp));
+ if (i <= 0) {
+ jas_eprintf("invalid code block width (%d)\n", i);
+ goto error;
+ }
+ tccp->cblkwidthexpn = jpc_floorlog2(i);
break;
case OPT_CBLKHEIGHT:
- tccp->cblkheightexpn =
- jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
+ i = atoi(jas_tvparser_getval(tvp));
+ if (i <= 0) {
+ jas_eprintf("invalid code block height (%d)\n", i);
+ goto error;
+ }
+ tccp->cblkheightexpn = jpc_floorlog2(i);
break;
case OPT_MODE:
if ((tagid = jas_taginfo_nonull(jas_taginfos_lookup(modetab,
diff --git a/src/libjasper/jpc/jpc_t2dec.c b/src/libjasper/jpc/jpc_t2dec.c
index de77623a..1eff88a0 100644
--- a/src/libjasper/jpc/jpc_t2dec.c
+++ b/src/libjasper/jpc/jpc_t2dec.c
@@ -337,7 +337,8 @@ static int jpc_dec_decodepkt(jpc_dec_t *dec, jas_stream_t *pkthdrstream, jas_str
const unsigned n = JAS_MIN((unsigned)numnewpasses, maxpasses);
mycounter += n;
numnewpasses -= n;
- if ((len = jpc_bitstream_getbits(inb, cblk->numlenbits + jpc_floorlog2(n))) < 0) {
+ if ((len = jpc_bitstream_getbits(inb,
+ cblk->numlenbits + jpc_floorlog2(n))) < 0) {
jpc_bitstream_close(inb);
return -1;
}

3
package/jasper/jasper.mk
View File

@@ -21,6 +21,9 @@ JASPER_IGNORE_CVES += CVE-2023-51257
# 0002-Fixes-400.patch
JASPER_IGNORE_CVES += CVE-2025-8835
# 0003-Fixes-401.patch
JASPER_IGNORE_CVES += CVE-2025-8836
ifeq ($(BR2_STATIC_LIBS),y)
JASPER_CONF_OPTS += -DJAS_ENABLE_SHARED=OFF
endif