From 0af8069fc138bacb24cf5836b35d28852ea8b014 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 24 Feb 2026 22:14:47 +0100 Subject: [PATCH] package/jasper: add patch for CVE-2025-8836 Fixes the following vulnerability: - CVE-2025-8836: A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. For more information, see: https://www.cve.org/CVERecord?id=CVE-2025-8836 Signed-off-by: Thomas Perale --- package/jasper/0003-Fixes-401.patch | 80 +++++++++++++++++++++++++++++ package/jasper/jasper.mk | 3 ++ 2 files changed, 83 insertions(+) create mode 100644 package/jasper/0003-Fixes-401.patch diff --git a/package/jasper/0003-Fixes-401.patch b/package/jasper/0003-Fixes-401.patch new file mode 100644 index 0000000000..9741d90eee --- /dev/null +++ b/package/jasper/0003-Fixes-401.patch @@ -0,0 +1,80 @@ +From 79185d32d7a444abae441935b20ae4676b3513d4 Mon Sep 17 00:00:00 2001 +From: Michael Adams +Date: Sat, 2 Aug 2025 18:00:39 -0700 +Subject: [PATCH] Fixes #401. + +JPEG-2000 (JPC) Encoder: +- Added some missing range checking on several coding parameters + (e.g., precint width/height and codeblock width/height). + +CVE: CVE-2025-8836 +Upstream: https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4.patch +[thomas: removed the binary blob, backport, adapt lines] +Signed-off-by: Thomas Perale +--- + src/libjasper/jpc/jpc_enc.c | 30 ++++++++++++++++++++++++------ + src/libjasper/jpc/jpc_t2dec.c | 3 ++- + 3 files changed, 26 insertions(+), 7 deletions(-) + create mode 100644 data/test/other/poc_401.pnm + +diff --git a/src/libjasper/jpc/jpc_enc.c b/src/libjasper/jpc/jpc_enc.c +index 041c030a..e910a863 100644 +--- a/src/libjasper/jpc/jpc_enc.c ++++ b/src/libjasper/jpc/jpc_enc.c +@@ -474,18 +474,36 @@ static jpc_enc_cp_t *cp_create(const char *optstr, jas_image_t *image) + cp->tileheight = atoi(jas_tvparser_getval(tvp)); + break; + case OPT_PRCWIDTH: +- prcwidthexpn = jpc_floorlog2(atoi(jas_tvparser_getval(tvp))); ++ i = atoi(jas_tvparser_getval(tvp)); ++ if (i <= 0) { ++ jas_eprintf("invalid precinct width (%d)\n", i); ++ goto error; ++ } ++ prcwidthexpn = jpc_floorlog2(i); + break; + case OPT_PRCHEIGHT: +- prcheightexpn = jpc_floorlog2(atoi(jas_tvparser_getval(tvp))); ++ i = atoi(jas_tvparser_getval(tvp)); ++ if (i <= 0) { ++ jas_eprintf("invalid precinct height (%d)\n", i); ++ goto error; ++ } ++ prcheightexpn = jpc_floorlog2(i); + break; + case OPT_CBLKWIDTH: +- tccp->cblkwidthexpn = +- jpc_floorlog2(atoi(jas_tvparser_getval(tvp))); ++ i = atoi(jas_tvparser_getval(tvp)); ++ if (i <= 0) { ++ jas_eprintf("invalid code block width (%d)\n", i); ++ goto error; ++ } ++ tccp->cblkwidthexpn = jpc_floorlog2(i); + break; + case OPT_CBLKHEIGHT: +- tccp->cblkheightexpn = +- jpc_floorlog2(atoi(jas_tvparser_getval(tvp))); ++ i = atoi(jas_tvparser_getval(tvp)); ++ if (i <= 0) { ++ jas_eprintf("invalid code block height (%d)\n", i); ++ goto error; ++ } ++ tccp->cblkheightexpn = jpc_floorlog2(i); + break; + case OPT_MODE: + if ((tagid = jas_taginfo_nonull(jas_taginfos_lookup(modetab, +diff --git a/src/libjasper/jpc/jpc_t2dec.c b/src/libjasper/jpc/jpc_t2dec.c +index de77623a..1eff88a0 100644 +--- a/src/libjasper/jpc/jpc_t2dec.c ++++ b/src/libjasper/jpc/jpc_t2dec.c +@@ -337,7 +337,8 @@ static int jpc_dec_decodepkt(jpc_dec_t *dec, jas_stream_t *pkthdrstream, jas_str + const unsigned n = JAS_MIN((unsigned)numnewpasses, maxpasses); + mycounter += n; + numnewpasses -= n; +- if ((len = jpc_bitstream_getbits(inb, cblk->numlenbits + jpc_floorlog2(n))) < 0) { ++ if ((len = jpc_bitstream_getbits(inb, ++ cblk->numlenbits + jpc_floorlog2(n))) < 0) { + jpc_bitstream_close(inb); + return -1; + } diff --git a/package/jasper/jasper.mk b/package/jasper/jasper.mk index 527ad6fa8c..d499c8a7c2 100644 --- a/package/jasper/jasper.mk +++ b/package/jasper/jasper.mk @@ -21,6 +21,9 @@ JASPER_IGNORE_CVES += CVE-2023-51257 # 0002-Fixes-400.patch JASPER_IGNORE_CVES += CVE-2025-8835 +# 0003-Fixes-401.patch +JASPER_IGNORE_CVES += CVE-2025-8836 + ifeq ($(BR2_STATIC_LIBS),y) JASPER_CONF_OPTS += -DJAS_ENABLE_SHARED=OFF endif