mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-28 21:11:41 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/jbig2dec: add upstream security fix for CVE-2023-46361

Browse Source 
Fixes the following security issue:
CVE-2023-46361: Artifex Software jbig2dec v0.20 was discovered to
contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.

https://www.cve.org/CVERecord?id=CVE-2023-46361

Note that jbig2dec version 0.19 (used in Buildroot 2024.02.11) is not
officially listed as affected, but it actually has the same bug.

Also note that this CVE is about a crash in the CLI tool only.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
[Julien: add JBIG2DEC_IGNORE_CVES]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 63c2dd2d40)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Raphaël Mélotte
2025-03-10 11:08:40 +00:00
committed by Peter Korsgaard
parent 155038635f
commit 9c0891190a
2 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
package/jbig2dec/0001-Bug-705041-jbig2dec-Avoid-uninitialized-allocator-in.patch Normal file
View File

@@ -0,0 +1,28 @@
From e60a9f388bd5655cb514491ef8d55d403aef0773 Mon Sep 17 00:00:00 2001
From: Sebastian Rasmussen <sebras@gmail.com>
Date: Sun, 5 Nov 2023 12:21:52 +0100
Subject: [PATCH] Bug 705041: jbig2dec: Avoid uninitialized allocator in
command-line tool.
Upstream: https://github.com/ArtifexSoftware/jbig2dec/commit/ee53a7e4bc7819d32e8c0b2057885bcc97586bf3
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
---
jbig2dec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/jbig2dec.c b/jbig2dec.c
index 15d204d..1e1dad8 100644
--- a/jbig2dec.c
+++ b/jbig2dec.c
@@ -567,7 +567,7 @@ main(int argc, char **argv)
{
jbig2dec_params_t params;
jbig2dec_error_callback_state_t error_callback_state;
- jbig2dec_allocator_t allocator_;
+ jbig2dec_allocator_t allocator_ = { 0 };
jbig2dec_allocator_t *allocator = &allocator_;
Jbig2Ctx *ctx = NULL;
FILE *f = NULL, *f_page = NULL;
--
2.48.1

3
package/jbig2dec/jbig2dec.mk
View File

@@ -14,4 +14,7 @@ JBIG2DEC_INSTALL_STAGING = YES
# tarball is missing install-sh, install.sh, or shtool
JBIG2DEC_AUTORECONF = YES
# 0001-Bug-705041-jbig2dec-Avoid-uninitialized-allocator-in.patch
JBIG2DEC_IGNORE_CVES += CVE-2023-46361
$(eval $(autotools-package))