mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 00:04:06 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/jasper: add patch for CVE-2025-8837

Browse Source 
Fixes the following vulnerability:

- CVE-2025-8837:
    A vulnerability was identified in JasPer up to 4.2.5. This affects the
    function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the
    component JPEG2000 File Handler. The manipulation leads to use after
    free. An attack has to be approached locally. The exploit has been
    disclosed to the public and may be used.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-8837
  - 8308060d3f

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2026-02-24 22:14:48 +01:00
parent 0af8069fc1
commit ac9c499ca0
2 changed files with 66 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

63
package/jasper/0004-Fixes-402-403.patch Normal file
View File

@@ -0,0 +1,63 @@
From 8308060d3fbc1da10353ac8a95c8ea60eba9c25a Mon Sep 17 00:00:00 2001
From: Michael Adams <mdadams@ece.uvic.ca>
Date: Tue, 5 Aug 2025 20:46:48 -0700
Subject: [PATCH] Fixes #402, #403.
JPEG-2000 (JPC) Decoder:
- Added the setting of several pointers to null in some cleanup code
after the pointed-to memory was freed. This pointer nulling is not
needed normally, but it is needed when certain debugging logs are
enabled (so that the debug code understands that the memory associated
with the aforementioned pointers has been freed).
CVE: CVE-2025-8837
Upstream: https://github.com/jasper-software/jasper/commit/8308060d3fbc1da10353ac8a95c8ea60eba9c25a
[thomas: removed the binary blob, adapt line]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
src/libjasper/jpc/jpc_dec.c | 13 ++++++++-----
3 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/src/libjasper/jpc/jpc_dec.c b/src/libjasper/jpc/jpc_dec.c
index 125a29ba..7e44f052 100644
--- a/src/libjasper/jpc/jpc_dec.c
+++ b/src/libjasper/jpc/jpc_dec.c
@@ -1107,23 +1107,23 @@ static int jpc_dec_tilefini(jpc_dec_t *dec, jpc_dec_tile_t *tile)
if (tile->cp) {
jpc_dec_cp_destroy(tile->cp);
- //tile->cp = 0;
+ tile->cp = 0;
}
if (tile->tcomps) {
jas_free(tile->tcomps);
- //tile->tcomps = 0;
+ tile->tcomps = 0;
}
if (tile->pi) {
jpc_pi_destroy(tile->pi);
- //tile->pi = 0;
+ tile->pi = 0;
}
if (tile->pkthdrstream) {
jas_stream_close(tile->pkthdrstream);
- //tile->pkthdrstream = 0;
+ tile->pkthdrstream = 0;
}
if (tile->pptstab) {
jpc_ppxstab_destroy(tile->pptstab);
- //tile->pptstab = 0;
+ tile->pptstab = 0;
}
tile->state = JPC_TILE_DONE;
@@ -2259,6 +2259,9 @@ static int jpc_dec_dump(const jpc_dec_t *dec)
const jpc_dec_tile_t *tile;
for (tileno = 0, tile = dec->tiles; tileno < dec->numtiles;
++tileno, ++tile) {
+ if (!tile->tcomps) {
+ continue;
+ }
assert(!dec->numcomps || tile->tcomps);
unsigned compno;
const jpc_dec_tcomp_t *tcomp;

3
package/jasper/jasper.mk
View File

@@ -24,6 +24,9 @@ JASPER_IGNORE_CVES += CVE-2025-8835
# 0003-Fixes-401.patch
JASPER_IGNORE_CVES += CVE-2025-8836
# 0004-Fixes-402-403.patch
JASPER_IGNORE_CVES += CVE-2025-8837
ifeq ($(BR2_STATIC_LIBS),y)
JASPER_CONF_OPTS += -DJAS_ENABLE_SHARED=OFF
endif