From ac9c499ca0c1e1b1a3ddb64b7a8a10c4f2191e89 Mon Sep 17 00:00:00 2001
From: Thomas Perale <thomas.perale@mind.be>
Date: Tue, 24 Feb 2026 22:14:48 +0100
Subject: [PATCH] package/jasper: add patch for CVE-2025-8837

Fixes the following vulnerability:

- CVE-2025-8837:
    A vulnerability was identified in JasPer up to 4.2.5. This affects the
    function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the
    component JPEG2000 File Handler. The manipulation leads to use after
    free. An attack has to be approached locally. The exploit has been
    disclosed to the public and may be used.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-8837
  - https://github.com/jasper-software/jasper/commit/8308060d3fbc1da10353ac8a95c8ea60eba9c25a

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/jasper/0004-Fixes-402-403.patch | 63 +++++++++++++++++++++++++
 package/jasper/jasper.mk                |  3 ++
 2 files changed, 66 insertions(+)
 create mode 100644 package/jasper/0004-Fixes-402-403.patch

diff --git a/package/jasper/0004-Fixes-402-403.patch b/package/jasper/0004-Fixes-402-403.patch
new file mode 100644
index 0000000000..d7d777d9cd
--- /dev/null
+++ b/package/jasper/0004-Fixes-402-403.patch
@@ -0,0 +1,63 @@
+From 8308060d3fbc1da10353ac8a95c8ea60eba9c25a Mon Sep 17 00:00:00 2001
+From: Michael Adams <mdadams@ece.uvic.ca>
+Date: Tue, 5 Aug 2025 20:46:48 -0700
+Subject: [PATCH] Fixes #402, #403.
+
+JPEG-2000 (JPC) Decoder:
+- Added the setting of several pointers to null in some cleanup code
+  after the pointed-to memory was freed.  This pointer nulling is not
+  needed normally, but it is needed when certain debugging logs are
+  enabled (so that the debug code understands that the memory associated
+  with the aforementioned pointers has been freed).
+
+CVE: CVE-2025-8837
+Upstream: https://github.com/jasper-software/jasper/commit/8308060d3fbc1da10353ac8a95c8ea60eba9c25a
+[thomas: removed the binary blob, adapt line]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/libjasper/jpc/jpc_dec.c |  13 ++++++++-----
+ 3 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/src/libjasper/jpc/jpc_dec.c b/src/libjasper/jpc/jpc_dec.c
+index 125a29ba..7e44f052 100644
+--- a/src/libjasper/jpc/jpc_dec.c
++++ b/src/libjasper/jpc/jpc_dec.c
+@@ -1107,23 +1107,23 @@ static int jpc_dec_tilefini(jpc_dec_t *dec, jpc_dec_tile_t *tile)
+ 
+ 	if (tile->cp) {
+ 		jpc_dec_cp_destroy(tile->cp);
+-		//tile->cp = 0;
++		tile->cp = 0;
+ 	}
+ 	if (tile->tcomps) {
+ 		jas_free(tile->tcomps);
+-		//tile->tcomps = 0;
++		tile->tcomps = 0;
+ 	}
+ 	if (tile->pi) {
+ 		jpc_pi_destroy(tile->pi);
+-		//tile->pi = 0;
++		tile->pi = 0;
+ 	}
+ 	if (tile->pkthdrstream) {
+ 		jas_stream_close(tile->pkthdrstream);
+-		//tile->pkthdrstream = 0;
++		tile->pkthdrstream = 0;
+ 	}
+ 	if (tile->pptstab) {
+ 		jpc_ppxstab_destroy(tile->pptstab);
+-		//tile->pptstab = 0;
++		tile->pptstab = 0;
+ 	}
+ 
+ 	tile->state = JPC_TILE_DONE;
+@@ -2259,6 +2259,9 @@ static int jpc_dec_dump(const jpc_dec_t *dec)
+ 	const jpc_dec_tile_t *tile;
+ 	for (tileno = 0, tile = dec->tiles; tileno < dec->numtiles;
+ 	  ++tileno, ++tile) {
++		if (!tile->tcomps) {
++			continue;
++		}
+ 		assert(!dec->numcomps || tile->tcomps);
+ 		unsigned compno;
+ 		const jpc_dec_tcomp_t *tcomp;
diff --git a/package/jasper/jasper.mk b/package/jasper/jasper.mk
index d499c8a7c2..90c8e0c9a9 100644
--- a/package/jasper/jasper.mk
+++ b/package/jasper/jasper.mk
@@ -24,6 +24,9 @@ JASPER_IGNORE_CVES += CVE-2025-8835
 # 0003-Fixes-401.patch
 JASPER_IGNORE_CVES += CVE-2025-8836
 
+# 0004-Fixes-402-403.patch
+JASPER_IGNORE_CVES += CVE-2025-8837
+
 ifeq ($(BR2_STATIC_LIBS),y)
 JASPER_CONF_OPTS += -DJAS_ENABLE_SHARED=OFF
 endif