From c46fb3c8b3d13875fd22846dd3cf0ca20f480559 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 19 Aug 2025 15:39:11 +0200 Subject: [PATCH] package/openjpeg: add patch to fix CVE-2025-54874 Fixes the following vulnerability: - CVE-2025-54874 OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG 2.5.3 and earlier, a call to opj_jp2_read_header may lead to OOB heap memory write when the data stream p_stream is too short and p_image is not initialized. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-54874 - https://github.com/uclouvain/openjpeg/commit/f809b80c67717c152a5ad30bf06774f00da4fd2d Signed-off-by: Thomas Perale Signed-off-by: Peter Korsgaard --- ...check-for-error-after-parsing-header.patch | 41 +++++++++++++++++++ package/openjpeg/openjpeg.mk | 3 ++ 2 files changed, 44 insertions(+) create mode 100644 package/openjpeg/0001-check-for-error-after-parsing-header.patch diff --git a/package/openjpeg/0001-check-for-error-after-parsing-header.patch b/package/openjpeg/0001-check-for-error-after-parsing-header.patch new file mode 100644 index 0000000000..9a02fbf3d4 --- /dev/null +++ b/package/openjpeg/0001-check-for-error-after-parsing-header.patch @@ -0,0 +1,41 @@ +From f809b80c67717c152a5ad30bf06774f00da4fd2d Mon Sep 17 00:00:00 2001 +From: Sebastian Rasmussen +Date: Thu, 16 Jan 2025 02:13:43 +0100 +Subject: [PATCH] opj_jp2_read_header: Check for error after parsing header. + +Consider the case where the caller has not set the p_image +pointer to NULL before calling opj_read_header(). + +If opj_j2k_read_header_procedure() fails while obtaining the rest +of the marker segment when calling opj_stream_read_data() because +the data stream is too short, then opj_j2k_read_header() will +never have the chance to initialize p_image, leaving it +uninitialized. + +opj_jp2_read_header() will check the p_image value whether +opj_j2k_read_header() suceeded or failed. This may be detected as +an error in valgrind or ASAN. + +The fix is to check whether opj_j2k_read_header() suceeded before +using the output argument p_image. + +Upstream: https://github.com/uclouvain/openjpeg/commit/f809b80c67717c152a5ad30bf06774f00da4fd2d +CVE: CVE-2025-54874 +Signed-off-by: Thomas Perale +--- + src/lib/openjp2/jp2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/lib/openjp2/jp2.c b/src/lib/openjp2/jp2.c +index 4df055a54..da5063186 100644 +--- a/src/lib/openjp2/jp2.c ++++ b/src/lib/openjp2/jp2.c +@@ -2873,7 +2873,7 @@ OPJ_BOOL opj_jp2_read_header(opj_stream_private_t *p_stream, + p_image, + p_manager); + +- if (p_image && *p_image) { ++ if (ret && p_image && *p_image) { + /* Set Image Color Space */ + if (jp2->enumcs == 16) { + (*p_image)->color_space = OPJ_CLRSPC_SRGB; diff --git a/package/openjpeg/openjpeg.mk b/package/openjpeg/openjpeg.mk index 275659cd3c..7b1352c222 100644 --- a/package/openjpeg/openjpeg.mk +++ b/package/openjpeg/openjpeg.mk @@ -11,6 +11,9 @@ OPENJPEG_LICENSE_FILES = LICENSE OPENJPEG_CPE_ID_VENDOR = uclouvain OPENJPEG_INSTALL_STAGING = YES +# 0001-check-for-error-after-parsing-header.patch +OPENJPEG_IGNORE_CVES += CVE-2025-54874 + OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_ZLIB),zlib) OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_LIBPNG),libpng) OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_TIFF),tiff)