mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/jasper: add patch for CVE-2023-51257

Browse Source 
This fixes the following vulnerability:

- CVE-2023-51257:

An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and
before allows a local attacker to execute arbitrary code.

For more information see:
  - https://nvd.nist.gov//vuln/detail/CVE-2023-51257
  - aeef5293c9

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 860c35d1ac)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2025-09-17 20:54:42 +02:00
committed by Arnout Vandecappelle
parent 42db5653f7
commit eb6a93ab86
2 changed files with 49 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
package/jasper/0001-Fixes-367.patch Normal file
View File

@@ -0,0 +1,46 @@
From aeef5293c978158255ad4f127089644745602f2a Mon Sep 17 00:00:00 2001
From: Michael Adams <mdadams@ece.uvic.ca>
Date: Thu, 14 Dec 2023 19:04:19 -0800
Subject: [PATCH] Fixes #367.
Fixed an integer-overflow bug in the ICC profile parsing code.
Added another invalid image to the test set.
CVE: CVE-2023-51257
Upstream: https://github.com/jasper-software/jasper/commit/aeef5293c978158255ad4f127089644745602f2a
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
src/libjasper/base/jas_icc.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/src/libjasper/base/jas_icc.c b/src/libjasper/base/jas_icc.c
index 905b823..2d1e91e 100644
--- a/src/libjasper/base/jas_icc.c
+++ b/src/libjasper/base/jas_icc.c
@@ -1295,10 +1295,22 @@ static int jas_icctxt_input(jas_iccattrval_t *attrval, jas_stream_t *in,
{
jas_icctxt_t *txt = &attrval->data.txt;
txt->string = 0;
- if (!(txt->string = jas_malloc(cnt)))
+ /* The string must at least contain a single null character. */
+ if (cnt < 1) {
goto error;
- if (jas_stream_read(in, txt->string, cnt) != cnt)
+ }
+ if (!(txt->string = jas_malloc(cnt))) {
+ goto error;
+ }
+ if (jas_stream_read(in, txt->string, cnt) != cnt) {
goto error;
+ }
+ /* Ensure that the string is null terminated. */
+ if (txt->string[cnt - 1] != '\0') {
+ goto error;
+ }
+ /* The following line is redundant, unless we do not enforce that
+ the last character must be null. */
txt->string[cnt - 1] = '\0';
if (strlen(txt->string) + 1 != cnt)
goto error;
--
2.39.5

3
package/jasper/jasper.mk
View File

@@ -15,6 +15,9 @@ JASPER_CONF_OPTS = \
-DJAS_ENABLE_DOC=OFF \
-DJAS_ENABLE_PROGRAMS=OFF
# 0001-Fixes-367.patch
JASPER_IGNORE_CVES += CVE-2023-51257
ifeq ($(BR2_STATIC_LIBS),y)
JASPER_CONF_OPTS += -DJAS_ENABLE_SHARED=OFF
endif