[jasper/f19] CVE-2014-9029 (#1170650)
Jiří Popelka
jpopelka at fedoraproject.org
Thu Dec 4 15:01:56 UTC 2014
commit 85a20e3e608016f6313f3b98db0bd4c74330aff8
Author: Jiri Popelka <jpopelka at redhat.com>
Date: Thu Dec 4 15:49:08 2014 +0100
CVE-2014-9029 (#1170650)
jasper-CVE-2014-9029.patch | 29 +++++++++++++++++++++++++++++
jasper.spec | 9 ++++++++-
2 files changed, 37 insertions(+), 1 deletions(-)
---
diff --git a/jasper-CVE-2014-9029.patch b/jasper-CVE-2014-9029.patch
new file mode 100644
index 0000000..98a2035
--- /dev/null
+++ b/jasper-CVE-2014-9029.patch
@@ -0,0 +1,29 @@
+--- jasper-1.900.1.orig/src/libjasper/jpc/jpc_dec.c 2014-11-27 12:45:44.000000000 +0100
++++ jasper-1.900.1/src/libjasper/jpc/jpc_dec.c 2014-11-27 12:44:58.000000000 +0100
+@@ -1281,7 +1281,7 @@ static int jpc_dec_process_coc(jpc_dec_t
+ jpc_coc_t *coc = &ms->parms.coc;
+ jpc_dec_tile_t *tile;
+
+- if (JAS_CAST(int, coc->compno) > dec->numcomps) {
++ if (JAS_CAST(int, coc->compno) >= dec->numcomps) {
+ jas_eprintf("invalid component number in COC marker segment\n");
+ return -1;
+ }
+@@ -1307,7 +1307,7 @@ static int jpc_dec_process_rgn(jpc_dec_t
+ jpc_rgn_t *rgn = &ms->parms.rgn;
+ jpc_dec_tile_t *tile;
+
+- if (JAS_CAST(int, rgn->compno) > dec->numcomps) {
++ if (JAS_CAST(int, rgn->compno) >= dec->numcomps) {
+ jas_eprintf("invalid component number in RGN marker segment\n");
+ return -1;
+ }
+@@ -1356,7 +1356,7 @@ static int jpc_dec_process_qcc(jpc_dec_t
+ jpc_qcc_t *qcc = &ms->parms.qcc;
+ jpc_dec_tile_t *tile;
+
+- if (JAS_CAST(int, qcc->compno) > dec->numcomps) {
++ if (JAS_CAST(int, qcc->compno) >= dec->numcomps) {
+ jas_eprintf("invalid component number in QCC marker segment\n");
+ return -1;
+ }
diff --git a/jasper.spec b/jasper.spec
index c5009a1..13672a2 100644
--- a/jasper.spec
+++ b/jasper.spec
@@ -7,7 +7,7 @@ Summary: Implementation of the JPEG-2000 standard, Part 1
Name: jasper
Group: System Environment/Libraries
Version: 1.900.1
-Release: 24%{?dist}
+Release: 25%{?dist}
License: JasPer
URL: http://www.ece.uvic.ca/~frodo/jasper/
@@ -32,6 +32,8 @@ Patch7: jasper-pkgconfig.patch
Patch8: jasper-1.900.1-CVE-2011-4516-CVE-2011-4517-CERT-VU-887409.patch
+Patch9: jasper-CVE-2014-9029.patch
+
# Issues found by static analysis of code
Patch10: jasper-1.900.1-Coverity-BAD_SIZEOF.patch
Patch11: jasper-1.900.1-Coverity-CHECKED_RETURN.patch
@@ -93,6 +95,7 @@ Requires: %{name}-libs%{?_isa} = %{version}-%{release}
%patch6 -p1 -b .CVE-2008-3522
%patch7 -p1 -b .pkgconfig
%patch8 -p1 -b .CVE-2011-4516-4517
+%patch9 -p1 -b .CVE-2014-9029
%patch10 -p1 -b .BAD_SIZEOF
%patch11 -p1 -b .CHECKED_RETURN
@@ -170,6 +173,10 @@ make check
%changelog
+* Thu Dec 04 2014 Jiri Popelka <jpopelka at redhat.com> - 1.900.1-25
+- CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
+ marker segment decoders (#1170650)
+
* Mon Mar 25 2013 Jiri Popelka <jpopelka at redhat.com> - 1.900.1-24
- added --force option to autoreconf (#925604)
More information about the scm-commits
mailing list