Your message dated Sat, 08 Feb 2020 14:23:35 +0000
with message-id
<a894a0233c2d264936953d7a69507573c4a5742a.ca...@adam-barratt.org.uk>
and subject line Closing bugs included in 9.12
has caused the Debian Bug report #942024,
regarding stretch-pu: package openjpeg2/2.1.2-1.1+deb9u4
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
942024: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942024
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: stretch
User: [email protected]
Usertags: pu
Dear release managers,
as discussed in #939553[0], no DSA will be issued by the security team for
CVE-2018-21010 and this vulnerability can be fixed via -pu. The attached
debdiff addresses this issue, along with CVE-2018-20847 and CVE-2018-21010.
Patches for CVE-2018-20847 and CVE-2018-21010 are straight from upstream.
Concerning CVE-2018-21010, I did a few changes to remove non-security
related refactoring and improve readability.
thanks!
cheers,
Hugo
[0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=939553
--
Hugo Lefeuvre (hle) | www.owl.eu.com
RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD
ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C
diff -Nru openjpeg2-2.1.2/debian/changelog openjpeg2-2.1.2/debian/changelog
--- openjpeg2-2.1.2/debian/changelog 2019-03-07 22:41:30.000000000 +0100
+++ openjpeg2-2.1.2/debian/changelog 2019-10-08 15:20:27.000000000 +0200
@@ -1,3 +1,16 @@
+openjpeg2 (2.1.2-1.1+deb9u4) stretch; urgency=medium
+
+ * Non-maintainer upload.
+ * CVE-2018-21010: heap buffer overflow in color_apply_icc_profile
+ (Closes: #939553).
+ * CVE-2018-20847: improper computation of values in the function
+ opj_get_encoding_parameters, leading to an integer overflow
+ (Closes: #931294).
+ * CVE-2016-9112: floating point exception or divide by zero in the
+ function opj_pi_next_cprl (Closes: #844551).
+
+ -- Hugo Lefeuvre <[email protected]> Tue, 08 Oct 2019 15:20:27 +0200
+
openjpeg2 (2.1.2-1.1+deb9u3) stretch-security; urgency=medium
* Non-maintainer upload by the Security Team.
diff -Nru openjpeg2-2.1.2/debian/patches/CVE-2016-9112.patch
openjpeg2-2.1.2/debian/patches/CVE-2016-9112.patch
--- openjpeg2-2.1.2/debian/patches/CVE-2016-9112.patch 1970-01-01
01:00:00.000000000 +0100
+++ openjpeg2-2.1.2/debian/patches/CVE-2016-9112.patch 2019-10-08
15:20:27.000000000 +0200
@@ -0,0 +1,59 @@
+Subject: fix division by zero and undefined behavior on shift in pi.c
+Author: Even Rouault <[email protected]>
+Origin: upstream, https://github.com/uclouvain/openjpeg/commit/d27ccf01c68a31ad
+--- a/src/lib/openjp2/pi.c 2019-10-08 15:46:03.364003550 +0200
++++ b/src/lib/openjp2/pi.c 2019-10-09 08:59:02.183880328 +0200
+@@ -360,6 +360,17 @@
+ try1 = opj_int_ceildiv(pi->ty1,
(OPJ_INT32)(comp->dy << levelno));
+ rpx = res->pdx + levelno;
+ rpy = res->pdy + levelno;
++
++ /* To avoid divisions by zero /
undefined behaviour on shift */
++ /* in below tests */
++ /* Fixes reading
id:000026,sig:08,src:002419,op:int32,pos:60,val:+32 */
++ /* of
https://github.com/uclouvain/openjpeg/issues/938 */
++ if (rpx >= 31 || ((comp->dx << rpx) >>
rpx) != comp->dx ||
++ rpy >= 31 || ((comp->dy << rpy)
>> rpy) != comp->dy) {
++ continue;
++ }
++
++ /* See ISO-15441. B.12.1.3 Resolution
level-position-component-layer progression */
+ if (!((pi->y % (OPJ_INT32)(comp->dy <<
rpy) == 0) || ((pi->y == pi->ty0) && ((try0 << levelno) % (1 << rpy))))){
+ continue;
+ }
+@@ -441,6 +452,17 @@
+ try1 = opj_int_ceildiv(pi->ty1,
(OPJ_INT32)(comp->dy << levelno));
+ rpx = res->pdx + levelno;
+ rpy = res->pdy + levelno;
++
++ /* To avoid divisions by zero /
undefined behaviour on shift */
++ /* in below tests */
++ /* Relates to
id:000019,sig:08,src:001098,op:flip1,pos:49 */
++ /* of
https://github.com/uclouvain/openjpeg/issues/938 */
++ if (rpx >= 31 || ((comp->dx << rpx) >>
rpx) != comp->dx ||
++ rpy >= 31 || ((comp->dy << rpy)
>> rpy) != comp->dy) {
++ continue;
++ }
++
++ /* See ISO-15441. B.12.1.4
Position-component-resolution level-layer progression */
+ if (!((pi->y % (OPJ_INT32)(comp->dy <<
rpy) == 0) || ((pi->y == pi->ty0) && ((try0 << levelno) % (1 << rpy))))){
+ continue;
+ }
+@@ -520,6 +542,17 @@
+ try1 = opj_int_ceildiv(pi->ty1,
(OPJ_INT32)(comp->dy << levelno));
+ rpx = res->pdx + levelno;
+ rpy = res->pdy + levelno;
++
++ /* To avoid divisions by zero /
undefined behaviour on shift */
++ /* in below tests */
++ /* Fixes reading
id:000019,sig:08,src:001098,op:flip1,pos:49 */
++ /* of
https://github.com/uclouvain/openjpeg/issues/938 */
++ if (rpx >= 31 || ((comp->dx << rpx) >>
rpx) != comp->dx ||
++ rpy >= 31 || ((comp->dy << rpy)
>> rpy) != comp->dy) {
++ continue;
++ }
++
++ /* See ISO-15441. B.12.1.5
Component-position-resolution level-layer progression */
+ if (!((pi->y % (OPJ_INT32)(comp->dy <<
rpy) == 0) || ((pi->y == pi->ty0) && ((try0 << levelno) % (1 << rpy))))){
+ continue;
+ }
diff -Nru openjpeg2-2.1.2/debian/patches/CVE-2018-20847.patch
openjpeg2-2.1.2/debian/patches/CVE-2018-20847.patch
--- openjpeg2-2.1.2/debian/patches/CVE-2018-20847.patch 1970-01-01
01:00:00.000000000 +0100
+++ openjpeg2-2.1.2/debian/patches/CVE-2018-20847.patch 2019-10-08
15:20:27.000000000 +0200
@@ -0,0 +1,36 @@
+Description: fix integer overflow in opj_get_encoding_parameters
+ This bug is known at three places in the source code:
+ opj_get_all_encoding_parameters() and opj_tcd_init_tile() in pi.c and tcd.c
+ (both fixed _before_ the release of 2.1.2), and opj_get_encoding_parameters()
+ in pi.c. This patch addresses the issue in opj_get_encoding_parameters().
+Author: Young_X <[email protected]>
+Origin: upstream, https://github.com/uclouvain/openjpeg/commit/c58df149900df862
+--- a/src/lib/openjp2/pi.c 2019-10-08 15:42:07.754437740 +0200
++++ b/src/lib/openjp2/pi.c 2019-10-08 15:46:03.364003550 +0200
+@@ -574,6 +574,9 @@
+ /* position in x and y of tile */
+ OPJ_UINT32 p, q;
+
++ /* non-corrected (in regard to image offset) tile offset */
++ OPJ_UINT32 l_tx0, l_ty0;
++
+ /* preconditions */
+ assert(p_cp != 00);
+ assert(p_image != 00);
+@@ -589,10 +592,12 @@
+ q = p_tileno / p_cp->tw;
+
+ /* find extent of tile */
+- *p_tx0 = opj_int_max((OPJ_INT32)(p_cp->tx0 + p * p_cp->tdx),
(OPJ_INT32)p_image->x0);
+- *p_tx1 = opj_int_min((OPJ_INT32)(p_cp->tx0 + (p + 1) * p_cp->tdx),
(OPJ_INT32)p_image->x1);
+- *p_ty0 = opj_int_max((OPJ_INT32)(p_cp->ty0 + q * p_cp->tdy),
(OPJ_INT32)p_image->y0);
+- *p_ty1 = opj_int_min((OPJ_INT32)(p_cp->ty0 + (q + 1) * p_cp->tdy),
(OPJ_INT32)p_image->y1);
++ l_tx0 = p_cp->tx0 + p * p_cp->tdx; /* can't be greater than p_image->x1
so won't overflow */
++ *p_tx0 = (OPJ_INT32)opj_uint_max(l_tx0, p_image->x0);
++ *p_tx1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_tx0, p_cp->tdx),
p_image->x1);
++ l_ty0 = p_cp->ty0 + q * p_cp->tdy; /* can't be greater than p_image->y1
so won't overflow */
++ *p_ty0 = (OPJ_INT32)opj_uint_max(l_ty0, p_image->y0);
++ *p_ty1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_ty0, p_cp->tdy),
p_image->y1);
+
+ /* max precision is 0 (can only grow) */
+ *p_max_prec = 0;
diff -Nru openjpeg2-2.1.2/debian/patches/CVE-2018-21010.patch
openjpeg2-2.1.2/debian/patches/CVE-2018-21010.patch
--- openjpeg2-2.1.2/debian/patches/CVE-2018-21010.patch 1970-01-01
01:00:00.000000000 +0100
+++ openjpeg2-2.1.2/debian/patches/CVE-2018-21010.patch 2019-10-08
15:20:27.000000000 +0200
@@ -0,0 +1,26 @@
+Description: color_apply_icc_profile: avoid potential heap buffer overflow
+ This patch addresses CVE-2018-21010. It differs slightly from upstream's
+ patch in that we avoid whitespace refactoring and complex nested ifs.
+Author: Even Rouault <[email protected]>, Hugo Lefeuvre
<[email protected]>
+Origin: upstream, https://github.com/uclouvain/openjpeg/commit/2e5ab1d9987831c9
+--- a/src/bin/common/color.c 2019-10-08 15:26:20.349834699 +0200
++++ b/src/bin/common/color.c 2019-10-08 15:28:25.492050700 +0200
+@@ -496,6 +496,18 @@
+
+ if(image->numcomps > 2)/* RGB, RGBA */
+ {
++
++ if (!(image->comps[0].w == image->comps[1].w &&
++ image->comps[0].w == image->comps[2].w) ||
++ !(image->comps[0].h == image->comps[1].h &&
++ image->comps[0].h == image->comps[2].h))
++ {
++ fprintf(stderr,
++ "[ERROR] Image components should have the same width
and height\n");
++ cmsDeleteTransform(transform);
++ return;
++ }
++
+ if( prec <= 8 )
+ {
+ unsigned char *inbuf, *outbuf, *in, *out;
diff -Nru openjpeg2-2.1.2/debian/patches/series
openjpeg2-2.1.2/debian/patches/series
--- openjpeg2-2.1.2/debian/patches/series 2019-03-07 22:40:20.000000000
+0100
+++ openjpeg2-2.1.2/debian/patches/series 2019-10-08 15:20:27.000000000
+0200
@@ -15,3 +15,7 @@
CVE-2018-6616.patch
CVE-2018-14423.patch
CVE-2018-5785.patch
+
+CVE-2018-21010.patch
+CVE-2018-20847.patch
+CVE-2016-9112.patch
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Package: release.debian.org
Version: 9.12
Hi,
Each of the uploads referred to by these bugs was included in today's
oldstable point release.
Regards,
Adam
--- End Message ---
