Attachment 316092 Details for Bug 346501 – Patch used by Ubuntu

[patch] Patch used by Ubuntu

ubuntu-jasper-1.701-CVE-2007-2721.diff (text/plain), 2.15 KB, created by Tomas Hoger on 2008-09-08 15:10:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2008-09-08 15:10:39 UTC

Size: 2.15 KB

patch

obsolete

>diff -u jasper-1.701.0/debian/changelog jasper-1.701.0/debian/changelog
>--- jasper-1.701.0/debian/changelog
>+++ jasper-1.701.0/debian/changelog
>@@ -1,3 +1,12 @@
>+jasper (1.701.0-2ubuntu0.7.04) feisty-security; urgency=low
>+
>+  * SECURITY UPDATE: code execution via crafted JPEG2000 images.
>+  * src/libjasper/jp2/{jp2_cod,jpc_cs,jpc_dec}.c: upstream fixes.
>+  * References
>+    CVE-2007-2721
>+
>+ -- Kees Cook <kees@ubuntu.com>  Mon, 20 Aug 2007 14:07:30 -0700
>+
> jasper (1.701.0-2) unstable; urgency=low
> 
>   * Prevent compression of pdf documents in binary packages
>only in patch2:
>unchanged:
>--- jasper-1.701.0.orig/src/libjasper/jp2/jp2_cod.c
>+++ jasper-1.701.0/src/libjasper/jp2/jp2_cod.c
>@@ -247,7 +247,7 @@
> 	box = 0;
> 	tmpstream = 0;
> 
>-	if (!(box = jas_malloc(sizeof(jp2_box_t)))) {
>+	if (!(box = jas_calloc(1, sizeof(jp2_box_t)))) {
> 		goto error;
> 	}
> 	box->ops = &jp2_boxinfo_unk.ops;
>only in patch2:
>unchanged:
>--- jasper-1.701.0.orig/src/libjasper/jpc/jpc_dec.c
>+++ jasper-1.701.0/src/libjasper/jpc/jpc_dec.c
>@@ -1207,7 +1207,7 @@
> 	dec->numhtiles = JPC_CEILDIV(dec->xend - dec->tilexoff, dec->tilewidth);
> 	dec->numvtiles = JPC_CEILDIV(dec->yend - dec->tileyoff, dec->tileheight);
> 	dec->numtiles = dec->numhtiles * dec->numvtiles;
>-	if (!(dec->tiles = jas_malloc(dec->numtiles * sizeof(jpc_dec_tile_t)))) {
>+	if (!(dec->tiles = jas_calloc(dec->numtiles, sizeof(jpc_dec_tile_t)))) {
> 		return -1;
> 	}
> 
>@@ -1231,7 +1231,7 @@
> 		tile->pkthdrstreampos = 0;
> 		tile->pptstab = 0;
> 		tile->cp = 0;
>-		if (!(tile->tcomps = jas_malloc(dec->numcomps *
>+		if (!(tile->tcomps = jas_calloc(dec->numcomps,
> 		  sizeof(jpc_dec_tcomp_t)))) {
> 			return -1;
> 		}
>only in patch2:
>unchanged:
>--- jasper-1.701.0.orig/src/libjasper/jpc/jpc_cs.c
>+++ jasper-1.701.0/src/libjasper/jpc/jpc_cs.c
>@@ -983,7 +983,10 @@
> 		compparms->numstepsizes = (len - n) / 2;
> 		break;
> 	}
>-if (compparms->numstepsizes > 0) {
>+if (compparms->numstepsizes > 3 * JPC_MAXRLVLS + 1) {
>+		jpc_qcx_destroycompparms(compparms);
>+                return -1;
>+        } else if (compparms->numstepsizes > 0) {
> 	compparms->stepsizes = jas_malloc(compparms->numstepsizes *
> 	  sizeof(uint_fast32_t));
> 	assert(compparms->stepsizes);

Actions: View | Diff

Attachments on bug 346501: 316091 | 316092 | 316093