aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages/patches
diff options
context:
space:
mode:
authorMark H Weaver <mhw@netris.org>2015-10-02 12:30:41 -0400
committerMark H Weaver <mhw@netris.org>2015-10-02 12:33:26 -0400
commitb927058237a36b3bd870cff50a4107bfd4a39e41 (patch)
tree3b0ddc7d6ef7f5fb72413a81f9a3b819fb1ff1a8 /gnu/packages/patches
parent9ab5ea449e3bb048f6ff456e20616f3f9a24c34f (diff)
downloadguix-b927058237a36b3bd870cff50a4107bfd4a39e41.tar
guix-b927058237a36b3bd870cff50a4107bfd4a39e41.tar.gz
gnu: openjpeg-2.x: Add fix for use-after-free in opj_j2k_write_mco.
* gnu/packages/patches/openjpeg-use-after-free-fix.patch: New file. * gnu-system.am (dist_patch_DATA): Add it. * gnu/packages/image.scm (openjpeg, openjpeg-2.0)[source]: Add patch. [home-page]: Update.
Diffstat (limited to 'gnu/packages/patches')
-rw-r--r--gnu/packages/patches/openjpeg-use-after-free-fix.patch48
1 files changed, 48 insertions, 0 deletions
diff --git a/gnu/packages/patches/openjpeg-use-after-free-fix.patch b/gnu/packages/patches/openjpeg-use-after-free-fix.patch
new file mode 100644
index 0000000000..1a9cb1ae1d
--- /dev/null
+++ b/gnu/packages/patches/openjpeg-use-after-free-fix.patch
@@ -0,0 +1,48 @@
+From 940100c28ae28931722290794889cf84a92c5f6f Mon Sep 17 00:00:00 2001
+From: mayeut <mayeut@users.noreply.github.com>
+Date: Sun, 6 Sep 2015 17:24:03 +0200
+Subject: [PATCH] Fix potential use-after-free in opj_j2k_write_mco function
+
+Fixes #563
+---
+ src/lib/openjp2/j2k.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c
+index 19a48f5..d487d89 100644
+--- a/src/lib/openjp2/j2k.c
++++ b/src/lib/openjp2/j2k.c
+@@ -5559,8 +5559,7 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k,
+ assert(p_stream != 00);
+
+ l_tcp =&(p_j2k->m_cp.tcps[p_j2k->m_current_tile_number]);
+- l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data;
+-
++
+ l_mco_size = 5 + l_tcp->m_nb_mcc_records;
+ if (l_mco_size > p_j2k->m_specific_param.m_encoder.m_header_tile_data_size) {
+
+@@ -5575,6 +5574,8 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k,
+ p_j2k->m_specific_param.m_encoder.m_header_tile_data = new_header_tile_data;
+ p_j2k->m_specific_param.m_encoder.m_header_tile_data_size = l_mco_size;
+ }
++ l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data;
++
+
+ opj_write_bytes(l_current_data,J2K_MS_MCO,2); /* MCO */
+ l_current_data += 2;
+@@ -5586,10 +5587,9 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k,
+ ++l_current_data;
+
+ l_mcc_record = l_tcp->m_mcc_records;
+- for (i=0;i<l_tcp->m_nb_mcc_records;++i) {
++ for (i=0;i<l_tcp->m_nb_mcc_records;++i) {
+ opj_write_bytes(l_current_data,l_mcc_record->m_index,1);/* Imco -> use the mcc indicated by 1*/
+ ++l_current_data;
+-
+ ++l_mcc_record;
+ }
+
+--
+2.5.0
+