Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 13 Aug 2018 20:31:34 +0000 (UTC)
From:      Mahdi Mokhtari <mmokhi@FreeBSD.org>
To:        ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org
Subject:   svn commit: r477112 - in head/graphics/openjpeg: . files
Message-ID:  <201808132031.w7DKVYoX067949@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: mmokhi
Date: Mon Aug 13 20:31:33 2018
New Revision: 477112
URL: https://svnweb.freebsd.org/changeset/ports/477112

Log:
  graphics/openjpeg: Fix CVE-2017-14041
  The port had 5 CVEs reported in
  vuxml entry < http://www.vuxml.org/freebsd/11dc3890-0e64-11e8-99b0-d017c2987f9a.html >.
  These patches are fix for CVE-2017-1404
  
  Reported by:	Philip Jocks <pj@netzkommune.de>
  Approved by:	sunpoet (maintainer)
  Sponsored by:	The FreeBSD Foundation
  Differential Revision:	https://reviews.freebsd.org/D16685

Added:
  head/graphics/openjpeg/files/
  head/graphics/openjpeg/files/patch-src_bin_jp3d_convert.c   (contents, props changed)
  head/graphics/openjpeg/files/patch-src_bin_jpwl_convert.c   (contents, props changed)
Modified:
  head/graphics/openjpeg/Makefile

Modified: head/graphics/openjpeg/Makefile
==============================================================================
--- head/graphics/openjpeg/Makefile	Mon Aug 13 20:26:05 2018	(r477111)
+++ head/graphics/openjpeg/Makefile	Mon Aug 13 20:31:33 2018	(r477112)
@@ -3,6 +3,7 @@
 
 PORTNAME=	openjpeg
 PORTVERSION=	2.3.0
+PORTREVISION=	1
 DISTVERSIONPREFIX=	v
 CATEGORIES=	graphics
 

Added: head/graphics/openjpeg/files/patch-src_bin_jp3d_convert.c
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/graphics/openjpeg/files/patch-src_bin_jp3d_convert.c	Mon Aug 13 20:31:33 2018	(r477112)
@@ -0,0 +1,11 @@
+--- src/bin/jp3d/convert.c.orig	2018-08-02 17:40:37 UTC
++++ src/bin/jp3d/convert.c
+@@ -297,7 +297,7 @@ opj_volume_t* pgxtovolume(char *relpath,
+         fprintf(stdout, "[INFO] Loading %s \n", pgxfiles[pos]);
+ 
+         fseek(f, 0, SEEK_SET);
+-        fscanf(f, "PG%[ \t]%c%c%[ \t+-]%d%[ \t]%d%[ \t]%d", temp, &endian1, &endian2,
++        fscanf(f, "PG%31[ \t]%c%c%31[ \t+-]%d%31[ \t]%d%31[ \t]%d", temp, &endian1, &endian2
+                signtmp, &prec, temp, &w, temp, &h);
+ 
+         i = 0;

Added: head/graphics/openjpeg/files/patch-src_bin_jpwl_convert.c
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/graphics/openjpeg/files/patch-src_bin_jpwl_convert.c	Mon Aug 13 20:31:33 2018	(r477112)
@@ -0,0 +1,11 @@
+--- src/bin/jpwl/convert.c.orig	2018-08-02 17:47:37 UTC
++++ src/bin/jpwl/convert.c
+@@ -1348,7 +1348,7 @@ opj_image_t* pgxtoimage(const char *file
+     }
+ 
+     fseek(f, 0, SEEK_SET);
+-    if (fscanf(f, "PG%[ \t]%c%c%[ \t+-]%d%[ \t]%d%[ \t]%d", temp, &endian1,
++    if (fscanf(f, "PG%31[ \t]%c%c%31[ \t+-]%d%31[ \t]%d%31[ \t]%d", temp, &endian1,
+                &endian2, signtmp, &prec, temp, &w, temp, &h) != 9) {
+         fprintf(stderr,
+                 "ERROR: Failed to read the right number of element from the fscanf() function!\n");

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201808132031.w7DKVYoX067949>