From 63c2dd2d40186ca6817a5be122a2ba78033f3cfc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20M=C3=A9lotte?= Date: Mon, 10 Mar 2025 11:08:40 +0000 Subject: [PATCH] package/jbig2dec: add upstream security fix for CVE-2023-46361 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes the following security issue: CVE-2023-46361: Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c. https://www.cve.org/CVERecord?id=CVE-2023-46361 Note that jbig2dec version 0.19 (used in Buildroot 2024.02.11) is not officially listed as affected, but it actually has the same bug. Also note that this CVE is about a crash in the CLI tool only. Signed-off-by: Raphaël Mélotte [Julien: add JBIG2DEC_IGNORE_CVES] Signed-off-by: Julien Olivain --- ...dec-Avoid-uninitialized-allocator-in.patch | 28 +++++++++++++++++++ package/jbig2dec/jbig2dec.mk | 3 ++ 2 files changed, 31 insertions(+) create mode 100644 package/jbig2dec/0001-Bug-705041-jbig2dec-Avoid-uninitialized-allocator-in.patch diff --git a/package/jbig2dec/0001-Bug-705041-jbig2dec-Avoid-uninitialized-allocator-in.patch b/package/jbig2dec/0001-Bug-705041-jbig2dec-Avoid-uninitialized-allocator-in.patch new file mode 100644 index 0000000000..8331d5f2a4 --- /dev/null +++ b/package/jbig2dec/0001-Bug-705041-jbig2dec-Avoid-uninitialized-allocator-in.patch @@ -0,0 +1,28 @@ +From e60a9f388bd5655cb514491ef8d55d403aef0773 Mon Sep 17 00:00:00 2001 +From: Sebastian Rasmussen +Date: Sun, 5 Nov 2023 12:21:52 +0100 +Subject: [PATCH] Bug 705041: jbig2dec: Avoid uninitialized allocator in + command-line tool. + +Upstream: https://github.com/ArtifexSoftware/jbig2dec/commit/ee53a7e4bc7819d32e8c0b2057885bcc97586bf3 +Signed-off-by: Raphaël Mélotte +--- + jbig2dec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/jbig2dec.c b/jbig2dec.c +index 15d204d..1e1dad8 100644 +--- a/jbig2dec.c ++++ b/jbig2dec.c +@@ -567,7 +567,7 @@ main(int argc, char **argv) + { + jbig2dec_params_t params; + jbig2dec_error_callback_state_t error_callback_state; +- jbig2dec_allocator_t allocator_; ++ jbig2dec_allocator_t allocator_ = { 0 }; + jbig2dec_allocator_t *allocator = &allocator_; + Jbig2Ctx *ctx = NULL; + FILE *f = NULL, *f_page = NULL; +-- +2.48.1 + diff --git a/package/jbig2dec/jbig2dec.mk b/package/jbig2dec/jbig2dec.mk index 8509a609c4..6b5d18785a 100644 --- a/package/jbig2dec/jbig2dec.mk +++ b/package/jbig2dec/jbig2dec.mk @@ -12,4 +12,7 @@ JBIG2DEC_LICENSE_FILES = LICENSE JBIG2DEC_CPE_ID_VENDOR = artifex JBIG2DEC_INSTALL_STAGING = YES +# 0001-Bug-705041-jbig2dec-Avoid-uninitialized-allocator-in.patch +JBIG2DEC_IGNORE_CVES += CVE-2023-46361 + $(eval $(autotools-package))