mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 00:20:38 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/openjpeg: add upstream patch for CVE-2026-6192

Browse Source 
- CVE-2026-6192:
    A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This
    impacts the function opj_pi_initialise_encode in the library
    src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The
    attack must be carried out locally. The exploit is publicly available
    and might be used. The identifier of the patch is
    839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a
    patch to address this issue.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-6192
  - 839936aa33

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 353007cf40)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2026-06-29 23:06:00 +02:00
parent 2723abb9f4
commit f532ff0fef
2 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
package/openjpeg/0001-opj-pi-initialise-encode-avoid-potential-integer-overflow-leading-to-insufficient-memory-allocation.patch Normal file
View File

@@ -0,0 +1,35 @@
From 839936aa33eb8899bbbd80fda02796bb65068951 Mon Sep 17 00:00:00 2001
From: Even Rouault <even.rouault@spatialys.com>
Date: Sun, 5 Apr 2026 13:25:27 +0200
Subject: [PATCH] opj_pi_initialise_encode() (write code path): avoid potential
integer overflow leading to insufficient memory allocation
Fixes #1619
CVE: CVE-2026-6192
Upstream: https://github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65068951
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
src/lib/openjp2/pi.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/src/lib/openjp2/pi.c b/src/lib/openjp2/pi.c
index 15ac33142..4abb87af2 100644
--- a/src/lib/openjp2/pi.c
+++ b/src/lib/openjp2/pi.c
@@ -1694,9 +1694,12 @@ opj_pi_iterator_t *opj_pi_initialise_encode(const opj_image_t *p_image,
l_current_pi = l_pi;
/* memory allocation for include*/
- l_current_pi->include_size = l_tcp->numlayers * l_step_l;
- l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size,
- sizeof(OPJ_INT16));
+ l_current_pi->include = NULL;
+ if (l_step_l <= UINT_MAX / l_tcp->numlayers) {
+ l_current_pi->include_size = l_tcp->numlayers * l_step_l;
+ l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size,
+ sizeof(OPJ_INT16));
+ }
if (!l_current_pi->include) {
opj_free(l_tmp_data);
opj_free(l_tmp_ptr);

3
package/openjpeg/openjpeg.mk
View File

@@ -11,6 +11,9 @@ OPENJPEG_LICENSE_FILES = LICENSE
OPENJPEG_CPE_ID_VENDOR = uclouvain
OPENJPEG_INSTALL_STAGING = YES
# 0001-opj-pi-initialise-encode-avoid-potential-integer-overflow-leading-to-insufficient-memory-allocation.patch
OPENJPEG_IGNORE_CVES += CVE-2026-6192
OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_ZLIB),zlib)
OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_LIBPNG),libpng)
OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_TIFF),tiff)