From f532ff0fef11f95fd982e84b6647cab6790913b9 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Mon, 29 Jun 2026 23:06:00 +0200 Subject: [PATCH] package/openjpeg: add upstream patch for CVE-2026-6192 - CVE-2026-6192: A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-6192 - https://github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65068951 Signed-off-by: Thomas Perale Signed-off-by: Fiona Klute (cherry picked from commit 353007cf40f3fc68e1cb2b8878d30f5cdc40ac6a) Signed-off-by: Thomas Perale --- ...ng-to-insufficient-memory-allocation.patch | 35 +++++++++++++++++++ package/openjpeg/openjpeg.mk | 3 ++ 2 files changed, 38 insertions(+) create mode 100644 package/openjpeg/0001-opj-pi-initialise-encode-avoid-potential-integer-overflow-leading-to-insufficient-memory-allocation.patch diff --git a/package/openjpeg/0001-opj-pi-initialise-encode-avoid-potential-integer-overflow-leading-to-insufficient-memory-allocation.patch b/package/openjpeg/0001-opj-pi-initialise-encode-avoid-potential-integer-overflow-leading-to-insufficient-memory-allocation.patch new file mode 100644 index 0000000000..de5c925ec0 --- /dev/null +++ b/package/openjpeg/0001-opj-pi-initialise-encode-avoid-potential-integer-overflow-leading-to-insufficient-memory-allocation.patch @@ -0,0 +1,35 @@ +From 839936aa33eb8899bbbd80fda02796bb65068951 Mon Sep 17 00:00:00 2001 +From: Even Rouault +Date: Sun, 5 Apr 2026 13:25:27 +0200 +Subject: [PATCH] opj_pi_initialise_encode() (write code path): avoid potential + integer overflow leading to insufficient memory allocation + +Fixes #1619 + +CVE: CVE-2026-6192 +Upstream: https://github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65068951 +Signed-off-by: Thomas Perale +--- + src/lib/openjp2/pi.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/src/lib/openjp2/pi.c b/src/lib/openjp2/pi.c +index 15ac33142..4abb87af2 100644 +--- a/src/lib/openjp2/pi.c ++++ b/src/lib/openjp2/pi.c +@@ -1694,9 +1694,12 @@ opj_pi_iterator_t *opj_pi_initialise_encode(const opj_image_t *p_image, + l_current_pi = l_pi; + + /* memory allocation for include*/ +- l_current_pi->include_size = l_tcp->numlayers * l_step_l; +- l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size, +- sizeof(OPJ_INT16)); ++ l_current_pi->include = NULL; ++ if (l_step_l <= UINT_MAX / l_tcp->numlayers) { ++ l_current_pi->include_size = l_tcp->numlayers * l_step_l; ++ l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size, ++ sizeof(OPJ_INT16)); ++ } + if (!l_current_pi->include) { + opj_free(l_tmp_data); + opj_free(l_tmp_ptr); diff --git a/package/openjpeg/openjpeg.mk b/package/openjpeg/openjpeg.mk index bc5d8143a6..7ded900856 100644 --- a/package/openjpeg/openjpeg.mk +++ b/package/openjpeg/openjpeg.mk @@ -11,6 +11,9 @@ OPENJPEG_LICENSE_FILES = LICENSE OPENJPEG_CPE_ID_VENDOR = uclouvain OPENJPEG_INSTALL_STAGING = YES +# 0001-opj-pi-initialise-encode-avoid-potential-integer-overflow-leading-to-insufficient-memory-allocation.patch +OPENJPEG_IGNORE_CVES += CVE-2026-6192 + OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_ZLIB),zlib) OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_LIBPNG),libpng) OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_TIFF),tiff)