From: Nicolas Serafini Date: Mon, 13 Jul 2020 10:25:13 +0000 (+0200) Subject: package/exiv2: bump version to 0.27.3 X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=f0ace38f6bdfe35f1e43fc4e67ec8af3ccfa15bc;p=buildroot.git package/exiv2: bump version to 0.27.3 Bump version 0.27.3 and remove 0001[1] and 0002[2] local patches that has been upstreamed. Release notes: https://github.com/Exiv2/exiv2/blob/v0.27.3/releasenotes/releasenotes.txt [1]: https://github.com/Exiv2/exiv2/commit/b7890776c62398ca1005e8edc32786859d60fcf7 [2]: https://github.com/Exiv2/exiv2/commit/1b917c3f7dd86336a9f6fda4456422c419dfe88c Signed-off-by: Nicolas Serafini Signed-off-by: Thomas Petazzoni --- diff --git a/package/exiv2/0001-crwimage-Check-offset-and-size-against-total-size.patch b/package/exiv2/0001-crwimage-Check-offset-and-size-against-total-size.patch deleted file mode 100644 index f26006e3a5..0000000000 --- a/package/exiv2/0001-crwimage-Check-offset-and-size-against-total-size.patch +++ /dev/null @@ -1,32 +0,0 @@ -From b7890776c62398ca1005e8edc32786859d60fcf7 Mon Sep 17 00:00:00 2001 -From: Jens Georg -Date: Sun, 6 Oct 2019 15:05:20 +0200 -Subject: [PATCH] crwimage: Check offset and size against total size - -Corrupted or specially crafted CRW images might exceed the overall -buffersize. - -Fixes #1019 - -(cherry picked from commit 683451567284005cd24e1ccb0a76ca401000968b) -[Retrieved (and slightly updated to keep only the fix) from: -https://github.com/Exiv2/exiv2/commit/50e9dd964a439da357798344ed1dd86edcadf0ec] -Signed-off-by: Fabrice Fontaine ---- - src/crwimage_int.cpp | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/src/crwimage_int.cpp b/src/crwimage_int.cpp -index 29311fdb7..c0d955350 100644 ---- a/src/crwimage_int.cpp -+++ b/src/crwimage_int.cpp -@@ -268,6 +268,9 @@ namespace Exiv2 { - #ifdef EXIV2_DEBUG_MESSAGES - std::cout << "Reading directory 0x" << std::hex << tag() << "\n"; - #endif -+ if (this->offset() + this->size() > size) -+ throw Error(kerOffsetOutOfRange); -+ - readDirectory(pData + offset(), this->size(), byteOrder); - #ifdef EXIV2_DEBUG_MESSAGES - std::cout << "<---- 0x" << std::hex << tag() << "\n"; diff --git a/package/exiv2/0002-fix_1011_jp2_readmetadata_loop.patch b/package/exiv2/0002-fix_1011_jp2_readmetadata_loop.patch deleted file mode 100644 index 400bf342ce..0000000000 --- a/package/exiv2/0002-fix_1011_jp2_readmetadata_loop.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 1b917c3f7dd86336a9f6fda4456422c419dfe88c Mon Sep 17 00:00:00 2001 -From: clanmills -Date: Tue, 1 Oct 2019 17:39:44 +0100 -Subject: [PATCH] Fix #1011 fix_1011_jp2_readmetadata_loop - -[Retrieved (and slighlty updated to keep only the fix) from: -https://github.com/Exiv2/exiv2/commit/a82098f4f90cd86297131b5663c3dec6a34470e8] -Signed-off-by: Fabrice Fontaine ---- - src/jp2image.cpp | 25 +++++++++++++++---- - test/data/Jp2Image_readMetadata_loop.poc | Bin 0 -> 738 bytes - tests/bugfixes/github/test_CVE_2017_17725.py | 4 +-- - tests/bugfixes/github/test_issue_1011.py | 13 ++++++++++ - 4 files changed, 35 insertions(+), 7 deletions(-) - create mode 100755 test/data/Jp2Image_readMetadata_loop.poc - create mode 100644 tests/bugfixes/github/test_issue_1011.py - -diff --git a/src/jp2image.cpp b/src/jp2image.cpp -index d5cd1340a..0de088d62 100644 ---- a/src/jp2image.cpp -+++ b/src/jp2image.cpp -@@ -18,10 +18,6 @@ - * Foundation, Inc., 51 Franklin Street, 5th Floor, Boston, MA 02110-1301 USA. - */ - --/* -- File: jp2image.cpp --*/ -- - // ***************************************************************************** - - // included header files -@@ -197,6 +193,16 @@ namespace Exiv2 - return result; - } - -+static void boxes_check(size_t b,size_t m) -+{ -+ if ( b > m ) { -+#ifdef EXIV2_DEBUG_MESSAGES -+ std::cout << "Exiv2::Jp2Image::readMetadata box maximum exceeded" << std::endl; -+#endif -+ throw Error(kerCorruptedMetadata); -+ } -+} -+ - void Jp2Image::readMetadata() - { - #ifdef EXIV2_DEBUG_MESSAGES -@@ -219,9 +225,12 @@ namespace Exiv2 - Jp2BoxHeader subBox = {0,0}; - Jp2ImageHeaderBox ihdr = {0,0,0,0,0,0,0,0}; - Jp2UuidBox uuid = {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}}; -+ size_t boxes = 0 ; -+ size_t boxem = 1000 ; // boxes max - - while (io_->read((byte*)&box, sizeof(box)) == sizeof(box)) - { -+ boxes_check(boxes++,boxem ); - position = io_->tell(); - box.length = getLong((byte*)&box.length, bigEndian); - box.type = getLong((byte*)&box.type, bigEndian); -@@ -251,8 +260,12 @@ namespace Exiv2 - - while (io_->read((byte*)&subBox, sizeof(subBox)) == sizeof(subBox) && subBox.length ) - { -+ boxes_check(boxes++, boxem) ; - subBox.length = getLong((byte*)&subBox.length, bigEndian); - subBox.type = getLong((byte*)&subBox.type, bigEndian); -+ if (subBox.length > io_->size() ) { -+ throw Error(kerCorruptedMetadata); -+ } - #ifdef EXIV2_DEBUG_MESSAGES - std::cout << "Exiv2::Jp2Image::readMetadata: " - << "subBox = " << toAscii(subBox.type) << " length = " << subBox.length << std::endl; -@@ -308,7 +321,9 @@ namespace Exiv2 - } - - io_->seek(restore,BasicIo::beg); -- io_->seek(subBox.length, Exiv2::BasicIo::cur); -+ if ( io_->seek(subBox.length, Exiv2::BasicIo::cur) != 0 ) { -+ throw Error(kerCorruptedMetadata); -+ } - restore = io_->tell(); - } - break; diff --git a/package/exiv2/exiv2.hash b/package/exiv2/exiv2.hash index 7937d3f572..94ab4ac638 100644 --- a/package/exiv2/exiv2.hash +++ b/package/exiv2/exiv2.hash @@ -1,4 +1,3 @@ # Locally calculated -sha256 3dbcaf01fbc5b98d42f091d1ff0d4b6cd9750dc724de3d9c0d113948570b2934 exiv2-0.27.2.tar.gz +sha256 6398bc743c32b85b2cb2a604273b8c90aa4eb0fd7c1700bf66cbb2712b4f00c1 exiv2-0.27.3.tar.gz sha256 a7ba75cb966aca374711e2af49e5f3aea6a4443a803440f5d93e73a5a1222f66 COPYING -sha256 46cde7dc11e64c78d650b4851b88f6704b4665ff60f22a1caf68ceb15e217e5b COPYING-CMAKE-SCRIPTS diff --git a/package/exiv2/exiv2.mk b/package/exiv2/exiv2.mk index 5ca16c4747..7f38473609 100644 --- a/package/exiv2/exiv2.mk +++ b/package/exiv2/exiv2.mk @@ -4,22 +4,11 @@ # ################################################################################ -EXIV2_VERSION = 0.27.2 +EXIV2_VERSION = 0.27.3 EXIV2_SITE = $(call github,Exiv2,exiv2,v$(EXIV2_VERSION)) EXIV2_INSTALL_STAGING = YES -EXIV2_LICENSE = GPL-2.0+, BSD-3-Clause -EXIV2_LICENSE_FILES = COPYING COPYING-CMAKE-SCRIPTS - -# CVE-2019-13504 is misclassified (by our CVE tracker) as affecting version -# 0.27.2, while in fact both commits that fixed this issue are already in this -# version. -EXIV2_IGNORE_CVES += CVE-2019-13504 - -# 0001-crwimage-Check-offset-and-size-against-total-size.patch -EXIV2_IGNORE_CVES += CVE-2019-17402 - -# 0002-fix_1011_jp2_readmetadata_loop.patch -EXIV2_IGNORE_CVES += CVE-2019-20421 +EXIV2_LICENSE = GPL-2.0+ +EXIV2_LICENSE_FILES = COPYING EXIV2_CONF_OPTS += -DEXIV2_ENABLE_BUILD_SAMPLES=OFF