Control: tags 772036 + patch Control: tags 772036 + pending Hi Roland,
I've prepared an NMU for jasper (versioned as 1.900.1-debian1-2.2) and uploaded it to DELAYED/2, with the same patch used for the DSA. Are you working on an update yourself? Let me know if so, so I will remove my upload from the delayed queue. If you are fine with my upload, I would gladly move it forward directly to the archive to get the fix sooner for jessie. Regards, Salvatore
diff -Nru jasper-1.900.1-debian1/debian/changelog jasper-1.900.1-debian1/debian/changelog --- jasper-1.900.1-debian1/debian/changelog 2014-09-30 15:54:59.000000000 +0200 +++ jasper-1.900.1-debian1/debian/changelog 2014-12-05 08:59:32.000000000 +0100 @@ -1,3 +1,12 @@ +jasper (1.900.1-debian1-2.2) unstable; urgency=high + + * Non-maintainer upload. + * Add 04-CVE-2014-9029.patch patch. + CVE-2014-9029: incorrect component number check in COC, RGN and QCC + marker segment decoders. (Closes: #772036) + + -- Salvatore Bonaccorso <car...@debian.org> Fri, 05 Dec 2014 08:39:16 +0100 + jasper (1.900.1-debian1-2.1) unstable; urgency=medium * Non-maintainer upload (acked by maintainer) diff -Nru jasper-1.900.1-debian1/debian/patches/04-CVE-2014-9029.patch jasper-1.900.1-debian1/debian/patches/04-CVE-2014-9029.patch --- jasper-1.900.1-debian1/debian/patches/04-CVE-2014-9029.patch 1970-01-01 01:00:00.000000000 +0100 +++ jasper-1.900.1-debian1/debian/patches/04-CVE-2014-9029.patch 2014-12-05 08:59:32.000000000 +0100 @@ -0,0 +1,38 @@ +Description: CVE-2014-9029: Heap overflows in libjasper +Origin: vendor, https://bugzilla.redhat.com/attachment.cgi?id=961994&action=diff +Bug-Debian: https://bugs.debian.org/772036 +Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1167537 +Forwarded: no +Author: Tomas Hoger <tho...@redhat.com> +Reviewed-by: Salvatore Bonaccorso <car...@debian.org> +Last-Update: 2014-11-28 + +--- a/src/libjasper/jpc/jpc_dec.c ++++ b/src/libjasper/jpc/jpc_dec.c +@@ -1280,7 +1280,7 @@ static int jpc_dec_process_coc(jpc_dec_t + jpc_coc_t *coc = &ms->parms.coc; + jpc_dec_tile_t *tile; + +- if (JAS_CAST(int, coc->compno) > dec->numcomps) { ++ if (JAS_CAST(int, coc->compno) >= dec->numcomps) { + jas_eprintf("invalid component number in COC marker segment\n"); + return -1; + } +@@ -1306,7 +1306,7 @@ static int jpc_dec_process_rgn(jpc_dec_t + jpc_rgn_t *rgn = &ms->parms.rgn; + jpc_dec_tile_t *tile; + +- if (JAS_CAST(int, rgn->compno) > dec->numcomps) { ++ if (JAS_CAST(int, rgn->compno) >= dec->numcomps) { + jas_eprintf("invalid component number in RGN marker segment\n"); + return -1; + } +@@ -1355,7 +1355,7 @@ static int jpc_dec_process_qcc(jpc_dec_t + jpc_qcc_t *qcc = &ms->parms.qcc; + jpc_dec_tile_t *tile; + +- if (JAS_CAST(int, qcc->compno) > dec->numcomps) { ++ if (JAS_CAST(int, qcc->compno) >= dec->numcomps) { + jas_eprintf("invalid component number in QCC marker segment\n"); + return -1; + } diff -Nru jasper-1.900.1-debian1/debian/patches/series jasper-1.900.1-debian1/debian/patches/series --- jasper-1.900.1-debian1/debian/patches/series 2014-09-30 15:54:59.000000000 +0200 +++ jasper-1.900.1-debian1/debian/patches/series 2014-12-05 08:59:32.000000000 +0100 @@ -1,3 +1,4 @@ 01-misc-fixes.patch 02-fix-filename-buffer-overflow.patch 03-CVE-2011-4516-and-CVE-2011-4517.patch +04-CVE-2014-9029.patch
