diff --git a/LibRaw-0.18.9.tar.gz b/LibRaw-0.18.9.tar.gz deleted file mode 100644 index 79e3b8e..0000000 --- a/LibRaw-0.18.9.tar.gz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:d2ef177032e6d804fc512b206d02c393fca26be43ecd136cc26926407273b24e -size 1282015 diff --git a/LibRaw-0.19.0.tar.gz b/LibRaw-0.19.0.tar.gz new file mode 100644 index 0000000..4216777 --- /dev/null +++ b/LibRaw-0.19.0.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:e83f51e83b19f9ba6b8bd144475fc12edf2d7b3b930d8d280bdebd8a8f3ed259 +size 1300662 diff --git a/libraw-CVE-2018-10528.patch b/libraw-CVE-2018-10528.patch deleted file mode 100644 index 38bd8aa..0000000 --- a/libraw-CVE-2018-10528.patch +++ /dev/null @@ -1,37 +0,0 @@ -Index: LibRaw-0.18.9/src/libraw_cxx.cpp -=================================================================== ---- LibRaw-0.18.9.orig/src/libraw_cxx.cpp 2018-04-30 11:13:15.126021499 +0200 -+++ LibRaw-0.18.9/src/libraw_cxx.cpp 2018-04-30 11:16:43.677077398 +0200 -@@ -5484,17 +5484,18 @@ void x3f_clear(void *p) - x3f_delete((x3f_t*)p); - } - --static char *utf2char(utf16_t *str, char *buffer) -+void utf2char(utf16_t *str, char *buffer, unsigned bufsz) - { -+ if(bufsz<1) return; -+ buffer[bufsz-1] = 0; - char *b = buffer; - -- while (*str != 0x00) { -+ while (*str != 0x00 && --bufsz>0) { - char *chr = (char *)str; - *b++ = *chr; - str++; - } - *b = 0; -- return buffer; - } - - static void *lr_memmem(const void *l, size_t l_len, const void *s, size_t s_len) -@@ -5555,8 +5556,8 @@ void LibRaw::parse_x3f() - x3f_property_t *P = PL->property_table.element; - for (i=0; inum_properties; i++) { - char name[100], value[100]; -- utf2char(P[i].name,name); -- utf2char(P[i].value,value); -+ utf2char(P[i].name,name,sizeof(name)); -+ utf2char(P[i].value,value,sizeof(value)); - if (!strcmp (name, "ISO")) - imgdata.other.iso_speed = atoi(value); - if (!strcmp (name, "CAMMANUF")) diff --git a/libraw-CVE-2018-10529.patch b/libraw-CVE-2018-10529.patch deleted file mode 100644 index 4648adf..0000000 --- a/libraw-CVE-2018-10529.patch +++ /dev/null @@ -1,79 +0,0 @@ -Index: LibRaw-0.18.9/internal/libraw_x3f.cpp -=================================================================== ---- LibRaw-0.18.9.orig/internal/libraw_x3f.cpp 2018-04-24 16:23:24.000000000 +0200 -+++ LibRaw-0.18.9/internal/libraw_x3f.cpp 2018-04-30 11:35:17.477351409 +0200 -@@ -121,8 +121,6 @@ typedef struct x3f_property_s { - /* Computed */ - utf16_t *name; /* 0x0000 terminated UTF 16 */ - utf16_t *value; /* 0x0000 terminated UTF 16 */ -- char *name_utf8; /* converted to UTF 8 */ -- char *value_utf8; /* converted to UTF 8 */ - } x3f_property_t; - - typedef struct x3f_property_table_s { -@@ -516,7 +514,6 @@ unsigned x3f_get4(LibRaw_abstract_datast - int _cur = _file->_func(_buffer,1,_left); \ - if (_cur == 0) { \ - throw LIBRAW_EXCEPTION_IO_CORRUPT; \ -- exit(1); \ - } \ - _left -= _cur; \ - } \ -@@ -912,11 +909,6 @@ static void free_camf_entry(camf_entry_t - if (PL) - { - int i; -- -- for (i = 0; i < PL->property_table.size; i++) { -- FREE(PL->property_table.element[i].name_utf8); -- FREE(PL->property_table.element[i].value_utf8); -- } - } - FREE(PL->property_table.element); - FREE(PL->data); -@@ -1624,14 +1616,14 @@ static void x3f_load_property_list(x3f_i - - if (!PL->data_size) - PL->data_size = read_data_block(&PL->data, I, DE, 0); -+ uint32_t maxoffset = PL->data_size/sizeof(utf16_t)-2; // at least 2 chars, value + terminating 0x0000 - - for (i=0; inum_properties; i++) { - x3f_property_t *P = &PL->property_table.element[i]; -- -+ if(P->name_offset > maxoffset || P->value_offset > maxoffset) -+ throw LIBRAW_EXCEPTION_IO_CORRUPT; - P->name = ((utf16_t *)PL->data + P->name_offset); - P->value = ((utf16_t *)PL->data + P->value_offset); -- P->name_utf8 = 0;// utf16le_to_utf8(P->name); -- P->value_utf8 = 0;//utf16le_to_utf8(P->value); - } - } - -Index: LibRaw-0.18.9/src/libraw_cxx.cpp -=================================================================== ---- LibRaw-0.18.9.orig/src/libraw_cxx.cpp 2018-04-30 11:35:17.477351409 +0200 -+++ LibRaw-0.18.9/src/libraw_cxx.cpp 2018-04-30 11:38:21.568048079 +0200 -@@ -5551,13 +5551,21 @@ void LibRaw::parse_x3f() - // Parse property list - DEH = &DE->header; - x3f_property_list_t *PL = &DEH->data_subsection.property_list; -+ utf16_t *datap = (utf16_t*) PL->data; -+ uint32_t maxitems = PL->data_size/sizeof(utf16_t); - if (PL->property_table.size != 0) { - int i; - x3f_property_t *P = PL->property_table.element; - for (i=0; inum_properties; i++) { - char name[100], value[100]; -- utf2char(P[i].name,name,sizeof(name)); -- utf2char(P[i].value,value,sizeof(value)); -+ int noffset = (P[i].name - datap); -+ int voffset = (P[i].value - datap); -+ if(noffset < 0 || noffset>maxitems || voffset<0 || voffset>maxitems) -+ throw LIBRAW_EXCEPTION_IO_CORRUPT; -+ int maxnsize = maxitems - (P[i].name - datap); -+ int maxvsize = maxitems - (P[i].value - datap); -+ utf2char(P[i].name, name,MIN(maxnsize,sizeof(name))); -+ utf2char(P[i].value, value,MIN(maxvsize,sizeof(value))); - if (!strcmp (name, "ISO")) - imgdata.other.iso_speed = atoi(value); - if (!strcmp (name, "CAMMANUF")) diff --git a/libraw.changes b/libraw.changes index a42e896..433b1fa 100644 --- a/libraw.changes +++ b/libraw.changes @@ -1,3 +1,13 @@ +------------------------------------------------------------------- +Wed Aug 1 10:13:46 UTC 2018 - pgajdos@suse.com + +- new upstream branch, version 0.19.x + * fixes CVE-2018-10529 and CVE-2018-10528, hence removing + . libraw-CVE-2018-10528.patch + . libraw-CVE-2018-10529.patch + * the rest of changes at + https://www.libraw.org/download#stable + ------------------------------------------------------------------- Mon Apr 30 09:18:00 UTC 2018 - pgajdos@suse.com diff --git a/libraw.spec b/libraw.spec index bd1a827..2448db1 100644 --- a/libraw.spec +++ b/libraw.spec @@ -17,10 +17,10 @@ %define tar_name LibRaw -%define lver 16 +%define lver 19 %define lname libraw%{lver} Name: libraw -Version: 0.18.9 +Version: 0.19.0 Release: 0 Summary: Library for reading RAW files obtained from digital photo cameras License: CDDL-1.0 OR LGPL-2.1-only @@ -28,8 +28,6 @@ Group: Development/Libraries/C and C++ Url: https://www.libraw.org/ #Git-Clone: git://github.com/LibRaw/LibRaw Source: https://www.libraw.org/data/%tar_name-%version.tar.gz -Patch0: libraw-CVE-2018-10528.patch -Patch1: libraw-CVE-2018-10529.patch BuildRequires: fdupes BuildRequires: gcc-c++ BuildRequires: libjasper-devel @@ -97,8 +95,6 @@ against LibRaw. LibRaw does not provide dynamic libraries. %prep %setup -qn %tar_name-%version -%patch0 -p1 -%patch1 -p1 %build export CXXFLAGS="%optflags -fPIC -DUSE_ZLIB"