pool/libraw
SHA256
4
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

- new upstream branch, version 0.19.x

Browse Source 
* fixes CVE-2018-10529 and CVE-2018-10528, hence removing
    . libraw-CVE-2018-10528.patch
    . libraw-CVE-2018-10529.patch
  * the rest of changes at
    https://www.libraw.org/download#stable

OBS-URL: https://build.opensuse.org/package/show/graphics/libraw?expand=0&rev=115
This commit is contained in:
Petr Gajdos 2018-08-01 10:16:21 +00:00 committed by Git OBS Bridge
parent 8834ddc7f5
commit bf698e2497
6 changed files with 15 additions and 125 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
LibRaw-0.18.9.tar.gz
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:d2ef177032e6d804fc512b206d02c393fca26be43ecd136cc26926407273b24e
size 1282015

3
LibRaw-0.19.0.tar.gz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:e83f51e83b19f9ba6b8bd144475fc12edf2d7b3b930d8d280bdebd8a8f3ed259
size 1300662

37
libraw-CVE-2018-10528.patch
View File

@ -1,37 +0,0 @@
Index: LibRaw-0.18.9/src/libraw_cxx.cpp
===================================================================
--- LibRaw-0.18.9.orig/src/libraw_cxx.cpp 2018-04-30 11:13:15.126021499 +0200
+++ LibRaw-0.18.9/src/libraw_cxx.cpp 2018-04-30 11:16:43.677077398 +0200
@@ -5484,17 +5484,18 @@ void x3f_clear(void *p)
x3f_delete((x3f_t*)p);
}
-static char *utf2char(utf16_t *str, char *buffer)
+void utf2char(utf16_t *str, char *buffer, unsigned bufsz)
{
+ if(bufsz<1) return;
+ buffer[bufsz-1] = 0;
char *b = buffer;
- while (*str != 0x00) {
+ while (*str != 0x00 && --bufsz>0) {
char *chr = (char *)str;
*b++ = *chr;
str++;
}
*b = 0;
- return buffer;
}
static void *lr_memmem(const void *l, size_t l_len, const void *s, size_t s_len)
@@ -5555,8 +5556,8 @@ void LibRaw::parse_x3f()
x3f_property_t *P = PL->property_table.element;
for (i=0; i<PL->num_properties; i++) {
char name[100], value[100];
- utf2char(P[i].name,name);
- utf2char(P[i].value,value);
+ utf2char(P[i].name,name,sizeof(name));
+ utf2char(P[i].value,value,sizeof(value));
if (!strcmp (name, "ISO"))
imgdata.other.iso_speed = atoi(value);
if (!strcmp (name, "CAMMANUF"))

79
libraw-CVE-2018-10529.patch
View File

@ -1,79 +0,0 @@
Index: LibRaw-0.18.9/internal/libraw_x3f.cpp
===================================================================
--- LibRaw-0.18.9.orig/internal/libraw_x3f.cpp 2018-04-24 16:23:24.000000000 +0200
+++ LibRaw-0.18.9/internal/libraw_x3f.cpp 2018-04-30 11:35:17.477351409 +0200
@@ -121,8 +121,6 @@ typedef struct x3f_property_s {
/* Computed */
utf16_t *name; /* 0x0000 terminated UTF 16 */
utf16_t *value; /* 0x0000 terminated UTF 16 */
- char *name_utf8; /* converted to UTF 8 */
- char *value_utf8; /* converted to UTF 8 */
} x3f_property_t;
typedef struct x3f_property_table_s {
@@ -516,7 +514,6 @@ unsigned x3f_get4(LibRaw_abstract_datast
int _cur = _file->_func(_buffer,1,_left); \
if (_cur == 0) { \
throw LIBRAW_EXCEPTION_IO_CORRUPT; \
- exit(1); \
} \
_left -= _cur; \
} \
@@ -912,11 +909,6 @@ static void free_camf_entry(camf_entry_t
if (PL)
{
int i;
-
- for (i = 0; i < PL->property_table.size; i++) {
- FREE(PL->property_table.element[i].name_utf8);
- FREE(PL->property_table.element[i].value_utf8);
- }
}
FREE(PL->property_table.element);
FREE(PL->data);
@@ -1624,14 +1616,14 @@ static void x3f_load_property_list(x3f_i
if (!PL->data_size)
PL->data_size = read_data_block(&PL->data, I, DE, 0);
+ uint32_t maxoffset = PL->data_size/sizeof(utf16_t)-2; // at least 2 chars, value + terminating 0x0000
for (i=0; i<PL->num_properties; i++) {
x3f_property_t *P = &PL->property_table.element[i];
-
+ if(P->name_offset > maxoffset || P->value_offset > maxoffset)
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
P->name = ((utf16_t *)PL->data + P->name_offset);
P->value = ((utf16_t *)PL->data + P->value_offset);
- P->name_utf8 = 0;// utf16le_to_utf8(P->name);
- P->value_utf8 = 0;//utf16le_to_utf8(P->value);
}
}
Index: LibRaw-0.18.9/src/libraw_cxx.cpp
===================================================================
--- LibRaw-0.18.9.orig/src/libraw_cxx.cpp 2018-04-30 11:35:17.477351409 +0200
+++ LibRaw-0.18.9/src/libraw_cxx.cpp 2018-04-30 11:38:21.568048079 +0200
@@ -5551,13 +5551,21 @@ void LibRaw::parse_x3f()
// Parse property list
DEH = &DE->header;
x3f_property_list_t *PL = &DEH->data_subsection.property_list;
+ utf16_t *datap = (utf16_t*) PL->data;
+ uint32_t maxitems = PL->data_size/sizeof(utf16_t);
if (PL->property_table.size != 0) {
int i;
x3f_property_t *P = PL->property_table.element;
for (i=0; i<PL->num_properties; i++) {
char name[100], value[100];
- utf2char(P[i].name,name,sizeof(name));
- utf2char(P[i].value,value,sizeof(value));
+ int noffset = (P[i].name - datap);
+ int voffset = (P[i].value - datap);
+ if(noffset < 0 || noffset>maxitems || voffset<0 || voffset>maxitems)
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
+ int maxnsize = maxitems - (P[i].name - datap);
+ int maxvsize = maxitems - (P[i].value - datap);
+ utf2char(P[i].name, name,MIN(maxnsize,sizeof(name)));
+ utf2char(P[i].value, value,MIN(maxvsize,sizeof(value)));
if (!strcmp (name, "ISO"))
imgdata.other.iso_speed = atoi(value);
if (!strcmp (name, "CAMMANUF"))

10
libraw.changes
View File

@ -1,3 +1,13 @@
-------------------------------------------------------------------
Wed Aug 1 10:13:46 UTC 2018 - pgajdos@suse.com
- new upstream branch, version 0.19.x
* fixes CVE-2018-10529 and CVE-2018-10528, hence removing
. libraw-CVE-2018-10528.patch
. libraw-CVE-2018-10529.patch
* the rest of changes at
https://www.libraw.org/download#stable
------------------------------------------------------------------- -------------------------------------------------------------------
Mon Apr 30 09:18:00 UTC 2018 - pgajdos@suse.com Mon Apr 30 09:18:00 UTC 2018 - pgajdos@suse.com

8
libraw.spec
View File

@ -17,10 +17,10 @@
%define tar_name LibRaw %define tar_name LibRaw
%define lver 16 %define lver 19
%define lname libraw%{lver} %define lname libraw%{lver}
Name: libraw Name: libraw
Version: 0.18.9 Version: 0.19.0
Release: 0 Release: 0
Summary: Library for reading RAW files obtained from digital photo cameras Summary: Library for reading RAW files obtained from digital photo cameras
License: CDDL-1.0 OR LGPL-2.1-only License: CDDL-1.0 OR LGPL-2.1-only
@ -28,8 +28,6 @@ Group: Development/Libraries/C and C++
Url: https://www.libraw.org/ Url: https://www.libraw.org/
#Git-Clone: git://github.com/LibRaw/LibRaw #Git-Clone: git://github.com/LibRaw/LibRaw
Source: https://www.libraw.org/data/%tar_name-%version.tar.gz Source: https://www.libraw.org/data/%tar_name-%version.tar.gz
Patch0: libraw-CVE-2018-10528.patch
Patch1: libraw-CVE-2018-10529.patch
BuildRequires: fdupes BuildRequires: fdupes
BuildRequires: gcc-c++ BuildRequires: gcc-c++
BuildRequires: libjasper-devel BuildRequires: libjasper-devel
@ -97,8 +95,6 @@ against LibRaw. LibRaw does not provide dynamic libraries.
%prep %prep
%setup -qn %tar_name-%version %setup -qn %tar_name-%version
%patch0 -p1
%patch1 -p1
%build %build
export CXXFLAGS="%optflags -fPIC -DUSE_ZLIB" export CXXFLAGS="%optflags -fPIC -DUSE_ZLIB"