Skip to content

Commit 5b622c3

Browse files
azurelinux-securitykgodara912kevin-b-lockwood
authored
[AutoPR- Security] Patch jasper for CVE-2025-8837, CVE-2025-8836 [MEDIUM] (#14499)
Co-authored-by: kgodara912 <[email protected]> Co-authored-by: Kevin Lockwood <[email protected]>
1 parent bcd8202 commit 5b622c3

File tree

3 files changed

+152
-1
lines changed

3 files changed

+152
-1
lines changed

‎SPECS/jasper/CVE-2025-8836.patch

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
From 4ced19ffd2d1d1ce63baa9be551f789a4927c37e Mon Sep 17 00:00:00 2001
2+
From: Michael Adams <[email protected]>
3+
Date: Sat, 2 Aug 2025 18:00:39 -0700
4+
Subject: [PATCH] Fixes #401.
5+
6+
JPEG-2000 (JPC) Encoder:
7+
- Added some missing range checking on several coding parameters
8+
(e.g., precint width/height and codeblock width/height).
9+
10+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
11+
Upstream-reference: https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4.patch
12+
---
13+
src/libjasper/jpc/jpc_enc.c | 30 ++++++++++++++++++++++++------
14+
src/libjasper/jpc/jpc_t2dec.c | 3 ++-
15+
2 files changed, 26 insertions(+), 7 deletions(-)
16+
17+
diff --git a/src/libjasper/jpc/jpc_enc.c b/src/libjasper/jpc/jpc_enc.c
18+
index 93013f9..c957e3f 100644
19+
--- a/src/libjasper/jpc/jpc_enc.c
20+
+++ b/src/libjasper/jpc/jpc_enc.c
21+
@@ -474,18 +474,36 @@ static jpc_enc_cp_t *cp_create(const char *optstr, jas_image_t *image)
22+
cp->tileheight = atoi(jas_tvparser_getval(tvp));
23+
break;
24+
case OPT_PRCWIDTH:
25+
- prcwidthexpn = jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
26+
+ i = atoi(jas_tvparser_getval(tvp));
27+
+ if (i <= 0) {
28+
+ jas_eprintf("invalid precinct width (%d)\n", i);
29+
+ goto error;
30+
+ }
31+
+ prcwidthexpn = jpc_floorlog2(i);
32+
break;
33+
case OPT_PRCHEIGHT:
34+
- prcheightexpn = jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
35+
+ i = atoi(jas_tvparser_getval(tvp));
36+
+ if (i <= 0) {
37+
+ jas_eprintf("invalid precinct height (%d)\n", i);
38+
+ goto error;
39+
+ }
40+
+ prcheightexpn = jpc_floorlog2(i);
41+
break;
42+
case OPT_CBLKWIDTH:
43+
- tccp->cblkwidthexpn =
44+
- jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
45+
+ i = atoi(jas_tvparser_getval(tvp));
46+
+ if (i <= 0) {
47+
+ jas_eprintf("invalid code block width (%d)\n", i);
48+
+ goto error;
49+
+ }
50+
+ tccp->cblkwidthexpn = jpc_floorlog2(i);
51+
break;
52+
case OPT_CBLKHEIGHT:
53+
- tccp->cblkheightexpn =
54+
- jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
55+
+ i = atoi(jas_tvparser_getval(tvp));
56+
+ if (i <= 0) {
57+
+ jas_eprintf("invalid code block height (%d)\n", i);
58+
+ goto error;
59+
+ }
60+
+ tccp->cblkheightexpn = jpc_floorlog2(i);
61+
break;
62+
case OPT_MODE:
63+
if ((tagid = jas_taginfo_nonull(jas_taginfos_lookup(modetab,
64+
diff --git a/src/libjasper/jpc/jpc_t2dec.c b/src/libjasper/jpc/jpc_t2dec.c
65+
index e52b549..6e1f1f7 100644
66+
--- a/src/libjasper/jpc/jpc_t2dec.c
67+
+++ b/src/libjasper/jpc/jpc_t2dec.c
68+
@@ -337,7 +337,8 @@ static int jpc_dec_decodepkt(jpc_dec_t *dec, jas_stream_t *pkthdrstream, jas_str
69+
const unsigned n = JAS_MIN((unsigned)numnewpasses, maxpasses);
70+
mycounter += n;
71+
numnewpasses -= n;
72+
- if ((len = jpc_bitstream_getbits(inb, cblk->numlenbits + jpc_floorlog2(n))) < 0) {
73+
+ if ((len = jpc_bitstream_getbits(inb,
74+
+ cblk->numlenbits + jpc_floorlog2(n))) < 0) {
75+
jpc_bitstream_close(inb);
76+
return -1;
77+
}
78+
--
79+
2.45.4
80+

‎SPECS/jasper/CVE-2025-8837.patch

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
From 3e063893dc0bc44d22f1eabbf10dc7f06ee95aca Mon Sep 17 00:00:00 2001
2+
From: Michael Adams <[email protected]>
3+
Date: Tue, 5 Aug 2025 20:46:48 -0700
4+
Subject: [PATCH] Fixes #402, #403.
5+
6+
JPEG-2000 (JPC) Decoder:
7+
- Added the setting of several pointers to null in some cleanup code
8+
after the pointed-to memory was freed. This pointer nulling is not
9+
needed normally, but it is needed when certain debugging logs are
10+
enabled (so that the debug code understands that the memory associated
11+
with the aforementioned pointers has been freed).
12+
13+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
14+
Upstream-reference: https://github.com/jasper-software/jasper/commit/8308060d3fbc1da10353ac8a95c8ea60eba9c25a.patch
15+
---
16+
src/libjasper/jpc/jpc_dec.c | 13 ++++++++-----
17+
3 files changed, 8 insertions(+), 5 deletions(-)
18+
19+
diff --git a/src/libjasper/jpc/jpc_dec.c b/src/libjasper/jpc/jpc_dec.c
20+
index 2553696..c2600c4 100644
21+
--- a/src/libjasper/jpc/jpc_dec.c
22+
+++ b/src/libjasper/jpc/jpc_dec.c
23+
@@ -1107,23 +1107,23 @@ static int jpc_dec_tilefini(jpc_dec_t *dec, jpc_dec_tile_t *tile)
24+
25+
if (tile->cp) {
26+
jpc_dec_cp_destroy(tile->cp);
27+
- //tile->cp = 0;
28+
+ tile->cp = 0;
29+
}
30+
if (tile->tcomps) {
31+
jas_free(tile->tcomps);
32+
- //tile->tcomps = 0;
33+
+ tile->tcomps = 0;
34+
}
35+
if (tile->pi) {
36+
jpc_pi_destroy(tile->pi);
37+
- //tile->pi = 0;
38+
+ tile->pi = 0;
39+
}
40+
if (tile->pkthdrstream) {
41+
jas_stream_close(tile->pkthdrstream);
42+
- //tile->pkthdrstream = 0;
43+
+ tile->pkthdrstream = 0;
44+
}
45+
if (tile->pptstab) {
46+
jpc_ppxstab_destroy(tile->pptstab);
47+
- //tile->pptstab = 0;
48+
+ tile->pptstab = 0;
49+
}
50+
51+
tile->state = JPC_TILE_DONE;
52+
@@ -2259,6 +2259,9 @@ static int jpc_dec_dump(const jpc_dec_t *dec, FILE *out)
53+
const jpc_dec_tile_t *tile;
54+
for (tileno = 0, tile = dec->tiles; tileno < dec->numtiles;
55+
++tileno, ++tile) {
56+
+ if (!tile->tcomps) {
57+
+ continue;
58+
+ }
59+
assert(!dec->numcomps || tile->tcomps);
60+
unsigned compno;
61+
const jpc_dec_tcomp_t *tcomp;
62+
--
63+
2.45.4
64+

‎SPECS/jasper/jasper.spec

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Implementation of the JPEG-2000 standard, Part 1
22
Name: jasper
33
Version: 2.0.32
4-
Release: 4%{?dist}
4+
Release: 5%{?dist}
55
License: JasPer
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -13,6 +13,8 @@ Patch2: jasper-2.0.14-rpath.patch
1313
Patch100: jasper-2.0.2-test-ppc64-disable.patch
1414
Patch101: jasper-2.0.2-test-ppc64le-disable.patch
1515
Patch102: CVE-2023-51257.patch
16+
Patch103: CVE-2025-8836.patch
17+
Patch104: CVE-2025-8837.patch
1618
# autoreconf
1719
BuildRequires: cmake
1820
BuildRequires: gcc
@@ -75,6 +77,8 @@ Requires: %{name}-libs%{?_isa} = %{version}-%{release}
7577
%endif
7678

7779
%patch102 -p1 -b .cve-2023-51257.patch
80+
%patch 103 -p1
81+
%patch 104 -p1
7882

7983
%build
8084
mkdir builder
@@ -116,6 +120,9 @@ make test -C builder
116120
%{_libdir}/libjasper.so.4*
117121

118122
%changelog
123+
* Tue Aug 12 2025 Azure Linux Security Servicing Account <[email protected]> - 2.0.32-5
124+
- Patch for CVE-2025-8837, CVE-2025-8836
125+
119126
* Fri Aug 23 2024 Sumedh Sharma <[email protected]> - 2.0.32-4
120127
- Add patch to resolve CVE-2023-51257
121128

0 commit comments

Comments
 (0)