~ubuntu-branches/ubuntu/raring/openjpeg/raring-proposed

#! /bin/sh /usr/share/dpatch/dpatch-run

## cve-2012-3535.dpatch by Michael Gilbert <mgilbert@debian.org>

##

## All lines beginning with `## DP:' are a description of the patch.

## DP: No description.

 

@DPATCH@

diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' openjpeg-1.3+dfsg~/libopenjpeg/j2k.c openjpeg-1.3+dfsg/libopenjpeg/j2k.c

--- openjpeg-1.3+dfsg~/libopenjpeg/j2k.c        2012-10-13 17:39:04.000000000 -0400

+++ openjpeg-1.3+dfsg/libopenjpeg/j2k.c 2012-10-13 17:39:05.000000000 -0400

@@ -719,6 +719,11 @@

                                        "of resolutions of this component\nModify the cp_reduce parameter.\n\n", compno);

                j2k->state |= J2K_STATE_ERR;

        }

+       if( tccp->numresolutions > J2K_MAXRLVLS ) {

+               opj_event_msg(j2k->cinfo, EVT_ERROR, "Error decoding, truncating.\n");

+               j2k->state |= J2K_STATE_ERR;

+               tccp->numresolutions = J2K_MAXRLVLS;

+       }

 

        tccp->cblkw = cio_read(cio, 1) + 2;     /* SPcox (E) */

        tccp->cblkh = cio_read(cio, 1) + 2;     /* SPcox (F) */

diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' openjpeg-1.3+dfsg~/libopenjpeg/t2.c openjpeg-1.3+dfsg/libopenjpeg/t2.c

--- openjpeg-1.3+dfsg~/libopenjpeg/t2.c 2012-10-13 17:38:59.000000000 -0400

+++ openjpeg-1.3+dfsg/libopenjpeg/t2.c  2012-10-13 17:40:46.053362086 -0400

@@ -566,6 +566,9 @@

 #endif /* USE_JPWL */

                                

                                cblk->data = (unsigned char*) opj_realloc(cblk->data, (cblk->len + seg->newlen) * sizeof(unsigned char*));

+                               if ((cblk->len + seg->newlen) > 8192) {

+                                       return -999;

+                               }

                                memcpy(cblk->data + cblk->len, c, seg->newlen);

                                if (seg->numpasses == 0) {

                                        seg->data = &cblk->data;