From e3404b10ba4ec07638436d50c9a3d3e6a87a8e58 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Tue, 12 Mar 2019 21:20:00 +0100 Subject: package/openjpeg: security bump to latest git version Current git contains fixes for a number of post-2.3.0 security issues: git shortlog --no-merges -i --grep cve --grep overflow --grep zero v2.3.0.. Even Rouault (2): Avoid out-of-bounds write overflow due to uint32 overflow computation on images with huge dimensions. color_apply_icc_profile: avoid potential heap buffer overflow Hugo Lefeuvre (4): convertbmp: fix issues with zero bitmasks jp3d/jpwl convert: fix write stack buffer overflow jp2: convert: fix null pointer dereference convertbmp: detect invalid file dimensions early Karol Babioch (2): jp3d: Replace sprintf() by snprintf() in volumetobin() opj_mj2_extract: Check provided output prefix for length Stefan Weil (1): Fix some potential overflow issues (#1161) Young_X (5): [MJ2] To avoid divisions by zero / undefined behaviour on shift [JPWL] fix CVE-2018-16375 [JPWL] imagetotga(): fix read heap buffer overflow if numcomps < 3 (#987) [JPWL] opj_compress: reorder checks related to code block dimensions to avoid potential int overflow [JP3D] To avoid divisions by zero / undefined behaviour on shift (CVE-2018-14423 ichlubna (1): openjp3d: Int overflow fixed (#1159) setharnold (1): fix unchecked integer multiplication overflow Drop now upstreamed 0004-install-static-lib.patch. Add a hash for the LICENSE file. Signed-off-by: Peter Korsgaard Signed-off-by: Thomas Petazzoni (cherry picked from commit a5e8c81875a26551e780e409a0647916e626c969) Signed-off-by: Peter Korsgaard --- package/openjpeg/0004-install-static-lib.patch | 27 -------------------------- 1 file changed, 27 deletions(-) delete mode 100644 package/openjpeg/0004-install-static-lib.patch (limited to 'package/openjpeg/0004-install-static-lib.patch') diff --git a/package/openjpeg/0004-install-static-lib.patch b/package/openjpeg/0004-install-static-lib.patch deleted file mode 100644 index 4a3bbfa28a..0000000000 --- a/package/openjpeg/0004-install-static-lib.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 66297f07a43d2770a97c8456d20202f3d051d980 Mon Sep 17 00:00:00 2001 -From: Even Rouault -Date: Mon, 9 Oct 2017 11:40:43 +0200 -Subject: [PATCH] Unix build: fix regression of 2.3.0 where a shared-only or - static-only build lacks the installation target for the library (#1019, fixes - regression introduced by 3dfc6ca2bcf06fd1adb6b6b4cecc6c092f08ba0b) - -Downloaded from upstream commit -https://github.com/uclouvain/openjpeg/commit/66297f07a43d2770a97c8456d20202f3d051d980 - -Signed-off-by: Bernd Kuhls ---- - src/lib/openjp2/CMakeLists.txt | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/lib/openjp2/CMakeLists.txt b/src/lib/openjp2/CMakeLists.txt -index 0b4520384..f8990ccf0 100644 ---- a/src/lib/openjp2/CMakeLists.txt -+++ b/src/lib/openjp2/CMakeLists.txt -@@ -99,6 +99,7 @@ else() - set(INSTALL_LIBS ${OPENJPEG_LIBRARY_NAME} openjp2_static) - else() - add_library(${OPENJPEG_LIBRARY_NAME} ${OPENJPEG_SRCS}) -+ set(INSTALL_LIBS ${OPENJPEG_LIBRARY_NAME}) - endif() - endif() - -- cgit v1.2.3