buildroot/package/jasper, branch 2016.11

jasper: bump version to 1.900.31 (security)

2016-11-29T21:36:00+00:00

Fixed CVEs: - CVE-2016-9387 - CVE-2016-9388 - CVE-2016-9389 - CVE-2016-9390 - CVE-2016-9391 - CVE-2016-9392 - CVE-2016-9393 - CVE-2016-9394 - CVE-2016-9395 - CVE-2016-9396 - CVE-2016-9397 - CVE-2016-9398 - CVE-2016-9399 - CVE-2016-9557 - CVE-2016-9560 Changes to jasper.mk: - Switched site method to GitHub. 1.900.31 is not released as a tarball in the official website. - Autoreconf necessary since there isn't any configure script. We need to generate it. Signed-off-by: Vicente Olivert Riera Signed-off-by: Peter Korsgaard

jasper: disable -pedantic-errors

2016-11-13T11:23:17+00:00

The -pedantic-errors gcc option turns -pedantic warnings into errors. This mostly affects older gcc versions that default to the ISO90 C standard. Use the --disable-strict configure option to remove -pedantic-errors. Fixes: http://autobuild.buildroot.net/results/191/191f80779df1a9e6f832106e6c4bdf601e2a9893/ http://autobuild.buildroot.net/results/1fe/1febccc7215814490fa3c776b34bc367363afe39/ http://autobuild.buildroot.net/results/a6f/a6f9bfec3406fc21b130f1669e3534651b9c9596/ Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni

jasper: security bump to version 1.900.22

2016-11-11T14:07:43+00:00

Fixes: CVE-2016-8693: Double free vulnerability in mem_close CVE-2016-8692: Divide by zero in jpc_dec_process_siz CVE-2016-8691: Divide by zero in jpc_dec_process_siz CVE-2016-8690: Null pointer dereference in bmp_getdata triggered by crafted BMP image CVE-2016-2089: matrix rows_ NULL pointer dereference in jas_matrix_clip() CVE-2016-8886: memory allocation failure in jas_malloc CVE-2016-8887: Null pointer dereference in jp2_colr_destroy CVE-2016-8884, CVE-2016-8885: Null pointer dereference in bmp_getdata (incomplete fix for CVE-2016-8690) CVE-2016-8880: Heap buffer overflow in jpc_dec_cp_setfromcox() CVE-2016-8881: Heap buffer overflow in jpc_getuint16() CVE-2016-8882: Null pointer access in jpc_pi_destroy CVE-2016-8883: Assert in jpc_dec_tiledecode() Drop upstream patches. Change SITE to the official download location, since the current one does not have the updated version. Unfortunately, the official site only offers tar.gz. Fix license. It is "based on the MIT license", but not exactly the same (http://www.ece.uvic.ca/~frodo/jasper/; under "Legal Issues"). Drop autoreconf; the autotools version has been updated since commit 324ccec90d (jasper: autoreconf to fix rpath issue) that introduced it. Cc: Maxime Hadjinlian Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni

jasper: add security patches

2016-08-17T06:39:36+00:00

Fixes: CVE-2016-2116 - Memory leak in jas_iccprof_createfrombuf causing memory consumption. CVE-2016-1577 - Double free vulnerability in jas_iccattrval_destroy. CVE-2016-1867 - out-of-bounds read in the jpc_pi_nextcprl() function. CVE-2015-5221 - Use-after-free and double-free flaws in Jasper JPEG-2000 library. CVE-2015-5203 - double free in jasper_image_stop_load() Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

jasper: add hash file

2015-07-16T20:36:36+00:00

Signed-off-by: Gustavo Zacarias

jasper: Disable debugging when building for xtensa

2015-05-19T19:36:18+00:00

xtensa gcc is not able to generate correct code when compiling with -O0 enabled by --enable-debug. Instead of disabling package build it with --disable-debug. Fixes: http://autobuild.buildroot.net/results/5d17055027055ffd33fcd28b208130afb26343c9/ Signed-off-by: Max Filippov Signed-off-by: Peter Korsgaard

jasper: Don't overwrite CFLAGS when configured with --enable-debug

2015-05-19T19:36:05+00:00

This drops architecture-specific ABI flags, which may be important. Signed-off-by: Max Filippov Signed-off-by: Peter Korsgaard

jasper: add security fixes for CVE-2014-8157/8158

2015-01-26T22:13:44+00:00

Fixes: CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

jasper: add patches to fix CVE-2014-8137 and CVE-2014-8138

2014-12-19T20:41:17+00:00

Fixes: CVE-2014-8137 - double-free in jas_iccattrval_destroy() CVE-2014-8138 - heap overflow in jp2_decode() Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

jasper: add a patch fixing CVE-2014-9029

2014-12-10T20:24:04+00:00

See http://www.ocert.org/advisories/ocert-2014-009.html for the details. Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni