* [Buildroot] [PATCH 1/2] package/graphicsmagick: security bump to version 1.3.45
@ 2025-04-23 19:06 Peter Korsgaard
2025-04-23 19:06 ` [Buildroot] [PATCH 2/2] package/graphicsmagick: add post-1.3.45 security fixes Peter Korsgaard
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Peter Korsgaard @ 2025-04-23 19:06 UTC (permalink / raw)
To: buildroot; +Cc: Grzegorz Blach
1.3.44 added the following security fixes:
* TIFF: Fixed multiple heap and stack buffer overflows (directed by
the source EXIF profile) while writing EXIF into the native TIFF
IFD.
* FITS: Fix problem that the FITS reader could return invalid image
frames with rows or columns set to zero. Other code in the library
crashes, or even asserts, if invalid image frames with rows or
columns set to zero are returned.
* Coverity fixes: Various fixes for Coverity issues raised after the
update to version 2023.12.2.
* Clang Analyzer (scan-build) fixes: Various fixes for new issues
discovered by Clang Analyzer.
https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/7046c344273c263a9b6e4901b910508aea3804b5
In addition 1.3.45 fixes a off-by-one issue introduced in 1.3.44:
https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/96f765a2e3cebf0b70094da34d03b73c50c3aa63
Update the Copyright.txt hash for a change in copyright years:
https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/f0bba104ee3859286ea8adfc2ff603fd64be5624
https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/26fce892769e4a26247dd2db5b8dc0719ce20953
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
package/graphicsmagick/graphicsmagick.hash | 4 ++--
package/graphicsmagick/graphicsmagick.mk | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/package/graphicsmagick/graphicsmagick.hash b/package/graphicsmagick/graphicsmagick.hash
index a894aedf11..044214c8fc 100644
--- a/package/graphicsmagick/graphicsmagick.hash
+++ b/package/graphicsmagick/graphicsmagick.hash
@@ -1,3 +1,3 @@
# Locally computed:
-sha256 97dc1a9d4e89c77b25a3b24505e7ff1653b88f9bfe31f189ce10804b8efa7746 GraphicsMagick-1.3.40.tar.xz
-sha256 0a20e661de942ebe115a354d0ec6d1d42b93856ea765f813f350a5ce5024cdb7 Copyright.txt
+sha256 dcea5167414f7c805557de2d7a47a9b3147bcbf617b91f5f0f4afe5e6543026b GraphicsMagick-1.3.45.tar.xz
+sha256 27d121f97ad71ff506ac5a6a9539e969154f3a66f3da24fd5b6f268acd106295 Copyright.txt
diff --git a/package/graphicsmagick/graphicsmagick.mk b/package/graphicsmagick/graphicsmagick.mk
index 76b826ceef..baaa9bcb02 100644
--- a/package/graphicsmagick/graphicsmagick.mk
+++ b/package/graphicsmagick/graphicsmagick.mk
@@ -4,7 +4,7 @@
#
################################################################################
-GRAPHICSMAGICK_VERSION = 1.3.40
+GRAPHICSMAGICK_VERSION = 1.3.45
GRAPHICSMAGICK_SOURCE = GraphicsMagick-$(GRAPHICSMAGICK_VERSION).tar.xz
GRAPHICSMAGICK_SITE = https://downloads.sourceforge.net/project/graphicsmagick/graphicsmagick/$(GRAPHICSMAGICK_VERSION)
GRAPHICSMAGICK_LICENSE = MIT
--
2.39.5
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [Buildroot] [PATCH 2/2] package/graphicsmagick: add post-1.3.45 security fixes
2025-04-23 19:06 [Buildroot] [PATCH 1/2] package/graphicsmagick: security bump to version 1.3.45 Peter Korsgaard
@ 2025-04-23 19:06 ` Peter Korsgaard
2025-04-23 19:24 ` [Buildroot] [PATCH 1/2] package/graphicsmagick: security bump to version 1.3.45 Julien Olivain
2025-05-02 11:06 ` Arnout Vandecappelle via buildroot
2 siblings, 0 replies; 4+ messages in thread
From: Peter Korsgaard @ 2025-04-23 19:06 UTC (permalink / raw)
To: buildroot; +Cc: Grzegorz Blach
Fixes the following security issues:
- CVE-2025-27795: ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks
image dimension resource limits
https://nvd.nist.gov/vuln/detail/CVE-2025-27795
- CVE-2025-32460: GraphicsMagick before 8e56520 has a heap-based buffer
over-read in ReadJXLImage in coders/jxl.c, related to an
ImportViewPixelArea call.
https://nvd.nist.gov/vuln/detail/CVE-2025-32460
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
...pply-image-dimension-resource-limits.patch | 32 ++++++++++
...ixel_format-num_channels-needs-to-be.patch | 60 +++++++++++++++++++
package/graphicsmagick/graphicsmagick.mk | 6 ++
3 files changed, 98 insertions(+)
create mode 100644 package/graphicsmagick/0001-ReadJXLImage-Apply-image-dimension-resource-limits.patch
create mode 100644 package/graphicsmagick/0002-ReadJXLImage-pixel_format-num_channels-needs-to-be.patch
diff --git a/package/graphicsmagick/0001-ReadJXLImage-Apply-image-dimension-resource-limits.patch b/package/graphicsmagick/0001-ReadJXLImage-Apply-image-dimension-resource-limits.patch
new file mode 100644
index 0000000000..275738a71a
--- /dev/null
+++ b/package/graphicsmagick/0001-ReadJXLImage-Apply-image-dimension-resource-limits.patch
@@ -0,0 +1,32 @@
+# HG changeset patch
+# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
+# Date 1725886903 18000
+# Mon Sep 09 08:01:43 2024 -0500
+# Node ID 9bbae7314e3c3b19b830591010ed90bb136b9c42
+# Parent db3ff8d00c28c38895e1600a28706ce251dac570
+ReadJXLImage(): Apply image dimension resource limits. Addresses oss-fuzz Issue 69728
+
+Upstream: https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/9bbae7314e3c3b19b830591010ed90bb136b9c42
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+[Peter: drop ChangeLog/version changes]
+diff --git a/coders/jxl.c b/coders/jxl.c
+--- a/coders/jxl.c
++++ b/coders/jxl.c
+@@ -571,6 +571,7 @@
+ basic_info.alpha_bits, basic_info.num_color_channels,
+ basic_info.have_animation == JXL_FALSE ? "False" : "True");
+ }
++
+ if (basic_info.num_extra_channels)
+ {
+ size_t index;
+@@ -637,6 +638,9 @@
+
+ image->orientation=convert_orientation(basic_info.orientation);
+
++ if (CheckImagePixelLimits(image, exception) != MagickPass)
++ ThrowJXLReaderException(ResourceLimitError,ImagePixelLimitExceeded,image);
++
+ pixel_format.endianness=JXL_NATIVE_ENDIAN;
+ pixel_format.align=0;
+ if (basic_info.num_color_channels == 1)
diff --git a/package/graphicsmagick/0002-ReadJXLImage-pixel_format-num_channels-needs-to-be.patch b/package/graphicsmagick/0002-ReadJXLImage-pixel_format-num_channels-needs-to-be.patch
new file mode 100644
index 0000000000..d1cc795b4c
--- /dev/null
+++ b/package/graphicsmagick/0002-ReadJXLImage-pixel_format-num_channels-needs-to-be.patch
@@ -0,0 +1,60 @@
+# HG changeset patch
+# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
+# Date 1743004970 18000
+# Wed Mar 26 11:02:50 2025 -0500
+# Node ID 8e56520435df50f618a03f2721a39a70a515f1cb
+# Parent 036a1376a2a6dc9504c5148249cbd8feaef72de6
+ReadJXLImage(): pixel_format.num_channels needs to be 2 for grayscale matte.
+
+Upstream: https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/8e56520435df50f618a03f2721a39a70a515f1cb
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+[Peter: drop ChangeLog/version changes]
+
+diff --git a/coders/jxl.c b/coders/jxl.c
+--- a/coders/jxl.c
++++ b/coders/jxl.c
+@@ -658,7 +658,7 @@
+ ThrowJXLReaderException(ResourceLimitError,MemoryAllocationFailed,image);
+ }
+ grayscale=MagickTrue;
+- pixel_format.num_channels=1;
++ pixel_format.num_channels=image->matte ? 2 : 1;
+ pixel_format.data_type=(basic_info.bits_per_sample <= 8 ? JXL_TYPE_UINT8 :
+ (basic_info.bits_per_sample <= 16 ? JXL_TYPE_UINT16 :
+ JXL_TYPE_FLOAT));
+@@ -843,6 +843,24 @@
+ size_t
+ out_len;
+
++ if (image->logging)
++ (void) LogMagickEvent(CoderEvent,GetMagickModule(),
++ "JxlPixelFormat:\n"
++ " num_channels: %u\n"
++ " data_type: %s\n"
++ " endianness: %s\n"
++ " align: %" MAGICK_SIZE_T_F "u",
++ pixel_format.num_channels,
++ pixel_format.data_type == JXL_TYPE_FLOAT ? "float" :
++ (pixel_format.data_type == JXL_TYPE_UINT8 ? "uint8" :
++ (pixel_format.data_type == JXL_TYPE_UINT16 ? "uint16" :
++ (pixel_format.data_type == JXL_TYPE_FLOAT16 ? "float16" :
++ "unknown"))) ,
++ pixel_format.endianness == JXL_NATIVE_ENDIAN ? "native" :
++ (pixel_format.endianness == JXL_LITTLE_ENDIAN ? "little" :
++ (pixel_format.endianness == JXL_BIG_ENDIAN ? "big" : "unknown")),
++ pixel_format.align);
++
+ status=JxlDecoderImageOutBufferSize(jxl_decoder,&pixel_format,&out_len);
+ if (status != JXL_DEC_SUCCESS)
+ {
+@@ -852,6 +870,10 @@
+ break;
+ }
+
++ if (image->logging)
++ (void) LogMagickEvent(CoderEvent,GetMagickModule(),
++ "JxlDecoderImageOutBufferSize() returns %" MAGICK_SIZE_T_F "u",
++ (MAGICK_SIZE_T) out_len);
+ out_buf=MagickAllocateResourceLimitedArray(unsigned char *,out_len,sizeof(*out_buf));
+ if (out_buf == (unsigned char *) NULL)
+ ThrowJXLReaderException(ResourceLimitError,MemoryAllocationFailed,image);
diff --git a/package/graphicsmagick/graphicsmagick.mk b/package/graphicsmagick/graphicsmagick.mk
index baaa9bcb02..4b9f3bd23c 100644
--- a/package/graphicsmagick/graphicsmagick.mk
+++ b/package/graphicsmagick/graphicsmagick.mk
@@ -11,6 +11,12 @@ GRAPHICSMAGICK_LICENSE = MIT
GRAPHICSMAGICK_LICENSE_FILES = Copyright.txt
GRAPHICSMAGICK_CPE_ID_VENDOR = graphicsmagick
+# 0001-ReadJXLImage-Apply-image-dimension-resource-limits.patch
+GRAPHICSMAGICK_IGNORE_CVES += CVE-2025-27795
+
+# 0002-ReadJXLImage-pixel_format-num_channels-needs-to-be.patch
+GRAPHICSMAGICK_IGNORE_CVES += CVE-2025-32460
+
GRAPHICSMAGICK_INSTALL_STAGING = YES
GRAPHICSMAGICK_CONFIG_SCRIPTS = GraphicsMagick-config GraphicsMagickWand-config
--
2.39.5
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/graphicsmagick: security bump to version 1.3.45
2025-04-23 19:06 [Buildroot] [PATCH 1/2] package/graphicsmagick: security bump to version 1.3.45 Peter Korsgaard
2025-04-23 19:06 ` [Buildroot] [PATCH 2/2] package/graphicsmagick: add post-1.3.45 security fixes Peter Korsgaard
@ 2025-04-23 19:24 ` Julien Olivain
2025-05-02 11:06 ` Arnout Vandecappelle via buildroot
2 siblings, 0 replies; 4+ messages in thread
From: Julien Olivain @ 2025-04-23 19:24 UTC (permalink / raw)
To: Peter Korsgaard; +Cc: buildroot, Grzegorz Blach
On 23/04/2025 21:06, Peter Korsgaard wrote:
> 1.3.44 added the following security fixes:
>
> * TIFF: Fixed multiple heap and stack buffer overflows (directed by
> the source EXIF profile) while writing EXIF into the native TIFF
> IFD.
>
> * FITS: Fix problem that the FITS reader could return invalid image
> frames with rows or columns set to zero. Other code in the library
> crashes, or even asserts, if invalid image frames with rows or
> columns set to zero are returned.
>
> * Coverity fixes: Various fixes for Coverity issues raised after the
> update to version 2023.12.2.
>
> * Clang Analyzer (scan-build) fixes: Various fixes for new issues
> discovered by Clang Analyzer.
>
> https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/7046c344273c263a9b6e4901b910508aea3804b5
>
> In addition 1.3.45 fixes a off-by-one issue introduced in 1.3.44:
> https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/96f765a2e3cebf0b70094da34d03b73c50c3aa63
>
> Update the Copyright.txt hash for a change in copyright years:
> https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/f0bba104ee3859286ea8adfc2ff603fd64be5624
> https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/26fce892769e4a26247dd2db5b8dc0719ce20953
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Series applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/graphicsmagick: security bump to version 1.3.45
2025-04-23 19:06 [Buildroot] [PATCH 1/2] package/graphicsmagick: security bump to version 1.3.45 Peter Korsgaard
2025-04-23 19:06 ` [Buildroot] [PATCH 2/2] package/graphicsmagick: add post-1.3.45 security fixes Peter Korsgaard
2025-04-23 19:24 ` [Buildroot] [PATCH 1/2] package/graphicsmagick: security bump to version 1.3.45 Julien Olivain
@ 2025-05-02 11:06 ` Arnout Vandecappelle via buildroot
2 siblings, 0 replies; 4+ messages in thread
From: Arnout Vandecappelle via buildroot @ 2025-05-02 11:06 UTC (permalink / raw)
To: Peter Korsgaard, buildroot; +Cc: Grzegorz Blach
On 23/04/2025 21:06, Peter Korsgaard wrote:
> 1.3.44 added the following security fixes:
>
> * TIFF: Fixed multiple heap and stack buffer overflows (directed by
> the source EXIF profile) while writing EXIF into the native TIFF
> IFD.
>
> * FITS: Fix problem that the FITS reader could return invalid image
> frames with rows or columns set to zero. Other code in the library
> crashes, or even asserts, if invalid image frames with rows or
> columns set to zero are returned.
>
> * Coverity fixes: Various fixes for Coverity issues raised after the
> update to version 2023.12.2.
>
> * Clang Analyzer (scan-build) fixes: Various fixes for new issues
> discovered by Clang Analyzer.
>
> https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/7046c344273c263a9b6e4901b910508aea3804b5
>
> In addition 1.3.45 fixes a off-by-one issue introduced in 1.3.44:
> https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/96f765a2e3cebf0b70094da34d03b73c50c3aa63
>
> Update the Copyright.txt hash for a change in copyright years:
> https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/f0bba104ee3859286ea8adfc2ff603fd64be5624
> https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/26fce892769e4a26247dd2db5b8dc0719ce20953
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Applied both to 2025.02.x, thanks.
Regards,
Arnout
> ---
> package/graphicsmagick/graphicsmagick.hash | 4 ++--
> package/graphicsmagick/graphicsmagick.mk | 2 +-
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/package/graphicsmagick/graphicsmagick.hash b/package/graphicsmagick/graphicsmagick.hash
> index a894aedf11..044214c8fc 100644
> --- a/package/graphicsmagick/graphicsmagick.hash
> +++ b/package/graphicsmagick/graphicsmagick.hash
> @@ -1,3 +1,3 @@
> # Locally computed:
> -sha256 97dc1a9d4e89c77b25a3b24505e7ff1653b88f9bfe31f189ce10804b8efa7746 GraphicsMagick-1.3.40.tar.xz
> -sha256 0a20e661de942ebe115a354d0ec6d1d42b93856ea765f813f350a5ce5024cdb7 Copyright.txt
> +sha256 dcea5167414f7c805557de2d7a47a9b3147bcbf617b91f5f0f4afe5e6543026b GraphicsMagick-1.3.45.tar.xz
> +sha256 27d121f97ad71ff506ac5a6a9539e969154f3a66f3da24fd5b6f268acd106295 Copyright.txt
> diff --git a/package/graphicsmagick/graphicsmagick.mk b/package/graphicsmagick/graphicsmagick.mk
> index 76b826ceef..baaa9bcb02 100644
> --- a/package/graphicsmagick/graphicsmagick.mk
> +++ b/package/graphicsmagick/graphicsmagick.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -GRAPHICSMAGICK_VERSION = 1.3.40
> +GRAPHICSMAGICK_VERSION = 1.3.45
> GRAPHICSMAGICK_SOURCE = GraphicsMagick-$(GRAPHICSMAGICK_VERSION).tar.xz
> GRAPHICSMAGICK_SITE = https://downloads.sourceforge.net/project/graphicsmagick/graphicsmagick/$(GRAPHICSMAGICK_VERSION)
> GRAPHICSMAGICK_LICENSE = MIT
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-05-02 11:06 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-04-23 19:06 [Buildroot] [PATCH 1/2] package/graphicsmagick: security bump to version 1.3.45 Peter Korsgaard
2025-04-23 19:06 ` [Buildroot] [PATCH 2/2] package/graphicsmagick: add post-1.3.45 security fixes Peter Korsgaard
2025-04-23 19:24 ` [Buildroot] [PATCH 1/2] package/graphicsmagick: security bump to version 1.3.45 Julien Olivain
2025-05-02 11:06 ` Arnout Vandecappelle via buildroot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.