From: Baruch Siach <baruch@tkos.co.il>
To: buildroot@busybox.net
Subject: [Buildroot] [PATCH 1/1] package/libraw: security bump to version 0.20.0
Date: Sun, 06 Sep 2020 16:09:25 +0300 [thread overview]
Message-ID: <87o8mj127u.fsf@tarshish> (raw)
In-Reply-To: <20200906125351.2869468-1-fontaine.fabrice@gmail.com>
Hi Fabrice,
On Sun, Sep 06 2020, Fabrice Fontaine wrote:
> - Fix CVE-2020-15503: LibRaw before 0.20-RC1 lacks a thumbnail size
> range check. This affects decoders/unpack_thumb.cpp,
> postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example,
> malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without
> validating T.tlength.
>
> - zlib is an optional dependency since
> https://github.com/LibRaw/LibRaw/commit/b63f017b063edb5e7091e3952ee20cb4d002edbe
>
> Also update indentation in hash file (two spaces) as well as README.md
> hash, no license changes:
> - https://github.com/LibRaw/LibRaw/commit/d1975cb0e055d2bfe58c9d845c9a3e57c346a2f9
> - https://github.com/LibRaw/LibRaw/commit/d38361b76e1a405a25b11165a1ee5495fc899246
>
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
You might want to add this patch as well:
http://patchwork.ozlabs.org/project/buildroot/patch/20200827213657.257570-1-fontaine.fabrice at gmail.com/
Looks like it fell between the cracks last time.
baruch
> ---
> package/libraw/libraw.hash | 8 ++++----
> package/libraw/libraw.mk | 9 ++++++++-
> 2 files changed, 12 insertions(+), 5 deletions(-)
>
> diff --git a/package/libraw/libraw.hash b/package/libraw/libraw.hash
> index 3337396f5f..e8117cd1f1 100644
> --- a/package/libraw/libraw.hash
> +++ b/package/libraw/libraw.hash
> @@ -1,5 +1,5 @@
> # Locally calculated
> -sha256 40a262d7cc71702711a0faec106118ee004f86c86cc228281d12d16da03e02f5 LibRaw-0.19.5.tar.gz
> -sha256 eea173a556abac0370461e57e12aab266894ea6be3874c2be05fd87871f75449 LICENSE.LGPL
> -sha256 0e3098d2d54a12434715f6679ea408d57da5e8d613c385c58ecc6fe5d30cc81f LICENSE.CDDL
> -sha256 ed971b7f1f57fd8e7d28419ff7749cfe0f296e701687756e798a69555fd76646 README.md
> +sha256 1f0a383da2ce9f409087facd28261decbf6be72cc90c78cd003b0766e4d694a3 LibRaw-0.20.0.tar.gz
> +sha256 eea173a556abac0370461e57e12aab266894ea6be3874c2be05fd87871f75449 LICENSE.LGPL
> +sha256 0e3098d2d54a12434715f6679ea408d57da5e8d613c385c58ecc6fe5d30cc81f LICENSE.CDDL
> +sha256 313415f7f48f6cd3cc78856626aab4bbe97dbb1e9a11db9c25396ca8d0e76cd9 README.md
> diff --git a/package/libraw/libraw.mk b/package/libraw/libraw.mk
> index e786b844a9..e33674e6f5 100644
> --- a/package/libraw/libraw.mk
> +++ b/package/libraw/libraw.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -LIBRAW_VERSION = 0.19.5
> +LIBRAW_VERSION = 0.20.0
> LIBRAW_SOURCE = LibRaw-$(LIBRAW_VERSION).tar.gz
> LIBRAW_SITE = http://www.libraw.org/data
> LIBRAW_INSTALL_STAGING = YES
> @@ -41,4 +41,11 @@ else
> LIBRAW_CONF_OPTS += --disable-lcms
> endif
>
> +ifeq ($(BR2_PACKAGE_ZLIB),y)
> +LIBRAW_CONF_OPTS += --enable-zlib
> +LIBRAW_DEPENDENCIES += zlib
> +else
> +LIBRAW_CONF_OPTS += --disable-zlib
> +endif
> +
> $(eval $(autotools-package))
--
~. .~ Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
- baruch at tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -
next prev parent reply other threads:[~2020-09-06 13:09 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-06 12:53 [Buildroot] [PATCH 1/1] package/libraw: security bump to version 0.20.0 Fabrice Fontaine
2020-09-06 13:09 ` Baruch Siach [this message]
2020-09-07 21:10 ` Thomas Petazzoni
2020-09-11 21:07 ` Peter Korsgaard
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87o8mj127u.fsf@tarshish \
--to=baruch@tkos.co.il \
--cc=buildroot@busybox.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.