Re: [Buildroot] [PATCH 1/1] package/libjxl: security bump to version 0.8.2

From: "Yann E. MORIN" <yann.morin.1998@free.fr>
To: Julien Olivain <ju.o@free.fr>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>, buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH 1/1] package/libjxl: security bump to version 0.8.2
Date: Fri, 15 Sep 2023 23:39:17 +0200	[thread overview]
Message-ID: <20230915213917.GN2571@scaer> (raw)
In-Reply-To: <80eccb888c17302f362990c956de8529@free.fr>

Julien, All,

On 2023-09-15 21:30 +0200, Julien Olivain spake thusly:
> Hi Fabrice,
> 
> I tested this patch on branch master at commit 3557a7b
> with commands:
> 
>     support/testing/run-tests \
>         -d dl -o output_folder \
>         tests.package.test_libjxl
>     ...
>     OK
> 
> While trying with:
> 
>     utils/test-pkg -a -p libjxl
>     ...
>         bootlin-riscv32-glibc [17/45]: FAILED
>         bootlin-riscv64-glibc [18/45]: FAILED
>          bootlin-riscv64-musl [19/45]: FAILED
>     ...
>     45 builds, 11 skipped, 3 build failed, 0 legal-info failed, 0 show-info
> failed
> 
> I had those 3 build failures. They were introduced by v0.8.1 and are
> unrelated to this patch. I proposed a fix at:
> https://patchwork.ozlabs.org/project/buildroot/patch/20230915192308.1432032-1-ju.o@free.fr/
> 
> and also made sure this fix works for both v0.8.1 and v0.8.2 proposed in
> this patch.

Thank you! I applied your patch already!

Regards,
Yann E. MORIN.

> On 14/09/2023 23:56, Fabrice Fontaine wrote:
> >Fix CVE-2023-35790: An issue was discovered in dec_patch_dictionary.cc
> >in libjxl before 0.8.2. An integer underflow in patch decoding can lead
> >to a denial of service, such as an infinite loop.
> >
> >https://github.com/libjxl/libjxl/releases/tag/v0.8.2
> >
> >Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> 
> Reviewed-by: Julien Olivain <ju.o@free.fr>
> Tested-by: Julien Olivain <ju.o@free.fr>
> 
> >---
> > package/libjxl/libjxl.hash | 2 +-
> > package/libjxl/libjxl.mk   | 2 +-
> > 2 files changed, 2 insertions(+), 2 deletions(-)
> >
> >diff --git a/package/libjxl/libjxl.hash b/package/libjxl/libjxl.hash
> >index 6b4c9d8d0a..c8f98d10ea 100644
> >--- a/package/libjxl/libjxl.hash
> >+++ b/package/libjxl/libjxl.hash
> >@@ -1,4 +1,4 @@
> > # Locally computed:
> >-sha256  60f43921ad3209c9e180563025eda0c0f9b1afac51a2927b9ff59fff3950dc56
> >libjxl-0.8.1.tar.gz
> >+sha256  c70916fb3ed43784eb840f82f05d390053a558e2da106e40863919238fa7b420
> >libjxl-0.8.2.tar.gz
> > sha256  8405932022a556380c2d8c272eff154a923feb197233f348ce5f7334fb0a5ede
> >LICENSE
> > sha256  91915f8ae056a68a3c5bdf05d9f6f78bb6903e27a8ca3a8434c9e4ac87300575
> >PATENTS
> >diff --git a/package/libjxl/libjxl.mk b/package/libjxl/libjxl.mk
> >index f603327bf6..47c110eb53 100644
> >--- a/package/libjxl/libjxl.mk
> >+++ b/package/libjxl/libjxl.mk
> >@@ -4,7 +4,7 @@
> > #
> >################################################################################
> >
> >-LIBJXL_VERSION = 0.8.1
> >+LIBJXL_VERSION = 0.8.2
> > LIBJXL_SITE = $(call github,libjxl,libjxl,v$(LIBJXL_VERSION))
> > LIBJXL_LICENSE = BSD-3-Clause
> > LIBJXL_LICENSE_FILES = LICENSE PATENTS
> 
> Best regards,
> 
> Julien.
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot