Re: [Buildroot] [PATCH 1/1] package/libjxl: security bump to version 0.8.2

From: Julien Olivain <ju.o@free.fr>
To: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>, buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH 1/1] package/libjxl: security bump to version 0.8.2
Date: Fri, 15 Sep 2023 21:30:07 +0200	[thread overview]
Message-ID: <80eccb888c17302f362990c956de8529@free.fr> (raw)
In-Reply-To: <20230914215606.309735-1-fontaine.fabrice@gmail.com>

Hi Fabrice,

I tested this patch on branch master at commit 3557a7b
with commands:

     support/testing/run-tests \
         -d dl -o output_folder \
         tests.package.test_libjxl
     ...
     OK

While trying with:

     utils/test-pkg -a -p libjxl
     ...
         bootlin-riscv32-glibc [17/45]: FAILED
         bootlin-riscv64-glibc [18/45]: FAILED
          bootlin-riscv64-musl [19/45]: FAILED
     ...
     45 builds, 11 skipped, 3 build failed, 0 legal-info failed, 0 
show-info failed

I had those 3 build failures. They were introduced by v0.8.1 and are
unrelated to this patch. I proposed a fix at:
https://patchwork.ozlabs.org/project/buildroot/patch/20230915192308.1432032-1-ju.o@free.fr/

and also made sure this fix works for both v0.8.1 and v0.8.2 proposed in
this patch.

On 14/09/2023 23:56, Fabrice Fontaine wrote:
> Fix CVE-2023-35790: An issue was discovered in dec_patch_dictionary.cc
> in libjxl before 0.8.2. An integer underflow in patch decoding can lead
> to a denial of service, such as an infinite loop.
> 
> https://github.com/libjxl/libjxl/releases/tag/v0.8.2
> 
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Reviewed-by: Julien Olivain <ju.o@free.fr>
Tested-by: Julien Olivain <ju.o@free.fr>

> ---
>  package/libjxl/libjxl.hash | 2 +-
>  package/libjxl/libjxl.mk   | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/package/libjxl/libjxl.hash b/package/libjxl/libjxl.hash
> index 6b4c9d8d0a..c8f98d10ea 100644
> --- a/package/libjxl/libjxl.hash
> +++ b/package/libjxl/libjxl.hash
> @@ -1,4 +1,4 @@
>  # Locally computed:
> -sha256  
> 60f43921ad3209c9e180563025eda0c0f9b1afac51a2927b9ff59fff3950dc56  
> libjxl-0.8.1.tar.gz
> +sha256  
> c70916fb3ed43784eb840f82f05d390053a558e2da106e40863919238fa7b420  
> libjxl-0.8.2.tar.gz
>  sha256  
> 8405932022a556380c2d8c272eff154a923feb197233f348ce5f7334fb0a5ede  
> LICENSE
>  sha256  
> 91915f8ae056a68a3c5bdf05d9f6f78bb6903e27a8ca3a8434c9e4ac87300575  
> PATENTS
> diff --git a/package/libjxl/libjxl.mk b/package/libjxl/libjxl.mk
> index f603327bf6..47c110eb53 100644
> --- a/package/libjxl/libjxl.mk
> +++ b/package/libjxl/libjxl.mk
> @@ -4,7 +4,7 @@
>  #
>  
> ################################################################################
> 
> -LIBJXL_VERSION = 0.8.1
> +LIBJXL_VERSION = 0.8.2
>  LIBJXL_SITE = $(call github,libjxl,libjxl,v$(LIBJXL_VERSION))
>  LIBJXL_LICENSE = BSD-3-Clause
>  LIBJXL_LICENSE_FILES = LICENSE PATENTS

Best regards,

Julien.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot