!128 fix CVE-2024-56827

From: @changtao615 
Reviewed-by: @t_feng 
Signed-off-by: @t_feng

backport-CVE-2021-3575.patch

@@ -1,35 +1,43 @@
-From f4cb033a340b55dbc576453c4b6a967fec5cbbda Mon Sep 17 00:00:00 2001
-From: Mehdi Sabwat <mehdisabwat@gmail.com>
-Date: Fri, 7 May 2021 01:50:37 +0200
-Subject: [PATCH] fix heap buffer overflow #1347
-
-Conflict:NA
-Reference:https://github.com/uclouvain/openjpeg/commit/f4cb033a340b55dbc576453c4b6a967fec5cbbda
+From 7bd884f8750892de4f50bf4642fcfbe7011c6bdf Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sun, 18 Feb 2024 17:02:25 +0100
+Subject: [PATCH] opj_decompress: fix off-by-one read heap-buffer-overflow in
+ sycc420_to_rgb() when x0 and y0 are odd (CVE-2021-3575, fixes #1347)
+
+Reference:https://github.com/uclouvain/openjpeg/commit/7bd884f8750892de4f50bf4642fcfbe7011c6bdf
+Conflict:NA
 
 ---
- src/bin/common/color.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
+ src/bin/common/color.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
 
 diff --git a/src/bin/common/color.c b/src/bin/common/color.c
-index 27f15f137..935fa44eb 100644
+index 27f15f137..ae5d648da 100644
 --- a/src/bin/common/color.c
 +++ b/src/bin/common/color.c
-@@ -368,12 +368,15 @@ static void sycc420_to_rgb(opj_image_t *img)
+@@ -358,7 +358,15 @@ static void sycc420_to_rgb(opj_image_t *img)
+     if (i < loopmaxh) {
+         size_t j;
  
+-        for (j = 0U; j < (maxw & ~(size_t)1U); j += 2U) {
++        if (offx > 0U) {
++            sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b);
++            ++y;
++            ++r;
++            ++g;
++            ++b;
++        }
++
++        for (j = 0U; j < (loopmaxw & ~(size_t)1U); j += 2U) {
              sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
  
--            ++y;
-+            if (*y != img->comps[0].data[loopmaxh])
-+                ++y;
-             ++r;
-             ++g;
-             ++b;
--            ++cb;
--            ++cr;
-+            if (*cb != img->comps[1].data[loopmaxh])
-+                ++cb;
-+            if (*cr != img->comps[2].data[loopmaxh])
-+                ++cr;
+             ++y;
+@@ -375,7 +383,7 @@ static void sycc420_to_rgb(opj_image_t *img)
+             ++cb;
+             ++cr;
          }
-         if (j < maxw) {
+-        if (j < maxw) {
++        if (j < loopmaxw) {
              sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
+         }
+     }

backport-CVE-2022-1122.patch

@@ -0,0 +1,29 @@
+From 0afbdcf3e6d0d2bd2e16a0c4d513ee3cf86e460d Mon Sep 17 00:00:00 2001
+From: xiaoxiaoafeifei <lliangliang2007@163.com>
+Date: Wed, 14 Jul 2021 09:35:13 +0800
+Subject: [PATCH] Fix segfault in src/bin/jp2/opj_decompress.c due to
+ uninitialized pointer (fixes #1368) (#1369)
+
+Conflict:NA
+Reference:https://github.com/uclouvain/openjpeg/commit/0afbdcf3e6d0d2bd2e16a0c4d513ee3cf86e460d
+
+---
+ src/bin/jp2/opj_decompress.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/bin/jp2/opj_decompress.c b/src/bin/jp2/opj_decompress.c
+index cdc543a..f32e702 100644
+--- a/src/bin/jp2/opj_decompress.c
++++ b/src/bin/jp2/opj_decompress.c
+@@ -1351,7 +1351,7 @@ int main(int argc, char **argv)
+         int it_image;
+         num_images = get_num_images(img_fol.imgdirpath);
+ 
+-        dirptr = (dircnt_t*)malloc(sizeof(dircnt_t));
++        dirptr = (dircnt_t*)calloc(1, sizeof(dircnt_t));
+         if (!dirptr) {
+             destroy_parameters(&parameters);
+             return EXIT_FAILURE;
+-- 
+2.27.0
+

backport-CVE-2023-39328.patch

@@ -0,0 +1,32 @@
+From b287b27a87ecfbbd3b1206b17269d19e76a1b467 Mon Sep 17 00:00:00 2001
+From: pic4xiu <40382944+pic4xiu@users.noreply.github.com>
+Date: Thu, 29 Jun 2023 19:50:47 +0800
+Subject: [PATCH] Update opj_malloc.c
+
+Conflict: NA
+Reference: https://github.com/uclouvain/openjpeg/commit/b287b27a87ecfbbd3b1206b17269d19e76a1b467
+---
+ src/lib/openjp2/opj_malloc.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/src/lib/openjp2/opj_malloc.c b/src/lib/openjp2/opj_malloc.c
+index dca91bfcb..6242614f9 100644
+--- a/src/lib/openjp2/opj_malloc.c
++++ b/src/lib/openjp2/opj_malloc.c
+@@ -197,6 +197,16 @@ void * opj_malloc(size_t size)
+ }
+ void * opj_calloc(size_t num, size_t size)
+ {
++    static unsigned long long allocated_size = 0;
++    static unsigned long long max_allocated_size = 4ULL * 1024 * 1024 * 1024;
++    /*Restrict this function can only malloc 4GB of memory*/
++    
++    unsigned long long total_size = (unsigned long long)(num * size);
++    allocated_size += total_size;
++    if (allocated_size > max_allocated_size) {
++        /*Prevent excessive resource allocation*/
++        return NULL;
++    }
+     if (num == 0 || size == 0) {
+         /* prevent implementation defined behavior of realloc */
+         return NULL;

backport-CVE-2024-56826.patch

@@ -0,0 +1,122 @@
+From 98592ee6d6904f1b48e8207238779b89a63befa2 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Mon, 25 Nov 2024 23:11:24 +0100
+Subject: [PATCH] sycc422_to_rgb(): fix out-of-bounds read accesses when 2 *
+ width_component_1_or_2 + 1 == with_component_0
+
+Fixes #1563
+
+Also adjusts sycc420_to_rgb() for potential similar issue (amending
+commit 7bd884f8750892de4f50bf4642fcfbe7011c6bdf)
+---
+ src/bin/common/color.c | 42 ++++++++++++++++++++++++++++++++----------
+ 1 file changed, 32 insertions(+), 10 deletions(-)
+
+diff --git a/src/bin/common/color.c b/src/bin/common/color.c
+index ae5d648da..e4924a152 100644
+--- a/src/bin/common/color.c
++++ b/src/bin/common/color.c
+@@ -158,7 +158,7 @@ static void sycc422_to_rgb(opj_image_t *img)
+ {
+     int *d0, *d1, *d2, *r, *g, *b;
+     const int *y, *cb, *cr;
+-    size_t maxw, maxh, max, offx, loopmaxw;
++    size_t maxw, maxh, max, offx, loopmaxw, comp12w;
+     int offset, upb;
+     size_t i;
+ 
+@@ -167,6 +167,7 @@ static void sycc422_to_rgb(opj_image_t *img)
+     upb = (1 << upb) - 1;
+ 
+     maxw = (size_t)img->comps[0].w;
++    comp12w = (size_t)img->comps[1].w;
+     maxh = (size_t)img->comps[0].h;
+     max = maxw * maxh;
+ 
+@@ -212,13 +213,19 @@ static void sycc422_to_rgb(opj_image_t *img)
+             ++cr;
+         }
+         if (j < loopmaxw) {
+-            sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++            if (j / 2 == comp12w) {
++                sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b);
++            } else {
++                sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++            }
+             ++y;
+             ++r;
+             ++g;
+             ++b;
+-            ++cb;
+-            ++cr;
++            if (j / 2 < comp12w) {
++                ++cb;
++                ++cr;
++            }
+         }
+     }
+ 
+@@ -246,7 +253,7 @@ static void sycc420_to_rgb(opj_image_t *img)
+ {
+     int *d0, *d1, *d2, *r, *g, *b, *nr, *ng, *nb;
+     const int *y, *cb, *cr, *ny;
+-    size_t maxw, maxh, max, offx, loopmaxw, offy, loopmaxh;
++    size_t maxw, maxh, max, offx, loopmaxw, offy, loopmaxh, comp12w;
+     int offset, upb;
+     size_t i;
+ 
+@@ -255,6 +262,7 @@ static void sycc420_to_rgb(opj_image_t *img)
+     upb = (1 << upb) - 1;
+ 
+     maxw = (size_t)img->comps[0].w;
++    comp12w = (size_t)img->comps[1].w;
+     maxh = (size_t)img->comps[0].h;
+     max = maxw * maxh;
+ 
+@@ -336,19 +344,29 @@ static void sycc420_to_rgb(opj_image_t *img)
+             ++cr;
+         }
+         if (j < loopmaxw) {
+-            sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++            if (j / 2 == comp12w) {
++                sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b);
++            } else {
++                sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++            }
+             ++y;
+             ++r;
+             ++g;
+             ++b;
+ 
+-            sycc_to_rgb(offset, upb, *ny, *cb, *cr, nr, ng, nb);
++            if (j / 2 == comp12w) {
++                sycc_to_rgb(offset, upb, *ny, 0, 0, nr, ng, nb);
++            } else {
++                sycc_to_rgb(offset, upb, *ny, *cb, *cr, nr, ng, nb);
++            }
+             ++ny;
+             ++nr;
+             ++ng;
+             ++nb;
+-            ++cb;
+-            ++cr;
++            if (j / 2 < comp12w) {
++                ++cb;
++                ++cr;
++            }
+         }
+         y += maxw;
+         r += maxw;
+@@ -384,7 +402,11 @@ static void sycc420_to_rgb(opj_image_t *img)
+             ++cr;
+         }
+         if (j < loopmaxw) {
+-            sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++            if (j / 2 == comp12w) {
++                sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b);
++            } else {
++                sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++            }
+         }
+     }
+ 

backport-CVE-2024-56827.patch

@@ -0,0 +1,28 @@
+From e492644fbded4c820ca55b5e50e598d346e850e8 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Mon, 25 Nov 2024 22:02:54 +0100
+Subject: [PATCH] opj_j2k_add_tlmarker(): validate that current tile-part
+ number if smaller that total number of tile-parts
+
+Fixes #1564
+---
+ src/lib/openjp2/j2k.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c
+index 5df7940..3b2ade8 100644
+--- a/src/lib/openjp2/j2k.c
++++ b/src/lib/openjp2/j2k.c
+@@ -7463,7 +7463,8 @@ static OPJ_BOOL opj_j2k_add_tlmarker(OPJ_UINT32 tileno,
+     if (type == J2K_MS_SOT) {
+         OPJ_UINT32 l_current_tile_part = cstr_index->tile_index[tileno].current_tpsno;
+ 
+-        if (cstr_index->tile_index[tileno].tp_index) {
++        if (cstr_index->tile_index[tileno].tp_index &&
++                l_current_tile_part < cstr_index->tile_index[tileno].nb_tps) {
+             cstr_index->tile_index[tileno].tp_index[l_current_tile_part].start_pos = pos;
+         }
+ 
+-- 
+2.46.0
+

openjpeg2.spec

@@ -1,6 +1,6 @@
 Name:           openjpeg2
 Version:        2.3.1
-Release:        10
+Release:        15
 Summary:        C-Library for JPEG 2000
 License:        BSD and MIT
 URL:            https://github.com/uclouvain/openjpeg
@@ -25,7 +25,11 @@ Patch6013:      backport-CVE-2020-27842.patch
 Patch6014:      backport-0001-CVE-2019-12973.patch
 Patch6015:      backport-0002-CVE-2019-12973.patch
 Patch6016:      backport-CVE-2021-3575.patch
-
+Patch6017:      backport-CVE-2022-1122.patch
+Patch6018:      backport-CVE-2023-39328.patch
+Patch6019:      backport-CVE-2024-56826.patch
+Patch6020:      backport-CVE-2024-56827.patch
+ 
 BuildRequires:  cmake gcc-c++ make zlib-devel libpng-devel libtiff-devel lcms2-devel doxygen
 
 Provides:       %{name}-tools
@@ -101,6 +105,27 @@ mv %{buildroot}%{_mandir}/man1/opj_dump.1 %{buildroot}%{_mandir}/man1/opj2_dump.
 %{_mandir}/man3/*.3*
 
 %changelog
+* Tue Jan 7 2025 changtao <changtao@kylinos.cn> - 2.3.1-15
+- Type: CVE
+- CVE: CVE-2024-56827
+- SUG: NA
+- DESC: fix CVE-2024-56827
+
+* Tue Jan 7 2025 zhangpan <zhangpan103@h-partners.com> - 2.3.1-14
+- fix CVE-2024-56826
+
+* Tue Oct 29 2024 zhangpan <zhangpan103@h-partners.com> - 2.3.1-13
+- fix CVE-2021-3575
+
+* Thu Jul 11 2024 xinghe <xinghe2@h-partners.com> - 2.3.1-12
+- Type:cves
+- ID:CVE-2023-39328
+- SUG:NA
+- DESC:fix CVE-2023-39328
+
+* Mon May 16 2022 dongyuzhen <dongyuzhen@h-partners.com> - 2.3.1-11
+- fix CVE-2022-1122
+
 * Tue Apr 12 2022 dongyuzhen <dongyuzhen@h-partners.com> - 2.3.1-10
 - fix the issue of opj2_compress/opj2_decompress don't work with png/tiff images