diff --git a/.gitignore b/.gitignore index 921901c..8ddbfbf 100644 --- a/.gitignore +++ b/.gitignore @@ -54,3 +54,6 @@ LibRaw-0.9.1.tar.gz /LibRaw-0.18.4.tar.gz /LibRaw-demosaic-pack-GPL2-0.18.4.tar.gz /LibRaw-demosaic-pack-GPL3-0.18.4.tar.gz +/LibRaw-0.18.5.tar.gz +/LibRaw-demosaic-pack-GPL2-0.18.5.tar.gz +/LibRaw-demosaic-pack-GPL3-0.18.5.tar.gz diff --git a/LibRaw.spec b/LibRaw.spec index 27c3793..ac4d9c4 100644 --- a/LibRaw.spec +++ b/LibRaw.spec @@ -1,7 +1,7 @@ Summary: Library for reading RAW files obtained from digital photo cameras Name: LibRaw -Version: 0.18.4 -Release: 2%{?dist} +Version: 0.18.5 +Release: 1%{?dist} License: GPLv3+ Group: Development/Libraries URL: http://www.libraw.org @@ -14,7 +14,6 @@ Source1: http://www.libraw.org/data/%{name}-demosaic-pack-GPL2-%{version}.tar.gz Source2: http://www.libraw.org/data/%{name}-demosaic-pack-GPL3-%{version}.tar.gz Patch0: LibRaw-0.6.0-pkgconfig.patch Patch1: LibRaw-0.17.1-CVE-2015-8366-8367.patch -Patch2: d13e8f6d1e987b7491182040a188c16a395f1d21.patch Provides: bundled(dcraw) = 9.25 @@ -56,7 +55,6 @@ LibRaw sample programs %patch0 -p0 -b .pkgconfig %patch1 -p1 -b .CVE-2015-8366 -%patch2 -p1 -b .CVE-2017-14348 %build %configure --enable-examples=yes --enable-jasper --enable-lcms \ @@ -105,6 +103,9 @@ make install DESTDIR=%{buildroot} %postun -p /sbin/ldconfig %changelog +* Fri Sep 22 2017 Gwyn Ciesla - 0.18.5-1 +- 0.18.5 + * Fri Sep 15 2017 Gwyn Ciesla - 0.18.4-2 - Patch for CVE-2017-14348. diff --git a/d13e8f6d1e987b7491182040a188c16a395f1d21.patch b/d13e8f6d1e987b7491182040a188c16a395f1d21.patch deleted file mode 100644 index 76fe4df..0000000 --- a/d13e8f6d1e987b7491182040a188c16a395f1d21.patch +++ /dev/null @@ -1,70 +0,0 @@ -From d13e8f6d1e987b7491182040a188c16a395f1d21 Mon Sep 17 00:00:00 2001 -From: Alex Tutubalin -Date: Wed, 13 Sep 2017 09:31:01 +0300 -Subject: [PATCH] CVE-2017-1438 credits; fix for Kodak 65000 out of bounds - access - ---- - Changelog.txt | 6 +++++- - dcraw/dcraw.c | 11 +++++++++-- - internal/dcraw_common.cpp | 11 +++++++++-- - 3 files changed, 23 insertions(+), 5 deletions(-) - -diff --git a/Changelog.txt b/Changelog.txt -index 95bdc952..9b247882 100755 ---- a/Changelog.txt -+++ b/Changelog.txt -@@ -1,5 +1,9 @@ -+2017-09-13 Alex Tutubalin -+ * Fixed possible out of bound access in Kodak 6500 loader -+ - 2017-09-12 Alex Tutubalin -- * Fix for possible heap overrun in Canon makernotes parser -+ * CVE-2017-14348: Fix for possible heap overrun in Canon makernotes parser -+ Credit: Henri Salo from Nixu Corporation - * LibRaw 0.18.4 - - 2017-09-09 Alex Tutubalin -diff --git a/internal/dcraw_common.cpp b/internal/dcraw_common.cpp -index 18bcdbcb..8fb2b073 100644 ---- a/internal/dcraw_common.cpp -+++ b/internal/dcraw_common.cpp -@@ -3240,8 +3240,15 @@ void CLASS kodak_65000_load_raw() - len = MIN (256, width-col); - ret = kodak_65000_decode (buf, len); - for (i=0; i < len; i++) -- if ((RAW(row,col+i) = curve[ret ? buf[i] : -- (pred[i & 1] += buf[i])]) >> 12) derror(); -+ { -+ int idx = ret ? buf[i] : (pred[i & 1] += buf[i]); -+ if(idx >=0 && idx <= 0xffff) -+ { -+ if ((RAW(row,col+i) = curve[idx]) >> 12) derror(); -+ } -+ else -+ derror(); -+ } - } - } - } ---- LibRaw-0.18.4/dcraw/dcraw.c~ 2017-09-15 09:17:55.000000000 -0500 -+++ LibRaw-0.18.4/dcraw/dcraw.c 2017-09-15 09:20:29.532287605 -0500 -@@ -2589,8 +2589,16 @@ - len = MIN (256, width-col); - ret = kodak_65000_decode (buf, len); - for (i=0; i < len; i++) -- if ((RAW(row,col+i) = curve[ret ? buf[i] : -- (pred[i & 1] += buf[i])]) >> 12) derror(); -+ { -+ int idx = ret ? buf[i] : (pred[i & 1] += buf[i]); -+ if(idx >=0 && idx <= 0xffff) -+ { -+ if ((RAW(row,col+i) = curve[idx]) >> 12) derror(); -+ } -+ else -+ derror(); -+ } -+ - } - } - diff --git a/sources b/sources index d1d10e8..36643b0 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (LibRaw-0.18.4.tar.gz) = e71db23a70f0cda745ae862f4cb6a0c51c968e4c7399f28e86de8beb894526fa76cd337c1406e2eaee3f287f15e8912d1a0f7217493c6444a491ca3329f63776 -SHA512 (LibRaw-demosaic-pack-GPL2-0.18.4.tar.gz) = 05bef76530f9237e1d1bfe08014f30de328b68319f88d126aaffa8baf3b89615d160bac36a6ad2cc38cab0faeb8c4bf86714dd568e7f01cfd1ee2513ac175a5d -SHA512 (LibRaw-demosaic-pack-GPL3-0.18.4.tar.gz) = 158d951d0e1c35f1ebdde8849f0b51e23332c8b5b13a4b0ab0677a3d4a1682afd6e7c5dec4194072b4588699bf49a023591fa1b05d2a8f4c54cd1a44e65e3ad9 +SHA512 (LibRaw-0.18.5.tar.gz) = 751a1c54507b7408d0d36c3f1fb0e31928f5ae540fae42eb2b57d8fcebcd44134dc452a4f3838dd31dbc8fb3978a6cac6129429a3350f8be5dc44146309aff81 +SHA512 (LibRaw-demosaic-pack-GPL2-0.18.5.tar.gz) = 1599695394717558e61844e32d76bf653741592d81691c9f55bfb72c8c5d485bce4eab3fc0eefd37640254c431bd78706fe04ca547e42566dda789f0b6559af5 +SHA512 (LibRaw-demosaic-pack-GPL3-0.18.5.tar.gz) = c00193b64673e093c33a9d1316448eea4eb7e2b274d5d3bd39cef02b7269e56ce72f9b47831039e00b2feb8344b5266f9c03b5f11212d520809674db253cb028