|
 |
d78456 |
From a7b920bdbde1ee15a1a470d743dbae69ee398c75 Mon Sep 17 00:00:00 2001
|
|
|
d78456 |
From: Kevin Backhouse <kevinbackhouse@github.com>
|
|
|
d78456 |
Date: Wed, 30 Jun 2021 16:47:12 +0100
|
|
|
d78456 |
Subject: [PATCH 1/2] Regression test for
|
|
|
d78456 |
https://github.com/Exiv2/exiv2/security/advisories/GHSA-mxw9-qx4c-6m8v
|
|
|
d78456 |
|
|
|
d78456 |
---
|
|
|
d78456 |
test/data/issue_ghsa_mxw9_qx4c_6m8v_poc.jp2 | Bin 0 -> 1692 bytes
|
|
|
d78456 |
.../github/test_issue_ghsa_mxw9_qx4c_6m8v.py | 18 ++++++++++++++++++
|
|
|
d78456 |
2 files changed, 18 insertions(+)
|
|
|
d78456 |
create mode 100644 test/data/issue_ghsa_mxw9_qx4c_6m8v_poc.jp2
|
|
|
d78456 |
create mode 100644 tests/bugfixes/github/test_issue_ghsa_mxw9_qx4c_6m8v.py
|
|
|
d78456 |
|
|
|
d78456 |
diff --git a/tests/bugfixes/github/test_issue_ghsa_mxw9_qx4c_6m8v.py b/tests/bugfixes/github/test_issue_ghsa_mxw9_qx4c_6m8v.py
|
|
|
d78456 |
new file mode 100644
|
|
|
d78456 |
index 0000000000..8f8b6676cf
|
|
|
d78456 |
--- /dev/null
|
|
|
d78456 |
+++ b/tests/bugfixes/github/test_issue_ghsa_mxw9_qx4c_6m8v.py
|
|
|
d78456 |
@@ -0,0 +1,18 @@
|
|
|
d78456 |
+# -*- coding: utf-8 -*-
|
|
|
d78456 |
+
|
|
|
d78456 |
+from system_tests import CaseMeta, CopyTmpFiles, path, check_no_ASAN_UBSAN_errors
|
|
|
d78456 |
+@CopyTmpFiles("$data_path/issue_ghsa_mxw9_qx4c_6m8v_poc.jp2")
|
|
|
d78456 |
+
|
|
|
d78456 |
+class Jp2ImageEncodeJp2HeaderOutOfBoundsRead2(metaclass=CaseMeta):
|
|
|
d78456 |
+ """
|
|
|
d78456 |
+ Regression test for the bug described in:
|
|
|
d78456 |
+ https://github.com/Exiv2/exiv2/security/advisories/GHSA-mxw9-qx4c-6m8v
|
|
|
d78456 |
+ """
|
|
|
d78456 |
+ url = "https://github.com/Exiv2/exiv2/security/advisories/GHSA-mxw9-qx4c-6m8v"
|
|
|
d78456 |
+
|
|
|
d78456 |
+ filename = path("$tmp_path/issue_ghsa_mxw9_qx4c_6m8v_poc.jp2")
|
|
|
d78456 |
+ commands = ["$exiv2 rm $filename"]
|
|
|
d78456 |
+ stdout = [""]
|
|
|
d78456 |
+ retval = [0]
|
|
|
d78456 |
+
|
|
|
d78456 |
+ compare_stderr = check_no_ASAN_UBSAN_errors
|
|
|
d78456 |
|
|
|
d78456 |
From 9be257340193dbe3fb810aa33531c40ae9df6414 Mon Sep 17 00:00:00 2001
|
|
|
d78456 |
From: Kevin Backhouse <kevinbackhouse@github.com>
|
|
|
d78456 |
Date: Wed, 30 Jun 2021 16:47:50 +0100
|
|
|
d78456 |
Subject: [PATCH 2/2] Fix incorrect loop condition.
|
|
|
d78456 |
|
|
|
d78456 |
---
|
|
|
d78456 |
src/jp2image.cpp | 6 ++++--
|
|
|
d78456 |
.../bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py | 11 +++++------
|
|
|
d78456 |
2 files changed, 9 insertions(+), 8 deletions(-)
|
|
|
d78456 |
|
|
|
d78456 |
diff --git a/src/jp2image.cpp b/src/jp2image.cpp
|
|
|
d78456 |
index b6a388542f..3bf3566294 100644
|
|
|
d78456 |
--- a/src/jp2image.cpp
|
|
|
d78456 |
+++ b/src/jp2image.cpp
|
|
|
d78456 |
@@ -656,12 +656,14 @@ static void boxes_check(size_t b,size_t m)
|
|
|
d78456 |
char* p = (char*) boxBuf.pData_;
|
|
|
d78456 |
bool bWroteColor = false ;
|
|
|
d78456 |
|
|
|
d78456 |
- while ( count < length || !bWroteColor ) {
|
|
|
d78456 |
+ while ( count < length && !bWroteColor ) {
|
|
|
d78456 |
enforce(sizeof(Jp2BoxHeader) <= length - count, Exiv2::kerCorruptedMetadata);
|
|
|
d78456 |
Jp2BoxHeader* pSubBox = (Jp2BoxHeader*) (p+count) ;
|
|
|
d78456 |
|
|
|
d78456 |
// copy data. pointer could be into a memory mapped file which we will decode!
|
|
|
d78456 |
- Jp2BoxHeader subBox = *pSubBox ;
|
|
|
d78456 |
+ // pSubBox isn't always an aligned pointer, so use memcpy to do the copy.
|
|
|
d78456 |
+ Jp2BoxHeader subBox;
|
|
|
d78456 |
+ memcpy(&subBox, pSubBox, sizeof(Jp2BoxHeader));
|
|
|
d78456 |
Jp2BoxHeader newBox = subBox;
|
|
|
d78456 |
|
|
|
d78456 |
if ( count < length ) {
|
|
|
d78456 |
diff --git a/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py b/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py
|
|
|
d78456 |
index c98b3815eb..44f6a906cb 100644
|
|
|
d78456 |
--- a/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py
|
|
|
d78456 |
+++ b/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py
|
|
|
d78456 |
@@ -1,7 +1,7 @@
|
|
|
d78456 |
# -*- coding: utf-8 -*-
|
|
|
d78456 |
|
|
|
d78456 |
-from system_tests import CaseMeta, path
|
|
|
d78456 |
-
|
|
|
d78456 |
+from system_tests import CaseMeta, CopyTmpFiles, path
|
|
|
d78456 |
+@CopyTmpFiles("$data_path/issue_ghsa_8949_hhfh_j7rj_poc.jp2","$data_path/issue_ghsa_8949_hhfh_j7rj_poc.exv")
|
|
|
d78456 |
|
|
|
d78456 |
class Jp2ImageEncodeJp2HeaderOutOfBoundsRead(metaclass=CaseMeta):
|
|
|
d78456 |
"""
|
|
|
d78456 |
@@ -10,13 +10,12 @@ class Jp2ImageEncodeJp2HeaderOutOfBoundsRead(metaclass=CaseMeta):
|
|
|
d78456 |
"""
|
|
|
d78456 |
url = "https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj"
|
|
|
d78456 |
|
|
|
d78456 |
- filename1 = path("$data_path/issue_ghsa_8949_hhfh_j7rj_poc.jp2")
|
|
|
d78456 |
- filename2 = path("$data_path/issue_ghsa_8949_hhfh_j7rj_poc.exv")
|
|
|
d78456 |
+ filename1 = path("$tmp_path/issue_ghsa_8949_hhfh_j7rj_poc.jp2")
|
|
|
d78456 |
+ filename2 = path("$tmp_path/issue_ghsa_8949_hhfh_j7rj_poc.exv")
|
|
|
d78456 |
commands = ["$exiv2 in $filename1"]
|
|
|
d78456 |
stdout = [""]
|
|
|
d78456 |
stderr = [
|
|
|
d78456 |
"""Error: XMP Toolkit error 201: XML parsing failure
|
|
|
d78456 |
Warning: Failed to decode XMP metadata.
|
|
|
d78456 |
-$filename1: Could not write metadata to file: $kerCorruptedMetadata
|
|
|
d78456 |
"""]
|
|
|
d78456 |
- retval = [1]
|
|
|
d78456 |
+ retval = [0]
|