64f840
64f840
# NOTE: packages that can use jasper:
64f840
# ImageMagick
64f840
# netpbm
64f840
64f840
Summary: Implementation of the JPEG-2000 standard, Part 1
64f840
Name:    jasper
64f840
Version: 2.0.14
48da38
Release: 5%{?dist}
64f840
64f840
License: JasPer
64f840
URL:     http://www.ece.uvic.ca/~frodo/jasper/
64f840
Source0: http://www.ece.uvic.ca/~frodo/jasper/software/jasper-%{version}.tar.gz
64f840
64f840
64f840
Patch1: jasper-2.0.14-CVE-2016-9396.patch
48da38
Patch2: jasper-2.0.14-CVE-2021-26927.patch
48da38
Patch3: jasper-2.0.14-CVE-2021-3272.patch
48da38
Patch4: jasper-2.0.14-CVE-2020-27828.patch
48da38
64f840
# architecture related patches
64f840
Patch100: jasper-2.0.2-test-ppc64-disable.patch
64f840
Patch101: jasper-2.0.2-test-ppc64le-disable.patch
64f840
64f840
# autoreconf
64f840
BuildRequires: cmake
64f840
BuildRequires: freeglut-devel 
64f840
BuildRequires: libGLU-devel
64f840
BuildRequires: libjpeg-devel
64f840
BuildRequires: libXmu-devel libXi-devel
64f840
BuildRequires: pkgconfig doxygen
64f840
BuildRequires: mesa-libGL-devel
64f840
BuildRequires: gcc
64f840
64f840
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
64f840
64f840
%description
64f840
This package contains an implementation of the image compression
64f840
standard JPEG-2000, Part 1. It consists of tools for conversion to and
64f840
from the JP2 and JPC formats.
64f840
64f840
%package devel
64f840
Summary: Header files, libraries and developer documentation
64f840
Provides: libjasper-devel = %{version}-%{release}
64f840
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
64f840
Requires: libjpeg-devel
64f840
Requires: pkgconfig
64f840
%description devel
64f840
%{summary}.
64f840
64f840
%package libs
64f840
Summary: Runtime libraries for %{name}
64f840
Conflicts: jasper < 1.900.1-4
64f840
%description libs
64f840
%{summary}.
64f840
64f840
%package utils
64f840
Summary: Nonessential utilities for %{name}
64f840
Requires: %{name} = %{version}-%{release}
64f840
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
64f840
%description utils
64f840
%{summary}, including jiv and tmrdemo.
64f840
64f840
64f840
%prep
64f840
%setup -q -n %{name}-%{version}
64f840
64f840
%patch1 -p1 -b .CVE-2016-9396
48da38
%patch2 -p1 -b .CVE-2021-26927
48da38
%patch3 -p1 -b .CVE-2021-3272
48da38
%patch4 -p1 -b .CVE-2020-27828
64f840
# Need to disable one test to be able to build it on ppc64 arch
64f840
# At ppc64 this test just stuck (nothing happend - no exception or error)
64f840
64f840
%if "%{_arch}" == "ppc64"
64f840
%patch100 -p1 -b .test-ppc64-disable
64f840
%endif
64f840
64f840
# Need to disable two tests to be able to build it on ppc64le arch
64f840
# At ppc64le this tests just stuck (nothing happend - no exception or error)
64f840
64f840
%if "%{_arch}" == "ppc64le"
64f840
%patch101 -p1 -b .test-ppc64le-disable
64f840
%endif
64f840
64f840
64f840
mkdir -p builder
64f840
64f840
%cmake -G "Unix Makefiles" \
64f840
       -H%{_builddir}/%{name}-%{version} \
64f840
       -B%{_builddir}/%{name}-%{version}/builder
64f840
64f840
64f840
%build
64f840
pushd builder
64f840
make clean all
64f840
64f840
popd
64f840
64f840
%install
64f840
pushd builder
64f840
make install DESTDIR=%{buildroot}
64f840
64f840
#%if "%{_arch}" != "arm" && "%{_arch}" != "i386"
64f840
#	mv %{buildroot}/usr/lib %{buildroot}/usr/lib64
64f840
#%endif
64f840
64f840
# Unpackaged files
64f840
rm -f doc/README
64f840
rm -f %{buildroot}%{_libdir}/lib*.la
64f840
popd
64f840
64f840
%check
64f840
pushd builder
64f840
make test
64f840
64f840
popd
64f840
64f840
%ldconfig_scriptlets libs
64f840
64f840
64f840
%files
64f840
%{_bindir}/imgcmp
64f840
%{_bindir}/imginfo
64f840
%{_bindir}/jasper
64f840
%{_mandir}/man1/img*
64f840
%{_mandir}/man1/jasper.1*
64f840
%{_docdir}/JasPer/*
64f840
64f840
%files devel
64f840
%doc doc/*
64f840
%{_includedir}/jasper/
64f840
%{_libdir}/libjasper.so
64f840
%{_libdir}/pkgconfig/jasper.pc
64f840
64f840
%files libs
64f840
%doc COPYRIGHT LICENSE README
64f840
%{_libdir}/libjasper.so*
64f840
64f840
%files utils
64f840
%{_bindir}/jiv
64f840
%{_mandir}/man1/jiv.1*
64f840
64f840
64f840
%changelog
48da38
* Tue Jun 01 2021 Josef Ridky <jridky@redhat.com> - 2.0.14-5
48da38
- Fix CVE-2021-26927 (#1933860)
48da38
- Fix CVE-2021-26926 (#1922316)
48da38
- Fix CVE-2021-3272 (#1922283)
48da38
- Fix CVE-2020-27828 (#1905692)
48da38
64f840
* Wed May 30 2018 Josef Ridky <jridky@redhat.com> - 2.0.14-4
64f840
- Fix CVE-2016-9396 (#1583722)
64f840
64f840
* Mon Feb 26 2018 Josef Ridky <jridky@redhat.com> - 2.0.14-3
64f840
- Clean spec file
64f840
- Remove unused Group tag
64f840
- Add gcc requirement
64f840
- Use ldconfig scriptlet
64f840
64f840
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.14-2
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
64f840
64f840
* Fri Sep 15 2017 rebase-helper <rebase-helper@localhost.local> - 2.0.14-1
64f840
- New upstream release 2.0.14 (#1491888)
64f840
64f840
* Fri Aug 25 2017 Josef Ridky <jridky@redhat.com> - 2.0.12-4
64f840
- CVE-2017-1000050 jasper: NULL pointer exception in jp2_encode() (#1472888)
64f840
64f840
* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.12-3
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
64f840
64f840
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.12-2
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
64f840
64f840
* Fri Mar 03 2017 Josef Ridky <jridky@redhat.com> - 2.0.12-1
64f840
- New upstream release 2.0.12 (#1428622)
64f840
64f840
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.10-2
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
64f840
64f840
* Tue Jan 17 2017 Josef Ridky <jridky@redhat.com> - 2.0.10-1
64f840
- New upstream release 2.0.10 (#1403401)
64f840
64f840
* Thu Dec  1 2016 Josef Ridky <jridky@redhat.com> - 2.0.2-1
64f840
- New upstream release 2.0.2 (#1395929)
64f840
- CVE-2016-9262 jasper: Multiple overflow vulnerabilities leading to use after free (#1393883)
64f840
- CVE-2016-8654 jasper: Heap-based buffer overflow in QMFB code in JPC codec (#1399168)
64f840
- CVE-2016-9388 jasper: Reachable assertion in RAS encoder/decoder
64f840
- CVE-2016-9389 jasper: Improper equality testing of component domains via assertion
64f840
- CVE-2016-9390 jasper: Assertion failure when tiles lie outside of the image area
64f840
- CVE-2016-9391 jasper: reachable assertions in the JPC bitstream code
64f840
- CVE-2016-9392 jasper: Missing sanity checks on the date in SIZ marker segment
64f840
- CVE-2016-9393 jasper: Missing sanity checks on the date in SIZ marker segment
64f840
- CVE-2016-9394 jasper: Missing sanity checks on the data in a SIZ marker segment
64f840
- CVE-2016-9395 jasper: Assertion failure in jas_seq2d_create
64f840
- CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
64f840
- CVE-2016-9560 jasper: Stack-based buffer overflow in jpc_tsfb.c
64f840
- Upgrade libjasper.so.1* to libjasper.so.4*
64f840
64f840
* Mon Oct 24 2016 Josef Ridky <jridky@redhat.com> - 1.900.13-1
64f840
- New upstream release 1.900.13 (#1385637)
64f840
- Release contains security fix for CVE-2016-8690, CVE-2016-8691, CVE-2016-8692, CVE-2016-8693 (#1385516)
64f840
64f840
* Thu Oct 13 2016 Josef Ridky <jridky@redhat.com> - 1.900.3-1
64f840
- New upstream release 1.900.3
64f840
64f840
* Tue Oct 11 2016 Josef Ridky <jridky@redhat.com> - 1.900.2-2
64f840
- CVE-2016-2089 - matrix rows_ NULL pointer dereference in jas_matrix_clip() (#1302636)
64f840
64f840
* Mon Oct 10 2016 Josef Ridky <jridky@redhat.com> - 1.900.2-1
64f840
- New upstream release 1.900.2 (#1382188)
64f840
64f840
* Thu Sep 15 2016 Dave Airlie <airlied@redhat.com> - 1.900.1-34
64f840
- patch 14 is an ABI break, this breaks gnome-software and steam
64f840
- this would require a new revision of the .so to fix properly
64f840
- as sizeof (int) != sizeof (size_t)
64f840
64f840
* Fri Aug 12 2016 Josef Ridky <jridky@redhat.com> - 1.900.1-33
64f840
- CVE-2015-5203 - double free in jasper_image_stop_load() (#1254244)
64f840
- CVE-2015-5221 - Use-after-free and double-free flaws (#1255714)
64f840
- CVE-2016-1867 - out-of-bounds read in the jpc_pi_nextcprl() function (#1298138)
64f840
- CVE-2016-1577 - double free vulnerability in jas_iccattrval_destroy (#1314468)
64f840
- CVE-2016-2116 - memory leak in jas_iccprof_createfrombuf causing 
64f840
		  memory consumption (#1314473)
64f840
64f840
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.900.1-32
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
64f840
64f840
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.900.1-31
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
64f840
64f840
* Thu Jan 22 2015 Jiri Popelka <jpopelka@redhat.com> - 1.900.1-30
64f840
- CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1184750)
64f840
- CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1184750)
64f840
64f840
* Thu Dec 18 2014 Jiri Popelka <jpopelka@redhat.com> - 1.900.1-29
64f840
- CVE-2014-8137 - double-free in jas_iccattrval_destroy() (oCERT-2014-012) (#1175761)
64f840
- CVE-2014-8138 - heap overflow in jp2_decode() (oCERT-2014-012) (#1175761)
64f840
64f840
* Thu Dec 04 2014 Jiri Popelka <jpopelka@redhat.com> - 1.900.1-28
64f840
- CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
64f840
                  marker segment decoders (#1170650)
64f840
64f840
* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.900.1-27
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
64f840
64f840
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.900.1-26
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
64f840
64f840
* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.900.1-25
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
64f840
64f840
* Mon Mar 25 2013 Jiri Popelka <jpopelka@redhat.com> - 1.900.1-24
64f840
- added --force option to autoreconf (#925604)
64f840
64f840
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.900.1-23
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
64f840
64f840
* Fri Jan 18 2013 Adam Tkac <atkac redhat com> - 1.900.1-22
64f840
- rebuild due to "jpeg8-ABI" feature drop
64f840
64f840
* Thu Dec 06 2012 Jiri Popelka <jpopelka@redhat.com> - 1.900.1-21
64f840
- build with -fno-strict-overflow
64f840
64f840
* Thu Jul 19 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.900.1-20
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
64f840
64f840
* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.900.1-19
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
64f840
64f840
* Fri Dec 09 2011 Jiri Popelka <jpopelka@redhat.com> - 1.900.1-18
64f840
- CVE-2011-4516, CVE-2011-4517 jasper: heap buffer overflow flaws
64f840
  lead to arbitrary code execution (CERT VU#887409) (#765660)
64f840
- Fixed problems found by static analysis of code (#761440)
64f840
- spec file modernized
64f840
64f840
* Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.900.1-17
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
64f840
64f840
* Wed Jun 30 2010 Rex Dieter <rdieter@fedoraproject.org> - 1.900.1-16
64f840
- rebuild
64f840
64f840
* Sun Feb 14 2010 Rex Dieter <rdieter@fedoraproject.org> - 1.900.1-15
64f840
- FTBFS jasper-1.900.1-14.fc12: ImplicitDSOLinking (#564794)
64f840
64f840
* Thu Oct 29 2009 Rex Dieter <rdieter@fedoraproject.org> - 1.900.1-14
64f840
- add pkgconfig support
64f840
64f840
* Tue Oct 13 2009 Rex Dieter <rdieter@fedoraproject.org> - 1.900.1-13
64f840
- CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls (#461476)
64f840
- CVE-2008-3522 jasper: possible buffer overflow in 
64f840
  jas_stream_printf() (#461478)
64f840
64f840
* Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.900.1-12
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
64f840
64f840
* Sat Jul 18 2009 Rex Dieter <rdieter@fedoraproject.org> - 1.900.1-11
64f840
- FTBFS jasper-1.900.1-10.fc11 (#511743)
64f840
64f840
* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.900.1-10
64f840
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
64f840
64f840
* Sun Jan 25 2009 Rex Dieter <rdieter@fedoraproject.org> 1.900.1-9
64f840
- patch for "jpc_dec_tiledecode: Assertion `dec->numcomps == 3' failed)
64f840
  (#481284, #481291)
64f840
64f840
* Fri Feb 08 2008 Rex Dieter <rdieter@fedoraproject.org> 1.900.1-8
64f840
- respin (gcc43)
64f840
64f840
* Mon Oct 15 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 1.900.1-7
64f840
- -libs: %%post/%%postun -p /sbin/ldconfig
64f840
64f840
* Mon Sep 17 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 1.900.1-6
64f840
- -libs: -Requires: %%name
64f840
- -devel: +Provides: libjasper-devel
64f840
- drop (unused) geojasper bits
64f840
64f840
* Wed Aug 22 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 1.900.1-4
64f840
- -libs subpkg to be multilib friendlier
64f840
- -utils subpkg for non-essential binaries jiv, tmrdemo (#244153)
64f840
64f840
* Fri Aug 17 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 1.900.1-3
64f840
- License: JasPer
64f840
64f840
* Wed May 23 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 1.900.1-2
64f840
- CVE-2007-2721 (#240397)
64f840
64f840
* Thu Mar 29 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 1.900.1-1
64f840
- jasper-1.900.1
64f840
64f840
* Fri Dec 08 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.900.0-3
64f840
- omit deprecated memleak patch
64f840
64f840
* Fri Dec 08 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.900.0-2
64f840
- jasper-1.900.0 (#218947)
64f840
64f840
* Mon Sep 18 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.701.0-15
64f840
- memory leak (#207006)
64f840
64f840
* Tue Aug 29 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.701.0-13
64f840
- fc6 respin
64f840
64f840
* Wed Mar 1 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.701.0-12
64f840
- fixup build issues introduced by geojasper integration
64f840
64f840
* Wed Mar 1 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.701.0-10
64f840
- support/use geojasper (optional, default no)
64f840
- fc5: gcc/glibc respin
64f840
64f840
* Fri Feb 10 2006 Rex Dieter <rexdieter[AT]users.sf.net>
64f840
- fc5: gcc/glibc respin
64f840
64f840
* Tue Jan 31 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.701.0-9
64f840
- workaround "freeglut-devel should Requires: libGL-devel, libGLU-devel"
64f840
  (#179464)
64f840
64f840
* Tue Jan 31 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.701.0-8
64f840
- revert jasper to jaspertool rename (#176773)
64f840
- actually use/apply GL patch
64f840
64f840
* Tue Oct 18 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.701.0-7
64f840
- GL patch to remove libGL dependancy (using only freeglut)
64f840
64f840
* Tue Oct 18 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.701.0-6
64f840
- token %%check section
64f840
- --enable-shared 
64f840
64f840
* Mon Oct 17 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.701.0-5
64f840
- use %%{?dist}
64f840
- BR: libGL-devel 
64f840
64f840
* Thu Apr  7 2005 Michael Schwendt <mschwendt[AT]users.sf.net>
64f840
- rebuilt
64f840
64f840
* Sat Oct 23 2004 Rex Dieter <rexdieter at sf.net> 0:1.701.0-0.fdr.3
64f840
- Capitalize summary
64f840
- remove 0-length ChangeLog
64f840
64f840
* Fri Jun 04 2004 Rex Dieter <rexdieter at sf.net> 0:1.701.0-0.fdr.2
64f840
- nuke .la file
64f840
- BR: glut-devel -> freeglut-devel
64f840
64f840
* Tue Jun 01 2004 Rex Dieter <rexdieter at sf.net> 0:1.701.0-0.fdr.1
64f840
- 1.701.0
64f840
64f840
* Tue Jun 01 2004 Rex Dieter <rexdieter at sf.net> 0:1.700.5-0.fdr.2
64f840
- avoid conflicts with fc'2 tomcat by renaming /usr/bin/jasper -> jaspertool
64f840
64f840
* Mon Mar 08 2004 Rex Dieter <rexdieter at sf.net> 0:1.700.5-0.fdr.1
64f840
- use Epochs.
64f840
- -devel: Requires: %%name = %%epoch:%%version
64f840
64f840
* Thu Jan 22 2004 Rex Dieter <rexdieter at sf.net> 1.700.5-0.fdr.0
64f840
- first try
64f840