Overview

Request 789669 accepted

- Upate to version 2.0.4:
- bug 388 was fixed upstream
https://github.com/libjpeg-turbo/libjpeg-turbo/issues/388
- removed patches, as it is included in this release.
* Fixed a regression in the Windows packaging system
(introduced by 2.0 beta1[2]) whereby, if both the 64-bit libjpeg-turbo
SDK for GCC and the 64-bit libjpeg-turbo SDK for Visual C++ were installed
on the same system, only one of them could be uninstalled.
* Fixed a signed integer overflow and subsequent segfault that occurred when
attempting to decompress images with more than 715827882 pixels using the 64-bit C version of TJBench.
* Fixed out-of-bounds write in tjDecompressToYUV2() and tjDecompressToYUVPlanes()
(sometimes manifesting as a double free) that occurred when attempting to decompress
grayscale JPEG images that were compressed with a sampling factor other than 1
(for instance, with cjpeg -grayscale -sample 2x2).
* Fixed a regression introduced by 2.0.2[5] that caused the TurboJPEG API to incorrectly
identify some JPEG images with unusual sampling factors as 4:4:4 JPEG images.
This was known to cause a buffer overflow when attempting to decompress some such images using
tjDecompressToYUV2() or tjDecompressToYUVPlanes().
* Fixed an issue, detected by ASan, whereby attempting to losslessly transform a specially-crafted
malformed JPEG image containing an extremely-high-frequency coefficient block
(junk image data that could never be generated by a legitimate JPEG compressor) could cause the
Huffman encoder's local buffer to be overrun. (Refer to 1.4.0[9] and 1.4beta1[15].)
Given that the buffer overrun was fully contained within the stack and did not cause a segfault
or other user-visible errant behavior, and given that the lossless transformer (unlike the decompressor)
is not generally exposed to arbitrary data exploits, this issue did not likely pose a security risk.
The ARM 64-bit (ARMv8) NEON SIMD assembly code now stores constants in a separate read-only data
section rather than in the text section, to support execute-only memory layouts.
- libjpeg-turbo-issue-388.patch upstreamed

- Added If statments for Fedora not having sertain openSUSE macros

Request History
Petr Gajdos's avatar

pgajdos created request

- Upate to version 2.0.4:
- bug 388 was fixed upstream
https://github.com/libjpeg-turbo/libjpeg-turbo/issues/388
- removed patches, as it is included in this release.
* Fixed a regression in the Windows packaging system
(introduced by 2.0 beta1[2]) whereby, if both the 64-bit libjpeg-turbo
SDK for GCC and the 64-bit libjpeg-turbo SDK for Visual C++ were installed
on the same system, only one of them could be uninstalled.
* Fixed a signed integer overflow and subsequent segfault that occurred when
attempting to decompress images with more than 715827882 pixels using the 64-bit C version of TJBench.
* Fixed out-of-bounds write in tjDecompressToYUV2() and tjDecompressToYUVPlanes()
(sometimes manifesting as a double free) that occurred when attempting to decompress
grayscale JPEG images that were compressed with a sampling factor other than 1
(for instance, with cjpeg -grayscale -sample 2x2).
* Fixed a regression introduced by 2.0.2[5] that caused the TurboJPEG API to incorrectly
identify some JPEG images with unusual sampling factors as 4:4:4 JPEG images.
This was known to cause a buffer overflow when attempting to decompress some such images using
tjDecompressToYUV2() or tjDecompressToYUVPlanes().
* Fixed an issue, detected by ASan, whereby attempting to losslessly transform a specially-crafted
malformed JPEG image containing an extremely-high-frequency coefficient block
(junk image data that could never be generated by a legitimate JPEG compressor) could cause the
Huffman encoder's local buffer to be overrun. (Refer to 1.4.0[9] and 1.4beta1[15].)
Given that the buffer overrun was fully contained within the stack and did not cause a segfault
or other user-visible errant behavior, and given that the lossless transformer (unlike the decompressor)
is not generally exposed to arbitrary data exploits, this issue did not likely pose a security risk.
The ARM 64-bit (ARMv8) NEON SIMD assembly code now stores constants in a separate read-only data
section rather than in the text section, to support execute-only memory layouts.
- libjpeg-turbo-issue-388.patch upstreamed

- Added If statments for Fedora not having sertain openSUSE macros


Factory Auto's avatar

factory-auto added opensuse-review-team as a reviewer

Please review sources


Factory Auto's avatar

factory-auto accepted review

Check script succeeded


Saul Goodman's avatar

licensedigger accepted review

ok


Ismail Dönmez's avatar

namtrac accepted review


Dominique Leuenberger's avatar

dimstar_suse set openSUSE:Factory:Staging:C as a staging project

Being evaluated by staging project "openSUSE:Factory:Staging:C"


Dominique Leuenberger's avatar

dimstar_suse accepted review

Picked "openSUSE:Factory:Staging:C"


Dominique Leuenberger's avatar

dimstar_suse accepted review

Staging Project openSUSE:Factory:Staging:C got accepted.


Dominique Leuenberger's avatar

dimstar_suse approved review

Staging Project openSUSE:Factory:Staging:C got accepted.


Dominique Leuenberger's avatar

dimstar_suse accepted request

Staging Project openSUSE:Factory:Staging:C got accepted.

openSUSE Build Service is sponsored by