main/openjpeg: security upgrade to 2.1.2 (CVE-2016-7445). Fixes #6262

3 files changed, 10 insertions, 103 deletions

diff --git a/main/openjpeg/APKBUILD b/main/openjpeg/APKBUILD
index 9e340a68ed..0333df5311 100644
--- a/main/openjpeg/APKBUILD
+++ b/main/openjpeg/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: William Pitcock <nenolod@dereferenced.org>
 # Maintainer:
 pkgname=openjpeg
-pkgver=2.1.0
-pkgrel=1
+pkgver=2.1.2
+pkgrel=0
 pkgdesc="Open-source implementation of JPEG2000 image codec"
 url="http://www.openjpeg.org/"
 arch="all"
@@ -12,11 +12,13 @@ depends_dev=""
 makedepends="$depends_dev libpng-dev tiff-dev lcms-dev doxygen cmake"
 install=""
 subpackages="$pkgname-dev $pkgname-tools"
-source="http://downloads.sourceforge.net/project/openjpeg.mirror/$pkgver/openjpeg-$pkgver.tar.gz
-        CVE-2015-6581.patch
-        fix-use-after-free.patch
+source="$pkgname-$pkgver.tar.gz::https://github.com/uclouvain/openjpeg/archive/v$pkgver.tar.gz
         "
 
+# secfixes:
+#   2.1.2-r0:
+#   - CVE-2016-7445
+
 _builddir="${srcdir}/$pkgname-$pkgver"
 prepare() {
         local i
@@ -50,12 +52,6 @@ tools() {
         mv "$pkgdir"/usr/bin "$subpkgdir"/usr/
 }
 
-md5sums="f6419fcc233df84f9a81eb36633c6db6  openjpeg-2.1.0.tar.gz
-c4d44799e0f048d4e8ea63dc66c043c2  CVE-2015-6581.patch
-5dfdfba1783e5f62a4270b0a3681e77f  fix-use-after-free.patch"
-sha256sums="1232bb814fd88d8ed314c94f0bfebb03de8559583a33abbe8c64ef3fc0a8ff03  openjpeg-2.1.0.tar.gz
-bb970ede0eeb5b2b849fe4a6ec93114bb8887160fdf06cc77f179866b5fc9ad8  CVE-2015-6581.patch
-fc7205e89cc8221511d8bd056254b56445ff872b3fd217bfb6295f3989b2c9cc  fix-use-after-free.patch"
-sha512sums="3da84d7828a82c738f6ea5fe776c989283ba257cc6884aebfc090cee7e33c88471dee1a93f4a87a300b11f43b98f6624b838171f06227add24afcb1d57208df1  openjpeg-2.1.0.tar.gz
-cf6b65b955de0de29af6b6be4d09c172a153f881be07e3e80435fdcdfe3fae07c4e11138ba76fb62f2ec1adb8043d580b4bfcf5e0807e82ec36307b0cb18f67f  CVE-2015-6581.patch
-a1cebeb7933bf10b47ebe420b71c0e2a83eb269028cf42aae08eb9b8a36b19df4c94c91ae1ef3d13e0a284f34ac0bd989e56f8071f0c0a3ca0326cc8d2502d91  fix-use-after-free.patch"
+md5sums="40a7bfdcc66280b3c1402a0eb1a27624  openjpeg-2.1.2.tar.gz"
+sha256sums="4ce77b6ef538ef090d9bde1d5eeff8b3069ab56c4906f083475517c2c023dfa7  openjpeg-2.1.2.tar.gz"
+sha512sums="411067e33c8e4da9921d0281e932a4ac2af592cf822bfad828daea9e2b9c414859455bcec6d912ce76460ea462fa4cbd94a401333bda5716ec017d18b8e5942c  openjpeg-2.1.2.tar.gz"
diff --git a/main/openjpeg/CVE-2015-6581.patch b/main/openjpeg/CVE-2015-6581.patch
deleted file mode 100644
index e1ff602196..0000000000
--- a/main/openjpeg/CVE-2015-6581.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 0fa5a17c98c4b8f9ee2286f4f0a50cf52a5fccb0 Mon Sep 17 00:00:00 2001
-From: Matthieu Darbois <mayeut@users.noreply.github.com>
-Date: Tue, 19 May 2015 21:57:27 +0000
-Subject: [PATCH] [trunk] Correct potential double free on malloc failure in
- opj_j2k_copy_default_tcp_and_create_tcp (fixes issue 492)
-
----
- src/lib/openjp2/j2k.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c
-index 8c62a39..cbdd368 100644
---- a/src/lib/openjp2/j2k.c
-+++ b/src/lib/openjp2/j2k.c
-@@ -7365,6 +7365,12 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd (       opj_j2k_t * p_j2
-                 l_tcp->cod = 0;
-                 l_tcp->ppt = 0;
-                 l_tcp->ppt_data = 00;
-+                /* Remove memory not owned by this tile in case of early error return. */
-+                l_tcp->m_mct_decoding_matrix = 00;
-+                l_tcp->m_nb_max_mct_records = 0;
-+                l_tcp->m_mct_records = 00;
-+                l_tcp->m_nb_max_mcc_records = 0;
-+                l_tcp->m_mcc_records = 00;
-                 /* Reconnect the tile-compo coding parameters pointer to the current tile coding parameters*/
-                 l_tcp->tccps = l_current_tccp;
- 
-@@ -7402,6 +7408,8 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd (       opj_j2k_t * p_j2
- 
-                         ++l_src_mct_rec;
-                         ++l_dest_mct_rec;
-+                        /* Update with each pass to free exactly what has been allocated on early return. */
-+                        l_tcp->m_nb_max_mct_records += 1;
-                 }
- 
-                 /* Get the mcc_record of the dflt_tile_cp and copy them into the current tile cp*/
-@@ -7411,6 +7419,7 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd (       opj_j2k_t * p_j2
-                         return OPJ_FALSE;
-                 }
-                 memcpy(l_tcp->m_mcc_records,l_default_tcp->m_mcc_records,l_mcc_records_size);
-+                l_tcp->m_nb_max_mcc_records = l_default_tcp->m_nb_max_mcc_records;
- 
-                 /* Copy the mcc record data from dflt_tile_cp to the current tile*/
-                 l_src_mcc_rec = l_default_tcp->m_mcc_records;
diff --git a/main/openjpeg/fix-use-after-free.patch b/main/openjpeg/fix-use-after-free.patch
deleted file mode 100644
index 6dbffbae30..0000000000
--- a/main/openjpeg/fix-use-after-free.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 940100c28ae28931722290794889cf84a92c5f6f Mon Sep 17 00:00:00 2001
-From: mayeut <mayeut@users.noreply.github.com>
-Date: Sun, 6 Sep 2015 17:24:03 +0200
-Subject: [PATCH] Fix potential use-after-free in opj_j2k_write_mco function
-
-Fixes #563
----
- src/lib/openjp2/j2k.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c
-index 19a48f5..d487d89 100644
---- a/src/lib/openjp2/j2k.c
-+++ b/src/lib/openjp2/j2k.c
-@@ -5559,8 +5559,7 @@ static OPJ_BOOL opj_j2k_write_mco(     opj_j2k_t *p_j2k,
-         assert(p_stream != 00);
- 
-         l_tcp =&(p_j2k->m_cp.tcps[p_j2k->m_current_tile_number]);
--        l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data;
--
-+       
-         l_mco_size = 5 + l_tcp->m_nb_mcc_records;
-         if (l_mco_size > p_j2k->m_specific_param.m_encoder.m_header_tile_data_size) {
- 
-@@ -5575,6 +5574,8 @@ static OPJ_BOOL opj_j2k_write_mco(     opj_j2k_t *p_j2k,
-                 p_j2k->m_specific_param.m_encoder.m_header_tile_data = new_header_tile_data;
-                 p_j2k->m_specific_param.m_encoder.m_header_tile_data_size = l_mco_size;
-         }
-+        l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data;
-+
- 
-         opj_write_bytes(l_current_data,J2K_MS_MCO,2);                   /* MCO */
-         l_current_data += 2;
-@@ -5586,10 +5587,9 @@ static OPJ_BOOL opj_j2k_write_mco(     opj_j2k_t *p_j2k,
-         ++l_current_data;
- 
-         l_mcc_record = l_tcp->m_mcc_records;
--        for     (i=0;i<l_tcp->m_nb_mcc_records;++i) {
-+        for (i=0;i<l_tcp->m_nb_mcc_records;++i) {
-                 opj_write_bytes(l_current_data,l_mcc_record->m_index,1);/* Imco -> use the mcc indicated by 1*/
-                 ++l_current_data;
--
-                 ++l_mcc_record;
-         }
-