Skip to content

Commit d219d28

Browse files
azurelinux-securityKanishk-Bansalkevin-b-lockwood
authored
[AutoPR- Security] Patch jasper for CVE-2025-8837, CVE-2025-8836, CVE-2025-8835 [MEDIUM] (#14480)
Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com> Co-authored-by: Kevin Lockwood <v-klockwood@microsoft.com>
1 parent cfbc086 commit d219d28

4 files changed

Lines changed: 330 additions & 1 deletion

File tree

‎SPECS/jasper/CVE-2025-8835.patch‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
From 61763661b030bfb15bad9de67e8e7b5baf617bf3 Mon Sep 17 00:00:00 2001
2+
From: Michael Adams <mdadams@ece.uvic.ca>
3+
Date: Tue, 29 Jul 2025 20:16:35 -0700
4+
Subject: [PATCH] Fixes #400.
5+
6+
Added a check for a missing color component in the jas_image_chclrspc
7+
function.
8+
9+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
10+
Upstream-reference: https://github.com/jasper-software/jasper/commit/bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52.patch
11+
---
12+
src/libjasper/base/jas_image.c | 72 ++++++++++++++++++++++++++++-----
13+
1 files changed, 61 insertions(+), 11 deletions(-)
14+
15+
diff --git a/src/libjasper/base/jas_image.c b/src/libjasper/base/jas_image.c
16+
index 1ed0905..c8aa42b 100644
17+
--- a/src/libjasper/base/jas_image.c
18+
+++ b/src/libjasper/base/jas_image.c
19+
@@ -118,6 +118,8 @@ static void jas_image_calcbbox2(const jas_image_t *image,
20+
jas_image_coord_t *bry);
21+
static void jas_image_fmtinfo_init(jas_image_fmtinfo_t *fmtinfo);
22+
static void jas_image_fmtinfo_cleanup(jas_image_fmtinfo_t *fmtinfo);
23+
+static jas_cmcmptfmt_t* jas_cmcmptfmt_array_create(int n);
24+
+static void jas_cmcmptfmt_array_destroy(jas_cmcmptfmt_t* cmptfmts, int n);
25+
26+
/******************************************************************************\
27+
* Create and destroy operations.
28+
@@ -413,6 +415,36 @@ static void jas_image_cmpt_destroy(jas_image_cmpt_t *cmpt)
29+
jas_free(cmpt);
30+
}
31+
32+
+static jas_cmcmptfmt_t* jas_cmcmptfmt_array_create(int n)
33+
+{
34+
+ jas_cmcmptfmt_t* cmptfmts;
35+
+ JAS_LOGDEBUGF(10, "jas_cmcmptfmt_array_create(%d)\n", n);
36+
+ if (!(cmptfmts = jas_alloc2(n, sizeof(jas_cmcmptfmt_t)))) {
37+
+ return 0;
38+
+ }
39+
+ for (int i = 0; i < n; ++i) {
40+
+ cmptfmts[i].buf = 0;
41+
+ }
42+
+ JAS_LOGDEBUGF(10, "jas_cmcmptfmt_array_create(%d) returning %p\n", n,
43+
+ JAS_CAST(void *, cmptfmts));
44+
+ return cmptfmts;
45+
+}
46+
+
47+
+static void jas_cmcmptfmt_array_destroy(jas_cmcmptfmt_t* cmptfmts, int n)
48+
+{
49+
+ assert(cmptfmts);
50+
+ assert(n > 0);
51+
+ JAS_LOGDEBUGF(10, "jas_cmcmptfmt_array_destroy(%p, %d)\n",
52+
+ JAS_CAST(void *, cmptfmts), n);
53+
+ for (int i = 0; i < n; ++i) {
54+
+ if (cmptfmts[i].buf) {
55+
+ jas_free(cmptfmts[i].buf);
56+
+ }
57+
+ cmptfmts[i].buf = 0;
58+
+ }
59+
+ jas_free(cmptfmts);
60+
+}
61+
+
62+
/******************************************************************************\
63+
* Load and save operations.
64+
\******************************************************************************/
65+
@@ -1588,12 +1620,15 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
66+
jas_cmcmptfmt_t *incmptfmts;
67+
jas_cmcmptfmt_t *outcmptfmts;
68+
69+
+ assert(image);
70+
+ assert(outprof);
71+
+
72+
#if 0
73+
jas_eprintf("IMAGE\n");
74+
jas_image_dump(image, stderr);
75+
#endif
76+
77+
- if (image->numcmpts_ == 0) {
78+
+ if (!jas_image_numcmpts(image)) {
79+
/*
80+
can't work with a file with no components;
81+
continuing would crash because we'd attempt to
82+
@@ -1604,6 +1639,8 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
83+
84+
outimage = 0;
85+
xform = 0;
86+
+ incmptfmts = 0;
87+
+ outcmptfmts = 0;
88+
if (!(inimage = jas_image_copy(image))) {
89+
goto error;
90+
}
91+
@@ -1694,16 +1731,22 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
92+
}
93+
94+
inpixmap.numcmpts = numinclrchans;
95+
- if (!(incmptfmts = jas_alloc2(numinclrchans, sizeof(jas_cmcmptfmt_t)))) {
96+
+ assert(numinclrchans != 0);
97+
+ if (!(incmptfmts = jas_cmcmptfmt_array_create(numinclrchans))) {
98+
// formerly call to abort()
99+
goto error;
100+
}
101+
inpixmap.cmptfmts = incmptfmts;
102+
for (unsigned i = 0; i < numinclrchans; ++i) {
103+
const int j = jas_image_getcmptbytype(inimage, JAS_IMAGE_CT_COLOR(i));
104+
+ if (j < 0) {
105+
+ jas_logerrorf("missing color component %d\n", i);
106+
+ goto error;
107+
+ }
108+
if (!(incmptfmts[i].buf = jas_alloc2(width, sizeof(long)))) {
109+
goto error;
110+
}
111+
+ assert(j >= 0 && j < jas_image_numcmpts(inimage));
112+
incmptfmts[i].prec = jas_image_cmptprec(inimage, j);
113+
incmptfmts[i].sgnd = jas_image_cmptsgnd(inimage, j);
114+
incmptfmts[i].width = width;
115+
@@ -1711,7 +1754,7 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
116+
}
117+
118+
outpixmap.numcmpts = numoutclrchans;
119+
- if (!(outcmptfmts = jas_alloc2(numoutclrchans, sizeof(jas_cmcmptfmt_t)))) {
120+
+ if (!(outcmptfmts = jas_cmcmptfmt_array_create(numoutclrchans))) {
121+
// formerly call to abort()
122+
goto error;
123+
}
124+
@@ -1719,9 +1762,14 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
125+
126+
for (unsigned i = 0; i < numoutclrchans; ++i) {
127+
const int j = jas_image_getcmptbytype(outimage, JAS_IMAGE_CT_COLOR(i));
128+
+ if (j < 0) {
129+
+ jas_logerrorf("missing color component %d\n", i);
130+
+ goto error;
131+
+ }
132+
if (!(outcmptfmts[i].buf = jas_alloc2(width, sizeof(long)))) {
133+
goto error;
134+
}
135+
+ assert(j >= 0 && j < jas_image_numcmpts(outimage));
136+
outcmptfmts[i].prec = jas_image_cmptprec(outimage, j);
137+
outcmptfmts[i].sgnd = jas_image_cmptsgnd(outimage, j);
138+
outcmptfmts[i].width = width;
139+
@@ -1746,14 +1794,8 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
140+
}
141+
}
142+
143+
- for (unsigned i = 0; i < numoutclrchans; ++i) {
144+
- jas_free(outcmptfmts[i].buf);
145+
- }
146+
- jas_free(outcmptfmts);
147+
- for (unsigned i = 0; i < numinclrchans; ++i) {
148+
- jas_free(incmptfmts[i].buf);
149+
- }
150+
- jas_free(incmptfmts);
151+
+ jas_cmcmptfmt_array_destroy(outcmptfmts, numoutclrchans);
152+
+ jas_cmcmptfmt_array_destroy(incmptfmts, numinclrchans);
153+
jas_cmxform_destroy(xform);
154+
jas_image_destroy(inimage);
155+
156+
@@ -1765,6 +1807,14 @@ jas_image_t *jas_image_chclrspc(jas_image_t *image,
157+
#endif
158+
return outimage;
159+
error:
160+
+ if (incmptfmts) {
161+
+ assert(numinclrchans);
162+
+ jas_cmcmptfmt_array_destroy(incmptfmts, numinclrchans);
163+
+ }
164+
+ if (outcmptfmts) {
165+
+ assert(numoutclrchans);
166+
+ jas_cmcmptfmt_array_destroy(outcmptfmts, numoutclrchans);
167+
+ }
168+
if (xform) {
169+
jas_cmxform_destroy(xform);
170+
}
171+
--
172+
2.45.4
173+

‎SPECS/jasper/CVE-2025-8836.patch‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
From 2e231f399fa5768d0b61ea2d8ed41ebda55d8e8b Mon Sep 17 00:00:00 2001
2+
From: Michael Adams <mdadams@ece.uvic.ca>
3+
Date: Sat, 2 Aug 2025 18:00:39 -0700
4+
Subject: [PATCH] Fixes #401.
5+
6+
JPEG-2000 (JPC) Encoder:
7+
- Added some missing range checking on several coding parameters
8+
(e.g., precint width/height and codeblock width/height).
9+
10+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
11+
Upstream-reference: https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4.patch
12+
---
13+
src/libjasper/jpc/jpc_enc.c | 30 ++++++++++++++++++++++++------
14+
src/libjasper/jpc/jpc_t2dec.c | 3 ++-
15+
2 files changed, 26 insertions(+), 7 deletions(-)
16+
17+
diff --git a/src/libjasper/jpc/jpc_enc.c b/src/libjasper/jpc/jpc_enc.c
18+
index 041c030..e910a86 100644
19+
--- a/src/libjasper/jpc/jpc_enc.c
20+
+++ b/src/libjasper/jpc/jpc_enc.c
21+
@@ -484,18 +484,36 @@ static jpc_enc_cp_t *cp_create(const char *optstr, jas_image_t *image)
22+
cp->tileheight = atoi(jas_tvparser_getval(tvp));
23+
break;
24+
case OPT_PRCWIDTH:
25+
- prcwidthexpn = jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
26+
+ i = atoi(jas_tvparser_getval(tvp));
27+
+ if (i <= 0) {
28+
+ jas_logerrorf("invalid precinct width (%d)\n", i);
29+
+ goto error;
30+
+ }
31+
+ prcwidthexpn = jpc_floorlog2(i);
32+
break;
33+
case OPT_PRCHEIGHT:
34+
- prcheightexpn = jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
35+
+ i = atoi(jas_tvparser_getval(tvp));
36+
+ if (i <= 0) {
37+
+ jas_logerrorf("invalid precinct height (%d)\n", i);
38+
+ goto error;
39+
+ }
40+
+ prcheightexpn = jpc_floorlog2(i);
41+
break;
42+
case OPT_CBLKWIDTH:
43+
- tccp->cblkwidthexpn =
44+
- jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
45+
+ i = atoi(jas_tvparser_getval(tvp));
46+
+ if (i <= 0) {
47+
+ jas_logerrorf("invalid code block width (%d)\n", i);
48+
+ goto error;
49+
+ }
50+
+ tccp->cblkwidthexpn = jpc_floorlog2(i);
51+
break;
52+
case OPT_CBLKHEIGHT:
53+
- tccp->cblkheightexpn =
54+
- jpc_floorlog2(atoi(jas_tvparser_getval(tvp)));
55+
+ i = atoi(jas_tvparser_getval(tvp));
56+
+ if (i <= 0) {
57+
+ jas_logerrorf("invalid code block height (%d)\n", i);
58+
+ goto error;
59+
+ }
60+
+ tccp->cblkheightexpn = jpc_floorlog2(i);
61+
break;
62+
case OPT_MODE:
63+
if ((tagid = jas_taginfo_nonull(jas_taginfos_lookup(modetab,
64+
diff --git a/src/libjasper/jpc/jpc_t2dec.c b/src/libjasper/jpc/jpc_t2dec.c
65+
index de77623..1eff88a 100644
66+
--- a/src/libjasper/jpc/jpc_t2dec.c
67+
+++ b/src/libjasper/jpc/jpc_t2dec.c
68+
@@ -348,7 +348,8 @@ static int jpc_dec_decodepkt(jpc_dec_t *dec, jas_stream_t *pkthdrstream, jas_str
69+
const unsigned n = JAS_MIN((unsigned)numnewpasses, maxpasses);
70+
mycounter += n;
71+
numnewpasses -= n;
72+
- if ((len = jpc_bitstream_getbits(inb, cblk->numlenbits + jpc_floorlog2(n))) < 0) {
73+
+ if ((len = jpc_bitstream_getbits(inb,
74+
+ cblk->numlenbits + jpc_floorlog2(n))) < 0) {
75+
jpc_bitstream_close(inb);
76+
jas_logerrorf("cannot get bits\n");
77+
return -1;
78+
--
79+
2.45.4
80+

‎SPECS/jasper/CVE-2025-8837.patch‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
From 7978269b3d135a24678425dabde1360f569ba4eb Mon Sep 17 00:00:00 2001
2+
From: Michael Adams <mdadams@ece.uvic.ca>
3+
Date: Tue, 5 Aug 2025 20:46:48 -0700
4+
Subject: [PATCH] Fixes #402, #403.
5+
6+
JPEG-2000 (JPC) Decoder:
7+
- Added the setting of several pointers to null in some cleanup code
8+
after the pointed-to memory was freed. This pointer nulling is not
9+
needed normally, but it is needed when certain debugging logs are
10+
enabled (so that the debug code understands that the memory associated
11+
with the aforementioned pointers has been freed).
12+
13+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
14+
Upstream-reference: https://github.com/jasper-software/jasper/commit/8308060d3fbc1da10353ac8a95c8ea60eba9c25a.patch
15+
---
16+
src/libjasper/jpc/jpc_dec.c | 13 ++++++++-----
17+
1 files changed, 8 insertions(+), 5 deletions(-)
18+
19+
diff --git a/src/libjasper/jpc/jpc_dec.c b/src/libjasper/jpc/jpc_dec.c
20+
index 125a29b..7e44f05 100644
21+
--- a/src/libjasper/jpc/jpc_dec.c
22+
+++ b/src/libjasper/jpc/jpc_dec.c
23+
@@ -1136,23 +1136,23 @@ static int jpc_dec_tilefini(jpc_dec_t *dec, jpc_dec_tile_t *tile)
24+
25+
if (tile->cp) {
26+
jpc_dec_cp_destroy(tile->cp);
27+
- //tile->cp = 0;
28+
+ tile->cp = 0;
29+
}
30+
if (tile->tcomps) {
31+
jas_free(tile->tcomps);
32+
- //tile->tcomps = 0;
33+
+ tile->tcomps = 0;
34+
}
35+
if (tile->pi) {
36+
jpc_pi_destroy(tile->pi);
37+
- //tile->pi = 0;
38+
+ tile->pi = 0;
39+
}
40+
if (tile->pkthdrstream) {
41+
jas_stream_close(tile->pkthdrstream);
42+
- //tile->pkthdrstream = 0;
43+
+ tile->pkthdrstream = 0;
44+
}
45+
if (tile->pptstab) {
46+
jpc_ppxstab_destroy(tile->pptstab);
47+
- //tile->pptstab = 0;
48+
+ tile->pptstab = 0;
49+
}
50+
51+
tile->state = JPC_TILE_DONE;
52+
@@ -2288,6 +2288,9 @@ static int jpc_dec_dump(const jpc_dec_t *dec)
53+
const jpc_dec_tile_t *tile;
54+
for (tileno = 0, tile = dec->tiles; tileno < dec->numtiles;
55+
++tileno, ++tile) {
56+
+ if (!tile->tcomps) {
57+
+ continue;
58+
+ }
59+
assert(!dec->numcomps || tile->tcomps);
60+
unsigned compno;
61+
const jpc_dec_tcomp_t *tcomp;
62+
--
63+
2.45.4
64+

‎SPECS/jasper/jasper.spec‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
Summary: Implementation of the JPEG-2000 standard, Part 1
77
Name: jasper
88
Version: 4.2.1
9-
Release: 2%{?dist}
9+
Release: 3%{?dist}
1010

1111
License: JasPer-2.0
1212
Vendor: Microsoft Corporation
@@ -16,10 +16,15 @@ Source0: https://github.com/jasper-software/%{name}/archive/refs/tags/version-%{
1616

1717
# architecture related patches
1818
Patch0: CVE-2024-31744.patch
19+
Patch1: CVE-2025-8837.patch
20+
Patch2: CVE-2025-8836.patch
21+
Patch3: CVE-2025-8835.patch
22+
1923
Patch100: jasper-2.0.2-test-ppc64-disable.patch
2024
Patch101: jasper-2.0.2-test-ppc64le-disable.patch
2125
Patch102: jasper-4.1.0-test-i686-disable.patch
2226

27+
2328
# autoreconf
2429
BuildRequires: cmake
2530
BuildRequires: freeglut-devel
@@ -64,6 +69,9 @@ Requires: %{name}-libs%{?_isa} = %{version}-%{release}
6469
%prep
6570
%setup -q -n %{name}-version-%{version}
6671
%patch 0 -p1
72+
%patch 1 -p1
73+
%patch 2 -p1
74+
%patch 3 -p1
6775

6876
# Need to disable one test to be able to build it on ppc64 arch
6977
# At ppc64 this test just stuck (nothing happend - no exception or error)
@@ -99,6 +107,7 @@ make install/fast DESTDIR=%{buildroot} -C builder
99107
# Unpackaged files
100108
rm -f doc/README
101109
rm -f %{buildroot}%{_libdir}/lib*.la
110+
rm -f doc/src/license.dox.in
102111

103112

104113
%check
@@ -131,6 +140,9 @@ make test -C builder
131140

132141

133142
%changelog
143+
* Mon Aug 11 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 4.2.1-3
144+
- Patch for CVE-2025-8837, CVE-2025-8836, CVE-2025-8835
145+
134146
* Tue May 21 2024 Neha Agarwal <nehaagarwal@microsoft.com> - 4.2.1-2
135147
- Patch CVE-2024-31744.
136148

0 commit comments

Comments
 (0)