diff --git a/.gitignore b/.gitignore index 2082a37..5e401e9 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /jasper-1.900.28.tar.gz +/jasper-2.0.14.tar.gz diff --git a/jasper-1.900.1-CVE-2008-3520.patch b/jasper-1.900.1-CVE-2008-3520.patch deleted file mode 100644 index bd6f56c..0000000 --- a/jasper-1.900.1-CVE-2008-3520.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/src/libjasper/jp2/jp2_cod.c b/src/libjasper/jp2/jp2_cod.c -index 7f3608a..c4ba73c 100644 ---- a/src/libjasper/jp2/jp2_cod.c -+++ b/src/libjasper/jp2/jp2_cod.c -@@ -248,7 +248,7 @@ jp2_box_t *jp2_box_get(jas_stream_t *in) - box = 0; - tmpstream = 0; - -- if (!(box = jas_malloc(sizeof(jp2_box_t)))) { -+ if (!(box = jas_calloc(1, sizeof(jp2_box_t)))) { - goto error; - } - diff --git a/jasper-1.900.1-mingw32.patch b/jasper-1.900.1-mingw32.patch deleted file mode 100644 index f388349..0000000 --- a/jasper-1.900.1-mingw32.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -rup jasper-1.900.1.orig/src/libjasper/Makefile.in jasper-1.900.1.new/src/libjasper/Makefile.in ---- jasper-1.900.1.orig/src/libjasper/Makefile.in 2007-01-19 16:54:45.000000000 -0500 -+++ jasper-1.900.1.new/src/libjasper/Makefile.in 2008-09-09 10:08:43.000000000 -0400 -@@ -290,7 +290,7 @@ libjasper_la_LIBADD = \ - - # -release $(LT_RELEASE) - libjasper_la_LDFLAGS = \ -- -version-info $(LT_CURRENT):$(LT_REVISION):$(LT_AGE) -+ -no-undefined -version-info $(LT_CURRENT):$(LT_REVISION):$(LT_AGE) - - all: all-recursive - diff --git a/jasper-1.900.1-sleep.patch b/jasper-1.900.1-sleep.patch index b647e48..7589fb8 100644 --- a/jasper-1.900.1-sleep.patch +++ b/jasper-1.900.1-sleep.patch @@ -1,6 +1,6 @@ -diff -rup jasper-1.900.1/src/appl/tmrdemo.c jasper-1.900.1.new/src/appl/tmrdemo.c ---- jasper-1.900.1/src/appl/tmrdemo.c 2007-01-19 16:43:08.000000000 -0500 -+++ jasper-1.900.1.new/src/appl/tmrdemo.c 2008-09-09 09:14:21.000000000 -0400 +diff -rupN --no-dereference jasper-2.0.14/src/appl/tmrdemo.c jasper-2.0.14-new/src/appl/tmrdemo.c +--- jasper-2.0.14/src/appl/tmrdemo.c 2017-09-15 01:20:10.000000000 +0200 ++++ jasper-2.0.14-new/src/appl/tmrdemo.c 2019-08-28 19:08:56.104713628 +0200 @@ -1,4 +1,5 @@ #include +#include diff --git a/jasper-2.0.14-CVE-2016-9396.patch b/jasper-2.0.14-CVE-2016-9396.patch new file mode 100644 index 0000000..f0a671b --- /dev/null +++ b/jasper-2.0.14-CVE-2016-9396.patch @@ -0,0 +1,13 @@ +diff -rupN --no-dereference jasper-2.0.14/src/libjasper/jpc/jpc_cs.c jasper-2.0.14-new/src/libjasper/jpc/jpc_cs.c +--- jasper-2.0.14/src/libjasper/jpc/jpc_cs.c 2017-09-15 01:20:10.000000000 +0200 ++++ jasper-2.0.14-new/src/libjasper/jpc/jpc_cs.c 2019-08-28 19:08:56.070713641 +0200 +@@ -795,6 +795,9 @@ static int jpc_cox_getcompparms(jpc_ms_t + if (compparms->numdlvls > 32) { + goto error; + } ++ if (compparms->qmfbid != JPC_COX_INS && ++ compparms->qmfbid != JPC_COX_RFT) ++ goto error; + compparms->numrlvls = compparms->numdlvls + 1; + if (compparms->numrlvls > JPC_MAXRLVLS) { + goto error; diff --git a/jasper-libversion.patch b/jasper-libversion.patch new file mode 100644 index 0000000..f6ba34c --- /dev/null +++ b/jasper-libversion.patch @@ -0,0 +1,19 @@ +diff -rupN jasper-2.0.14/src/libjasper/CMakeLists.txt jasper-2.0.14-new/src/libjasper/CMakeLists.txt +--- jasper-2.0.14/src/libjasper/CMakeLists.txt 2017-09-15 01:20:10.000000000 +0200 ++++ jasper-2.0.14-new/src/libjasper/CMakeLists.txt 2019-08-28 19:24:04.710489394 +0200 +@@ -145,10 +145,11 @@ target_include_directories(libjasper BEF + set_target_properties(libjasper PROPERTIES OUTPUT_NAME jasper) + set_target_properties(libjasper PROPERTIES LINKER_LANGUAGE C) + +-if (UNIX) +- set_target_properties(libjasper PROPERTIES +- VERSION ${JAS_SO_NAME} SOVERSION ${JAS_SO_VERSION}) +-endif() ++set_target_properties(libjasper PROPERTIES ++ VERSION ${JAS_SO_NAME} SOVERSION ${JAS_SO_VERSION}) ++if(MINGW AND JAS_ENABLE_SHARED) ++ set_target_properties(libjasper PROPERTIES SUFFIX "-${JAS_SO_VERSION}${CMAKE_SHARED_LIBRARY_SUFFIX}") ++endif(MINGW AND JAS_ENABLE_SHARED) + + if (JAS_ENABLE_SHARED) + set_target_properties(libjasper PROPERTIES diff --git a/mingw-jasper.spec b/mingw-jasper.spec index f4b57cd..bc9d43a 100644 --- a/mingw-jasper.spec +++ b/mingw-jasper.spec @@ -1,11 +1,8 @@ -%?mingw_package_header - -%global mingw_build_win32 1 -%global mingw_build_win64 1 +%{?mingw_package_header} Name: mingw-jasper -Version: 1.900.28 -Release: 7%{?dist} +Version: 2.0.14 +Release: 1%{?dist} Summary: MinGW Windows Jasper library License: JasPer @@ -14,14 +11,11 @@ URL: http://www.ece.uvic.ca/~frodo/jasper/ Source0: http://www.ece.uvic.ca/~frodo/jasper/software/jasper-%{version}.tar.gz # Patches from Fedora native package. -# OpenBSD hardening patches addressing couple of possible integer overflows -# during the memory allocations -# https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-3520 -Patch5: jasper-1.900.1-CVE-2008-3520.patch +Patch0: jasper-2.0.14-CVE-2016-9396.patch # MinGW-specific patches. -# This patch adds '-no-undefined' flag to libtool line: -Patch1000: jasper-1.900.1-mingw32.patch +# Version the library +Patch1000: jasper-libversion.patch # This patch is a bit of a hack, but it's just there to fix a demo program: Patch1001: jasper-1.900.1-sleep.patch @@ -36,7 +30,7 @@ BuildRequires: mingw64-binutils BuildRequires: mingw32-libjpeg BuildRequires: mingw64-libjpeg -BuildRequires: autoconf automake libtool +BuildRequires: cmake %description @@ -73,54 +67,41 @@ Requires: mingw64-jasper = %{version}-%{release} Static version of the MinGW Windows Jasper library. -%?mingw_debug_package +%{?mingw_debug_package} %prep -%setup -q -n jasper-%{version} -%patch5 -p1 -b .CVE-2008-3520 - -# The libtool bundled with this package is too old for win64 support -autoreconf -i --force - -%patch1000 -p1 -b .mingw32 -%patch1001 -p1 -b .sleep +%autosetup -p1 -n jasper-%{version} %build -# comment from Red Hat Security Response Team: -# gcc inlines jas_iccattrtab_resize into jas_iccattrtab_add. Additionally, it -# essentially removes the "assert(maxents >= tab->numattrs);" assertion in -# jas_iccattrtab_resize, because it assumes that "maxents >= tab->numattrs" will -# always be true due to jas_iccattrtab_resize(attrtab, attrtab->numattrs + 32), -# especially the + 32. This assumption can only be true if it completely ignores -# the problem of signed integer overflows. I don't think it's a smart idea to -# accept that. -# -fno-strict-overflow forces gcc into keeping the assertion there. -CFLAGS="%{optflags} -fno-strict-overflow" \ -%mingw_configure \ - --disable-opengl --enable-libjpeg --enable-static --enable-shared -%mingw_make %{?_smp_mflags} +jasper_cmake_args="-DJAS_ENABLE_DOC=OFF -DJAS_ENABLE_OPENGL=OFF -DJAS_ENABLE_AUTOMATIC_DEPENDENCIES=OFF" +# Build static +MINGW_BUILDDIR_SUFFIX=-static %mingw_cmake -DJAS_ENABLE_SHARED=OFF $jasper_cmake_args +MINGW_BUILDDIR_SUFFIX=-static %mingw_make %{?_smp_mflags} +# Build shared +MINGW_BUILDDIR_SUFFIX=-shared %mingw_cmake -DJAS_ENABLE_SHARED=ON $jasper_cmake_args +MINGW_BUILDDIR_SUFFIX=-shared %mingw_make %{?_smp_mflags} %install -%mingw_make DESTDIR=$RPM_BUILD_ROOT install mandir=%{mingw32_mandir} +MINGW_BUILDDIR_SUFFIX=-static %mingw_make DESTDIR=%{buildroot} install +MINGW_BUILDDIR_SUFFIX=-shared %mingw_make DESTDIR=%{buildroot} install -# Remove .la files -rm $RPM_BUILD_ROOT%{mingw32_libdir}/*.la -rm $RPM_BUILD_ROOT%{mingw64_libdir}/*.la - -# Remove the manual pages - don't duplicate documentation which -# is in the native Fedora package. -rm $RPM_BUILD_ROOT%{mingw32_mandir}/man1/* +# Remove documentation +rm -rf %{buildroot}%{mingw32_mandir} +rm -rf %{buildroot}%{mingw64_mandir} +rm -rf %{buildroot}%{mingw32_docdir} +rm -rf %{buildroot}%{mingw64_docdir} +rmdir %{buildroot}%{mingw32_datadir} +rmdir %{buildroot}%{mingw64_datadir} %files -n mingw32-jasper -%doc COPYRIGHT LICENSE NEWS README +%license COPYRIGHT LICENSE %{mingw32_bindir}/imgcmp.exe %{mingw32_bindir}/imginfo.exe %{mingw32_bindir}/jasper.exe -%{mingw32_bindir}/tmrdemo.exe %{mingw32_bindir}/libjasper-4.dll %{mingw32_libdir}/libjasper.dll.a %{mingw32_libdir}/pkgconfig/jasper.pc @@ -130,11 +111,10 @@ rm $RPM_BUILD_ROOT%{mingw32_mandir}/man1/* %{mingw32_libdir}/libjasper.a %files -n mingw64-jasper -%doc COPYRIGHT LICENSE NEWS README +%license COPYRIGHT LICENSE %{mingw64_bindir}/imgcmp.exe %{mingw64_bindir}/imginfo.exe %{mingw64_bindir}/jasper.exe -%{mingw64_bindir}/tmrdemo.exe %{mingw64_bindir}/libjasper-4.dll %{mingw64_libdir}/libjasper.dll.a %{mingw64_libdir}/pkgconfig/jasper.pc @@ -145,6 +125,9 @@ rm $RPM_BUILD_ROOT%{mingw32_mandir}/man1/* %changelog +* Wed Aug 28 2019 Sandro Mani - 2.0.14-1 +- Update to 2.0.14 + * Thu Jul 25 2019 Fedora Release Engineering - 1.900.28-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild diff --git a/sources b/sources index d872fa0..668d026 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -979fd58a439ccaba8eb3b806d7e6a87e jasper-1.900.28.tar.gz +SHA512 (jasper-2.0.14.tar.gz) = 9e5cffd2e899e37ba08890e2377ddfc3c2fb13d9fe00dea6b4612e4d241a6f4327de6835809b415c41ae4bf44208cf7871c1982ff5fc04ae6bc09fd376b0afc8