diff --git a/.gitignore b/.gitignore index ff4f2be..cdecad8 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ /libjpeg-turbo-1.5.0.tar.gz /libjpeg-turbo-1.5.1.tar.gz /libjpeg-turbo-2.0.0.tar.gz +/libjpeg-turbo-2.0.2.tar.gz diff --git a/libjpeg-turbo-CVE-2018-19664.patch b/libjpeg-turbo-CVE-2018-19664.patch deleted file mode 100644 index f99863e..0000000 --- a/libjpeg-turbo-CVE-2018-19664.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 4a3f52b4d191d79f500831649037b9b24c730e37 Mon Sep 17 00:00:00 2001 -From: DRC -Date: Tue, 1 Jan 2019 20:32:40 -0600 -Subject: [PATCH] wrbmp.c: Don't allow quantization w/ non-RGB CS - -If cinfo->quantize_colors == 1, then jpeg_calc_output_dimensions() will -set cinfo->output_components to 1, and if cinfo->out_color_space is not -RGB (or extended RGB), hilarity will ensue. - -Fixes #305 ---- - wrbmp.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/wrbmp.c b/wrbmp.c -index 38a64e8..3489f14 100644 ---- a/wrbmp.c -+++ b/wrbmp.c -@@ -506,8 +506,9 @@ jinit_write_bmp(j_decompress_ptr cinfo, boolean is_os2, - dest->pub.put_pixel_rows = put_gray_rows; - else - dest->pub.put_pixel_rows = put_pixel_rows; -- } else if (cinfo->out_color_space == JCS_RGB565 || -- cinfo->out_color_space == JCS_CMYK) { -+ } else if (!cinfo->quantize_colors && -+ (cinfo->out_color_space == JCS_RGB565 || -+ cinfo->out_color_space == JCS_CMYK)) { - dest->pub.put_pixel_rows = put_pixel_rows; - } else { - ERREXIT(cinfo, JERR_BMP_COLORSPACE); --- -2.17.2 - diff --git a/libjpeg-turbo-CVE-2018-20330.patch b/libjpeg-turbo-CVE-2018-20330.patch deleted file mode 100644 index 169d01a..0000000 --- a/libjpeg-turbo-CVE-2018-20330.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 9c5f56c55a8610953854408b3aade01320064e07 Mon Sep 17 00:00:00 2001 -From: DRC -Date: Tue, 1 Jan 2019 18:57:36 -0600 -Subject: [PATCH] tjLoadImage(): Fix int overflow/segfault w/big BMP - -Fixes #304 ---- - turbojpeg.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/turbojpeg.c b/turbojpeg.c -index 90a9ce6..3b5154f 100644 ---- a/turbojpeg.c -+++ b/turbojpeg.c -@@ -1960,7 +1960,8 @@ DLLEXPORT unsigned char *tjLoadImage(const char *filename, int *width, - int align, int *height, int *pixelFormat, - int flags) - { -- int retval = 0, tempc, pitch; -+ int retval = 0, tempc; -+ size_t pitch; - tjhandle handle = NULL; - tjinstance *this; - j_compress_ptr cinfo = NULL; -@@ -2013,7 +2014,9 @@ DLLEXPORT unsigned char *tjLoadImage(const char *filename, int *width, - *pixelFormat = cs2pf[cinfo->in_color_space]; - - pitch = PAD((*width) * tjPixelSize[*pixelFormat], align); -- if ((dstBuf = (unsigned char *)malloc(pitch * (*height))) == NULL) -+ if ((unsigned long long)pitch * (unsigned long long)(*height) > -+ (unsigned long long)((size_t)-1) || -+ (dstBuf = (unsigned char *)malloc(pitch * (*height))) == NULL) - _throwg("tjLoadImage(): Memory allocation failure"); - - if (setjmp(this->jerr.setjmp_buffer)) { --- -2.17.2 - diff --git a/mingw-libjpeg-turbo.spec b/mingw-libjpeg-turbo.spec index cad4254..7726e0f 100644 --- a/mingw-libjpeg-turbo.spec +++ b/mingw-libjpeg-turbo.spec @@ -5,8 +5,8 @@ %global build_programs 0 Name: mingw-libjpeg-turbo -Version: 2.0.0 -Release: 3%{?dist} +Version: 2.0.2 +Release: 1%{?dist} Summary: MinGW Windows Libjpeg-turbo library License: wxWidgets @@ -16,8 +16,6 @@ Source0: http://downloads.sourceforge.net/libjpeg-turbo/libjpeg-turbo-%{v # Make jconfig.h more autoconf friendly # https://bugzilla.redhat.com/show_bug.cgi?id=843193 Patch0: libjpeg-turbo-match-autoconf-behavior.patch -Patch1: libjpeg-turbo-CVE-2018-19664.patch -Patch2: libjpeg-turbo-CVE-2018-20330.patch BuildArch: noarch @@ -158,6 +156,9 @@ chmod -x README.md %changelog +* Wed Feb 27 2019 Kalev Lember - 2.0.2-1 +- Update to 2.0.2 + * Fri Feb 01 2019 Fedora Release Engineering - 2.0.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild diff --git a/sources b/sources index 86499b1..bc1b8f3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (libjpeg-turbo-2.0.0.tar.gz) = 220e5248e780d3c40c7842ba52937b9b0860e89164bca16ec6e2afaf99dd5d0bc706dd9320f4d2aef67ac11d4876453ef688b1efeaf93ceb42e8c25e83da2487 +SHA512 (libjpeg-turbo-2.0.2.tar.gz) = 204b6d083e99488c975c75efb08699e4dc1c409556e4dee4f21e3ee67e9c6682eb342f2e5712816b0342c00399fbe6e43fbce30c3d22f30f7ef91db006b3be08