Merge lp:~logan/ubuntu/trusty/libjpeg6b/6b1-4ubuntu1 into lp:ubuntu/trusty/libjpeg6b

[Logan Rosen]

[Sebastien Bacher (seb128)]

Thanks for your work!

review: Approve

=== modified file '.pc/applied-patches'
--- .pc/applied-patches	2012-11-15 09:01:30 +0000
+++ .pc/applied-patches	2013-12-10 23:15:47 +0000
@@ -1,3 +1,3 @@
 extern_C-jpeglib.h
 use-autotools-dev
-debian-changes-6b1-1
+fix-CVE-2013-6629_6630

=== removed directory '.pc/debian-changes-6b1-1'
=== removed file '.pc/debian-changes-6b1-1/stamp-h1'
=== modified file 'debian/changelog'
--- debian/changelog	2012-11-29 13:54:26 +0000
+++ debian/changelog	2013-12-10 23:15:47 +0000
@@ -1,3 +1,18 @@
+libjpeg6b (6b1-4ubuntu1) trusty; urgency=low
+
+  * Merge from Debian unstable (LP: #1011177). Remaining changes:
+    - debian/rules: Remove "-Bsymbolic-functions" from LDFLAGS.
+
+ -- Logan Rosen <[e-mail]>  Tue, 10 Dec 2013 18:09:16 -0500
+
+libjpeg6b (6b1-4) unstable; urgency=high
+
+  * Apply upstream patch to fix CVE-2013-6629 and CVE-2013-6630.
+  * debian/rules clean: remove stamp-h1
+  * debian/copyright: fix download URL
+
+ -- Bill Allombert <[e-mail]>  Thu, 05 Dec 2013 23:43:52 +0100
+
 libjpeg6b (6b1-3ubuntu1) raring; urgency=low
 
   * Merge from Debian. Remaining changes:

=== modified file 'debian/copyright'
--- debian/copyright	2010-06-29 13:55:42 +0000
+++ debian/copyright	2013-12-10 23:15:47 +0000
@@ -2,7 +2,7 @@
 JPEG Group.
 
 This package was created by Bill Allombert <[e-mail]> from sources
-which can be found at http://www.ijg.org/jpegsrc.v6b1.tar.gz.
+which can be found at http://www.ijg.org/files/jpegsrc.v6b1.tar.gz.
 
 Package for version 6b was created by Mark Mickan <[e-mail]> from
 sources which can be found at ftp://ftp.uu.net/graphics/jpeg/jpegsrc.v6b.tar.gz

=== removed file 'debian/patches/debian-changes-6b1-1'
--- debian/patches/debian-changes-6b1-1	2010-06-29 13:55:42 +0000
+++ debian/patches/debian-changes-6b1-1	1970-01-01 00:00:00 +0000
@@ -1,47 +0,0 @@
-Description: Upstream changes introduced in version 6b1-1
- This patch has been created by dpkg-source during the package build.
- Here's the last changelog entry, hopefully it gives details on why
- those changes were made:
- .
- libjpeg6b (6b1-1) unstable; urgency=low
- .
-   * New upstream release
-     - libjpeg62 has now versionned symbols.
-     - Updated build system that use current libtool.
-     - Full source code for the build system.
-   * debian/copyright: add 6b1 upstream download URL.
-   * debian/control:
-     - libjpeg62-dev: Provides libjpeg-dev since the transition has been
-       postponed.
-     - Remove now useless dependency on libtool and sharutils
-     - Bump Standards-Version to 3.9.0.
-   * Get rid of dpatch system. Patches were only relevant to libjpeg-progs
-     which is not build from this package anymore.
-   * Move to new source format 3.0 (quilt). Patches applied:
-     - use-autotools-dev: Use autotools-dev version of config.sub/.guess.
-     - extern_C-jpeglib.h: Wrap jpeglib.h with extern "C" {} if __cplusplus
-       is defined.
-   * debian/rules:
-     - Adjust for new build system and new patch system.
-   * debian/shlibs: add (>=6b1) to avoid linker warnings with libjpeg6b.
- .
- The person named in the Author field signed this changelog entry.
-Author: Bill Allombert <[e-mail]>
-
----
-The information above should follow the Patch Tagging Guidelines, please
-checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
-are templates for supplementary fields that you might want to add:
-
-Origin: <vendor|upstream|other>, <url of original patch>
-Bug: <url in upstream bugtracker>
-Bug-Debian: http://bugs.debian.org/<bugnumber>
-Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
-Forwarded: <no|not-needed|url proving that it has been forwarded>
-Reviewed-By: <name and email of someone who approved the patch>
-Last-Update: <YYYY-MM-DD>
-
---- /dev/null
-+++ libjpeg6b-6b1/stamp-h1
-@@ -0,0 +1 @@
-+timestamp for jconfig.h

=== added file 'debian/patches/fix-CVE-2013-6629_6630'
--- debian/patches/fix-CVE-2013-6629_6630	1970-01-01 00:00:00 +0000
+++ debian/patches/fix-CVE-2013-6629_6630	2013-12-10 23:15:47 +0000
@@ -0,0 +1,108 @@
+Index: libjpeg6b-6b1/jdmarker.c
+===================================================================
+--- libjpeg6b-6b1.orig/jdmarker.c	1998-02-21 21:24:50.000000000 +0100
++++ libjpeg6b-6b1/jdmarker.c	2013-12-03 22:53:28.393111296 +0100
+@@ -238,7 +238,7 @@
+ /* Process a SOFn marker */
+ {
+   INT32 length;
+-  int c, ci;
++  int c, ci, i;
+   jpeg_component_info * compptr;
+   INPUT_VARS(cinfo);
+ 
+@@ -275,11 +275,27 @@
+     cinfo->comp_info = (jpeg_component_info *) (*cinfo->mem->alloc_small)
+ 			((j_common_ptr) cinfo, JPOOL_IMAGE,
+ 			 cinfo->num_components * SIZEOF(jpeg_component_info));
+-  
+-  for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
+-       ci++, compptr++) {
++
++  for (ci = 0; ci < cinfo->num_components; ci++) {
++    INPUT_BYTE(cinfo, c, return FALSE);
++    /* Check to see whether component id has already been seen   */
++    /* (in violation of the spec, but unfortunately seen in some */
++    /* files).  If so, create "fake" component id equal to the   */
++    /* max id seen so far + 1. */
++    for (i = 0, compptr = cinfo->comp_info; i < ci; i++, compptr++) {
++      if (c == compptr->component_id) {
++	compptr = cinfo->comp_info;
++	c = compptr->component_id;
++	compptr++;
++	for (i = 1; i < ci; i++, compptr++) {
++	  if (compptr->component_id > c) c = compptr->component_id;
++	}
++	c++;
++	break;
++      }
++    }
++    compptr->component_id = c;
+     compptr->component_index = ci;
+-    INPUT_BYTE(cinfo, compptr->component_id, return FALSE);
+     INPUT_BYTE(cinfo, c, return FALSE);
+     compptr->h_samp_factor = (c >> 4) & 15;
+     compptr->v_samp_factor = (c     ) & 15;
+@@ -302,7 +318,7 @@
+ /* Process a SOS marker */
+ {
+   INT32 length;
+-  int i, ci, n, c, cc;
++  int c, ci, i, n;
+   jpeg_component_info * compptr;
+   INPUT_VARS(cinfo);
+ 
+@@ -323,24 +339,38 @@
+   /* Collect the component-spec parameters */
+ 
+   for (i = 0; i < n; i++) {
+-    INPUT_BYTE(cinfo, cc, return FALSE);
+     INPUT_BYTE(cinfo, c, return FALSE);
+-    
++
++    /* Detect the case where component id's are not unique, and, if so, */
++    /* create a fake component id using the same logic as in get_sof.   */
++    for (ci = 0; ci < i; ci++) {
++      if (c == cinfo->cur_comp_info[ci]->component_id) {
++	c = cinfo->cur_comp_info[0]->component_id;
++	for (ci = 1; ci < i; ci++) {
++	  compptr = cinfo->cur_comp_info[ci];
++	  if (compptr->component_id > c) c = compptr->component_id;
++	}
++	c++;
++	break;
++      }
++    }
++
+     for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
+ 	 ci++, compptr++) {
+-      if (cc == compptr->component_id)
++      if (c == compptr->component_id)
+ 	goto id_found;
+     }
+ 
+-    ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
++    ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, c);
+ 
+   id_found:
+ 
+     cinfo->cur_comp_info[i] = compptr;
++    INPUT_BYTE(cinfo, c, return FALSE);
+     compptr->dc_tbl_no = (c >> 4) & 15;
+     compptr->ac_tbl_no = (c     ) & 15;
+-    
+-    TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, cc,
++
++    TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, compptr->component_id,
+ 	     compptr->dc_tbl_no, compptr->ac_tbl_no);
+   }
+ 
+@@ -456,6 +486,8 @@
+     if (count > 256 || ((INT32) count) > length)
+       ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
+ 
++    MEMZERO(huffval, SIZEOF(huffval)); /* pre-zero array for later copy */
++
+     for (i = 0; i < count; i++)
+       INPUT_BYTE(cinfo, huffval[i], return FALSE);
+ 

=== modified file 'debian/patches/series'
--- debian/patches/series	2010-06-29 13:55:42 +0000
+++ debian/patches/series	2013-12-10 23:15:47 +0000
@@ -1,3 +1,3 @@
 extern_C-jpeglib.h
 use-autotools-dev
-debian-changes-6b1-1
+fix-CVE-2013-6629_6630

=== modified file 'debian/rules'
--- debian/rules	2012-11-29 13:52:49 +0000
+++ debian/rules	2013-12-10 23:15:47 +0000
@@ -33,7 +33,7 @@
 clean: 
 	dh_testdir
 	dh_testroot
-	-rm -f build-stamp
+	-rm -f build-stamp stamp-h1
 	if [ -f Makefile ]; then $(MAKE) clean; fi
 	-rm -f Makefile jconfig.h config.log config.status  libtool
 	dh_clean

=== modified file 'jdmarker.c'
--- jdmarker.c	2003-09-08 16:22:08 +0000
+++ jdmarker.c	2013-12-10 23:15:47 +0000
@@ -238,7 +238,7 @@
 /* Process a SOFn marker */
 {
   INT32 length;
-  int c, ci;
+  int c, ci, i;
   jpeg_component_info * compptr;
   INPUT_VARS(cinfo);
 
@@ -275,11 +275,27 @@
     cinfo->comp_info = (jpeg_component_info *) (*cinfo->mem->alloc_small)
 			((j_common_ptr) cinfo, JPOOL_IMAGE,
 			 cinfo->num_components * SIZEOF(jpeg_component_info));
-  
-  for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
-       ci++, compptr++) {
+
+  for (ci = 0; ci < cinfo->num_components; ci++) {
+    INPUT_BYTE(cinfo, c, return FALSE);
+    /* Check to see whether component id has already been seen   */
+    /* (in violation of the spec, but unfortunately seen in some */
+    /* files).  If so, create "fake" component id equal to the   */
+    /* max id seen so far + 1. */
+    for (i = 0, compptr = cinfo->comp_info; i < ci; i++, compptr++) {
+      if (c == compptr->component_id) {
+	compptr = cinfo->comp_info;
+	c = compptr->component_id;
+	compptr++;
+	for (i = 1; i < ci; i++, compptr++) {
+	  if (compptr->component_id > c) c = compptr->component_id;
+	}
+	c++;
+	break;
+      }
+    }
+    compptr->component_id = c;
     compptr->component_index = ci;
-    INPUT_BYTE(cinfo, compptr->component_id, return FALSE);
     INPUT_BYTE(cinfo, c, return FALSE);
     compptr->h_samp_factor = (c >> 4) & 15;
     compptr->v_samp_factor = (c     ) & 15;
@@ -302,7 +318,7 @@
 /* Process a SOS marker */
 {
   INT32 length;
-  int i, ci, n, c, cc;
+  int c, ci, i, n;
   jpeg_component_info * compptr;
   INPUT_VARS(cinfo);
 
@@ -323,24 +339,38 @@
   /* Collect the component-spec parameters */
 
   for (i = 0; i < n; i++) {
-    INPUT_BYTE(cinfo, cc, return FALSE);
     INPUT_BYTE(cinfo, c, return FALSE);
-    
+
+    /* Detect the case where component id's are not unique, and, if so, */
+    /* create a fake component id using the same logic as in get_sof.   */
+    for (ci = 0; ci < i; ci++) {
+      if (c == cinfo->cur_comp_info[ci]->component_id) {
+	c = cinfo->cur_comp_info[0]->component_id;
+	for (ci = 1; ci < i; ci++) {
+	  compptr = cinfo->cur_comp_info[ci];
+	  if (compptr->component_id > c) c = compptr->component_id;
+	}
+	c++;
+	break;
+      }
+    }
+
     for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
 	 ci++, compptr++) {
-      if (cc == compptr->component_id)
+      if (c == compptr->component_id)
 	goto id_found;
     }
 
-    ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
+    ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, c);
 
   id_found:
 
     cinfo->cur_comp_info[i] = compptr;
+    INPUT_BYTE(cinfo, c, return FALSE);
     compptr->dc_tbl_no = (c >> 4) & 15;
     compptr->ac_tbl_no = (c     ) & 15;
-    
-    TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, cc,
+
+    TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, compptr->component_id,
 	     compptr->dc_tbl_no, compptr->ac_tbl_no);
   }
 
@@ -456,6 +486,8 @@
     if (count > 256 || ((INT32) count) > length)
       ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
 
+    MEMZERO(huffval, SIZEOF(huffval)); /* pre-zero array for later copy */
+
     for (i = 0; i < count; i++)
       INPUT_BYTE(cinfo, huffval[i], return FALSE);
 

=== removed file 'stamp-h1'
--- stamp-h1	2012-11-15 09:01:30 +0000
+++ stamp-h1	1970-01-01 00:00:00 +0000
@@ -1,1 +0,0 @@
-timestamp for jconfig.h