strepsirrhini/office-gobmx
9
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

upgrade libwebp to 1.3.1

Browse source 
Fixes CVE-2023-1999.

Change-Id: I3d0f5f718242977156729521d14efb1a8d71aee4
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/153819
Tested-by: Jenkins
Reviewed-by: Taichi Haradaguchi <20001722@ymail.ne.jp>
This commit is contained in:
Taichi Haradaguchi 2023-07-01 11:56:32 +09:00
parent e693d340a8
commit c1fe534ae4
3 changed files with 2 additions and 55 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
download.lst
View file

@ -334,8 +334,8 @@ LIBTOMMATH_TARBALL := ltm-1.0.zip
# three static lines
# so that git cherry-pick
# will not run into conflicts
LIBWEBP_SHA256SUM := 64ac4614db292ae8c5aa26de0295bf1623dbb3985054cb656c55e67431def17c
LIBWEBP_TARBALL := libwebp-1.3.0.tar.gz
LIBWEBP_SHA256SUM := b3779627c2dfd31e3d8c4485962c2efe17785ef975e2be5c8c0c9e6cd3c4ef66
LIBWEBP_TARBALL := libwebp-1.3.1.tar.gz
# three static lines
# so that git cherry-pick
# will not run into conflicts

52
external/libwebp/CVE-2023-1999.patch.1 vendored
View file

@ -1,52 +0,0 @@
From a486d800b60d0af4cc0836bf7ed8f21e12974129 Mon Sep 17 00:00:00 2001
From: James Zern <jzern@google.com>
Date: Wed, 22 Feb 2023 22:15:47 -0800
Subject: [PATCH] EncodeAlphaInternal: clear result->bw on error
This avoids a double free should the function fail prior to
VP8BitWriterInit() and a previous trial result's buffer carried over.
Previously in ApplyFiltersAndEncode() trial.bw (with a previous
iteration's buffer) would be freed, followed by best.bw pointing to the
same buffer.
Since:
187d379d add a fallback to ALPHA_NO_COMPRESSION
In addition, check the return value of VP8BitWriterInit() in this
function.
Bug: webp:603
Change-Id: Ic258381ee26c8c16bc211d157c8153831c8c6910
---
src/enc/alpha_enc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/enc/alpha_enc.c b/src/enc/alpha_enc.c
index f7c02690e3..7d205586fe 100644
--- a/src/enc/alpha_enc.c
+++ b/src/enc/alpha_enc.c
@@ -13,6 +13,7 @@
#include <assert.h>
#include <stdlib.h>
+#include <string.h>
#include "src/enc/vp8i_enc.h"
#include "src/dsp/dsp.h"
@@ -148,6 +149,7 @@ static int EncodeAlphaInternal(const uint8_t* const data, int width, int height,
}
} else {
VP8LBitWriterWipeOut(&tmp_bw);
+ memset(&result->bw, 0, sizeof(result->bw));
return 0;
}
}
@@ -162,7 +164,7 @@ static int EncodeAlphaInternal(const uint8_t* const data, int width, int height,
header = method | (filter << 2);
if (reduce_levels) header |= ALPHA_PREPROCESSED_LEVELS << 4;
- VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size);
+ if (!VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size)) ok = 0;
ok = ok && VP8BitWriterAppend(&result->bw, &header, ALPHA_HEADER_LEN);
ok = ok && VP8BitWriterAppend(&result->bw, output, output_size);

1
external/libwebp/UnpackedTarball_libwebp.mk vendored
View file

@ -15,7 +15,6 @@ $(eval $(call gb_UnpackedTarball_set_patchlevel,libwebp,0))
$(eval $(call gb_UnpackedTarball_add_patches,libwebp,\
external/libwebp/Makefile.vc.patch \
external/libwebp/CVE-2023-1999.patch.1 \
))
# vim: set noet sw=4 ts=4: