tree 701c25f64aca35fe8454321bdfc30fcad1a5dbf1
parent 658826e13d79bf78eeb22575241a82f83099d852
author Fabrice Fontaine <fontaine.fabrice@gmail.com> 1598560812 +0200
committer Peter Korsgaard <peter@korsgaard.com> 1598725298 +0200

package/openjpeg: fix CVE-2020-15389

Fix CVE-2020-15389: jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a
use-after-free that can be triggered if there is a mix of valid and
invalid files in a directory operated on by the decompressor. Triggering
a double-free may also be possible. This is related to calling
opj_image_destroy twice.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b006cc373f96ec86c027779e113c8f70bc40d1c3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>