From 1f68e8681d1005609e6deb2f5a0713f6f3096a74 Mon Sep 17 00:00:00 2001
From: zhangpan <zp1224248514@163.com>
Date: Tue, 29 Oct 2024 09:12:11 +0000
Subject: [PATCH] fix CVE-2021-3575

(cherry picked from commit e1d155b0b25ad0f11e3747ca535314f83842ff04)
---
 backport-CVE-2021-3575.patch | 43 ++++++++++++++++++++++++++++++++++++
 heap-buffer-overflow.patch   | 22 ------------------
 openjpeg2.spec               |  9 +++++---
 3 files changed, 49 insertions(+), 25 deletions(-)
 create mode 100644 backport-CVE-2021-3575.patch
 delete mode 100644 heap-buffer-overflow.patch

diff --git a/backport-CVE-2021-3575.patch b/backport-CVE-2021-3575.patch
new file mode 100644
index 0000000..e2c7a55
--- /dev/null
+++ b/backport-CVE-2021-3575.patch
@@ -0,0 +1,43 @@
+From 7bd884f8750892de4f50bf4642fcfbe7011c6bdf Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sun, 18 Feb 2024 17:02:25 +0100
+Subject: [PATCH] opj_decompress: fix off-by-one read heap-buffer-overflow in
+ sycc420_to_rgb() when x0 and y0 are odd (CVE-2021-3575, fixes #1347)
+
+Reference:https://github.com/uclouvain/openjpeg/commit/7bd884f8750892de4f50bf4642fcfbe7011c6bdf
+Conflict:NA
+
+---
+ src/bin/common/color.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/src/bin/common/color.c b/src/bin/common/color.c
+index 27f15f137..ae5d648da 100644
+--- a/src/bin/common/color.c
++++ b/src/bin/common/color.c
+@@ -358,7 +358,15 @@ static void sycc420_to_rgb(opj_image_t *img)
+     if (i < loopmaxh) {
+         size_t j;
+ 
+-        for (j = 0U; j < (maxw & ~(size_t)1U); j += 2U) {
++        if (offx > 0U) {
++            sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b);
++            ++y;
++            ++r;
++            ++g;
++            ++b;
++        }
++
++        for (j = 0U; j < (loopmaxw & ~(size_t)1U); j += 2U) {
+             sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
+ 
+             ++y;
+@@ -375,7 +383,7 @@ static void sycc420_to_rgb(opj_image_t *img)
+             ++cb;
+             ++cr;
+         }
+-        if (j < maxw) {
++        if (j < loopmaxw) {
+             sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
+         }
+     }
diff --git a/heap-buffer-overflow.patch b/heap-buffer-overflow.patch
deleted file mode 100644
index e606555..0000000
--- a/heap-buffer-overflow.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff -rupN --no-dereference openjpeg-2.4.0/src/bin/common/color.c openjpeg-2.4.0-new/src/bin/common/color.c
---- openjpeg-2.4.0/src/bin/common/color.c	2020-12-28 21:59:39.000000000 +0100
-+++ openjpeg-2.4.0-new/src/bin/common/color.c	2021-05-27 23:46:46.961130438 +0200
-@@ -368,12 +368,15 @@ static void sycc420_to_rgb(opj_image_t *
- 
-             sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
- 
--            ++y;
-+            if (*y != img->comps[0].data[loopmaxh])
-+                ++y;
-             ++r;
-             ++g;
-             ++b;
--            ++cb;
--            ++cr;
-+            if (*cb != img->comps[1].data[loopmaxh])
-+                ++cb;
-+            if (*cr != img->comps[2].data[loopmaxh])
-+                ++cr;
-         }
-         if (j < maxw) {
-             sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
diff --git a/openjpeg2.spec b/openjpeg2.spec
index 47f6747..578c1ad 100644
--- a/openjpeg2.spec
+++ b/openjpeg2.spec
@@ -2,15 +2,15 @@
 
 Name:           openjpeg2
 Version:        2.5.0
-Release:        4
+Release:        5
 Summary:        C-Library for JPEG 2000
 License:        BSD and MIT
 URL:            https://github.com/uclouvain/openjpeg
 Source0:        https://github.com/uclouvain/openjpeg/archive/v%{version}/openjpeg-%{version}.tar.gz
 
 Patch0:         openjpeg2_opj2.patch
-Patch1:         heap-buffer-overflow.patch
-Patch2:         backport-CVE-2023-39328.patch
+Patch1:         backport-CVE-2023-39328.patch
+Patch2:         backport-CVE-2021-3575.patch
 
 BuildRequires:  cmake gcc-c++ make zlib-devel libpng-devel libtiff-devel lcms2-devel doxygen java-devel
 BuildRequires:  jbigkit-devel libjpeg-turbo-devel
@@ -101,6 +101,9 @@ mv %{buildroot}%{_mandir}/man1/opj_dump.1 %{buildroot}%{_mandir}/man1/opj2_dump.
 %{_bindir}/opj2_dump
 
 %changelog
+* Tue Oct 29 2024 zhangpan <zhangpan103@h-partners.com> - 2.5.0-5
+- fix CVE-2021-3575
+
 * Thu Jul 11 2024 xinghe <xinghe2@h-partners.com> - 2.5.0-4
 - Type:cves
 - ID:CVE-2023-39328
-- 
Gitee