From patchwork Tue Dec 27 11:59:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 6343 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4NhCrz3mvSz3xlw for ; Tue, 27 Dec 2022 12:00:19 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4NhCrt1lGfz1Fg; Tue, 27 Dec 2022 12:00:14 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4NhCrt0qyrz300C; Tue, 27 Dec 2022 12:00:14 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4NhCrq4T92z2xLF for ; Tue, 27 Dec 2022 12:00:11 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4NhCrq1ccGz13n; Tue, 27 Dec 2022 12:00:11 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1672142411; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Eh4HKqXZte3LFSSPDMXJF3/82+HgEZkziRhCWRbufo0=; b=6xrUxb3DgfLyGtgKtfHIODXPk7z3KnCx9ilEearFAVZW9tntr+fhlsisFWS/4l+/IraeZM 9L7Siswe1gUbaWAA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1672142411; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Eh4HKqXZte3LFSSPDMXJF3/82+HgEZkziRhCWRbufo0=; b=MaTH3BCj91Zz7zmc+xG+E0zy907NDYzyxU4hPGVaf3KUcTzWid2ZgSOZxHsZKore/6KaOW vMRUKOpaSqH+spbSlKCcln1pMwpEivSX3uPLgZNuqQfjgx+3vs5I2HUQp+VO0/r0t58WGW FYVXlpXYGVfmK3ZqdgFp0BVhPvak/AbhofBXhTtVDx/FYdqtAwTk1Fiqnemaxz2RTFKj6Z dhTl2g+jovmMoE1AIM3qQLxJs5B7/92OGbO8BetyYFRPYDE3XrQtRXaylCcfZPc3fggrK/ 5wbTMuYHyzvlNp5I97siJAteSbLVkQ8Lahxejd3+S/Y26EtbyleDUogKt3n8nA== From: Adolf Belka To: development@lists.ipfire.org Subject: [PATCH] libexif: Update to version 0.6.24 Date: Tue, 27 Dec 2022 12:59:57 +0100 Message-Id: <20221227120002.12161-6-adolf.belka@ipfire.org> In-Reply-To: <20221227120002.12161-1-adolf.belka@ipfire.org> References: <20221227120002.12161-1-adolf.belka@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" - Update from version 0.6.22 to 0.6.24 - Update of rootfile not required - source file no longer provided in xz format - changed to bz2 - Changelog (Two CVE's fixed in 0.6.23) libexif-0.6.24 (2021-11-25): * Translation updates: sr, vi, pl, uk, french * fixed regression in exif_data_load_data which could not load EXIF in JPEG data anymore * Decode lots of Canon tag names * removed empty strings from translation (empty string would translate to the PO info header) * various warning removals and code improvements * added sample "persistent" afl fuzzer (100x faster than normal afl fuzzer) libexif-0.6.23 (2021-09-12): * Translation updates: es, pl, uk, fr * EXIF_TAG_SENSITIVITY_TYPE decoder added, added some more Exif 2.3 tags: - EXIF_TAG_STANDARD_OUTPUT_SENSITIVITY - EXIF_TAG_RECOMMENDED_EXPOSURE_INDEX - EXIF_TAG_ISO_SPEED - EXIF_TAG_ISO_SPEEDLatitudeYYY - EXIF_TAG_ISO_SPEEDLatitudeZZZ - EXIF_TAG_OFFSET_TIME - EXIF_TAG_OFFSET_TIME_ORIGINAL - EXIF_TAG_OFFSET_TIME_DIGITIZED - EXIF_TAG_IMAGE_DEPTH * be more relaxed to out of order JPG / EXIF dataheaders in files generated by some tools * default GPS IFD table added * Decode more Nikon Makernote tag names * Added Apple iOS Makernote * Security fixes: * CVE-2020-0198: unsigned integer overflow in exif_data_load_data_content * CVE-2020-0452: compiler optimization could remove an a bufferoverflow check, making a buffer overflow possible with some EXIF tags * some more denial of service (compute time or stack exhaustion) counter-measures added that avoid minutes of decoding time with malformed files found by OSS-Fuzz Signed-off-by: Adolf Belka Reviewed-by: Peter Müller --- lfs/libexif | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lfs/libexif b/lfs/libexif index c23dfd573..c89232b1c 100644 --- a/lfs/libexif +++ b/lfs/libexif @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team # +# Copyright (C) 2007-2022 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,15 +26,15 @@ include Config SUMMARY = An EXIF Tag Parsing Library for Digital Cameras -VER = 0.6.22 +VER = 0.6.24 THISAPP = libexif-$(VER) -DL_FILE = $(THISAPP).tar.xz +DL_FILE = $(THISAPP).tar.bz2 DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = libexif -PAK_VER = 2 +PAK_VER = 3 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 3771dcf2d6a9d9a63e2d3fcdd49487bec7af45d1d18aef1bf3d427893b0cfc464fab37adfbfa549571a58540c7c1eb402724afe05c36baa51a6b7f19ee17ed2b +$(DL_FILE)_BLAKE2 = 75d3a2b4fefd7b7706226e70d31250ef7e99eeb81a4839ddc36cc9e3180534542d8a02851f8e6fd5034bbc925a616ead8c4bfb0cce8bc5886c3ec54811914a6b install : $(TARGET)