Bug#1151921: jxrlib: memory bugs on damaged JPEG XR files, fixed in mircomir/jxrlib 1.4.4

[Joachim Rütter]

Package: jxrlib
> Version: 1.2~git20170615.f752187-5.3
> Severity: important
> Tags: security upstream
> X-Debbugs-Cc: team at security.debian.org
> 
> Hello,
> 
> jxrlib in Debian (1.2~git20170615.f752187-5.3 in sid, forky and trixie; -5 in bookworm; 1.1-6 in
> bullseye) has memory bugs that a damaged JPEG XR file of a few hundred bytes triggers, including a
> heap buffer overflow write. All of them are fixed in the maintained fork
> https://github.com/mircomir/jxrlib (1.4.4, 2026-10-09), which Arch, openSUSE Tumbleweed and
> MacPorts already ship.
> 
> Details, the affected functions and the fixing commits:
> https://www.openwall.com/lists/oss-security/2026/10/24/1
> 
> In short (line numbers from 1.2~git20170615.f752187-5.3):
> 
> 1. ReadBinaryData, jxrgluelib/JXRMeta.c:677: uCount + 2 overflows, heap buffer overflow
>    (write). Shown by source review. Fixed in cb97e6d.
> 2. ReadWMIHeader, image/decode/strdec.c:2965: stack buffer over-read. Fixed in d6e5f8d.
> 3. DecodeSignificantRun, image/decode/segdec.c:362: global buffer over-read. Fixed in debe47a.
> 4. initLookupTables, image/decode/strdec.c:2617: global buffer over-read. Fixed in ba86c04.
> 5. ImageStrDecDecode, image/decode/strdec.c:3536: NULL write, crash. Fixed in 190078d.
> 6. ParsePFDEntry, jxrgluelib/JXRGlueJxr.c:1573: assert, builds with asserts only. Fixed in 7d2d462.
> 
> Items 2 to 5 reproduce under AddressSanitizer with JxrDecApp built from Debian's source
> package. The security team has the test files; I can attach them here too if that helps.
> 
> Suggested fix: move to mircomir/jxrlib 1.4.4, or backport the six commits.
> 
> Best regards
> Joachim Ruetter
> https://featherview.mynetx.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20261024/15192f21/attachment.htm>