Open
fix(cve): 修复 CVE-2026-88384 在 OpenEXR 中的漏洞 #192
infra_teamAdd on 3 days ago
fix(cve): 修复 CVE-2026-88384 在 OpenEXR 中的漏洞 #192
Open
Total: 2 files changed+45-1
| @@ -1,7 +1,7 @@ | |||
| 1 | Name: OpenEXR | 1 | Name: OpenEXR |
| 2 | Summary: A high dynamic-range (HDR) image file format for use in computer imaging applications | 2 | Summary: A high dynamic-range (HDR) image file format for use in computer imaging applications |
| 3 | Version: 3.1.11 | 3 | Version: 3.1.11 |
| 4 | -Release: 12 | 4 | +Release: 13 |
| 5 | License: BSD-3-Clause | 5 | License: BSD-3-Clause |
| 6 | URL: http://www.openexr.com/ | 6 | URL: http://www.openexr.com/ |
| 7 | Source0: https://github.com/AcademySoftwareFoundation/openexr/archive/v%{version}/openexr-%{version}.tar.gz | 7 | Source0: https://github.com/AcademySoftwareFoundation/openexr/archive/v%{version}/openexr-%{version}.tar.gz |
| @@ -24,6 +24,7 @@ Patch14: backport-CVE-2026-59183.patch | |||
| 24 | Patch15: backport-CVE-2026-59184-2026-59189-2026-59981-2026-59982.patch | 24 | Patch15: backport-CVE-2026-59184-2026-59189-2026-59981-2026-59982.patch |
| 25 | Patch16: backport-CVE-2026-59186.patch | 25 | Patch16: backport-CVE-2026-59186.patch |
| 26 | Patch17: backport-CVE-2026-61555.patch | 26 | Patch17: backport-CVE-2026-61555.patch |
| 27 | +Patch18: backport-CVE-2026-88384.patch | ||
| 27 | 28 | ||
| 28 | BuildRequires: gcc-c++ zlib-devel pkgconfig python3-devel | 29 | BuildRequires: gcc-c++ zlib-devel pkgconfig python3-devel |
| 29 | BuildRequires: cmake gcc boost-devel pkgconfig(Imath) | 30 | BuildRequires: cmake gcc boost-devel pkgconfig(Imath) |
| @@ -92,6 +93,9 @@ EXCLUDE_REGEX='DWA[AB]Compression' | |||
| 92 | %{_libdir}/pkgconfig/OpenEXR.pc | 93 | %{_libdir}/pkgconfig/OpenEXR.pc |
| 93 | 94 | ||
| 94 | %changelog | 95 | %changelog |
| 96 | +* Wed Nov 04 2026 infra_team <zhaiwenjie1@huawei.com> - 3.1.11-13 | ||
| 97 | +- Fix CVE-2026-88384: NULL pointer dereference in OpaqueAttribute | ||
| 98 | + | ||
| 95 | * Mon Nov 02 2026 Funda Wang <fundawang@yeah.net> - 3.1.11-12 | 99 | * Mon Nov 02 2026 Funda Wang <fundawang@yeah.net> - 3.1.11-12 |
| 96 | - Align release with openEuler-24.03-LTS branches | 100 | - Align release with openEuler-24.03-LTS branches |
| 97 | 101 | ||
| @@ -0,0 +1,40 @@ | |||
| 1 | +From 067a50952bd58987b9693867f2608b4afb4cf1c7 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Peter Hillman <peterh@wetafx.co.nz> | ||
| 3 | +Date: Mon, 31 Aug 2026 11:09:49 +1200 | ||
| 4 | +Subject: [PATCH] fix: CVE-2026-88384 - guard memcpy on dataSize==0 | ||
| 5 | + | ||
| 6 | +Backport of upstream commit 70ddecfe ("check for dataSize==0 before | ||
| 7 | +memcpy in OpaqueAttribute") to OpenEXR 3.1.11. The upstream hunk for | ||
| 8 | +the 3-argument OpaqueAttribute constructor is dropped because that | ||
| 9 | +constructor does not exist in 3.1.11; the copy constructor and | ||
| 10 | +copyValueFrom memcpy calls are guarded by dataSize>0 instead. | ||
| 11 | + | ||
| 12 | +Upstream-commit: https://github.com/AcademySoftwareFoundation/openexr/commit/70ddecfe82d2566f3776b8ed923939afd47baca2 | ||
| 13 | +Signed-off-by: infra_team <zhaiwenjie1@huawei.com> | ||
| 14 | +--- | ||
| 15 | + src/lib/OpenEXR/ImfOpaqueAttribute.cpp | 2 ++ | ||
| 16 | + 1 file changed, 2 insertions(+) | ||
| 17 | + | ||
| 18 | +diff --git a/src/lib/OpenEXR/ImfOpaqueAttribute.cpp b/src/lib/OpenEXR/ImfOpaqueAttribute.cpp | ||
| 19 | +index 7d0962d..dcac2d6 100644 | ||
| 20 | +--- a/src/lib/OpenEXR/ImfOpaqueAttribute.cpp | ||
| 21 | ++++ b/src/lib/OpenEXR/ImfOpaqueAttribute.cpp | ||
| 22 | +@@ -37,6 +37,7 @@ OpaqueAttribute::OpaqueAttribute (const OpaqueAttribute &other): | ||
| 23 | + _data (other._dataSize) | ||
| 24 | + { | ||
| 25 | + _data.resizeErase (other._dataSize); | ||
| 26 | ++ if (other._dataSize>0) | ||
| 27 | + memcpy ((char *) _data, (const char *) other._data, other._dataSize); | ||
| 28 | + } | ||
| 29 | + | ||
| 30 | +@@ -93,6 +94,7 @@ OpaqueAttribute::copyValueFrom (const Attribute &other) | ||
| 31 | + | ||
| 32 | + _data.resizeErase (oa->_dataSize); | ||
| 33 | + _dataSize = oa->_dataSize; | ||
| 34 | ++ if (oa->_dataSize>0) | ||
| 35 | + memcpy ((char *) _data, (const char *) oa->_data, oa->_dataSize); | ||
| 36 | + } | ||
| 37 | + | ||
| 38 | +-- | ||
| 39 | +2.39.5 | ||
| 40 | + | ||