Update openjpeg to 2.3.0
ClosedPublic
Actions

Authored by kyrios123 on Oct 5 2017, 4:34 PM.

Details

Reviewers

JoshStrobl
• sunnyflunk

Group Reviewers

Triage Team

Commits

R2244:9865fe2365f0: Update openjpeg to 2.3.0

Summary

Release annoucement here
Include pkgconfig fix from @xulongwu4 (Longwu Ou) in D2622

Signed-off-by: Pierre-Yves <pyu@riseup.net>

Test Plan

$ opj_compress -i tst.png -o output.j2k

[INFO] tile number 1 / 1
[INFO] Generated outfile output.j2k
encode time: 73 ms

Diff Detail

Repository

R2244 openjpeg

Branch

master

Lint

No Lint Coverage

Unit

No Test Coverage

Event Timeline

kyrios123 created this revision.Oct 5 2017, 4:34 PM

Herald added a reviewer: Triage Team. · View Herald TranscriptOct 5 2017, 4:34 PM

there are certainly some CVE fixes but they didn't mention anything in their changelog

there are certainly some CVE fixes but they didn't mention anything in their changelog

While they didn't list the CVE IDs, they listed the actual messages for it like heap-based buffer overflows. If you run a CVE check against openjpeg 2.2.0 it should give a better idea of the CVEs, but we should get them documented here.

This revision now requires changes to proceed.Oct 9 2017, 12:28 PM

I don't know if I missed something, but the cve report is empty...

report.html3 KBDownload

You are doing that against 2.2.0, right?

report.html7 KBDownload

There were a number of CVE's for 2.2.0 (your flaw is running cvecheck on the 2.3.0 package.yml, where there aren't any CVE's against 2.3.0).

However, this update doesn't fix any published CVE's that weren't fixed in the last snapshot build. Some CVE's were published afterwards (so the CVE's aren't mentioned), but had already been fixed a month earlier.