reverted: --- openjpeg-1.3+dfsg/debian/libopenjpeg2.links +++ openjpeg-1.3+dfsg.orig/debian/libopenjpeg2.links @@ -1 +0,0 @@ -/usr/lib/libopenjpeg-2.1.3.0.so /usr/lib/libopenjpeg.so.2 diff -u openjpeg-1.3+dfsg/debian/libopenjpeg-dev.install openjpeg-1.3+dfsg/debian/libopenjpeg-dev.install --- openjpeg-1.3+dfsg/debian/libopenjpeg-dev.install +++ openjpeg-1.3+dfsg/debian/libopenjpeg-dev.install @@ -1,2 +1,3 @@ -*.h usr/include/ -lib*.a usr/lib +usr/include +usr/lib/*/lib*.a +usr/lib/*/libopenjpeg.so diff -u openjpeg-1.3+dfsg/debian/rules openjpeg-1.3+dfsg/debian/rules --- openjpeg-1.3+dfsg/debian/rules +++ openjpeg-1.3+dfsg/debian/rules @@ -5,6 +5,8 @@ # used as trailer in the generated manpages UVERSION = $(shell dpkg-parsechangelog | perl -ne 'print "$$1\n" if (/^Version: (.*?)(?:\.dfsg)?\-.*?$$/)') +DEB_HOST_MULTIARCH = $(shell dpkg-architecture -qDEB_HOST_MULTIARCH) + ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS))) EXTRA_CFLAGS += -O0 else @@ -59,7 +61,9 @@ dh_clean -k dh_installdirs - $(MAKE) dist + $(MAKE) install DESTDIR=dist INSTALL_LIBDIR=\$${PREFIX}/lib/$(DEB_HOST_MULTIARCH) + cd dist/usr/lib/$(DEB_HOST_MULTIARCH) && ln -s libopenjpeg.so.2 libopenjpeg.so + # The libraries and header file are in dist/ # So we'll dump the binaries there too cp codec/j2k_to_image codec/image_to_j2k dist/ reverted: --- openjpeg-1.3+dfsg/debian/libopenjpeg-dev.links +++ openjpeg-1.3+dfsg.orig/debian/libopenjpeg-dev.links @@ -1 +0,0 @@ -/usr/lib/libopenjpeg.so.2 /usr/lib/libopenjpeg.so diff -u openjpeg-1.3+dfsg/debian/libopenjpeg2.install openjpeg-1.3+dfsg/debian/libopenjpeg2.install --- openjpeg-1.3+dfsg/debian/libopenjpeg2.install +++ openjpeg-1.3+dfsg/debian/libopenjpeg2.install @@ -1 +1,2 @@ -lib*.so* usr/lib/ +usr/lib/*/lib*.so.* +usr/lib/*/lib*-*.so diff -u openjpeg-1.3+dfsg/debian/control openjpeg-1.3+dfsg/debian/control --- openjpeg-1.3+dfsg/debian/control +++ openjpeg-1.3+dfsg/debian/control @@ -3,7 +3,7 @@ Maintainer: Debian PhotoTools Maintainers Uploaders: Robin Cornelius , Cyril Brulebois Homepage: http://www.openjpeg.org -Build-Depends: debhelper (>= 5), dpatch (>= 2), libtiff4-dev +Build-Depends: debhelper (>= 5), dpatch (>= 2), libtiff4-dev, dpkg-dev (>= 1.16.0) Standards-Version: 3.7.3 Section: libs Vcs-Browser: http://git.debian.org/?p=pkg-phototools/openjpeg.git @@ -23,6 +23,8 @@ Package: libopenjpeg2 Section: libs Architecture: any +Multi-Arch: same +Pre-Depends: ${misc:Pre-Depends} Depends: ${shlibs:Depends} Description: JPEG 2000 image compression/decompression library Libopenjpeg2 is a library for handling the JPEG 2000 image compression format. @@ -39,6 +41,7 @@ Package: openjpeg-tools Section: graphics Architecture: any +Multi-Arch: foreign Depends: ${shlibs:Depends} Description: command-line tools using the JPEG 2000 library This package provides with command-line tools allowing for conversions between diff -u openjpeg-1.3+dfsg/debian/changelog openjpeg-1.3+dfsg/debian/changelog --- openjpeg-1.3+dfsg/debian/changelog +++ openjpeg-1.3+dfsg/debian/changelog @@ -1,3 +1,41 @@ +openjpeg (1.3+dfsg-4.6) unstable; urgency=low + + * Non-maintainer upload. + * Reduce debhelper dependency and debian/compat to 5 + - Multi-arch debug paths are not supported at this compatibility level, + so make libopenjpeg2-dbg not multi-arch. + + -- Michael Gilbert Wed, 19 Sep 2012 00:34:07 -0400 + +openjpeg (1.3+dfsg-4.5) unstable; urgency=low + + * Non-maintainer upload. + * Build-depend on debhelper >= 9 to ensure a multiarch-capable version is + installed (closes: #681722). + + -- Michael Gilbert Sun, 15 Jul 2012 18:40:53 -0400 + +openjpeg (1.3+dfsg-4.4) unstable; urgency=high + + * Non-maintainer upload by the Security Team. + * Fix cve-2012-3358: buffer overflow in JPEG2000 image file handling. + + -- Michael Gilbert Wed, 11 Jul 2012 14:51:21 -0400 + +openjpeg (1.3+dfsg-4.3) unstable; urgency=low + + * Non-maintainer upload with permission of the maintainer. + * Set debian/compat to 9 (closes: #680887). + + -- Michael Gilbert Tue, 10 Jul 2012 09:32:36 -0400 + +openjpeg (1.3+dfsg-4.2) unstable; urgency=low + + * Non-maintainer upload. + * Enable multiarch (closes: #675773). + + -- Michael Gilbert Mon, 02 Jul 2012 16:13:27 -0400 + openjpeg (1.3+dfsg-4.1) unstable; urgency=high * Non-maintainer upload by the Security Team. diff -u openjpeg-1.3+dfsg/debian/patches/00list openjpeg-1.3+dfsg/debian/patches/00list --- openjpeg-1.3+dfsg/debian/patches/00list +++ openjpeg-1.3+dfsg/debian/patches/00list @@ -4,0 +5 @@ +cve-2012-3358.dpatch only in patch2: unchanged: --- openjpeg-1.3+dfsg.orig/debian/patches/cve-2012-3358.dpatch +++ openjpeg-1.3+dfsg/debian/patches/cve-2012-3358.dpatch @@ -0,0 +1,60 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## cve-2012-3358.dpatch by Michael Gilbert +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: fix buffer overflow in JPEG2000 file handling. +## DP: https://bugzilla.redhat.com/show_bug.cgi?id=835767 + +@DPATCH@ +diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' openjpeg-1.3+dfsg~/libopenjpeg/j2k.c openjpeg-1.3+dfsg/libopenjpeg/j2k.c +--- openjpeg-1.3+dfsg~/libopenjpeg/j2k.c 2012-07-11 16:04:38.000000000 -0400 ++++ openjpeg-1.3+dfsg/libopenjpeg/j2k.c 2012-07-11 16:06:07.000000000 -0400 +@@ -1282,7 +1282,7 @@ + static int backup_tileno = 0; + + /* tileno is negative or larger than the number of tiles!!! */ +- if ((tileno < 0) || (tileno > (cp->tw * cp->th))) { ++ if ((tileno < 0) || (tileno >= (cp->tw * cp->th))) { + opj_event_msg(j2k->cinfo, EVT_ERROR, + "JPWL: bad tile number (%d out of a maximum of %d)\n", + tileno, (cp->tw * cp->th)); +@@ -1299,8 +1299,18 @@ + + /* keep your private count of tiles */ + backup_tileno++; +- }; ++ } ++ else + #endif /* USE_JPWL */ ++ { ++ /* tileno is negative or larger than the number of tiles!!! */ ++ if ((tileno < 0) || (tileno >= (cp->tw * cp->th))) { ++ opj_event_msg(j2k->cinfo, EVT_ERROR, ++ "JPWL: bad tile number (%d out of a maximum of %d)\n", ++ tileno, (cp->tw * cp->th)); ++ return; ++ } ++ } + + if (cp->tileno_size == 0) { + cp->tileno[cp->tileno_size] = tileno; +@@ -1338,8 +1348,18 @@ + totlen); + } + +- }; ++ } ++ else + #endif /* USE_JPWL */ ++ { ++ /* totlen is negative or larger than the bytes left!!! */ ++ if ((totlen < 0) || (totlen > (cio_numbytesleft(cio) + 8))) { ++ opj_event_msg(j2k->cinfo, EVT_ERROR, ++ "JPWL: bad tile byte size (%d bytes against %d bytes left)\n", ++ totlen, cio_numbytesleft(cio) + 8); ++ return; ++ } ++ } + + if (!totlen) + totlen = cio_numbytesleft(cio) + 8;