[vlc-commits] [Git][videolan/vlc][master] contrib: openjpeg: apply upstream patch

[Steve Lhomme (@robUx4)]

Steve Lhomme pushed to branch master at VideoLAN / VLC


Commits:
d52fe31b by Steve Lhomme at 2026-07-03T12:06:48+00:00
contrib: openjpeg: apply upstream patch

To fix CVE-2026-6192 [^1].

[^1]: https://app.opencve.io/cve/CVE-2026-6192

- - - - -


2 changed files:

- + contrib/src/openjpeg/839936aa33eb8899bbbd80fda02796bb65068951.patch
- contrib/src/openjpeg/rules.mak


Changes:

=====================================
contrib/src/openjpeg/839936aa33eb8899bbbd80fda02796bb65068951.patch
=====================================
@@ -0,0 +1,31 @@
+From 839936aa33eb8899bbbd80fda02796bb65068951 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault at spatialys.com>
+Date: Sun, 5 Apr 2026 13:25:27 +0200
+Subject: [PATCH] opj_pi_initialise_encode() (write code path): avoid potential
+ integer overflow leading to insufficient memory allocation
+
+Fixes #1619
+---
+ src/lib/openjp2/pi.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/src/lib/openjp2/pi.c b/src/lib/openjp2/pi.c
+index 15ac33142..4abb87af2 100644
+--- a/src/lib/openjp2/pi.c
++++ b/src/lib/openjp2/pi.c
+@@ -1694,9 +1694,12 @@ opj_pi_iterator_t *opj_pi_initialise_encode(const opj_image_t *p_image,
+     l_current_pi = l_pi;
+ 
+     /* memory allocation for include*/
+-    l_current_pi->include_size = l_tcp->numlayers * l_step_l;
+-    l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size,
+-                            sizeof(OPJ_INT16));
++    l_current_pi->include = NULL;
++    if (l_step_l <= UINT_MAX / l_tcp->numlayers) {
++        l_current_pi->include_size = l_tcp->numlayers * l_step_l;
++        l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size,
++                                sizeof(OPJ_INT16));
++    }
+     if (!l_current_pi->include) {
+         opj_free(l_tmp_data);
+         opj_free(l_tmp_ptr);


=====================================
contrib/src/openjpeg/rules.mak
=====================================
@@ -16,6 +16,7 @@ openjpeg: openjpeg-$(OPENJPEG_VERSION).tar.gz .sum-openjpeg
 	$(UNPACK)
 	$(APPLY) $(SRC)/openjpeg/5e258319332800f7a9937dc0b8b16b19a07dea8f.patch
 	$(APPLY) $(SRC)/openjpeg/7b508bb00f7fc5e7b61a6035fc4e2622d4ddff0d.patch
+	$(APPLY) $(SRC)/openjpeg/839936aa33eb8899bbbd80fda02796bb65068951.patch
 	$(call pkg_static,"./src/lib/openjp2/libopenjp2.pc.cmake.in")
 	$(MOVE)
 



View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/d52fe31b907fa3c1972637622ec16689eaf0c920

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/d52fe31b907fa3c1972637622ec16689eaf0c920
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help