New upstream release 2.0.2

libjpeg-turbo-CVE-2018-19664.patch

@@ -1,33 +0,0 @@
-From 4a3f52b4d191d79f500831649037b9b24c730e37 Mon Sep 17 00:00:00 2001
-From: DRC <information@libjpeg-turbo.org>
-Date: Tue, 1 Jan 2019 20:32:40 -0600
-Subject: [PATCH] wrbmp.c: Don't allow quantization w/ non-RGB CS
-
-If cinfo->quantize_colors == 1, then jpeg_calc_output_dimensions() will
-set cinfo->output_components to 1, and if cinfo->out_color_space is not
-RGB (or extended RGB), hilarity will ensue.
-
-Fixes #305
----
- wrbmp.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/wrbmp.c b/wrbmp.c
-index 38a64e8..3489f14 100644
---- a/wrbmp.c
-+++ b/wrbmp.c
-@@ -506,8 +506,9 @@ jinit_write_bmp(j_decompress_ptr cinfo, boolean is_os2,
-       dest->pub.put_pixel_rows = put_gray_rows;
-     else
-       dest->pub.put_pixel_rows = put_pixel_rows;
--  } else if (cinfo->out_color_space == JCS_RGB565 ||
--             cinfo->out_color_space == JCS_CMYK) {
-+  } else if (!cinfo->quantize_colors &&
-+             (cinfo->out_color_space == JCS_RGB565 ||
-+              cinfo->out_color_space == JCS_CMYK)) {
-     dest->pub.put_pixel_rows = put_pixel_rows;
-   } else {
-     ERREXIT(cinfo, JERR_BMP_COLORSPACE);
--- 
-2.17.2
-

libjpeg-turbo-CVE-2018-20330.patch

@@ -1,38 +0,0 @@
-From 9c5f56c55a8610953854408b3aade01320064e07 Mon Sep 17 00:00:00 2001
-From: DRC <information@libjpeg-turbo.org>
-Date: Tue, 1 Jan 2019 18:57:36 -0600
-Subject: [PATCH] tjLoadImage(): Fix int overflow/segfault w/big BMP
-
-Fixes #304
----
- turbojpeg.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/turbojpeg.c b/turbojpeg.c
-index 90a9ce6..3b5154f 100644
---- a/turbojpeg.c
-+++ b/turbojpeg.c
-@@ -1960,7 +1960,8 @@ DLLEXPORT unsigned char *tjLoadImage(const char *filename, int *width,
-                                      int align, int *height, int *pixelFormat,
-                                      int flags)
- {
--  int retval = 0, tempc, pitch;
-+  int retval = 0, tempc;
-+  size_t pitch;
-   tjhandle handle = NULL;
-   tjinstance *this;
-   j_compress_ptr cinfo = NULL;
-@@ -2013,7 +2014,9 @@ DLLEXPORT unsigned char *tjLoadImage(const char *filename, int *width,
-   *pixelFormat = cs2pf[cinfo->in_color_space];
- 
-   pitch = PAD((*width) * tjPixelSize[*pixelFormat], align);
--  if ((dstBuf = (unsigned char *)malloc(pitch * (*height))) == NULL)
-+  if ((unsigned long long)pitch * (unsigned long long)(*height) >
-+      (unsigned long long)((size_t)-1) ||
-+      (dstBuf = (unsigned char *)malloc(pitch * (*height))) == NULL)
-     _throwg("tjLoadImage(): Memory allocation failure");
- 
-   if (setjmp(this->jerr.setjmp_buffer)) {
--- 
-2.17.2
-

libjpeg-turbo-cmake.patch

@@ -1,8 +1,8 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index cc548f5..023ff66 100644
+index 2bc3458..46b9ee6 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -1314,7 +1314,7 @@ endif()
+@@ -1328,7 +1328,7 @@ set(EXE ${CMAKE_EXECUTABLE_SUFFIX})
  
  if(WITH_TURBOJPEG)
    if(ENABLE_SHARED)
@@ -11,18 +11,23 @@ index cc548f5..023ff66 100644
        ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
        LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
        RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
-@@ -1322,10 +1322,6 @@ if(WITH_TURBOJPEG)
+@@ -1341,15 +1341,6 @@ if(WITH_TURBOJPEG)
    if(ENABLE_STATIC)
      install(TARGETS turbojpeg-static ARCHIVE
        DESTINATION ${CMAKE_INSTALL_LIBDIR})
 -    if(NOT ENABLE_SHARED)
--      install(PROGRAMS ${CMAKE_CURRENT_BINARY_DIR}/tjbench-static${EXE}
+-      if(MSVC_IDE)
+-        set(DIR "${CMAKE_CURRENT_BINARY_DIR}/\${CMAKE_INSTALL_CONFIG_NAME}")
+-      else()
+-        set(DIR ${CMAKE_CURRENT_BINARY_DIR})
+-      endif()
+-      install(PROGRAMS ${DIR}/tjbench-static${EXE}
 -        DESTINATION ${CMAKE_INSTALL_BINDIR} RENAME tjbench${EXE})
 -    endif()
    endif()
    install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/turbojpeg.h
      DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
-@@ -1345,18 +1341,6 @@ endif()
+@@ -1374,18 +1365,6 @@ endif()
  
  install(TARGETS rdjpgcom wrjpgcom RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
  
@@ -41,7 +46,7 @@ index cc548f5..023ff66 100644
  if(UNIX OR MINGW)
    install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/cjpeg.1
      ${CMAKE_CURRENT_SOURCE_DIR}/djpeg.1 ${CMAKE_CURRENT_SOURCE_DIR}/jpegtran.1
-@@ -1370,7 +1354,7 @@ endif()
+@@ -1399,7 +1378,7 @@ install(FILES ${CMAKE_CURRENT_BINARY_DIR}/pkgscripts/libjpeg.pc
  
  install(FILES ${CMAKE_CURRENT_BINARY_DIR}/jconfig.h
    ${CMAKE_CURRENT_SOURCE_DIR}/jerror.h ${CMAKE_CURRENT_SOURCE_DIR}/jmorecfg.h

libjpeg-turbo.spec

@@ -1,14 +1,12 @@
 Name:           libjpeg-turbo
-Version:        2.0.0
-Release:        4%{?dist}
+Version:        2.0.2
+Release:        1%{?dist}
 Summary:        A MMX/SSE2/SIMD accelerated library for manipulating JPEG image files
 License:        IJG
 URL:            http://sourceforge.net/projects/libjpeg-turbo
 
 Source0:        http://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.gz
 Patch0:         libjpeg-turbo-cmake.patch
-Patch1:         libjpeg-turbo-CVE-2018-20330.patch
-Patch2:         libjpeg-turbo-CVE-2018-19664.patch
 
 BuildRequires:  gcc
 BuildRequires:  cmake
@@ -71,8 +69,6 @@ manipulate JPEG files using the TurboJPEG library.
 %prep
 %setup -q
 %patch0 -p1
-%patch1 -p1
-%patch2 -p1
 
 %build
 %{cmake} -DCMAKE_SKIP_RPATH:BOOL=YES \
@@ -172,6 +168,9 @@ LD_LIBRARY_PATH=%{buildroot}%{_libdir} make test %{?_smp_mflags}
 %{_libdir}/pkgconfig/libturbojpeg.pc
 
 %changelog
+* Wed Feb 27 2019 Nikola Forró <nforro@redhat.com> - 2.0.2-1
+- New upstream release 2.0.2
+
 * Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.0-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 

sources

@@ -1 +1 @@
-SHA512 (libjpeg-turbo-2.0.0.tar.gz) = 220e5248e780d3c40c7842ba52937b9b0860e89164bca16ec6e2afaf99dd5d0bc706dd9320f4d2aef67ac11d4876453ef688b1efeaf93ceb42e8c25e83da2487
+SHA512 (libjpeg-turbo-2.0.2.tar.gz) = 204b6d083e99488c975c75efb08699e4dc1c409556e4dee4f21e3ee67e9c6682eb342f2e5712816b0342c00399fbe6e43fbce30c3d22f30f7ef91db006b3be08