# Buildsheet autogenerated by ravenadm tool -- Do not edit. NAMEBASE= jbig2dec VERSION= 0.20 REVISION= 2 KEYWORDS= graphics devel VARIANTS= std SDESC[std]= JBIG2 decoder and library (monochrome documents) HOMEPAGE= https://jbig2dec.com/ CONTACT= nobody DOWNLOAD_GROUPS= main SITES[main]= https://github.com/ArtifexSoftware/jbig2dec/releases/download/0.20/ DISTFILE[1]= jbig2dec-0.20.tar.gz:main DF_INDEX= 1 SPKGS[std]= set primary dev tools man OPTIONS_AVAILABLE= none OPTIONS_STANDARD= none EXRUN[tools]= primary USES= autoreconf cpe libtool png ssl zlib LICENSE= AGPLv3+:primary LICENSE_TERMS= primary:{{WRKSRC}}/LICENSE LICENSE_FILE= AGPLv3+:{{WRKSRC}}/COPYING LICENSE_SCHEME= solo CPE_VENDOR= artifex FPC_EQUIVALENT= graphics/jbig2dec MUST_CONFIGURE= gnu CONFIGURE_ARGS= --with-libpng={{LOCALBASE}} CONFIGURE_ENV= ac_cv_func_getopt_long=yes INSTALL_TARGET= install-strip SOVERSION= 0.0.0 LDFLAGS= -L{{OPENSSLLIB}} -lcrypto CVE_FIXED= CVE-2023-46361 [FILE:327:descriptions/desc.primary] jbig2dec is a decoder implementation of the JBIG2 image compression format. JBIG2 is designed for lossy or lossless encoding of 'bilevel' (1-bit monochrome) images at moderately high resolution, and in particular scanned paper documents. In this domain it is very efficient, offering compression ratios on the order of 100:1. [FILE:40:descriptions/desc.tools] This package contains jbig2dec program. [FILE:99:distinfo] 7b63ff6470289547e7a3a0f145cb8ea6c2afffdd65645b7d87d3b7febc96fb3a 497524 jbig2dec-0.20.tar.gz [FILE:63:manifests/plist.primary] lib/ libjbig2dec.so.%%SOMAJOR%% libjbig2dec.so.%%SOVERSION%% [FILE:78:manifests/plist.dev] include/jbig2.h lib/ libjbig2dec.a libjbig2dec.so lib/pkgconfig/jbig2dec.pc [FILE:13:manifests/plist.tools] bin/jbig2dec [FILE:26:manifests/plist.man] share/man/man1/jbig2dec.1 [FILE:753:patches/patch-CVE-2023-46361] From 44ca5b9d023e1de33fcb8984c85bb29619c4db7e Mon Sep 17 00:00:00 2001 From: Sebastian Rasmussen Date: Sun, 5 Nov 2023 12:21:52 +0100 Subject: [PATCH] Bug 705041: jbig2dec: Avoid uninitialized allocator in command-line tool. This fixes CVE-2023-46361. --- jbig2dec/jbig2dec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- jbig2dec.c.orig 2023-08-30 11:34:46 UTC +++ jbig2dec.c @@ -567,7 +567,7 @@ main(int argc, char **argv) { jbig2dec_params_t params; jbig2dec_error_callback_state_t error_callback_state; - jbig2dec_allocator_t allocator_; + jbig2dec_allocator_t allocator_ = { 0 }; jbig2dec_allocator_t *allocator = &allocator_; Jbig2Ctx *ctx = NULL; FILE *f = NULL, *f_page = NULL;