#182 CVE-2024-28574/28575/28576: replace bundled OpenJPEG 2.0.0 with 2.5.4

[Daniel Rosser]

Applies to FreeImage SVN trunk r1911 (also 3.19.0 [r1909]).

CVE-2024-28574 / CVE-2024-28575 / CVE-2024-28576 live in the bundled OpenJPEG 2.0.0 copy (Source/LibOpenJPEG/j2k.c: opj_j2k_copy_default_tcp_and_create_tcd, opj_j2k_read_mct, opj_j2k_tcp_destroy). They are not bugs in FreeImage glue. OpenJPEG 2.5.4 (and current system libopenjp2) contains the upstream fixes (28576 traces to openjpeg#477).

This is a vendor-tree replacement of Source/LibOpenJPEG 2.0.0 -> 2.5.4 plus Makefile.srcs so the GNU makefile still compiles the new units (ht_dec.c, opj_malloc.c, sparse_array.c, thread.c) and drops the removed raw.c.

NVD:
https://nvd.nist.gov/vuln/detail/CVE-2024-28574
https://nvd.nist.gov/vuln/detail/CVE-2024-28575
https://nvd.nist.gov/vuln/detail/CVE-2024-28576

GitHub: https://github.com/danoli3/FreeImage/commit/229de19 (PR https://github.com/danoli3/FreeImage/pull/68)

Apply from the FreeImage tree root (gzipped because the unified diff is ~2.7MB):

gzip -dc CVE-2024-28574.patch.gz | patch -p0

Apply this BEFORE the OpenEXR vendor patch (CVE-2024-28562); that patch's Makefile.srcs hunk is based on this one.

Alternative to a tree bump: link system OpenJPEG 2.5+ instead of the bundled copy.

Related glue already on this tracker: #176 CVE-2024-28584 (J2KImageToFIBITMAP NULL check) — that is FreeImage code, independent of this replacement.

[Daniel Rosser]

Vendor-tree replacement #1 of 2 (OpenJPEG 2.0.0 -> 2.5.4). OpenEXR 2.2 -> 3.3.13 follows in a few minutes so the tracker is not flooded. Apply this first: gzip -dc CVE-2024-28574.patch.gz | patch -p0

[Daniel Rosser]

Sorry this one is a bit huge hopefully patch works on it. added to gz compressed.

[Daniel Rosser]

OpenEXR vendor-tree replacement is now #183 (CVE-2024-28562/28563/28564/28569: OpenEXR 2.2 -> 3.3.13). Apply this ticket first:

gzip -dc CVE-2024-28574.patch.gz | patch -p0

then the OpenEXR patch from #183:

gzip -dc CVE-2024-28562.patch.gz | patch -p0

https://sourceforge.net/p/freeimage/patches/183/