From 001fe509d6790b191123e899900c95bf94c32eb7 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Aug 19 2021 13:03:54 +0000
Subject: import compat-exiv2-026-0.26-3.el7_9


---

diff --git a/SOURCES/exiv2-CVE-2021-31291.patch b/SOURCES/exiv2-CVE-2021-31291.patch
new file mode 100644
index 0000000..d71d860
--- /dev/null
+++ b/SOURCES/exiv2-CVE-2021-31291.patch
@@ -0,0 +1,26 @@
+From 13e5a3e02339b746abcaee6408893ca2fd8e289d Mon Sep 17 00:00:00 2001
+From: Pydera <pydera@mailbox.org>
+Date: Thu, 8 Apr 2021 17:36:16 +0200
+Subject: [PATCH] Fix out of buffer access in #1529
+
+---
+ src/jp2image.cpp | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/jp2image.cpp b/src/jp2image.cpp
+index 4c072d7..ba025a3 100644
+--- a/src/jp2image.cpp
++++ b/src/jp2image.cpp
+@@ -739,9 +739,10 @@ namespace Exiv2
+ #endif
+                 box.length = io_->size() - io_->tell() + 8;
+             }
+-            if (box.length == 1)
++            if (box.length < 8)
+             {
+-                // FIXME. Special case. the real box size is given in another place.
++                // box is broken, so there is nothing we can do here
++                throw Error(14);
+             }
+
+             // Read whole box : Box header + Box data (not fixed size - can be null).
diff --git a/SPECS/compat-exiv2-026.spec b/SPECS/compat-exiv2-026.spec
index 0981289..d66bdbd 100644
--- a/SPECS/compat-exiv2-026.spec
+++ b/SPECS/compat-exiv2-026.spec
@@ -1,7 +1,7 @@
 
 Name:    compat-exiv2-026
 Version: 0.26
-Release: 2%{?dist}
+Release: 3%{?dist}
 Summary: Compatibility package with the exiv2 library in version 0.26
 
 License: GPLv2+
@@ -15,6 +15,7 @@ Patch7:  exiv2-crash-in-pentax-camera-files.patch
 Patch10: exiv2-CVE-2017-17723.patch
 Patch11: exiv2-CVE-2017-17725.patch
 Patch12: exiv2-CVE-2017-5772.patch
+Patch13: exiv2-CVE-2021-31291.patch
 
 BuildRequires: expat-devel
 BuildRequires: gettext
@@ -83,6 +84,10 @@ chmod 755 %{buildroot}%{_libdir}/libexiv2.so.*
 
 
 %changelog
+* Thu Aug 11 2021 Jan Grulich <jgrulich@redhat.com> - 0.26-3
+- Fix heap-based buffer overflow vulnerability in jp2image.cpp
+  Resolves: bz#1990394
+
 * Tue Feb 18 2020 Jan Grulich <jgrulich@redhat.com> - 0.26-2
 - Fix crash in Pentax camera files
   Resolves: bz#1747857