!15 [sync] PR-13: Fix jasper CVE-2008-3522

From: @openeuler-sync-bot 
Reviewed-by: @wk333 
Signed-off-by: @wk333

CVE-2008-3522.patch

@@ -0,0 +1,22 @@
+From d678ccd27b8a062e3bfd4c80d8ce2676a8166a27 Mon Sep 17 00:00:00 2001
+From: Richard Hughes <richard@hughsie.com>
+Date: Mon, 19 Sep 2016 10:03:36 +0100
+Subject: [PATCH] CVE-2008-3522
+
+---
+ converter/other/jpeg2000/libjasper/base/jas_stream.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/converter/other/jpeg2000/libjasper/base/jas_stream.c b/converter/other/jpeg2000/libjasper/base/jas_stream.c
+index 9a885564..fa9cb302 100644
+--- a/converter/other/jpeg2000/libjasper/base/jas_stream.c
++++ b/converter/other/jpeg2000/libjasper/base/jas_stream.c
+@@ -553,7 +553,7 @@ int jas_stream_printf(jas_stream_t *stream, const char *fmt, ...)
+ 	int ret;
+ 
+ 	va_start(ap, fmt);
+-	ret = vsprintf(buf, fmt, ap);
++	ret = vsnprintf(buf, sizeof buf, fmt, ap);
+ 	jas_stream_puts(stream, buf);
+ 	va_end(ap);
+ 	return ret;

netpbm.spec

@@ -1,6 +1,6 @@
 Name:            netpbm
 Version:         10.83.01
-Release:         5
+Release:         6
 Summary:         A library for handling different graphics file formats
 License:         BSD and GPLv2 and IJG and MIT and Public Domain
 URL:             http://netpbm.sourceforge.net/
@@ -26,6 +26,7 @@ Patch0015:       netpbm-cmuwtopbm.patch
 Patch0016:       netpbm-pamtojpeg2k.patch
 Patch0017:       netpbm-manfix.patch
 Patch0018:       netpbm-manual-pages.patch
+Patch0019:       CVE-2008-3522.patch
 
 BuildRequires:   libjpeg-devel, libpng-devel, libtiff-devel, flex
 BuildRequires:   libX11-devel perl-generators python3 libxml2-devel ghostscript-core gcc perl
@@ -155,6 +156,9 @@ cd -
 %{_mandir}/man5/*
 
 %changelog
+* Mon Jan 06 2025 wangkai <13474090681@163.com> - 10.83.01-6
+- Fix jasper CVE-2008-3522
+
 * Wed Jan 05 2022 Ge Wang <wangge20@huawei.com> - 10.83.01-5
 - Fix building error: Can not locate English.pm
 - Add perl in BuildRequires