From 3b85d24c1d927590ed3a336794562e9a512fc216 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Thu, 7 Sep 2017 16:45:51 +0200 Subject: [PATCH] gd: security bump to version 2.2.5 Fixes the following security issues: CVE-2017-6362: Double-free in gdImagePngPtr() CVE-2017-7890: Buffer over-read into uninitialized memory Drop patches no more needed: 0001-gdlib-config.patch: @LIBICONV@ is nowadays correct AC_SUBST'ed by configure 0002-gd_bmp-fix-build-with-uClibc.patch: upstream uses ceil() since https://github.com/libgd/libgd/commit/6913dd3cd2a7c2914ad9622419f9343bfe956135 While we're at it, add a hash for the license file. Signed-off-by: Peter Korsgaard --- package/gd/0001-gdlib-config.patch | 32 ------------ .../0002-gd_bmp-fix-build-with-uClibc.patch | 50 ------------------- package/gd/gd.hash | 3 +- package/gd/gd.mk | 2 +- 4 files changed, 3 insertions(+), 84 deletions(-) delete mode 100644 package/gd/0001-gdlib-config.patch delete mode 100644 package/gd/0002-gd_bmp-fix-build-with-uClibc.patch diff --git a/package/gd/0001-gdlib-config.patch b/package/gd/0001-gdlib-config.patch deleted file mode 100644 index 7756bf1240..0000000000 --- a/package/gd/0001-gdlib-config.patch +++ /dev/null @@ -1,32 +0,0 @@ -Fix gdlib-config - -Since the @LIBICONV@ macro doesn't get replaced at compile time, we -end up installing an invalid gdlib-config: the gdlib-config --libs -says that one should link against @LIBICONV@ which obviously doesn't -work. - -Use the OpenWRT patch from -https://dev.openwrt.org/browser/packages/libs/gd/patches/101-gdlib-config.patch - -Signed-off-by: Thomas Petazzoni - ---- a/config/gdlib-config.in -+++ b/config/gdlib-config.in -@@ -71,7 +71,7 @@ while test $# -gt 0; do - echo @LDFLAGS@ - ;; - --libs) -- echo -lgd @LIBS@ @LIBICONV@ -+ echo -lgd @LIBS@ - ;; - --cflags|--includes) - echo -I@includedir@ -@@ -84,7 +84,7 @@ while test $# -gt 0; do - echo "includedir: $includedir" - echo "cflags: -I@includedir@" - echo "ldflags: @LDFLAGS@" -- echo "libs: @LIBS@ @LIBICONV@" -+ echo "libs: @LIBS@" - echo "libdir: $libdir" - echo "features: @FEATURES@" - ;; diff --git a/package/gd/0002-gd_bmp-fix-build-with-uClibc.patch b/package/gd/0002-gd_bmp-fix-build-with-uClibc.patch deleted file mode 100644 index 89bc39186e..0000000000 --- a/package/gd/0002-gd_bmp-fix-build-with-uClibc.patch +++ /dev/null @@ -1,50 +0,0 @@ -From ea2a03e983acf34a1320b460dcad43b7e0b0b14f Mon Sep 17 00:00:00 2001 -Message-Id: -From: Baruch Siach -Date: Thu, 10 Apr 2014 15:49:13 +0300 -Subject: [PATCH] gd_bmp: fix build with uClibc - -Some architectures (like ARM) don't have the long double variants of math -functions under uClibc. Add a local ceill definition in this case. - -Patch status: reported upstream, -https://bitbucket.org/libgd/gd-libgd/issue/123/build-failure-agains-uclibc-arm - -Signed-off-by: Baruch Siach ---- - src/gd_bmp.c | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - -diff --git a/src/gd_bmp.c b/src/gd_bmp.c -index 0fc021909f1b..11b3ec1baa01 100644 ---- a/src/gd_bmp.c -+++ b/src/gd_bmp.c -@@ -25,6 +25,11 @@ - #include "gdhelpers.h" - #include "bmp.h" - -+#include -+#if defined (__UCLIBC__) && !defined(__UCLIBC_HAS_LONG_DOUBLE_MATH__) -+#define NO_LONG_DOUBLE -+#endif -+ - static int compress_row(unsigned char *uncompressed_row, int length); - static int build_rle_packet(unsigned char *row, int packet_type, int length, unsigned char *data); - -@@ -42,6 +47,13 @@ static int bmp_read_rle(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info); - - #define BMP_DEBUG(s) - -+#ifdef NO_LONG_DOUBLE -+long double ceill(long double x) -+{ -+ return (long double) ceil((double) x); -+} -+#endif -+ - static int gdBMPPutWord(gdIOCtx *out, int w) - { - /* Byte order is little-endian */ --- -1.9.1 - diff --git a/package/gd/gd.hash b/package/gd/gd.hash index a1991b1820..1cd9e56b18 100644 --- a/package/gd/gd.hash +++ b/package/gd/gd.hash @@ -1,2 +1,3 @@ # Locally calculated -sha256 137f13a7eb93ce72e32ccd7cebdab6874f8cf7ddf31d3a455a68e016ecd9e4e6 libgd-2.2.4.tar.xz +sha256 8c302ccbf467faec732f0741a859eef4ecae22fea2d2ab87467be940842bde51 libgd-2.2.5.tar.xz +sha256 d02dae2141d49b8a6b09b2b73e68a8f17d7bbeaaf02b3b841ee11fea2d9e328d COPYING diff --git a/package/gd/gd.mk b/package/gd/gd.mk index 63d16eb3ca..e2a46dca3c 100644 --- a/package/gd/gd.mk +++ b/package/gd/gd.mk @@ -4,7 +4,7 @@ # ################################################################################ -GD_VERSION = 2.2.4 +GD_VERSION = 2.2.5 GD_SOURCE = libgd-$(GD_VERSION).tar.xz GD_SITE = https://github.com/libgd/libgd/releases/download/gd-$(GD_VERSION) GD_INSTALL_STAGING = YES -- 2.30.2