gentoo auto-resync : 30:06:2023 - 19:43:35

4 files changed, 85 insertions, 24 deletions

diff --git a/media-libs/libwebp/Manifest b/media-libs/libwebp/Manifest
index f8eb89a84c41..114564d82d7e 100644
--- a/media-libs/libwebp/Manifest
+++ b/media-libs/libwebp/Manifest
@@ -1,8 +1,8 @@
 AUX libwebp-1.2.3-libpng-pkg-config.patch 1894 BLAKE2B 80c19e65b1f913fdf0e9dd37ca603bcf89bd7dd71cf81ebd8beab6bcf671b76482b3d6d053f53558463c7f3e139897382c90aad5a5cebbd8c49ce4512e7f048c SHA512 3b80c89eb4643a315af594158ca370b71f38ab285cfaa3d1b8d90b09aa420750dccd46f1222b1b9a983af6e9dc501da2d6c732c05a2a3b097ba0437785cc80c7
-DIST libwebp-1.1.0.tar.gz 4033877 BLAKE2B ac6c2267f43ba42079975938c8fecb75237a494ab8a4ca71b68a49c3d219afa92079fd94431ccbcc363a1e6aef890642a658f429b8d75cd90dd5d735fa37dcef SHA512 c8440059a985587d4876a5e7fc2d07523bc7f582a04ee5dab0ef07df32b9635b907224de2cc15246c831dd5d9215569770196626badccc3171fe2832d7cb4549
-DIST libwebp-1.2.2.tar.gz 4117468 BLAKE2B 8bdb5a82317f06c39458b04580fa674399bc02f15a8e28f8a17456e1e26af74d87a63ecfda9f2760822ba318e8bd42a9c84f87cc2a3c63bad4fbdc00d212010e SHA512 0dd0a721352b513a218d55383bcd0cc45b786df8089f70f87257b5dcc0c4e2f1798e20f1ca98b8fe51710abb667f9c4c14f20f980a11c484c8832f0dc66e3bff
+AUX libwebp-1.2.4-CVE-2023-1999.patch 1734 BLAKE2B 087b1bb4be5d3aceb7796ecbf497d6dc5396eab4b944d7c29bd15f939c9d891d5b0463770196cae87fa8bce2561e874e00fdaf1c05eada87258546956ca26c0a SHA512 6b108f30b2aa3326d1f4acf69bc7b01145e9a6922bcdaf01d5bd052418b9789706dd3757341a7eb5847e7ef42146fdd0ba7397b66e0003571008de7d88371d8f
 DIST libwebp-1.2.4.tar.gz 4141376 BLAKE2B 522ee427f63ec51040b2813ad4bac9df0c86678ea441a28f36f979b01d35b25d11e5297a139e00ddf3e14bade298d3c1ab9ad3157246926cb9a713d3f51bb205 SHA512 01f21e2c3057f5878b33664d0070832d78420de3cb2fe4379b07ae6a27bb569fd1c27a920fe324beccb96ae7bfa8c05fdd9e7b0aeba6de06ab4d8b084bb38803
-EBUILD libwebp-1.1.0-r1.ebuild 1818 BLAKE2B 5ac6b43e2ab71d547279ffaf74467b9ba74303cb7ed93f081bca6702b96c6de913f3a4661cb91759de9395a4b49bc68b4b6f4addb9ed46ba65fb2db4b6c38645 SHA512 5641ffacef779ce49be0edfbdbee00efc7ccab7068f1d64a71ecac845ad82cbf07ac8a2b2ee3adff9d80100f0a363c7ccc43f915afe668b841b500da180c5494
-EBUILD libwebp-1.2.2-r1.ebuild 1831 BLAKE2B 4bc2125d288e83e44ecd5716a31f2c151412731b2a1c45349c15f863201536fbd4957bb15fb7236e62d4db82f1cb82ac493631091a02f9b9a2e44befe436d473 SHA512 81d2718d0985b996cefd757c271c89e0216152e1a4816b72218590023e0ffa3f1d43cea22aacf22585b4b86c2b82da4b98fa3e40c58061d534648d5d1ece00cc
+DIST libwebp-1.3.1.tar.gz 4161782 BLAKE2B e3f0b66f98fb5add22653b0f8d7f7f5fff9df4e60eff221da78dda1a13d3a5b9da684d37dd0756dff52b1225c5ee04a54be95c008c34033bbe9fa824cbab7cee SHA512 f2c5e4fbbb5adf63d4a36bad88de23881c296da6f3ec73baded5e80fd55abef6cbeb90c271fd40766a76e170e5499c2983670d91e01064027ede22965d2b1d90
 EBUILD libwebp-1.2.4-r1.ebuild 1935 BLAKE2B 05119dbbd80d118ba0bd6be139a33d6dea97d4a6e09ea016adc74d0137c012520b1a345a8373f35a00ea6bb486a1c9c271423451cd6662a0ffde028ea185be72 SHA512 c20874065f870f79dc311f31926f59c70b83053c8951d1268c458648caccefccc5ec721f5bd6a1b8a16f6898f0c7aee89d236129c4d9e42023a3322992b1ba47
+EBUILD libwebp-1.2.4-r2.ebuild 1990 BLAKE2B 583a3db3cdf795b892deceffd0318ea00d4de1197f10d335535b72270462e777fb473af09e0cba046c37389f4eefc51fd94b47cd59a75e96991c678e5273aa3b SHA512 b22a34e3c40bf814cc43d1ca7babfbd1703aab7b1414bc82c5ff8d3f18976de6819a099a48b621db5b66789002e633413bd84ded6081768f036670d0892ac2c9
+EBUILD libwebp-1.3.1.ebuild 1936 BLAKE2B 0a7ab04071f7d17c58b7c2ee778f23e9326c0570918a16170cdbd9dd6027a2bc5fd7519d0f6364d7f67da3185d3276f7711f26d93ddeaf6ce7b181067a20d1f2 SHA512 7adaf609d5873622c575b260471f7efb8d77b3b231770d31c863408fd26b66955c4dd5fd713f81e9f169effbe39492544180ab7412eba348c06b33475172160b
 MISC metadata.xml 442 BLAKE2B 3700315ba8872e208756f663236158c42f967eab7bec9b440b238b14f76357fe7721e571b7c11d79fff0f8df90f9ad35504cef3f6dc2803b8e5394ac0e3ea437 SHA512 5fceda7410ea654e3d9297f3adcad43b99c298b436ec5d77a9396259b61a0c9dd2945b98f7fa7d0b7d38622e14bf82bcfbbbdc18f011f0b949ae61a9a8794800
diff --git a/media-libs/libwebp/files/libwebp-1.2.4-CVE-2023-1999.patch b/media-libs/libwebp/files/libwebp-1.2.4-CVE-2023-1999.patch
new file mode 100644
index 000000000000..9c023712a5aa
--- /dev/null
+++ b/media-libs/libwebp/files/libwebp-1.2.4-CVE-2023-1999.patch
@@ -0,0 +1,50 @@
+commit a486d800b60d0af4cc0836bf7ed8f21e12974129
+Author: James Zern <jzern@google.com>
+Date:   Wed Feb 22 22:15:47 2023 -0800
+
+    EncodeAlphaInternal: clear result->bw on error
+    
+    This avoids a double free should the function fail prior to
+    VP8BitWriterInit() and a previous trial result's buffer carried over.
+    Previously in ApplyFiltersAndEncode() trial.bw (with a previous
+    iteration's buffer) would be freed, followed by best.bw pointing to the
+    same buffer.
+    
+    Since:
+    187d379d add a fallback to ALPHA_NO_COMPRESSION
+    
+    In addition, check the return value of VP8BitWriterInit() in this
+    function.
+    
+    Bug: webp:603
+    Change-Id: Ic258381ee26c8c16bc211d157c8153831c8c6910
+
+diff --git a/src/enc/alpha_enc.c b/src/enc/alpha_enc.c
+index f7c02690..7d205586 100644
+--- a/src/enc/alpha_enc.c
++++ b/src/enc/alpha_enc.c
+@@ -13,6 +13,7 @@
+ 
+ #include <assert.h>
+ #include <stdlib.h>
++#include <string.h>
+ 
+ #include "src/enc/vp8i_enc.h"
+ #include "src/dsp/dsp.h"
+@@ -148,6 +149,7 @@ static int EncodeAlphaInternal(const uint8_t* const data, int width, int height,
+       }
+     } else {
+       VP8LBitWriterWipeOut(&tmp_bw);
++      memset(&result->bw, 0, sizeof(result->bw));
+       return 0;
+     }
+   }
+@@ -162,7 +164,7 @@ static int EncodeAlphaInternal(const uint8_t* const data, int width, int height,
+   header = method | (filter << 2);
+   if (reduce_levels) header |= ALPHA_PREPROCESSED_LEVELS << 4;
+ 
+-  VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size);
++  if (!VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size)) ok = 0;
+   ok = ok && VP8BitWriterAppend(&result->bw, &header, ALPHA_HEADER_LEN);
+   ok = ok && VP8BitWriterAppend(&result->bw, output, output_size);
+ 
diff --git a/media-libs/libwebp/libwebp-1.2.2-r1.ebuild b/media-libs/libwebp/libwebp-1.2.4-r2.ebuild
index a2c0be5f6358..bcf5f8174336 100644
--- a/media-libs/libwebp/libwebp-1.2.2-r1.ebuild
+++ b/media-libs/libwebp/libwebp-1.2.4-r2.ebuild
@@ -1,7 +1,8 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
+
 inherit autotools multilib-minimal
 
 MY_P="${P/_/-}"
@@ -9,11 +10,13 @@ MY_P="${P/_/-}"
 DESCRIPTION="A lossy image compression format"
 HOMEPAGE="https://developers.google.com/speed/webp/download"
 SRC_URI="https://storage.googleapis.com/downloads.webmproject.org/releases/webp/${MY_P}.tar.gz"
+S="${WORKDIR}/${MY_P}"
 
 LICENSE="BSD"
 SLOT="0/7" # subslot = libwebp soname version
-[[ "${PV}" = *_rc* ]] || \
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+if [[ ${PV} != *_rc* ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+fi
 IUSE="cpu_flags_arm_neon cpu_flags_x86_sse2 cpu_flags_x86_sse4_1 gif +jpeg opengl +png static-libs swap-16bit-csp tiff"
 
 # TODO: dev-lang/swig bindings in swig/ subdirectory
@@ -22,18 +25,23 @@ RDEPEND="gif? ( media-libs/giflib:= )
 	opengl? (
 		media-libs/freeglut
 		virtual/opengl
-		)
+	)
 	png? ( media-libs/libpng:= )
 	tiff? ( media-libs/tiff:= )"
 DEPEND="${RDEPEND}"
 
-S="${WORKDIR}/${MY_P}"
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.3-libpng-pkg-config.patch
+	"${FILESDIR}"/${PN}-1.2.4-CVE-2023-1999.patch
+)
 
 src_prepare() {
 	default
 
-	# Fix libtool relinking, bug 499270.
+	# Fix libtool relinking, bug #499270.
 	#elibtoolize
+
+	# Needed for pkg-config patch
 	eautoreconf
 }
 
@@ -53,7 +61,7 @@ multilib_src_configure() {
 		$(use_enable cpu_flags_x86_sse4_1 sse4.1)
 		$(use_enable cpu_flags_arm_neon neon)
 
-		# Only used for gif2webp binary wrt #486646
+		# Only used for gif2webp binary wrt bug #486646
 		$(multilib_native_use_enable gif)
 	)
 
@@ -66,5 +74,5 @@ multilib_src_install() {
 
 multilib_src_install_all() {
 	find "${ED}" -type f -name "*.la" -delete || die
-	dodoc AUTHORS ChangeLog doc/*.txt NEWS README{,.mux}
+	dodoc AUTHORS ChangeLog doc/*.txt NEWS README.md
 }
diff --git a/media-libs/libwebp/libwebp-1.1.0-r1.ebuild b/media-libs/libwebp/libwebp-1.3.1.ebuild
index c7953a03bab5..c89017f87f12 100644
--- a/media-libs/libwebp/libwebp-1.1.0-r1.ebuild
+++ b/media-libs/libwebp/libwebp-1.3.1.ebuild
@@ -1,7 +1,8 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
+
 inherit autotools multilib-minimal
 
 MY_P="${P/_/-}"
@@ -9,11 +10,13 @@ MY_P="${P/_/-}"
 DESCRIPTION="A lossy image compression format"
 HOMEPAGE="https://developers.google.com/speed/webp/download"
 SRC_URI="https://storage.googleapis.com/downloads.webmproject.org/releases/webp/${MY_P}.tar.gz"
+S="${WORKDIR}/${MY_P}"
 
 LICENSE="BSD"
 SLOT="0/7" # subslot = libwebp soname version
-[[ "${PV}" = *_rc* ]] || \
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+if [[ ${PV} != *_rc* ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+fi
 IUSE="cpu_flags_arm_neon cpu_flags_x86_sse2 cpu_flags_x86_sse4_1 gif +jpeg opengl +png static-libs swap-16bit-csp tiff"
 
 # TODO: dev-lang/swig bindings in swig/ subdirectory
@@ -22,18 +25,18 @@ RDEPEND="gif? ( media-libs/giflib:= )
 	opengl? (
 		media-libs/freeglut
 		virtual/opengl
-		)
+	)
 	png? ( media-libs/libpng:= )
 	tiff? ( media-libs/tiff:= )"
 DEPEND="${RDEPEND}"
 
-S="${WORKDIR}/${MY_P}"
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.3-libpng-pkg-config.patch
+)
 
 src_prepare() {
 	default
-
-	# Fix libtool relinking, bug 499270.
-	#elibtoolize
+	# Needed for pkg-config patch; use elibtoolize instead if that's ever dropped
 	eautoreconf
 }
 
@@ -53,7 +56,7 @@ multilib_src_configure() {
 		$(use_enable cpu_flags_x86_sse4_1 sse4.1)
 		$(use_enable cpu_flags_arm_neon neon)
 
-		# Only used for gif2webp binary wrt #486646
+		# Only used for gif2webp binary wrt bug #486646
 		$(multilib_native_use_enable gif)
 	)
 
@@ -66,5 +69,5 @@ multilib_src_install() {
 
 multilib_src_install_all() {
 	find "${ED}" -type f -name "*.la" -delete || die
-	dodoc AUTHORS ChangeLog doc/*.txt NEWS README{,.mux}
+	dodoc AUTHORS ChangeLog doc/*.txt NEWS README.md
 }