librsvg: Security fixes via update to 2.40.15

CVE-2016-4347 librsvg2: DoS parsing SVGs with circular definitions in certain rsvg_cairo_*() functions

CVE-2016-4348 librsvg2: DoS parsing SVGs with circular definitions _rsvg_css_normalize_font_size() function

(From OE-Core rev: 76f061c91fd00370e33bfc3d45ff98d8b3f63c41)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

1 files changed, 45 insertions, 0 deletions

diff --git a/meta/recipes-gnome/librsvg/librsvg_2.40.15.bb b/meta/recipes-gnome/librsvg/librsvg_2.40.15.bb
new file mode 100644
index 0000000000..caa6a24c9e
--- /dev/null
+++ b/meta/recipes-gnome/librsvg/librsvg_2.40.15.bb
@@ -0,0 +1,45 @@
+SUMMARY = "Library for rendering SVG files"
+HOMEPAGE = "http://ftp.gnome.org/pub/GNOME/sources/librsvg/"
+BUGTRACKER = "https://bugzilla.gnome.org/"
+
+LICENSE = "LGPLv2+"
+LIC_FILES_CHKSUM = "file://COPYING;md5=94d55d512a9ba36caa9b7df079bae19f \
+                    file://rsvg.h;beginline=3;endline=24;md5=20b4113c4909bbf0d67e006778302bc6"
+
+SECTION = "x11/utils"
+DEPENDS = "cairo gdk-pixbuf glib-2.0 libcroco libxml2 pango"
+BBCLASSEXTEND = "native"
+
+inherit autotools pkgconfig gnomebase gtk-doc pixbufcache upstream-version-is-even gobject-introspection
+
+SRC_URI += "file://gtk-option.patch"
+
+SRC_URI[archive.md5sum] = "3a66ab5b4fe1fb43b471708e4ff39a0e"
+SRC_URI[archive.sha256sum] = "d9cac4a123eec6e553a26e120979bab7425def9ae7ce7c079eba5e4a45db05f4"
+
+CACHED_CONFIGUREVARS = "ac_cv_path_GDK_PIXBUF_QUERYLOADERS=${STAGING_LIBDIR_NATIVE}/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders"
+
+# The older ld (2.22) on the host (Centos 6.5) doesn't have the
+# -Bsymbolic-functions option, we can disable it for native.
+EXTRA_OECONF_append_class-native = " --enable-Bsymbolic=auto"
+
+PACKAGECONFIG ??= "gdkpixbuf"
+# The gdk-pixbuf loader
+PACKAGECONFIG[gdkpixbuf] = "--enable-pixbuf-loader,--disable-pixbuf-loader,gdk-pixbuf-native"
+# GTK+ test application (rsvg-view)
+PACKAGECONFIG[gtk] = "--with-gtk3,--without-gtk3,gtk+3"
+
+do_install_append() {
+        # Loadable modules don't need .a or .la on Linux
+        rm -f ${D}${libdir}/gdk-pixbuf-2.0/*/loaders/*.a ${D}${libdir}/gdk-pixbuf-2.0/*/loaders/*.la
+}
+
+PACKAGES =+ "librsvg-gtk rsvg"
+FILES_rsvg = "${bindir}/rsvg* \
+              ${datadir}/pixmaps/svg-viewer.svg \
+              ${datadir}/themes"
+FILES_librsvg-gtk = "${libdir}/gdk-pixbuf-2.0/*/*/*.so"
+
+PIXBUF_PACKAGES = "librsvg-gtk"
+
+PIXBUFCACHE_SYSROOT_DEPS_append_class-native = " harfbuzz-native:do_populate_sysroot_setscene pango-native:do_populate_sysroot_setscene icu-native:do_populate_sysroot_setscene"