From 9b5e961f04f63aa3f93e39ed3470541323c2272f Mon Sep 17 00:00:00 2001 From: Wang Mingyu Date: Fri, 7 Jul 2023 11:10:06 +0800 Subject: libwebp: upgrade 1.3.0 -> 1.3.1 CVE-2023-1999.patch removed since it's included in 1.3.1 Changelog: ========== This is a binary compatible release. * security fixes for lossless encoder (#603, chromium: #1420107, #1455619, CVE-2023-1999) * improve error reporting through WebPPicture error codes * fix upsampling for RGB565 and RGBA4444 in NEON builds * img2webp: add -sharp_yuv & -near_lossless * Windows builds: - fix compatibility with clang-cl (#607) - improve Arm64 performance with cl.exe - add Arm64EC support * fix webp_js with emcc >= 3.1.27 (stack size change, #614) * CMake fixes (#592, #610, #612) * further updates to the container and lossless bitstream docs (#581, #611) (From OE-Core rev: 15411fb32b5a3c0ac9c06ff89db5664799f55d77) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie --- .../webp/files/CVE-2023-1999.patch | 55 ------------------- meta/recipes-multimedia/webp/libwebp_1.3.0.bb | 61 ---------------------- meta/recipes-multimedia/webp/libwebp_1.3.1.bb | 57 ++++++++++++++++++++ 3 files changed, 57 insertions(+), 116 deletions(-) delete mode 100644 meta/recipes-multimedia/webp/files/CVE-2023-1999.patch delete mode 100644 meta/recipes-multimedia/webp/libwebp_1.3.0.bb create mode 100644 meta/recipes-multimedia/webp/libwebp_1.3.1.bb (limited to 'meta/recipes-multimedia/webp') diff --git a/meta/recipes-multimedia/webp/files/CVE-2023-1999.patch b/meta/recipes-multimedia/webp/files/CVE-2023-1999.patch deleted file mode 100644 index d293ab93ab..0000000000 --- a/meta/recipes-multimedia/webp/files/CVE-2023-1999.patch +++ /dev/null @@ -1,55 +0,0 @@ -From a486d800b60d0af4cc0836bf7ed8f21e12974129 Mon Sep 17 00:00:00 2001 -From: James Zern -Date: Wed, 22 Feb 2023 22:15:47 -0800 -Subject: [PATCH] EncodeAlphaInternal: clear result->bw on error - -This avoids a double free should the function fail prior to -VP8BitWriterInit() and a previous trial result's buffer carried over. -Previously in ApplyFiltersAndEncode() trial.bw (with a previous -iteration's buffer) would be freed, followed by best.bw pointing to the -same buffer. - -Since: -187d379d add a fallback to ALPHA_NO_COMPRESSION - -In addition, check the return value of VP8BitWriterInit() in this -function. - -Bug: webp:603 -Change-Id: Ic258381ee26c8c16bc211d157c8153831c8c6910 - -CVE: CVE-2023-1999 -Upstream-Status: Backport [https://github.com/webmproject/libwebp/commit/a486d800b60d0af4cc0836bf7ed8f21e12974129] -Signed-off-by: Nikhil R ---- - src/enc/alpha_enc.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/src/enc/alpha_enc.c b/src/enc/alpha_enc.c -index f7c02690e3..7d205586fe 100644 ---- a/src/enc/alpha_enc.c -+++ b/src/enc/alpha_enc.c -@@ -13,6 +13,7 @@ - - #include - #include -+#include - - #include "src/enc/vp8i_enc.h" - #include "src/dsp/dsp.h" -@@ -148,6 +149,7 @@ static int EncodeAlphaInternal(const uint8_t* const data, int width, int height, - } - } else { - VP8LBitWriterWipeOut(&tmp_bw); -+ memset(&result->bw, 0, sizeof(result->bw)); - return 0; - } - } -@@ -162,7 +164,7 @@ static int EncodeAlphaInternal(const uint8_t* const data, int width, int height, - header = method | (filter << 2); - if (reduce_levels) header |= ALPHA_PREPROCESSED_LEVELS << 4; - -- VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size); -+ if (!VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size)) ok = 0; - ok = ok && VP8BitWriterAppend(&result->bw, &header, ALPHA_HEADER_LEN); - ok = ok && VP8BitWriterAppend(&result->bw, output, output_size); diff --git a/meta/recipes-multimedia/webp/libwebp_1.3.0.bb b/meta/recipes-multimedia/webp/libwebp_1.3.0.bb deleted file mode 100644 index 7ca67e44fb..0000000000 --- a/meta/recipes-multimedia/webp/libwebp_1.3.0.bb +++ /dev/null @@ -1,61 +0,0 @@ -SUMMARY = "WebP is an image format designed for the Web" -DESCRIPTION = "WebP is a method of lossy and lossless compression that can be \ - used on a large variety of photographic, translucent and \ - graphical images found on the web. The degree of lossy \ - compression is adjustable so a user can choose the trade-off \ - between file size and image quality. WebP typically achieves \ - an average of 30% more compression than JPEG and JPEG 2000, \ - without loss of image quality." -HOMEPAGE = "https://developers.google.com/speed/webp/" -SECTION = "libs" - -LICENSE = "BSD-3-Clause" -LIC_FILES_CHKSUM = "file://COPYING;md5=6e8dee932c26f2dab503abf70c96d8bb \ - file://PATENTS;md5=c6926d0cb07d296f886ab6e0cc5a85b7" - -SRC_URI = "http://downloads.webmproject.org/releases/webp/${BP}.tar.gz" -SRC_URI[sha256sum] = "64ac4614db292ae8c5aa26de0295bf1623dbb3985054cb656c55e67431def17c" - -UPSTREAM_CHECK_URI = "http://downloads.webmproject.org/releases/webp/index.html" - -SRC_URI += " \ - file://CVE-2023-1999.patch \ -" - -EXTRA_OECONF = " \ - --disable-wic \ - --enable-libwebpmux \ - --enable-libwebpdemux \ - --enable-threading \ -" - -# Do not trust configure to determine if neon is available. -# -EXTRA_OECONF_ARM = " \ - ${@bb.utils.contains("TUNE_FEATURES","neon","--enable-neon","--disable-neon",d)} \ -" -EXTRA_OECONF:append:arm = " ${EXTRA_OECONF_ARM}" -EXTRA_OECONF:append:armeb = " ${EXTRA_OECONF_ARM}" - -inherit autotools lib_package - -PACKAGECONFIG ??= "" - -# libwebpdecoder is a subset of libwebp, don't build it unless requested -PACKAGECONFIG[decoder] = "--enable-libwebpdecoder,--disable-libwebpdecoder" - -# Apply for examples programs: cwebp and dwebp -PACKAGECONFIG[gif] = "--enable-gif,--disable-gif,giflib" -PACKAGECONFIG[jpeg] = "--enable-jpeg,--disable-jpeg,jpeg" -PACKAGECONFIG[png] = "--enable-png,--disable-png,,libpng" -PACKAGECONFIG[tiff] = "--enable-tiff,--disable-tiff,tiff" - -# Apply only for example program vwebp -PACKAGECONFIG[gl] = "--enable-gl,--disable-gl,mesa-glut" - -PACKAGES =+ "${PN}-gif2webp" - -DESCRIPTION:${PN}-gif2webp = "Simple tool to convert animated GIFs to WebP" -FILES:${PN}-gif2webp = "${bindir}/gif2webp" - -BBCLASSEXTEND += "native nativesdk" diff --git a/meta/recipes-multimedia/webp/libwebp_1.3.1.bb b/meta/recipes-multimedia/webp/libwebp_1.3.1.bb new file mode 100644 index 0000000000..b9e763b08e --- /dev/null +++ b/meta/recipes-multimedia/webp/libwebp_1.3.1.bb @@ -0,0 +1,57 @@ +SUMMARY = "WebP is an image format designed for the Web" +DESCRIPTION = "WebP is a method of lossy and lossless compression that can be \ + used on a large variety of photographic, translucent and \ + graphical images found on the web. The degree of lossy \ + compression is adjustable so a user can choose the trade-off \ + between file size and image quality. WebP typically achieves \ + an average of 30% more compression than JPEG and JPEG 2000, \ + without loss of image quality." +HOMEPAGE = "https://developers.google.com/speed/webp/" +SECTION = "libs" + +LICENSE = "BSD-3-Clause" +LIC_FILES_CHKSUM = "file://COPYING;md5=6e8dee932c26f2dab503abf70c96d8bb \ + file://PATENTS;md5=c6926d0cb07d296f886ab6e0cc5a85b7" + +SRC_URI = "http://downloads.webmproject.org/releases/webp/${BP}.tar.gz" +SRC_URI[sha256sum] = "b3779627c2dfd31e3d8c4485962c2efe17785ef975e2be5c8c0c9e6cd3c4ef66" + +UPSTREAM_CHECK_URI = "http://downloads.webmproject.org/releases/webp/index.html" + +EXTRA_OECONF = " \ + --disable-wic \ + --enable-libwebpmux \ + --enable-libwebpdemux \ + --enable-threading \ +" + +# Do not trust configure to determine if neon is available. +# +EXTRA_OECONF_ARM = " \ + ${@bb.utils.contains("TUNE_FEATURES","neon","--enable-neon","--disable-neon",d)} \ +" +EXTRA_OECONF:append:arm = " ${EXTRA_OECONF_ARM}" +EXTRA_OECONF:append:armeb = " ${EXTRA_OECONF_ARM}" + +inherit autotools lib_package + +PACKAGECONFIG ??= "" + +# libwebpdecoder is a subset of libwebp, don't build it unless requested +PACKAGECONFIG[decoder] = "--enable-libwebpdecoder,--disable-libwebpdecoder" + +# Apply for examples programs: cwebp and dwebp +PACKAGECONFIG[gif] = "--enable-gif,--disable-gif,giflib" +PACKAGECONFIG[jpeg] = "--enable-jpeg,--disable-jpeg,jpeg" +PACKAGECONFIG[png] = "--enable-png,--disable-png,,libpng" +PACKAGECONFIG[tiff] = "--enable-tiff,--disable-tiff,tiff" + +# Apply only for example program vwebp +PACKAGECONFIG[gl] = "--enable-gl,--disable-gl,mesa-glut" + +PACKAGES =+ "${PN}-gif2webp" + +DESCRIPTION:${PN}-gif2webp = "Simple tool to convert animated GIFs to WebP" +FILES:${PN}-gif2webp = "${bindir}/gif2webp" + +BBCLASSEXTEND += "native nativesdk" -- cgit v1.2.3-54-g00ecf