From ddfd1cadb2eed91f75eb90aeb463be59de19ccbf Mon Sep 17 00:00:00 2001 From: Gyorgy Sarvari Date: Wed, 1 Apr 2026 22:30:06 +0200 Subject: giflib: upgrade 5.2.2 -> 6.1.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Drop patch that was merged upstream. License update: a copyright line was removed. The license is still MIT. Changes: Version 6.1.2 ============= Code Fixes ---------- * Fix for low-severity CVE-2026-23868 affecting gifponge, giftool, and gifbuild, but not the core library - library clients need not be alarned. Version 6.1.1 ============= This release bumps the major version, but only one entry point - EGifSpew() - has changed signature and behavior (in order to be able to pass out a detailed error code). The internal error codes in the E_GIF_ERR series have changed value so none of them collides with GIF_ERROR. This code has been systematically audited and hardened wuth ChatGPT-5.2. The only library fixes reported by users or found by robot were for some memory leaks that could only triggered by severely malformed GIFs. Other bugs are edge-case failures in the CLI tools. The gif2rbg CLI tool has been moved to the "obsolete" bin, because its only deployment case in 2026 is as a piñata at fuzzer parties. Warning: the CLI tools in the obsolete category will soon be removed from the distribution entirely. The maintainer is tired of fielding junk bugs filed against them by would-be coup-counters who found yet another edge case, and the rest of the world doesn't need noisy CVEs that aren't actually DoS or security issues for giflib clients. Code Fixes ---------- * Fix for CVE-2021-40633. * Fix SF bug #165 EGifSpew leaks GifFileOut->SColorMap * Fix SF bug #171 ImageMagick required to build giflib on non-Darwin Platforms * Fix SF bug #172 Incorrect object files in shared libutil on darwin * Fix SF bug #173 installation of manual pages and html documentation * Fix SF bug #175 Memory leaks in gifecho.c's main() and in gifalloc.c's GifMakeMapObject * Fix SF bug #177 wrong pointer used in giftool getbool * Fix SF bug #179 Path Traversal vulnerability * Fix SF bug #180: -Wformat-truncation likely pointing out an actual bug * Fix SF bug #182 out‐of‐bounds writes in Icon2Gif * Fix SF bug #184 uninitialized buffer in DumpScreen2RGB * Fix SF bug #185 integer overflow in gifbg.c * Fix SF bug #186 integer overflow in Icon2Gif * Fix SF bug #187: CVE-2025-31344 * Fix SF bug #170 Tests failing on Ubuntu Noble, giftext buffer overflow * Fix SF bug #165 EGifSpew leaks GifFileOut->SColorMap * Fix SF bug #162 detected memory leaks in GifMakeSavedImage giflib/gifalloc.c * Fix SF bug #161 detected memory leaks in EGifOpenFileHandle giflib/egif_lib.c * Fix SF bug #142 ABI break public symbol GifQuantizeBuffer Other bugs that duplicate these have breen addressesed by these fixes * SF bug #156 EGifSpew leaks SavedImages (and more); won't fix, caller might want to write a GIF, modify the in-memory data, then write again. Tests ----- Test suite now emits TAP (Test Anything Protocol). Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj --- ...0001-Makefile-fix-typo-in-soname-argument.patch | 34 ---------------------- meta-oe/recipes-devtools/giflib/giflib_5.2.2.bb | 29 ------------------ meta-oe/recipes-devtools/giflib/giflib_6.1.2.bb | 28 ++++++++++++++++++ 3 files changed, 28 insertions(+), 63 deletions(-) delete mode 100644 meta-oe/recipes-devtools/giflib/giflib/0001-Makefile-fix-typo-in-soname-argument.patch delete mode 100644 meta-oe/recipes-devtools/giflib/giflib_5.2.2.bb create mode 100644 meta-oe/recipes-devtools/giflib/giflib_6.1.2.bb diff --git a/meta-oe/recipes-devtools/giflib/giflib/0001-Makefile-fix-typo-in-soname-argument.patch b/meta-oe/recipes-devtools/giflib/giflib/0001-Makefile-fix-typo-in-soname-argument.patch deleted file mode 100644 index dc87ed60b9..0000000000 --- a/meta-oe/recipes-devtools/giflib/giflib/0001-Makefile-fix-typo-in-soname-argument.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 7f0cd4b6b56183b0afbefd01425e5ebd2b8733b4 Mon Sep 17 00:00:00 2001 -From: Martin Jansa -Date: Mon, 8 Jul 2024 13:18:11 +0200 -Subject: [PATCH] Makefile: fix typo in soname argument - -* introduced in: - https://sourceforge.net/p/giflib/code/ci/b65c7ac2905c0842e7977a7b51d83af4486ca7b8/ - there is no LIBUTILMAJOR variable only LIBUTILSOMAJOR leading to: - - ld: fatal error: -soname: must take a non-empty argument - collect2: error: ld returned 1 exit status - - with some linkers like GOLD - -Signed-off-by: Martin Jansa ---- -Upstream-Status: Submitted [https://sourceforge.net/p/giflib/code/merge-requests/17/] - - Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Makefile b/Makefile -index 87966a9..41b149e 100644 ---- a/Makefile -+++ b/Makefile -@@ -109,7 +109,7 @@ $(LIBUTILSO): $(UOBJECTS) $(UHEADERS) - ifeq ($(UNAME), Darwin) - $(CC) $(CFLAGS) -dynamiclib -current_version $(LIBVER) $(OBJECTS) -o $(LIBUTILSO) - else -- $(CC) $(CFLAGS) -shared $(LDFLAGS) -Wl,-soname -Wl,$(LIBUTILMAJOR) -o $(LIBUTILSO) $(UOBJECTS) -+ $(CC) $(CFLAGS) -shared $(LDFLAGS) -Wl,-soname -Wl,$(LIBUTILSOMAJOR) -o $(LIBUTILSO) $(UOBJECTS) - endif - - libutil.a: $(UOBJECTS) $(UHEADERS) diff --git a/meta-oe/recipes-devtools/giflib/giflib_5.2.2.bb b/meta-oe/recipes-devtools/giflib/giflib_5.2.2.bb deleted file mode 100644 index aa47f93095..0000000000 --- a/meta-oe/recipes-devtools/giflib/giflib_5.2.2.bb +++ /dev/null @@ -1,29 +0,0 @@ -SUMMARY = "shared library for GIF images" -SECTION = "libs" -LICENSE = "MIT" -LIC_FILES_CHKSUM = "file://COPYING;md5=ae11c61b04b2917be39b11f78d71519a" - -CVE_PRODUCT = "giflib_project:giflib" - -DEPENDS = "xmlto-native" - -SRC_URI = "${SOURCEFORGE_MIRROR}/giflib/${BP}.tar.gz \ - https://sourceforge.net/p/giflib/code/ci/d54b45b0240d455bbaedee4be5203d2703e59967/tree/doc/giflib-logo.gif?format=raw;subdir=${BP}/doc;name=logo;downloadfilename=giflib-logo.gif \ - file://0001-Makefile-fix-typo-in-soname-argument.patch \ -" - -SRC_URI[logo.sha256sum] = "1a54383986adad1521d00e003b4c482c27e8bc60690be944a1f3319c75abc2c9" -SRC_URI[sha256sum] = "be7ffbd057cadebe2aa144542fd90c6838c6a083b5e8a9048b8ee3b66b29d5fb" - -do_install() { - # using autotools's default will end up in /usr/local - oe_runmake DESTDIR=${D} PREFIX=${prefix} LIBDIR=${libdir} install -} - -PACKAGES += "${PN}-utils" -FILES:${PN} = "${libdir}/libgif.so.*" -FILES:${PN}-utils = "${bindir}" - -BBCLASSEXTEND = "native" - -RDEPENDS:${PN}-utils = "perl" diff --git a/meta-oe/recipes-devtools/giflib/giflib_6.1.2.bb b/meta-oe/recipes-devtools/giflib/giflib_6.1.2.bb new file mode 100644 index 0000000000..77f8905358 --- /dev/null +++ b/meta-oe/recipes-devtools/giflib/giflib_6.1.2.bb @@ -0,0 +1,28 @@ +SUMMARY = "shared library for GIF images" +SECTION = "libs" +LICENSE = "MIT" +LIC_FILES_CHKSUM = "file://COPYING;md5=b427970b2f3a9142a4e432c78c4680f4" + +CVE_PRODUCT = "giflib_project:giflib" + +DEPENDS = "xmlto-native" + +SRC_URI = "${SOURCEFORGE_MIRROR}/giflib/${BP}.tar.gz \ + https://sourceforge.net/p/giflib/code/ci/d54b45b0240d455bbaedee4be5203d2703e59967/tree/doc/giflib-logo.gif?format=raw;subdir=${BP}/doc;name=logo;downloadfilename=giflib-logo.gif \ +" + +SRC_URI[logo.sha256sum] = "1a54383986adad1521d00e003b4c482c27e8bc60690be944a1f3319c75abc2c9" +SRC_URI[sha256sum] = "2421abb54f5906b14965d28a278fb49e1ec9fe5ebbc56244dd012383a973d5c0" + +do_install() { + # using autotools's default will end up in /usr/local + oe_runmake DESTDIR=${D} PREFIX=${prefix} LIBDIR=${libdir} install +} + +PACKAGES += "${PN}-utils" +FILES:${PN} = "${libdir}/libgif.so.*" +FILES:${PN}-utils = "${bindir}" + +BBCLASSEXTEND = "native" + +RDEPENDS:${PN}-utils = "perl" -- cgit v1.2.3-54-g00ecf