Skip to contentSkip to conversation

gd: security bump to version 2.2.5

PATCH New Peter Korsgaard 1 participant 4 messages Sep 7, 2017 – Oct 16, 2017

lore
Share & tools
lore

Peter Korsgaard

author
#0 lore raw

PATCH 1/1 gd: security bump to version 2.2.5

Fixes the following security issues:

CVE-2017-6362: Double-free in gdImagePngPtr()
CVE-2017-7890: Buffer over-read into uninitialized memory

Drop patches no more needed:

0001-gdlib-config.patch: @LIBICONV@ is nowadays correct AC_SUBST'ed by configure

0002-gd_bmp-fix-build-with-uClibc.patch: upstream uses ceil() since
https://github.com/libgd/libgd/commit/6913dd3cd2a7c2914ad9622419f9343bfe956135

While we're at it, add a hash for the license file.

Signed-off-by Peter Korsgaard <[email protected]>
---
 package/gd/0001-gdlib-config.patch                 | 32 --------------
 package/gd/0002-gd_bmp-fix-build-with-uClibc.patch | 50 ----------------------
 package/gd/gd.hash                                 |  3 +-
 package/gd/gd.mk                                   |  2 +-
 4 files changed, 3 insertions(+), 84 deletions(-)
 delete mode 100644 package/gd/0001-gdlib-config.patch
 delete mode 100644 package/gd/0002-gd_bmp-fix-build-with-uClibc.patch
package/gd/0001-gdlib-config.patch deleted +0 -32
deleted file mode 100644
index 7756bf1240..0000000000
@@ -1,32 +0,0 @@
-Fix gdlib-config
-
-Since the @LIBICONV@ macro doesn't get replaced at compile time, we
-end up installing an invalid gdlib-config: the gdlib-config --libs
-says that one should link against @LIBICONV@ which obviously doesn't
-work.
-
-Use the OpenWRT patch from
-https://dev.openwrt.org/browser/packages/libs/gd/patches/101-gdlib-config.patch
-
-Signed-off-by: Thomas Petazzoni <[email protected]>
-
---- a/config/gdlib-config.in
-+++ b/config/gdlib-config.in
-@@ -71,7 +71,7 @@ while test $# -gt 0; do
- 	echo @LDFLAGS@
- 	;;
-     --libs)
--	echo -lgd @LIBS@ @LIBICONV@
-+	echo -lgd @LIBS@
- 	;;
-     --cflags|--includes)
- 	echo -I at includedir@
-@@ -84,7 +84,7 @@ while test $# -gt 0; do
- 	echo "includedir: $includedir"
- 	echo "cflags:     -I at includedir@"
- 	echo "ldflags:    @LDFLAGS@"
--	echo "libs:       @LIBS@ @LIBICONV@"
-+	echo "libs:       @LIBS@"
- 	echo "libdir:     $libdir"
- 	echo "features:   @FEATURES@"
- 	;;
package/gd/0002-gd_bmp-fix-build-with-uClibc.patch deleted +0 -50

50 lines not on this page · raw message

package/gd/gd.hash +2 -1
index a1991b1820..1cd9e56b18 100644
@@ -1,2 +1,3 @@
 # Locally calculated
-sha256	137f13a7eb93ce72e32ccd7cebdab6874f8cf7ddf31d3a455a68e016ecd9e4e6	libgd-2.2.4.tar.xz
+sha256	8c302ccbf467faec732f0741a859eef4ecae22fea2d2ab87467be940842bde51	libgd-2.2.5.tar.xz
+sha256  d02dae2141d49b8a6b09b2b73e68a8f17d7bbeaaf02b3b841ee11fea2d9e328d	COPYING
package/gd/gd.mk +1 -1
index 63d16eb3ca..e2a46dca3c 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-GD_VERSION = 2.2.4
+GD_VERSION = 2.2.5
 GD_SOURCE = libgd-$(GD_VERSION).tar.xz
 GD_SITE = https://github.com/libgd/libgd/releases/download/gd-$(GD_VERSION)
 GD_INSTALL_STAGING = YES
Signature · 1 line
2.11.0
author
#1 lore raw

PATCH 1/1 gd: security bump to version 2.2.5

Quoted 11 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes the following security issues:
CVE-2017-6362: Double-free in gdImagePngPtr()
CVE-2017-7890: Buffer over-read into uninitialized memory

Drop patches no more needed:

0001-gdlib-config.patch: @LIBICONV@ is nowadays correct AC_SUBST'ed by configure

Quoted 6 lines

0002-gd_bmp-fix-build-with-uClibc.patch: upstream uses ceil() since
https://github.com/libgd/libgd/commit/6913dd3cd2a7c2914ad9622419f9343bfe956135

While we're at it, add a hash for the license file.

Signed-off-by Peter Korsgaard <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard
author
#2 lore raw

PATCH 1/1 gd: security bump to version 2.2.5

In reply to Peter Korsgaard
Quoted 11 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes the following security issues:
CVE-2017-6362: Double-free in gdImagePngPtr()
CVE-2017-7890: Buffer over-read into uninitialized memory

Drop patches no more needed:

0001-gdlib-config.patch: @LIBICONV@ is nowadays correct AC_SUBST'ed by configure

Quoted 6 lines

0002-gd_bmp-fix-build-with-uClibc.patch: upstream uses ceil() since
https://github.com/libgd/libgd/commit/6913dd3cd2a7c2914ad9622419f9343bfe956135

While we're at it, add a hash for the license file.

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.02.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard
author
#3 lore raw

PATCH 1/1 gd: security bump to version 2.2.5

In reply to Peter Korsgaard
Quoted 11 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes the following security issues:
CVE-2017-6362: Double-free in gdImagePngPtr()
CVE-2017-7890: Buffer over-read into uninitialized memory

Drop patches no more needed:

0001-gdlib-config.patch: @LIBICONV@ is nowadays correct AC_SUBST'ed by configure

Quoted 6 lines

0002-gd_bmp-fix-build-with-uClibc.patch: upstream uses ceil() since
https://github.com/libgd/libgd/commit/6913dd3cd2a7c2914ad9622419f9343bfe956135

While we're at it, add a hash for the license file.

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.08.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard