[packages/ImageMagick/dev-7.1.0] Up to 7.1.0-60; Fixes CVE-2022-44267, CVE-2022-44268

glen glen at pld-linux.org
Fri Feb 3 13:53:36 CET 2023 

commit c1ffed96899664146da3efce5fd055993d48f352
Author: Elan Ruusamäe <glen at pld-linux.org>
Date:   Fri Feb 3 14:07:59 2023 +0200

    Up to 7.1.0-60; Fixes CVE-2022-44267, CVE-2022-44268
    
    coders/xtrn, coders/jxl, coders/flif are missing from build

 ImageMagick-link.patch | 14 +++++++-------
 ImageMagick.spec       | 29 ++++++++++++++++++++++-------
 config.patch           | 10 +++++-----
 3 files changed, 34 insertions(+), 19 deletions(-)
---
diff --git a/ImageMagick.spec b/ImageMagick.spec
index fd0c0f3..845b533 100644
--- a/ImageMagick.spec
+++ b/ImageMagick.spec
@@ -1,6 +1,15 @@
 # TODO
 # - create sane default policy file:
 #   https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=26801
+# - unpackaged:
+#   /usr/lib64/ImageMagick-7.1.0/modules-Q16/coders/bayer.la
+#   /usr/lib64/ImageMagick-7.1.0/modules-Q16/coders/bayer.so
+#   /usr/lib64/ImageMagick-7.1.0/modules-Q16/coders/ftxt.la
+#   /usr/lib64/ImageMagick-7.1.0/modules-Q16/coders/ftxt.so
+#   /usr/lib64/ImageMagick-7.1.0/modules-Q16/coders/qoi.la
+#   /usr/lib64/ImageMagick-7.1.0/modules-Q16/coders/qoi.so
+#   /usr/lib64/ImageMagick-7.1.0/modules-Q16/coders/strimg.la
+#   /usr/lib64/ImageMagick-7.1.0/modules-Q16/coders/strimg.so
 #
 # Conditional build:
 # - features:
@@ -23,8 +32,8 @@
 
 %define	libpng_ver 2:1.6.34
 
-%define		ver	7.0.11
-%define		pver	14
+%define		ver	7.1.0
+%define		pver	60
 Summary:	Image display, conversion, and manipulation under X
 Summary(de.UTF-8):	Darstellen, Konvertieren und Bearbeiten von Grafiken unter X
 Summary(es.UTF-8):	Exhibidor, convertidor y manipulador de imágenes bajo X
@@ -36,12 +45,12 @@ Summary(tr.UTF-8):	X altında resim gösterme, çevirme ve değişiklik yapma
 Summary(uk.UTF-8):	Перегляд, конвертування та обробка зображень під X Window
 Name:		ImageMagick
 Version:	%{ver}%{?pver:.%{pver}}
-Release:	8
+Release:	0.1
 Epoch:		1
 License:	Apache-like
 Group:		X11/Applications/Graphics
 Source0:	https://www.imagemagick.org/download/releases/%{name}-%{ver}-%{pver}.tar.xz
-# Source0-md5:	4e380b67b69e04e96fb65f4f25c8cab4
+# Source0-md5:	fbb79241137a6c8f7f161eda29973f62
 Patch0:		config.patch
 Patch1:		%{name}-link.patch
 Patch2:		%{name}-libpath.patch
@@ -751,7 +760,7 @@ Moduł kodera dla plików WMF.
 %patch4 -p1
 %patch5 -p1
 %patch6 -p1 -R
-%patch7 -p1
+#%patch7 -p1
 
 find -type f | xargs grep -l '/usr/local/bin/perl' | xargs %{__sed} -i -e 's=!/usr/local/bin/perl=!%{__perl}='
 
@@ -816,7 +825,7 @@ cp -p PerlMagick/demo/* $RPM_BUILD_ROOT%{_examplesdir}/%{name}-perl-%{version}
 %{__rm} $RPM_BUILD_ROOT%{perl_vendorarch}/auto/Image/Magick/.packlist
 %{__rm} $RPM_BUILD_ROOT%{perl_archlib}/perllocal.pod
 # packaged as %doc
-%{__rm} $RPM_BUILD_ROOT%{_docdir}/%{name}-%{mver}/{ChangeLog,LICENSE,NEWS.txt}
+%{__rm} $RPM_BUILD_ROOT%{_docdir}/%{name}-%{mver}/{LICENSE,NEWS.txt}
 # obsoleted by pkg-config
 %{__rm} $RPM_BUILD_ROOT%{_libdir}/lib*.la
 
@@ -1044,8 +1053,10 @@ rm -rf $RPM_BUILD_ROOT
 %{modulesdir}/coders/xps.la
 %attr(755,root,root) %{modulesdir}/coders/x.so
 %{modulesdir}/coders/x.la
+%if 0
 %attr(755,root,root) %{modulesdir}/coders/xtrn.so
 %{modulesdir}/coders/xtrn.la
+%endif
 %attr(755,root,root) %{modulesdir}/coders/xwd.so
 %{modulesdir}/coders/xwd.la
 %attr(755,root,root) %{modulesdir}/coders/yaml.so
@@ -1093,7 +1104,7 @@ rm -rf $RPM_BUILD_ROOT
 
 %files libs
 %defattr(644,root,root,755)
-%doc ChangeLog LICENSE AUTHORS.txt
+%doc LICENSE AUTHORS.txt
 %attr(755,root,root) %{_libdir}/libMagickCore-%{mver}.%{abisuf}.so.*.*.*
 %attr(755,root,root) %ghost %{_libdir}/libMagickCore-%{mver}.%{abisuf}.so.10
 %attr(755,root,root) %{_libdir}/libMagickWand-%{mver}.%{abisuf}.so.*.*.*
@@ -1137,11 +1148,13 @@ rm -rf $RPM_BUILD_ROOT
 %{modulesdir}/coders/exr.la
 %endif
 
+%if 0
 %files coder-flif
 %defattr(644,root,root,755)
 # R: flif
 %attr(755,root,root) %{modulesdir}/coders/flif.so
 %{modulesdir}/coders/flif.la
+%endif
 
 %if %{with fpx}
 %files coder-fpx
@@ -1177,6 +1190,7 @@ rm -rf $RPM_BUILD_ROOT
 %{modulesdir}/coders/jp2.la
 %endif
 
+%if 0
 %if %{with libjxl}
 %files coder-jxl
 %defattr(644,root,root,755)
@@ -1184,6 +1198,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(755,root,root) %{modulesdir}/coders/jxl.so
 %{modulesdir}/coders/jxl.la
 %endif
+%endif
 
 %files coder-miff
 %defattr(644,root,root,755)
diff --git a/ImageMagick-link.patch b/ImageMagick-link.patch
index ae30a0c..d26f299 100644
--- a/ImageMagick-link.patch
+++ b/ImageMagick-link.patch
@@ -30,8 +30,8 @@
  fi
  MAGICK_EXTRA_DEP_LIBS="$GOMP_LIBS"
  AC_SUBST([MAGICK_DEP_LIBS])
---- ImageMagick-6.9.10-19/coders/Makefile.am.orig	2018-12-20 00:48:40.000000000 +0100
-+++ ImageMagick-6.9.10-19/coders/Makefile.am	2018-12-22 10:26:05.633992165 +0100
+--- ImageMagick-7.1.0-60/coders/Makefile.am~	2023-02-03 14:16:08.000000000 +0200
++++ ImageMagick-7.1.0-60/coders/Makefile.am	2023-02-03 14:17:15.705028893 +0200
 @@ -468,7 +468,7 @@
  coders_djvu_la_SOURCES     = coders/djvu.c
  coders_djvu_la_CPPFLAGS    = $(MAGICK_CODER_CPPFLAGS)
@@ -102,12 +102,12 @@
  
  # TGA coder module
  coders_tga_la_SOURCES      = coders/tga.c
-@@ -1008,7 +1008,7 @@
+@@ -1389,7 +1389,7 @@
  coders_url_la_SOURCES      = coders/url.c
  coders_url_la_CPPFLAGS     = $(MAGICK_CODER_CPPFLAGS)
  coders_url_la_LDFLAGS      = $(MODULECOMMONFLAGS)
 -coders_url_la_LIBADD       = $(MAGICKCORE_LIBS) $(XML_LIBS) $(LZMA_LIBS) $(ZLIB_LIBS) $(MATH_LIBS)
-+coders_url_la_LIBADD       = $(MAGICKCORE_LIBS) $(XML_LIBS) $(ZLIB_LIBS) $(MATH_LIBS)
- 
- # UYVY coder module
- coders_uyvy_la_SOURCES     = coders/uyvy.c
++coders_url_la_LIBADD       = $(MAGICKCORE_LIBS) $(XML_LIBS) $(LZMA_LIBS) $(ZLIB_LIBS)
+ if WIN32_NATIVE_BUILD
+ coders_url_la_LIBADD += -lurlmon
+ endif
diff --git a/config.patch b/config.patch
index c86e054..98d7174 100644
--- a/config.patch
+++ b/config.patch
@@ -1,9 +1,9 @@
---- a/config/policy.xml	2021-01-25 16:04:11.000000000 +0100
-+++ b/config/policy.xml	2021-01-29 08:30:57.090166840 +0100
-@@ -79,4 +79,18 @@
-   <!-- <policy domain="system" name="shred" value="2"/> -->
-   <!-- <policy domain="system" name="precision" value="6"/> -->
+--- ImageMagick-7.1.0-60/config/policy.xml~	2023-01-30 02:02:28.000000000 +0200
++++ ImageMagick-7.1.0-60/config/policy.xml	2023-02-03 14:15:12.880962514 +0200
+@@ -80,4 +80,18 @@
+   <!-- <policy domain="system" name="shred" value="1"/> -->
    <!-- <policy domain="system" name="font" value="/path/to/unicode-font.ttf"/> -->
+   <policy domain="Undefined" rights="none"/>
 +  <policy domain="coder" rights="none" pattern="EPHEMERAL" />
 +  <policy domain="coder" rights="none" pattern="URL" />
 +  <policy domain="coder" rights="none" pattern="HTTPS" />
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/ImageMagick.git/commitdiff/c1ffed96899664146da3efce5fd055993d48f352

More information about the pld-cvs-commit mailing list