libpng: security bump to version 1.6.15

Fixes an out-of-bounds memory access in png_user_version_check().

Signed-off-by: Gustavo Zacarias <[email protected]>
Signed-off-by: Peter Korsgaard <[email protected]>

diff --git a/package/libpng/0001-disable-tools.patch b/package/libpng/0001-disable-tools.patch
new file mode 100644 (file)
index 0000000..e30eca9
--- /dev/null
+++ b/package/libpng/0001-disable-tools.patch
@@ -0,0 +1,30 @@
+Disable the new pngfix and png-fix-itxt tools: they take up space, fail to
+build on some oddball toolchain configurations and aren't expected/needed
+in a non-interactive embedded system.
+
+Signed-off-by: Gustavo Zacarias <[email protected]>
+
+diff -Nura libpng-1.6.10.orig/Makefile.am libpng-1.6.10/Makefile.am
+--- libpng-1.6.10.orig/Makefile.am     2014-03-17 08:51:25.812005079 -0300
++++ libpng-1.6.10/Makefile.am  2014-03-17 09:14:28.807586433 -0300
+@@ -10,7 +10,7 @@
+ check_PROGRAMS= pngtest pngunknown pngstest pngvalid pngimage
+ 
+ # Utilities - installed
+-bin_PROGRAMS= pngfix png-fix-itxt
++bin_PROGRAMS=
+ 
+ # This ensures that pnglibconf.h gets built at the start of 'make all' or
+ # 'make check', but it does not add dependencies to the individual programs,
+diff -Nura libpng-1.6.10.orig/Makefile.in libpng-1.6.10/Makefile.in
+--- libpng-1.6.10.orig/Makefile.in     2014-03-17 08:51:25.807005070 -0300
++++ libpng-1.6.10/Makefile.in  2014-03-17 09:14:44.846617623 -0300
+@@ -87,7 +87,7 @@
+ host_triplet = @host@
+ check_PROGRAMS = pngtest$(EXEEXT) pngunknown$(EXEEXT) \
+       pngstest$(EXEEXT) pngvalid$(EXEEXT) pngimage$(EXEEXT)
+-bin_PROGRAMS = pngfix$(EXEEXT) png-fix-itxt$(EXEEXT)
++bin_PROGRAMS =
+ @PNG_ARM_NEON_TRUE@am__append_1 = arm/arm_init.c\
+ @PNG_ARM_NEON_TRUE@   arm/filter_neon.S arm/filter_neon_intrinsics.c
+ 

diff --git a/package/libpng/0002-ignore-symbol-prefix.patch b/package/libpng/0002-ignore-symbol-prefix.patch
new file mode 100644 (file)
index 0000000..7f2cfff
--- /dev/null
+++ b/package/libpng/0002-ignore-symbol-prefix.patch
@@ -0,0 +1,26 @@
+Even if Blackfin GNU toolchain add prefix '_' to all symbols,
+symbol prefix is not accepted in the link flag --version-script.
+Don't append prefix in the symbols in the version script file.
+
+--- libpng-1.6.8/Makefile.am   2013-12-30 18:23:08.261797417 +0800
++++ libpng-1.6.8.bak/Makefile.am       2013-12-30 18:22:15.565795726 +0800
+@@ -225,7 +225,7 @@
+ # interfering with the symbol file format.
+ SYMBOL_CFLAGS = -DPNGLIB_LIBNAME='PNG@PNGLIB_MAJOR@@PNGLIB_MINOR@_0'\
+               -DPNGLIB_VERSION='@PNGLIB_VERSION@'\
+-              -DSYMBOL_PREFIX='$(SYMBOL_PREFIX)'\
++              -DSYMBOL_PREFIX=''\
+               -DPNG_NO_USE_READ_MACROS -DPNG_BUILDING_SYMBOL_TABLE
+ 
+ if DO_PNG_PREFIX
+--- libpng-1.6.8/Makefile.in   2013-12-30 18:23:08.261797417 +0800
++++ libpng-1.6.8.bak/Makefile.in       2013-12-30 18:22:09.853794547 +0800
+@@ -698,7 +698,7 @@
+ # interfering with the symbol file format.
+ SYMBOL_CFLAGS = -DPNGLIB_LIBNAME='PNG@PNGLIB_MAJOR@@PNGLIB_MINOR@_0' \
+       -DPNGLIB_VERSION='@PNGLIB_VERSION@' \
+-      -DSYMBOL_PREFIX='$(SYMBOL_PREFIX)' -DPNG_NO_USE_READ_MACROS \
++      -DSYMBOL_PREFIX='' -DPNG_NO_USE_READ_MACROS \
+       -DPNG_BUILDING_SYMBOL_TABLE $(am__append_5)
+ all: $(BUILT_SOURCES) config.h
+       $(MAKE) $(AM_MAKEFLAGS) all-am

diff --git a/package/libpng/libpng-01-disable-tools.patch b/package/libpng/libpng-01-disable-tools.patch
deleted file mode 100644 (file)
index e30eca9..0000000
--- a/package/libpng/libpng-01-disable-tools.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-Disable the new pngfix and png-fix-itxt tools: they take up space, fail to
-build on some oddball toolchain configurations and aren't expected/needed
-in a non-interactive embedded system.
-
-Signed-off-by: Gustavo Zacarias <[email protected]>
-
-diff -Nura libpng-1.6.10.orig/Makefile.am libpng-1.6.10/Makefile.am
---- libpng-1.6.10.orig/Makefile.am     2014-03-17 08:51:25.812005079 -0300
-+++ libpng-1.6.10/Makefile.am  2014-03-17 09:14:28.807586433 -0300
-@@ -10,7 +10,7 @@
- check_PROGRAMS= pngtest pngunknown pngstest pngvalid pngimage
- 
- # Utilities - installed
--bin_PROGRAMS= pngfix png-fix-itxt
-+bin_PROGRAMS=
- 
- # This ensures that pnglibconf.h gets built at the start of 'make all' or
- # 'make check', but it does not add dependencies to the individual programs,
-diff -Nura libpng-1.6.10.orig/Makefile.in libpng-1.6.10/Makefile.in
---- libpng-1.6.10.orig/Makefile.in     2014-03-17 08:51:25.807005070 -0300
-+++ libpng-1.6.10/Makefile.in  2014-03-17 09:14:44.846617623 -0300
-@@ -87,7 +87,7 @@
- host_triplet = @host@
- check_PROGRAMS = pngtest$(EXEEXT) pngunknown$(EXEEXT) \
-       pngstest$(EXEEXT) pngvalid$(EXEEXT) pngimage$(EXEEXT)
--bin_PROGRAMS = pngfix$(EXEEXT) png-fix-itxt$(EXEEXT)
-+bin_PROGRAMS =
- @PNG_ARM_NEON_TRUE@am__append_1 = arm/arm_init.c\
- @PNG_ARM_NEON_TRUE@   arm/filter_neon.S arm/filter_neon_intrinsics.c
- 

diff --git a/package/libpng/libpng-02-ignore-symbol-prefix.patch b/package/libpng/libpng-02-ignore-symbol-prefix.patch
deleted file mode 100644 (file)
index 7f2cfff..0000000
--- a/package/libpng/libpng-02-ignore-symbol-prefix.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-Even if Blackfin GNU toolchain add prefix '_' to all symbols,
-symbol prefix is not accepted in the link flag --version-script.
-Don't append prefix in the symbols in the version script file.
-
---- libpng-1.6.8/Makefile.am   2013-12-30 18:23:08.261797417 +0800
-+++ libpng-1.6.8.bak/Makefile.am       2013-12-30 18:22:15.565795726 +0800
-@@ -225,7 +225,7 @@
- # interfering with the symbol file format.
- SYMBOL_CFLAGS = -DPNGLIB_LIBNAME='PNG@PNGLIB_MAJOR@@PNGLIB_MINOR@_0'\
-               -DPNGLIB_VERSION='@PNGLIB_VERSION@'\
--              -DSYMBOL_PREFIX='$(SYMBOL_PREFIX)'\
-+              -DSYMBOL_PREFIX=''\
-               -DPNG_NO_USE_READ_MACROS -DPNG_BUILDING_SYMBOL_TABLE
- 
- if DO_PNG_PREFIX
---- libpng-1.6.8/Makefile.in   2013-12-30 18:23:08.261797417 +0800
-+++ libpng-1.6.8.bak/Makefile.in       2013-12-30 18:22:09.853794547 +0800
-@@ -698,7 +698,7 @@
- # interfering with the symbol file format.
- SYMBOL_CFLAGS = -DPNGLIB_LIBNAME='PNG@PNGLIB_MAJOR@@PNGLIB_MINOR@_0' \
-       -DPNGLIB_VERSION='@PNGLIB_VERSION@' \
--      -DSYMBOL_PREFIX='$(SYMBOL_PREFIX)' -DPNG_NO_USE_READ_MACROS \
-+      -DSYMBOL_PREFIX='' -DPNG_NO_USE_READ_MACROS \
-       -DPNG_BUILDING_SYMBOL_TABLE $(am__append_5)
- all: $(BUILT_SOURCES) config.h
-       $(MAKE) $(AM_MAKEFLAGS) all-am

diff --git a/package/libpng/libpng.hash b/package/libpng/libpng.hash
new file mode 100644 (file)
index 0000000..37f6067
--- /dev/null
+++ b/package/libpng/libpng.hash
@@ -0,0 +1,3 @@
+# From http://sourceforge.net/projects/libpng/files/libpng16/1.6.15/
+md5    a95cb387c53215b034203b41ec57c7e5        libpng-1.6.15.tar.xz
+sha1   bddeac8ca97fbcf54d6d32c6eefed5d94b49df88        libpng-1.6.15.tar.xz

diff --git a/package/libpng/libpng.mk b/package/libpng/libpng.mk
index 99510ca07493737a5850fcd9076278112ae7197b..67bf14196ac7c0d4a934883395ca7d2572ea8339 100644 (file)
--- a/package/libpng/libpng.mk
+++ b/package/libpng/libpng.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBPNG_VERSION = 1.6.12
+LIBPNG_VERSION = 1.6.15
 LIBPNG_SERIES = 16
 LIBPNG_SOURCE = libpng-$(LIBPNG_VERSION).tar.xz
 LIBPNG_SITE = http://downloads.sourceforge.net/project/libpng/libpng${LIBPNG_SERIES}/$(LIBPNG_VERSION)