CVS commit: pkgsrc/graphics

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Sat Aug  1 14:28:46 UTC 2026

Modified Files:
        pkgsrc/graphics/GraphicsMagick: Makefile.common distinfo
        pkgsrc/graphics/p5-GraphicsMagick: Makefile

Log Message:
GraphicsMagick p5-GraphicsMagick: updated to 1.3.48

1.3.48

Security Fixes:

Address ImageMagick CVE CVE-2026-42050, ImageMagick security advisory GHSA-7mxf-ff4f-jj7p, which is related to an X11 display buffer overflow. This is really a minor issue since it requires X11 
keyboard input and causes no harm.
DCM: In RLE decoder, detect and report end of input. Reported-by: Tristan Madani.
DCM: Convert from ASCII numeric value to unsigned value, with error detection. Avoid problems caused by negative values. Reported-by: Tristan Madani.
display: Correct bounds checking for 'filename' length. Thanks to Petr Gajdos for a heads-up regarding the disparity.
GradientImage(): Fix 'pixel_packets' and 'indexes' addressing logic for NorthGravity. Addresses "[security] GraphicsMagick GradientImage: heap-buffer-overflow READ in NorthGravity branch reached from 
gm convert (magick/gradient.c:284)" from David Korczynski. Credit to Anthropic Claude and Ada Logics.
ImageToBlob(): Fix memory leak which may occur if WriteImage() fails.
LOCALE: Bound the length passed to strncpy() and string terminator. Addresses "[security] GraphicsMagick LOCALE coder: stack-buffer-overflow WRITE in ReadConfigureFile reached from gm convert 
(coders/locale.c:257)" from David Korczynski. Credit to Anthropic Claude and Ada Logics.
META/IPTC: Prevent reading past the end of a truncated/short IPTC profile.
MIFF: Correct scope of 'values' reallocation error handling. Addresses "[security] GraphicsMagick MIFF reader: heap-use-after-free WRITE via stale cursor on values-buffer realloc failure 
(coders/miff.c:1048)" from David Korczynski. Credit to Anthropic Claude and Ada Logics.
MSL: Properly log warnings and errors using LogMagickEventList() given a va_list. Reported-by: Tristan Madani.
PCD: Over-provision the per-channel Huffman decode buffers and detect any attempt to overflow them. Discovered and reported by Cipher - Causal Security (https://causalsecurity.com/).
PCX: If image has more than 256 colors, save as a DirectClass type. Addresses "[security] GraphicsMagick PCX writer: heap-buffer-overflow WRITE in WritePCXImage colormap fill (coders/pcx.c:1186)" 
from David Korczynski. Credit to Anthropic Claude and Ada Logics.
PNG: Use only values from GetImageCharacteristics() since IsMonochromeImage() and IsGrayImage() may produce different answers. Addresses "[security] GraphicsMagick MNG re-encode: heap-buffer-overflow 
WRITE in ExportGrayAlphaQuantumType reached from gm convert (magick/export.c:1105)" as reported by David Korczynski via email on May 28, 2026. Credit to Anthropic Claude and Ada Logics.
SVG: Properly log warnings and errors using LogMagickEventList() given a va_list. Reported-by: Tristan Madani.
TIFF: Add many more validations and safeguards to EXIF in TIFF writer. Addresses "[security] GraphicsMagick TIFF writer: heap-buffer-overflow WRITE in AddIFDExifFields via 32-bit count*2 wrap on EXIF 
SHORT array (coders/tiff.c)" from David Korczynski. Credit to Anthropic Claude and Ada Logics.
TIFF: If EXIF profile string is not already NUL terminated, assure that it is NUL terminated before passing it to libtiff. Reported-by: Tristan Madani.
TIFF: In AddIFDExifFields(), address possible out of bounds read (2 bytes) beyond the end of the allocated profile buffer. Reported-by: Tristan Madani.
VIFF: Memory leak fix (ImageMagick CVE-2026-61870).

Bug fixes:

configure.ac: Fixes so Freetype and zlib may be detected if pkg-config is not available.
PICT: Remove the attempt to intuit byteCount must be a word because the approach used does not work reliably. This means that defective PICT files previously written by ImageMagick or GraphicsMagick 
may fail to be read.
VIFF: Fixes so remaining Khoros VIFF sample files sample files from the Encyclopedia Of Graphics File Formats which are based on integer data storage types read correctly.


To generate a diff of this commit:
cvs rdiff -u -r1.31 -r1.32 pkgsrc/graphics/GraphicsMagick/Makefile.common
cvs rdiff -u -r1.61 -r1.62 pkgsrc/graphics/GraphicsMagick/distinfo
cvs rdiff -u -r1.89 -r1.90 pkgsrc/graphics/p5-GraphicsMagick/Makefile

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/GraphicsMagick/Makefile.common
diff -u pkgsrc/graphics/GraphicsMagick/Makefile.common:1.31 pkgsrc/graphics/GraphicsMagick/Makefile.common:1.32
--- pkgsrc/graphics/GraphicsMagick/Makefile.common:1.31 Mon Jun 29 12:00:28 2026
+++ pkgsrc/graphics/GraphicsMagick/Makefile.common      Sat Aug  1 14:28:46 2026
@@ -1,10 +1,10 @@
-# $NetBSD: Makefile.common,v 1.31 2026/06/29 12:00:28 adam Exp $
+# $NetBSD: Makefile.common,v 1.32 2026/08/01 14:28:46 adam Exp $
 #
 # used by graphics/GraphicsMagick/Makefile
 # used by graphics/p5-GraphicsMagick/Makefile
 
 GM_MAJOR_VER=  1.3
-GM_MINOR_VER=  47
+GM_MINOR_VER=  48
 DISTVERSION=   ${GM_MAJOR_VER}.${GM_MINOR_VER}
 DISTNAME=      GraphicsMagick-${DISTVERSION}
 CATEGORIES=    graphics

Index: pkgsrc/graphics/GraphicsMagick/distinfo
diff -u pkgsrc/graphics/GraphicsMagick/distinfo:1.61 pkgsrc/graphics/GraphicsMagick/distinfo:1.62
--- pkgsrc/graphics/GraphicsMagick/distinfo:1.61        Mon Jun 29 12:00:28 2026
+++ pkgsrc/graphics/GraphicsMagick/distinfo     Sat Aug  1 14:28:46 2026
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.61 2026/06/29 12:00:28 adam Exp $
+$NetBSD: distinfo,v 1.62 2026/08/01 14:28:46 adam Exp $
 
-BLAKE2s (GraphicsMagick-1.3.47.tar.xz) = ccde62fa6ddb0f927a910efbbf640b6bda932af5ca5c8327eaaca6ea19823089
-SHA512 (GraphicsMagick-1.3.47.tar.xz) = 2a353555683f3d0fe5fdaf60d8fce3d6ccc5974b4184bc2140ddb426a833410355fa0bb53fbb5a81c5f1e905200e111a847634328a9f5e61dee9a88df3a42a00
-Size (GraphicsMagick-1.3.47.tar.xz) = 6075948 bytes
+BLAKE2s (GraphicsMagick-1.3.48.tar.xz) = dda3feca7968c9ea1fbd9a1459a0b36fe5e50a43149cf8c3f2637a334eeaa7c8
+SHA512 (GraphicsMagick-1.3.48.tar.xz) = baf4f82794628a116b568c2932bb1bf7c36ba89d0cb51fdd0209ad655f05883ae711319e5cc43cce09642aa3fc4b711731be00393f757eeb038440e15cc4437d
+Size (GraphicsMagick-1.3.48.tar.xz) = 6081828 bytes
 SHA1 (patch-config_delegates.mgk.in) = 56e90088424d0f07545abdbe355c6ce97e66dd77
 SHA1 (patch-configure) = efe9d38dee7f10457a36e89d7059e4e152a1f39e

Index: pkgsrc/graphics/p5-GraphicsMagick/Makefile
diff -u pkgsrc/graphics/p5-GraphicsMagick/Makefile:1.89 pkgsrc/graphics/p5-GraphicsMagick/Makefile:1.90
--- pkgsrc/graphics/p5-GraphicsMagick/Makefile:1.89     Thu Jul 16 19:03:57 2026
+++ pkgsrc/graphics/p5-GraphicsMagick/Makefile  Sat Aug  1 14:28:46 2026
@@ -1,6 +1,5 @@
-# $NetBSD: Makefile,v 1.89 2026/07/16 19:03:57 wiz Exp $
+# $NetBSD: Makefile,v 1.90 2026/08/01 14:28:46 adam Exp $
 
-PKGREVISION= 1
 .include "../../graphics/GraphicsMagick/Makefile.common"
 
 PKGNAME=       p5-GraphicsMagick-${DISTVERSION}