CVS commit: pkgsrc/graphics/gdk-pixbuf2

["Nia Alarie" <nia%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   nia
Date:           Fri Aug  1 09:10:57 UTC 2025

Modified Files:
        pkgsrc/graphics/gdk-pixbuf2: Makefile distinfo
Added Files:
        pkgsrc/graphics/gdk-pixbuf2/patches: patch-gdk-pixbuf_io-jpeg.c

Log Message:
gdk-pixbuf2: Apply patch for CVE-2025-7345.


To generate a diff of this commit:
cvs rdiff -u -r1.69 -r1.70 pkgsrc/graphics/gdk-pixbuf2/Makefile
cvs rdiff -u -r1.56 -r1.57 pkgsrc/graphics/gdk-pixbuf2/distinfo
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/graphics/gdk-pixbuf2/patches/patch-gdk-pixbuf_io-jpeg.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/gdk-pixbuf2/Makefile
diff -u pkgsrc/graphics/gdk-pixbuf2/Makefile:1.69 pkgsrc/graphics/gdk-pixbuf2/Makefile:1.70
--- pkgsrc/graphics/gdk-pixbuf2/Makefile:1.69   Thu Jul 31 20:22:07 2025
+++ pkgsrc/graphics/gdk-pixbuf2/Makefile        Fri Aug  1 09:10:57 2025
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.69 2025/07/31 20:22:07 wiz Exp $
+# $NetBSD: Makefile,v 1.70 2025/08/01 09:10:57 nia Exp $
 
 DISTNAME=      gdk-pixbuf-2.42.12
 PKGNAME=       ${DISTNAME:S/pixbuf/pixbuf2/}
-PKGREVISION=   2
+PKGREVISION=   3
 CATEGORIES=    graphics gnome
 MASTER_SITES=  ${MASTER_SITE_GNOME:=sources/gdk-pixbuf/${PKGVERSION_NOREV:R}/}
 EXTRACT_SUFX=  .tar.xz

Index: pkgsrc/graphics/gdk-pixbuf2/distinfo
diff -u pkgsrc/graphics/gdk-pixbuf2/distinfo:1.56 pkgsrc/graphics/gdk-pixbuf2/distinfo:1.57
--- pkgsrc/graphics/gdk-pixbuf2/distinfo:1.56   Thu Jun 27 15:19:59 2024
+++ pkgsrc/graphics/gdk-pixbuf2/distinfo        Fri Aug  1 09:10:57 2025
@@ -1,9 +1,10 @@
-$NetBSD: distinfo,v 1.56 2024/06/27 15:19:59 adam Exp $
+$NetBSD: distinfo,v 1.57 2025/08/01 09:10:57 nia Exp $
 
 BLAKE2s (gdk-pixbuf-2.42.12.tar.xz) = 14d58a61c191af2ef5ec7dd747f82cd9962d8bb38b2da345f496812e3861576b
 SHA512 (gdk-pixbuf-2.42.12.tar.xz) = ae9fcc9b4e8fd10a4c9bf34c3a755205dae7bbfe13fbc93ec4e63323dad10cc862df6a9e2e2e63c84ffa01c5e120a3be06ac9fad2a7c5e58d3dc6ba14d1766e8
 Size (gdk-pixbuf-2.42.12.tar.xz) = 6525072 bytes
 SHA1 (patch-gdk-pixbuf_gdk-pixbuf-scaled-anim.c) = a9d2436711b1a1c3bb58beef0df5e485ad6cbe7d
+SHA1 (patch-gdk-pixbuf_io-jpeg.c) = d3c86390af11f66576ce573b8059094e1adae932
 SHA1 (patch-gdk-pixbuf_meson.build) = d54c4f1c5c045c3988fc2bbac19d2aac3e32de89
 SHA1 (patch-tests_meson.build) = 7d60098d957e4b0677aad6452de651189fc06b2d
 SHA1 (patch-thumbnailer_meson.build) = 25d1ee1934bed00b4353ce33dacd52e3414b943f

Added files:

Index: pkgsrc/graphics/gdk-pixbuf2/patches/patch-gdk-pixbuf_io-jpeg.c
diff -u /dev/null pkgsrc/graphics/gdk-pixbuf2/patches/patch-gdk-pixbuf_io-jpeg.c:1.1
--- /dev/null   Fri Aug  1 09:10:57 2025
+++ pkgsrc/graphics/gdk-pixbuf2/patches/patch-gdk-pixbuf_io-jpeg.c      Fri Aug  1 09:10:57 2025
@@ -0,0 +1,44 @@
+$NetBSD: patch-gdk-pixbuf_io-jpeg.c,v 1.1 2025/08/01 09:10:57 nia Exp $
+
+From 4af78023ce7d3b5e3cec422a59bb4f48fa4f5886 Mon Sep 17 00:00:00 2001
+From: Matthias Clasen <mclasen%redhat.com@localhost>
+Date: Fri, 11 Jul 2025 11:02:05 -0400
+Subject: [PATCH] jpeg: Be more careful with chunked icc data
+
+We we inadvertendly trusting the sequence numbers not to lie.
+If they do we would report a larger data size than we actually
+allocated, leading to out of bounds memory access in base64
+encoding later on.
+
+This has been assigned CVE-2025-7345.
+
+Fixes: #249
+
+--- gdk-pixbuf/io-jpeg.c.orig  2024-05-15 02:15:41.000000000 +0000
++++ gdk-pixbuf/io-jpeg.c
+@@ -356,6 +356,7 @@ jpeg_parse_exif_app2_segment (JpegExifCo
+               context->icc_profile = g_new (gchar, chunk_size);
+               /* copy the segment data to the profile space */
+               memcpy (context->icc_profile, marker->data + 14, chunk_size);
++                ret = TRUE;
+               goto out;
+       }
+ 
+@@ -377,12 +378,15 @@ jpeg_parse_exif_app2_segment (JpegExifCo
+       /* copy the segment data to the profile space */
+       memcpy (context->icc_profile + offset, marker->data + 14, chunk_size);
+ 
+-      /* it's now this big plus the new data we've just copied */
+-      context->icc_profile_size += chunk_size;
++        context->icc_profile_size = MAX (context->icc_profile_size, offset + chunk_size);
+ 
+       /* success */
+       ret = TRUE;
+ out:
++        if (!ret) {
++                g_free (context->icc_profile);
++                context->icc_profile = NULL;
++        }
+       return ret;
+ }
+