CVS commit: pkgsrc/graphics/libsixel

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sun Apr 19 14:56:11 UTC 2026

Modified Files:
        pkgsrc/graphics/libsixel: Makefile distinfo

Log Message:
libsixel: update to 1.8.7r1.

Security fix for CVE-2026-33023 (GHSA-hr25-g2j6-qjw6), use-after-free in load_with_gdkpixbuf().
Thanks to @nicoppida

Security fix for CVE-2026-33018 (GHSA-w46f-jr9f-rgvp), use-after-free in load_gif().
Thanks to @nicoppida

Security fix for CVE-2026-33019 (GHSA-c854-ffg9-g72c), integer overflow that leads to out-of-bounds read in img2sixel.
Thanks to @nicoppida

Security fix for CVE-2026-33020 (GHSA-2xgm-4x47-2x2p), integer overflow in write_png_to_file() that leads to heap overflow.
Thanks to @nicoppida

Security fix for CVE-2026-33021 (GHSA-j6m5-2cc7-3whc), use-after-free in sixel_encoder_encode_bytes().
Thanks to @nicoppida

Security fix for #222, out-of-bounds memory access in packed pixel format copy path.
Thanks to @xyzzy42

Security backports and hardening for #220:
GIF transparent index OOB, per-frame palette compositing, DCS parameter overflow, resize/item5/quant integer overflows, and invalid PNG cleanup path.
Thanks to @ShangzhiXu

fix memory leak issue in GIF loader callback path (#207).
Thanks to @optionGo

python: fix bugs in sixel_encoder_encode_bytes (#223).
Thanks to @xyzzy42

build: make distcheck pass by shipping required fixtures.


To generate a diff of this commit:
cvs rdiff -u -r1.82 -r1.83 pkgsrc/graphics/libsixel/Makefile
cvs rdiff -u -r1.28 -r1.29 pkgsrc/graphics/libsixel/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/libsixel/Makefile
diff -u pkgsrc/graphics/libsixel/Makefile:1.82 pkgsrc/graphics/libsixel/Makefile:1.83
--- pkgsrc/graphics/libsixel/Makefile:1.82      Fri Feb  6 10:05:02 2026
+++ pkgsrc/graphics/libsixel/Makefile   Sun Apr 19 14:56:11 2026
@@ -1,11 +1,12 @@
-# $NetBSD: Makefile,v 1.82 2026/02/06 10:05:02 wiz Exp $
+# $NetBSD: Makefile,v 1.83 2026/04/19 14:56:11 wiz Exp $
 
-DISTNAME=              libsixel-1.8.7
-PKGREVISION=           4
+DISTNAME=              libsixel-1.8.7-r1
+PKGNAME=               ${DISTNAME:S/-r/r/}
 CATEGORIES=            graphics
 MASTER_SITES=          ${MASTER_SITE_GITHUB:=saitoha/}
 GITHUB_PROJECT=                libsixel
-GITHUB_TAG=            v${PKGVERSION_NOREV}
+#GITHUB_TAG=           v${PKGVERSION_NOREV}
+GITHUB_TAG=            v1.8.7-r1
 
 MAINTAINER=            tsutsui%NetBSD.org@localhost
 HOMEPAGE=              https://saitoha.github.io/libsixel/

Index: pkgsrc/graphics/libsixel/distinfo
diff -u pkgsrc/graphics/libsixel/distinfo:1.28 pkgsrc/graphics/libsixel/distinfo:1.29
--- pkgsrc/graphics/libsixel/distinfo:1.28      Sun Aug 31 09:30:45 2025
+++ pkgsrc/graphics/libsixel/distinfo   Sun Apr 19 14:56:11 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.28 2025/08/31 09:30:45 tsutsui Exp $
+$NetBSD: distinfo,v 1.29 2026/04/19 14:56:11 wiz Exp $
 
-BLAKE2s (libsixel-1.8.7.tar.gz) = 30ff2df59714ffad327568a00f0e1244fa73b1cdd36e07fc2a723c4a657d56da
-SHA512 (libsixel-1.8.7.tar.gz) = 269e54f8c91f31e03498b8f6ae7b5968cf4236a5c0b68dd551227bbbca4fd47f91fa1bc162546b0f8b9a53dfa3d9b0ab872e9af37299f66d8259f0aab8f61050
-Size (libsixel-1.8.7.tar.gz) = 4888313 bytes
+BLAKE2s (libsixel-1.8.7-r1.tar.gz) = 36a53e64d34ee4c1a0ef7367a3aa393e09c9d7e70a1475b2f15861e1e18a12f8
+SHA512 (libsixel-1.8.7-r1.tar.gz) = 6e12f405b96f896d9f5bde8b1ae4feb4c051d8576b68c34bbf294c5eacfd2b1b8b54e44580a98417c3b318467ded3b44534ddbab319d0f9317bbabf3fdb0c51a
+Size (libsixel-1.8.7-r1.tar.gz) = 4901699 bytes