CVS commit: pkgsrc/graphics/libjpeg-turbo

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Jun 30 20:07:33 UTC 2026

Modified Files:
        pkgsrc/graphics/libjpeg-turbo: Makefile PLIST distinfo
Added Files:
        pkgsrc/graphics/libjpeg-turbo/patches:
            patch-simd_arm__aarch32_jsimdcpu.c
Removed Files:
        pkgsrc/graphics/libjpeg-turbo/patches: patch-simd_CMakeLists.txt
            patch-simd_arm__aarch32_jsimd.c patch-simd_arm__aarch64_jsimd.c

Log Message:
libjpeg-turbo: updated to 3.2.0

3.2.0

Fixed a regression introduced by 3.2 beta1[9] that broke Arm64EC Windows builds.

Hardened the PNG writer (which is used by djpeg and tj3SaveImage*()) against applications that may erroneously attempt to write sample values that are out of range for the specified output data 
precision. This could have caused a buffer overrun in the PNG writer's rescale array if the output data precision was not 8 or 16 bits. The buffer overrun did not likely pose a security risk, since 
tj3SaveImage*() is not exposed to arbitrary external input data and since a caller that abused the API in the aforementioned manner could never work properly.

Hardened the libjpeg API against hypothetical applications that may erroneously call jpeg_crop_scanline() with buffered-image mode and raw data output enabled.  jpeg_crop_scanline() does not work 
with raw data output, but due to an oversight, it did not throw an error if both buffered-image mode and raw data output were enabled. If a hypothetical application aborted a normal decompression 
operation without reading any scanlines, started a new decompression operation using the same libjpeg instance with buffered-image mode and raw data output enabled, then called jpeg_crop_scanline() 
with arguments that would have caused any of the component planes to be cropped to a width of 1 sample, jpeg_crop_scanline() would have used freed memory. However, this did not likely pose a security 
risk, since an application that abused the API in the aforementioned manner could never work properly.

Fixed a buffer overrun and subsequent segfault in jpegtran that occurred when attempting to use the -crop and -trim options to expand the width of an image narrower than one iMCU, discard partial 
iMCUs, and fill each block in the expanded region with the DC coefficient of the nearest block in the input image ("flatten.") Similarly, fixed an infinite loop that occurred when attempting to use 
the -crop and -trim options to expand the width of an image narrower than one iMCU, discard partial iMCUs, and fill the expanded region with repeated reflections of the input image ("reflect.") When 
the only iMCU column in the input image is partial and partial iMCUs are trimmed, the flatten and reflect extensions cannot work properly, so jpegtran now throws an error if that is the case. These 
issues were confined to the jpegtran application and thus did not pose a security risk.


To generate a diff of this commit:
cvs rdiff -u -r1.44 -r1.45 pkgsrc/graphics/libjpeg-turbo/Makefile
cvs rdiff -u -r1.9 -r1.10 pkgsrc/graphics/libjpeg-turbo/PLIST
cvs rdiff -u -r1.38 -r1.39 pkgsrc/graphics/libjpeg-turbo/distinfo
cvs rdiff -u -r1.1 -r0 \
    pkgsrc/graphics/libjpeg-turbo/patches/patch-simd_CMakeLists.txt
cvs rdiff -u -r1.4 -r0 \
    pkgsrc/graphics/libjpeg-turbo/patches/patch-simd_arm__aarch32_jsimd.c
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/graphics/libjpeg-turbo/patches/patch-simd_arm__aarch32_jsimdcpu.c
cvs rdiff -u -r1.2 -r0 \
    pkgsrc/graphics/libjpeg-turbo/patches/patch-simd_arm__aarch64_jsimd.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/libjpeg-turbo/Makefile
diff -u pkgsrc/graphics/libjpeg-turbo/Makefile:1.44 pkgsrc/graphics/libjpeg-turbo/Makefile:1.45
--- pkgsrc/graphics/libjpeg-turbo/Makefile:1.44 Sun Mar 29 17:24:31 2026
+++ pkgsrc/graphics/libjpeg-turbo/Makefile      Tue Jun 30 20:07:32 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.44 2026/03/29 17:24:31 wiz Exp $
+# $NetBSD: Makefile,v 1.45 2026/06/30 20:07:32 adam Exp $
 
-DISTNAME=      libjpeg-turbo-3.1.4.1
+DISTNAME=      libjpeg-turbo-3.2.0
 CATEGORIES=    graphics
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libjpeg-turbo/}
 

Index: pkgsrc/graphics/libjpeg-turbo/PLIST
diff -u pkgsrc/graphics/libjpeg-turbo/PLIST:1.9 pkgsrc/graphics/libjpeg-turbo/PLIST:1.10
--- pkgsrc/graphics/libjpeg-turbo/PLIST:1.9     Tue Dec 24 15:39:44 2024
+++ pkgsrc/graphics/libjpeg-turbo/PLIST Tue Jun 30 20:07:32 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.9 2024/12/24 15:39:44 adam Exp $
+@comment $NetBSD: PLIST,v 1.10 2026/06/30 20:07:32 adam Exp $
 bin/cjpeg
 bin/djpeg
 bin/jpegtran
@@ -21,7 +21,7 @@ lib/libjpeg.so.8.3.2
 lib/libturbojpeg.a
 lib/libturbojpeg.so
 lib/libturbojpeg.so.0
-lib/libturbojpeg.so.0.4.0
+lib/libturbojpeg.so.0.5.0
 lib/pkgconfig/libjpeg.pc
 lib/pkgconfig/libturbojpeg.pc
 man/man1/cjpeg.1

Index: pkgsrc/graphics/libjpeg-turbo/distinfo
diff -u pkgsrc/graphics/libjpeg-turbo/distinfo:1.38 pkgsrc/graphics/libjpeg-turbo/distinfo:1.39
--- pkgsrc/graphics/libjpeg-turbo/distinfo:1.38 Sun May 31 09:40:07 2026
+++ pkgsrc/graphics/libjpeg-turbo/distinfo      Tue Jun 30 20:07:32 2026
@@ -1,10 +1,8 @@
-$NetBSD: distinfo,v 1.38 2026/05/31 09:40:07 spz Exp $
+$NetBSD: distinfo,v 1.39 2026/06/30 20:07:32 adam Exp $
 
-BLAKE2s (libjpeg-turbo-3.1.4.1.tar.gz) = 4563273544a3c7ada586875174553bd8edf94499b0ebcf1c447eb27990e7c992
-SHA512 (libjpeg-turbo-3.1.4.1.tar.gz) = 5c67fa6a528e35963736e0361ae6952f6f253b74cd31e8795de60a80287b123c4f35a333ca03934011b01f72110c13b26d13320fce2969287428cebde153c730
-Size (libjpeg-turbo-3.1.4.1.tar.gz) = 2528617 bytes
+BLAKE2s (libjpeg-turbo-3.2.0.tar.gz) = c159504a910ac29d4c7775bb3e5c6a59db79e38b77d956df349987a5df0234cb
+SHA512 (libjpeg-turbo-3.2.0.tar.gz) = 1ce063e9e126d55019385da3a6ff4521a9a3958edeab15e2465ae3435026dac6e598277eea066173ada47da37159d0f7812b2227869c10dd141dcfe2ddeab720
+Size (libjpeg-turbo-3.2.0.tar.gz) = 2537858 bytes
 SHA1 (patch-CMakeLists.txt) = ed81aa8def09bd03ff0c0a31ef2d7cac0bf06c8f
-SHA1 (patch-simd_CMakeLists.txt) = 03764c5bdbea9ca59e86eed31191128f8baf27db
-SHA1 (patch-simd_arm__aarch32_jsimd.c) = db5ac609a3897d249e6b29f601086cce78cd7406
-SHA1 (patch-simd_arm__aarch64_jsimd.c) = 76c5e81403f70a8ea8bca8ae2266066fff5ec6f9
+SHA1 (patch-simd_arm__aarch32_jsimdcpu.c) = 6251c6d9cc67980a754de2faaa4abb78eaaa9f1f
 SHA1 (patch-src_jpeglib.h) = 6be231604acd6a55f3a6d135cfaef20897e2926d

Added files:

Index: pkgsrc/graphics/libjpeg-turbo/patches/patch-simd_arm__aarch32_jsimdcpu.c
diff -u /dev/null pkgsrc/graphics/libjpeg-turbo/patches/patch-simd_arm__aarch32_jsimdcpu.c:1.1
--- /dev/null   Tue Jun 30 20:07:33 2026
+++ pkgsrc/graphics/libjpeg-turbo/patches/patch-simd_arm__aarch32_jsimdcpu.c    Tue Jun 30 20:07:32 2026
@@ -0,0 +1,37 @@
+$NetBSD: patch-simd_arm__aarch32_jsimdcpu.c,v 1.1 2026/06/30 20:07:32 adam Exp $
+
+NetBSD support.
+
+--- simd/arm/aarch32/jsimdcpu.c.orig   2026-06-30 17:25:43.000000000 +0000
++++ simd/arm/aarch32/jsimdcpu.c
+@@ -27,6 +27,9 @@
+ #include "../../jsimdint.h"
+ 
+ #include <ctype.h>
++#if defined(__NetBSD__)
++#include <sys/sysctl.h>
++#endif
+ 
+ #if !defined(__ARM_NEON__) && \
+     (defined(HAVE_GETAUXVAL) || defined(HAVE_ELF_AUX_INFO))
+@@ -108,6 +111,9 @@ jpeg_simd_cpu_support(void)
+   unsigned long cpufeatures = 0;
+ #elif defined(__linux__) || defined(ANDROID) || defined(__ANDROID__)
+   int bufsize = 1024; /* an initial guess for the line buffer size limit */
++#elif defined(__NetBSD__)
++  int neon_present;
++  size_t len;
+ #endif
+ #endif
+   unsigned int simd_support = 0;
+@@ -127,6 +133,10 @@ jpeg_simd_cpu_support(void)
+     if (bufsize > SOMEWHAT_SANE_PROC_CPUINFO_SIZE_LIMIT)
+       break;
+   }
++#elif defined(__NetBSD__)
++  if (sysctlbyname("machdep.neon_present", &neon_present, &len, NULL, 0) == 0
++      && neon_present != 0)
++    simd_support |= JSIMD_NEON;
+ #elif defined(HAVE_ELF_AUX_INFO)
+   elf_aux_info(AT_HWCAP, &cpufeatures, sizeof(cpufeatures));
+   if (cpufeatures & HWCAP_NEON)