CVS commit: [pkgsrc-2026Q3] pkgsrc/converters/fribidi

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Nov 11 10:30:22 UTC 2026

Modified Files:
        pkgsrc/converters/fribidi [pkgsrc-2026Q3]: Makefile PLIST distinfo

Log Message:
Pullup ticket #7359 - requested by taca
converters/fribidi: Security fix

Revisions pulled up:
- converters/fribidi/Makefile                                   1.38-1.40
- converters/fribidi/PLIST                                      1.9
- converters/fribidi/distinfo                                   1.25-1.26

---
   Module Name: pkgsrc
   Committed By:        ryoon
   Date:                Tue Sep 22 07:42:17 UTC 2026

   Modified Files:
        pkgsrc/converters/fribidi: Makefile PLIST distinfo

   Log Message:
   converters/fribidi: Update to 1.0.17

   Changelog:
   Overview of changes between 1.0.16 and 1.0.17
   =============================================

   * Update Unicode character databases to v18.0.0
   * Significant performance improvements: FSI base direction resolution,
     N0 bracket pairing, embedding-level resolution, and fribidi_reorder_line()
     no longer have quadratic worst-case behavior, giving large speedups on
     long paragraphs/lines.
   * Fixed fribidi_set_reorder_nsm() and fribidi_set_mirroring() not taking
     effect when called before fribidi_log2vis().
   * Fixed bracket pairing (N0) to match brackets by canonical equivalence
     only, per UAX #9 BD16.
   * Fixed a stack buffer overflow when parsing character-set equivalence
     tables, and an out-of-bounds read on trailing '_' in charset data.
   * fribidi-main: fixed truncation of lines/output containing embedded
     NUL bytes.
   * Generate and install the fribidi(1) man page.
   * Various build fixes (MSVC, MinGW, GCC 14 warnings).

---
   Module Name: pkgsrc
   Committed By:        ryoon
   Date:                Tue Sep 22 10:51:08 UTC 2026

   Modified Files:
        pkgsrc/converters/fribidi: Makefile

   Log Message:
   converters/fribidi: Fix build

   help2man is required to finish build.
   Reported by Marc Baudoin. Thank you.

---
   Module Name: pkgsrc
   Committed By:        wiz
   Date:                Sun Nov  1 21:12:54 UTC 2026

   Modified Files:
        pkgsrc/converters/fribidi: Makefile distinfo

   Log Message:
   fribidi: update to 1.0.18.

   Overview of changes between 1.0.17 and 1.0.18
   =============================================

   * Security and robustness fixes found by an automated scan (Anthropic's
     OSS Scanner):
     - fribidi_remove_bidi_marks(): fixed an out-of-bounds write before the
       caller's map when the position maps returned by one call are passed to
       a second call. The maps it returns are now correct, and removed
       characters are -1.
     - Fixed unchecked memory allocations in fribidi_reorder_line(),
       fribidi_log2vis() and the bracket pairing code, which could crash
       when memory ran out instead of returning failure.
     - Fixed an out-of-bounds read in the CapRTL decoder on platforms where
       plain char is unsigned (e.g. aarch64, arm, ppc64le, s390x).
     - Fixed quadratic running time on paragraphs made of many back-to-back
       isolates, and on deeply nested isolates containing brackets (N0).
   * Fixed a stack buffer overflow in the CapRTL/UTF-8 output of fribidi and
     fribidi-caprtl2utf8, and an integer overflow in the run-pool allocation
     on 32-bit platforms.
   * Fixed paragraph direction detection to reset isolates at paragraph
     boundaries.
   * Bidi fixes to match UAX #9 more closely. These can change the output for
     unusual input:
     - Overflow isolates are no longer treated as valid isolates (X5a-X5c),
       and PDF handling checks the overflow counts first (X7).
     - Bracket pairs (BD16/N0) no longer pair across isolates, and a full
       bracket stack no longer stops pairing outside its isolating run
       sequence.
   * fribidi_unicode_to_charset() now null-terminates the output for an
     unknown character set.
   * Added regression tests and a fuzzing seed.


To generate a diff of this commit:
cvs rdiff -u -r1.37 -r1.37.16.1 pkgsrc/converters/fribidi/Makefile
cvs rdiff -u -r1.8 -r1.8.58.1 pkgsrc/converters/fribidi/PLIST
cvs rdiff -u -r1.24 -r1.24.16.1 pkgsrc/converters/fribidi/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/converters/fribidi/Makefile
diff -u pkgsrc/converters/fribidi/Makefile:1.37 pkgsrc/converters/fribidi/Makefile:1.37.16.1
--- pkgsrc/converters/fribidi/Makefile:1.37     Tue Oct  8 15:38:42 2024
+++ pkgsrc/converters/fribidi/Makefile  Wed Nov 11 10:30:21 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.37 2024/10/08 15:38:42 wiz Exp $
+# $NetBSD: Makefile,v 1.37.16.1 2026/11/11 10:30:21 maya Exp $
 
-DISTNAME=      fribidi-1.0.16
+DISTNAME=      fribidi-1.0.18
 CATEGORIES=    converters
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=fribidi/}
 GITHUB_RELEASE=        v${PKGVERSION_NOREV}
@@ -11,9 +11,11 @@ HOMEPAGE=    https://github.com/fribidi/fri
 COMMENT=       Free Implementation of the Unicode Bidirectional Algorithm
 LICENSE=       gnu-gpl-v2
 
+TOOL_DEPENDS+= help2man-[0-9]*:../../converters/help2man
+
 USE_LIBTOOL=   yes
 GNU_CONFIGURE= yes
-USE_TOOLS+=    gmake
+USE_TOOLS+=    gmake pkg-config
 
 TEST_TARGET=   check
 

Index: pkgsrc/converters/fribidi/PLIST
diff -u pkgsrc/converters/fribidi/PLIST:1.8 pkgsrc/converters/fribidi/PLIST:1.8.58.1
--- pkgsrc/converters/fribidi/PLIST:1.8 Tue Sep 17 16:43:01 2019
+++ pkgsrc/converters/fribidi/PLIST     Wed Nov 11 10:30:21 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.8 2019/09/17 16:43:01 nia Exp $
+@comment $NetBSD: PLIST,v 1.8.58.1 2026/11/11 10:30:21 maya Exp $
 bin/fribidi
 include/fribidi/fribidi-arabic.h
 include/fribidi/fribidi-begindecls.h
@@ -24,6 +24,7 @@ include/fribidi/fribidi-unicode.h
 include/fribidi/fribidi.h
 lib/libfribidi.la
 lib/pkgconfig/fribidi.pc
+man/man1/fribidi.1
 man/man3/fribidi_charset_to_unicode.3
 man/man3/fribidi_debug_status.3
 man/man3/fribidi_get_bidi_type.3

Index: pkgsrc/converters/fribidi/distinfo
diff -u pkgsrc/converters/fribidi/distinfo:1.24 pkgsrc/converters/fribidi/distinfo:1.24.16.1
--- pkgsrc/converters/fribidi/distinfo:1.24     Tue Oct  8 15:38:42 2024
+++ pkgsrc/converters/fribidi/distinfo  Wed Nov 11 10:30:22 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.24 2024/10/08 15:38:42 wiz Exp $
+$NetBSD: distinfo,v 1.24.16.1 2026/11/11 10:30:22 maya Exp $
 
-BLAKE2s (fribidi-1.0.16.tar.xz) = de116d2debd50b1204020e0219c38a431a0ec42dd40755088c99ee0eb9a9c9b9
-SHA512 (fribidi-1.0.16.tar.xz) = e3a56f36155f6813e3609473639fc533de742309f561c463012dc90b412a1ac7694b765d92669b2cbfaee973ca0e92fa5e926e68a1a078921f26ef17d82ab651
-Size (fribidi-1.0.16.tar.xz) = 1098260 bytes
+BLAKE2s (fribidi-1.0.18.tar.xz) = e568404f0f5aefa38ea8b9b5eb9650d77fdb2a943e5cf11eff2eb683a538a990
+SHA512 (fribidi-1.0.18.tar.xz) = c7bf95e6695652ee935afc3067cb7667e77859bb6d27e7fc2b5294e1bc17d1a0c2ed5f7eef709999f7e51ec4475934f0a4abefde79bc3db577ca2f4361c92a1c
+Size (fribidi-1.0.18.tar.xz) = 1222656 bytes