Add an upstream patch to fix CVE-2020-35492:
A flaw was found in cairo's image-compositor.c in all versions prior to
1.17.4. This flaw allows an attacker who can provide a crafted input
file to cairo's image-compositor (for example, by convincing a user to
open a file in an application using cairo, or if an application uses
cairo on untrusted input) to cause a stack buffer overflow ->
out-of-bounds WRITE. The highest impact from this vulnerability is to
confidentiality, integrity, as well as system availability.
Important note: this is not the exact upstream patch. Indeed, the
upstream patch[1] contains a png file which appears as a binary diff
inside the patch. The `patch` tool which is used by Buildroot to apply
patches does not handle that kind of diff. Since it is just a test, it
shouldn't impact the quality of the CVE fix and all changes related to
the test are removed from the patch.
[1] 03a820b173
Cc: Quentin Schulz <foss+buildroot@0leil.net>
Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Add an upstream patch to fix CVE-2019-6462:
An issue was discovered in cairo 1.16.0. There is an infinite loop in
the function _arc_error_normalized in the file cairo-arc.c, related to
_arc_max_angle_for_tolerance_normalized.
Cc: Quentin Schulz <foss+buildroot@0leil.net>
Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure raised on uclibc and musl since the
addition of libexecinfo package in commit
eea8ba446c10701a273432552108d80fb2224ef4:
/home/giuliobenetti/autobuild/run/instance-2/output-1/host/lib/gcc/arm-buildroot-linux-uclibcgnueabi/10.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: /home/giuliobenetti/autobuild/run/instance-2/output-1/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libvcos.so: undefined reference to `backtrace_symbols'
/home/giuliobenetti/autobuild/run/instance-2/output-1/host/lib/gcc/arm-buildroot-linux-uclibcgnueabi/10.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: /home/giuliobenetti/autobuild/run/instance-2/output-1/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libvcos.so: undefined reference to `backtrace'
Fixes:
- http://autobuild.buildroot.org/results/836348270d564a46cc9ee840cf87b2494cc82cec
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
script support on host-cairo is needed for host-librsvg
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
gobject is needed for host-librsvg
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Add an upstream patch to fix CVE-2018-19876: cairo 1.16.0, in
cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a
free function incompatible with WebKit's fastMalloc, leading to an
application crash with a "free(): invalid pointer" error.
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Peter: extend commit message]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
We want to use SPDX identifier for license string as much as possible.
SPDX short identifier for MPLv1.0/MPLv1.1/MPLv2.0 is MPL-1.0/MPL-1.1/
MPL-2.0.
This change is done using following command.
find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/MPLv([1-2]\.[0-1])/MPL-\1/g'
Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
We want to use SPDX identifier for license string as much as possible.
SPDX short identifier for LGPLv2.1/LGPLv2.1+ is LGPL-2.1/LGPL-2.1+.
This change is done using following command.
find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/LGPLv2.1(\+)?/LGPL-2.1\1/g'
Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
As noticed by Rahul Bedarkar, the cairo library is LGPLv2.1 only
(not LGPLv2.1+) or MPLv1.1.
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
If OpenGL is enabled then enable cairo-gl.
However if GLESv2 is also present we must choose which implementation to
use.
Since normally OpenGL is more featured, has more dependencies and
wouldn't be present "by accident" it seems like the logical choice to
win over it.
This feature is useful for webkitgtk's accelerated 2d canvas.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
This commit modifies the cairo, icu and webkitgtk24 packages to use
BR2_TOOLCHAIN_HAS_LIBATOMIC when appropriate.
Fixes:
http://autobuild.buildroot.net/results/ec4/ec4e48c0e4b8fa72d8bb7ef4ad67a166699c0b62/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
When lzo was compiled before, cairo will use it as optional dependency:
$ output/host/usr/bin/x86_64-linux-readelf -a output/target/usr/bin/cairo-sphinx | grep NEEDED | sort
[...]
0x0000000000000001 (NEEDED) Shared library: [liblzo2.so.2]
The build system offers no option to en-/disable lzo support:
https://cgit.freedesktop.org/cairo/tree/configure.ac#n54
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
This commit handles the reverse dependency tree of cairo in terms of
atomic dependencies. There are two main changes:
- cairo in fact no longer needs atomic operations. It can perfectly
build without any __sync built-in, as was tested using an ARC
toolchain without atomics, and a SPARC toolchain. Optionally, Cairo
can use the __atomic builtins provided by gcc >= 4.7, so support
for this is added as well. Thanks to this change, the
BR2_ARCH_HAS_ATOMICS dependency is removed from cairo and all its
reverse dependencies.
- harfbuzz does require the __sync built-in for 4 bytes integers, so
we add a dependency on BR2_TOOLCHAIN_HAS_SYNC_4 to harfbuzz and all
its reverse dependency, the main one being the pango package. Due
to this, the vast majority of gtk-related packages are moved to a
dependency on BR2_ARCH_HAS_ATOMICS (which used to be due to cairo)
to a dependency on BR2_TOOLCHAIN_HAS_SYNC_4 (due to pango ->
harfbuzz).
In detail:
- cairo
Remove BR2_ARCH_HAS_ATOMICS dependency, link against -latomic when
gcc >= 4.8 in order to use the __atomic functions.
- harfbuzz
Add dependency on BR2_TOOLCHAIN_HAS_SYNC_4
- cairomm, gst-plugins-good, gst1-plugins-good, libgdiplus,
libsvg-cairo, weston
Remove BR2_ARCH_HAS_ATOMICS dependency (since cairo no longer needs
atomics)
- enlightenment, cwiid, gst-plugins-bad, gst-plugins-base,
gst1-plugins-bad, gst1-plugins-base, gtkmm3,
libevas-generic-loaders, libfm, libgail, libgtk2, libgtk3, librsvg,
openbox, opencv, opencv3, pango, pangomm, pcmanfm, pinentry,
rrdtool, webkit, webkitgtk24, xscreensaver
Switch from a BR2_ARCH_HAS_ATOMICS dependency to a
BR2_TOOLCHAIN_HAS_SYNC_4 (they depend on pango, harfbuzz, gtk, or
some other related package)
- directfb
Remove BR2_ARCH_ATOMICS dependency of the BR2_PACKAGE_DIRECTFB_SVG
(since cairo can build without atomics), but add a
BR2_TOOLCHAIN_HAS_SYNC_4 dependency on BR2_PACKAGE_DIRECTFB itself
since it does use __sync built-ins. This replaces the !BR2_sparc
dependency.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
These are completely historic from the initial commit (3a0a8791) and
completely unused.
Two separate builds with/without give nothing relevant with:
$ diff -u cairo.cv/config.log cairo-1.14.4/config.log|grep ^+
Same applies to removals with:
$ diff -u cairo.cv/config.log cairo-1.14.4/config.log|grep ^-
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Required for host-pango, which in turn is required for host-librsvg and
at last midori.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
This commit doesn't touch infra packages.
Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Bump cairo to version 1.12.12.
Signed-off-by: Eric Le Bihan <eric.le.bihan.dev@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS,
make the same change for FOO_CONF_OPT.
Sed command used:
find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g'
Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
DirectFB SVG support rely on Cairo and Cairo depends on DirectFB.
Since Cairo DirectFB backend is marked as experimental, this patch choose to
disable this backend when DirectFB SVG support is enable.
In add, this patch may solve some tricky situations between DirectFB and Cairo
(see http://sysmic.org/~jezz/results/c2f11fc0) and improve build reproducibility.
[Peter: propagate atomics dependency, needs libsvg-cairo, add cairo includes]
Signed-off-by: Jérôme Pouiller <jezz@sysmic.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The basic rule for a package is to have its options named
after the package name. There is no reason this should not
also be the case for virtual packages.
Besides, renaming the package will allow us to switch libopenvg to use
the soon-to-be-introduced virtual-package infrastructure.
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Eric Le Bihan <eric.le.bihan.dev@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Thomas De Schampheleire <patrickdepinguin@gmail.com>
Cc: Mike Zick <minimod@morethan.org>
Reviewed-by: Samuel Martin <s.martin49@gmail.com>
Cc: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net>
Acked-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
The basic rule for a package is to have its options named
after the package name. There is no reason this should not
also be the case for virtual packages.
Besides, this will allow us to switch libgles to use the
soon-to-be-introduced virtual-package infrastructure.
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Eric Le Bihan <eric.le.bihan.dev@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Thomas De Schampheleire <patrickdepinguin@gmail.com>
Cc: Mike Zick <minimod@morethan.org>
Cc: Samuel Martin <s.martin49@gmail.com>
Reviewed-by: Samuel Martin <s.martin49@gmail.com>
Cc: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Acked-by: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Directfb patch no longer needed.
[Peter: Add options for script/xml backends, support for Xrender backend]
Signed-off-by: Sagaert Johan <sagaert.johan@skynet.be>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
cairo depends on xlib_libX11 for its Xlib backend. But xlib_libX11
depends on XCB, so the XCB support can always be built into Cairo.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
cairo is a X client library, so there is no reason for it to build
depend on the X.org server. What Cairo needs is the xlib_libX11
library.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
The Cairo tracing and trace interpreter are most likely not that
useful, so disable them. They also require zlib, which isn't a
dependency of Cairo at the moment. This fixes the following build
failure:
http://autobuild.buildroot.org/results/a91e4e337fd9deb0f9fad433350feb27b2aee556/build-end.log
In the future, if people are interested by the trace and trace
interpreter, we can add a new Config.in knob for them.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Update the DirectFB patch as it no longer applied cleanly.
[Peter: drop redundant AUTORECONF = NO line]
Signed-off-by: Will Newton <will.newton@imgtec.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
host support was removed in 7b38fc20ba (cairo: remove host variant),
but it forgot to remove the HOST_CAIRO_CONF_OPT assignment.
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Bernd Kuhls