A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function
(io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing
maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding,
allowing out-of-bounds reads from heap memory, potentially causing application crashes or
arbitrary code execution.
(From OE-Core rev: 78a52a7feb995b4ab4f4df6b16feaac60f6ad59b)
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
The patch that allows to do so has not been accepted upstream, and wasn't correctly
working as it was running a native executable (gdk-pixbuf-query-loaders) with target .so plugins.
On the other hand, out of 20+ (currently 23) tests only three require
running binaries at build time to produce special test-specific input data:
cve-2015-4491
pixbuf-pixdata
pixbuf-resource
So let's simply omit these from the build: this can be done with a far
less invasive patch which has a chance of being accepted upstream.
gdk-pixbuf-print-mime-types is no longer installed
(the replaced patch was doing that).
(From OE-Core rev: 0d926508e75095eb446699b612729d0243eacc91)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
An automated conversion using scripts/contrib/convert-spdx-licenses.py to
convert to use the standard SPDX license identifiers. Two recipes in meta-selftest
were not converted as they're that way specifically for testing. A change in
linux-firmware was also skipped and may need a more manual tweak.
(From OE-Core rev: ceda3238cdbf1beb216ae9ddb242470d5dfc25e0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is the result of automated script conversion:
scripts/contrib/convert-overrides.py <oe-core directory>
converting the metadata to use ":" as the override character instead of "_".
(From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since commit [92fc28498f gdk-pixbuf: rewrite the cross-build support
for tests] applied, it add meson option -Duse_prebuilt_tools=true to
taget.
Add the same option for nativesdk to fix do_configure failure
|../gdk-pixbuf-2.42.6/thumbnailer/meson.build:32:0: ERROR: Arrays do not
have a method called 'full_path'
(From OE-Core rev: 4781dad55cc0449a3dc52914e2b6f9eace91158e)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It was scattered over four different patches, and wasn't guarded
by a configuration option. Hopefully the new patch is acceptable
to upstream.
(From OE-Core rev: 92fc28498fcb9bdcea743961729b21b7e6c6b1fa)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Note: jpg/png loaders are now builtin and no longer
provided as separate packages.
Drop backport missing-test-data.patch.
Drop no longer needed 0004-Do-not-run-tests-when-building.patch
Rebase 0004-Do-not-run-tests-when-building.patch
Rework 0003-target-only-Work-around-thumbnailer-cross-compile-fa.patch
so that it can be applied to both native and target builds.
(From OE-Core rev: 9eda439c7c775fb7fa26a97d2575b491e2a4bd45)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Native recipes have been special and they don't have packages generated
from them. The RDEPENDS/RPROVIDES and other runtime package specific
variables can contain important data about dependencies recipes need
though and currently it is required to write this information explicitly
in the native case.
We now delete the packaging tasks for native recipes which removes the
need to clear PACKAGES. The next step to improve the metadata is to
stop clearing it and ensure any entries in these variables are remapped
appropriately. The R* variables were already being processed by the class
extension code but the implementation was suboptimal.
This patch stops clearing PACKAGES and PACKAGES_DYNAMIC and fixes the places
where that caused issues in OE-Core, for example PACKAGES additions in anonymous
python without the "-native" suffix and a case where the included classes
caused a self reference in DEPENDS which would once have been removed by
the previous code.
The implementation uses datastore/parser parameters to ensure that the
variable overrides are not overwritten when calling setVar which is appropriate
for a function as close to the core as this one is.
Some now unneeded code in python3-setuptools is dropped, there are further
changes like this which can follow.
This change was verified with OE-Core by comparing task-depends.dot generated
by "bitbake world -g" before and after the change, the files were identical.
(From OE-Core rev: fd6a007efa7cb45101a66f294af81d9d33bb3fab)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport patch from
bdd3acbd48
image file in upstream patch is for test purpose only, it cause error during
do_patch so drop it:
File tests/test-images/fail/hang_114.gif: git binary diffs are not supported.
(From OE-Core rev: 7cd401b7c60dba91f6fb10395ab4a10a267cf23d)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
As README.md says gdk-pixbuf is under not only LGPLv2.1 but also its
later version, I fixed LICENSE value.
(From OE-Core rev: e9800fecbae1e4565275cd1528397c3cec81bcab)
Signed-off-by: Akira Shibakawa <arabishi900@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Convert the installed-tests toggle from simply respecting PTEST_ENABLED
to a PACKAGECONFIG, so that it can be turned on/off in the usual manner.
(From OE-Core rev: 08e61ffae6056055b56f93678bcbb9fd71f3303e)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The test is randomly modifying file data and some of these random
modifications cause OOM failures. There is no way to preserve and repeat
what was modified, so the test needs to re-engineered to do
proper fuzzing.
See here for details:
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/146
(From OE-Core rev: 732a9c83e946580607af3478cdc765d6541e3f64)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently gdk-pixbuf x11 loader is enabled only
for LSB build. But it is needed by other recipes like
Ice window manger(icewm) for X window system.
(From OE-Core rev: 277a2bef8ae41a0314ecad27379b299ba7d90f22)
Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Remove 0001-loaders.cache-depend-on-loaders-being-fully-build.patch
as upstream has fixed the issue.
Add a patch to revert upstream's decision to not cross-compile
thumbnailer or tests.
(From OE-Core rev: 0598f66aa823ec4355284a0a40c3d125d6c5e0c9)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is done similarly to gobject-introspection work by Andreas Müller,
and allows dropping duplicate clutter from the recipes.
(From OE-Core rev: ff578f4451a0a199202e576b647840910b4d3f59)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We need export XDG_DATA_DIRS to be ${STAGING_DATADIR} for gdk-pixbuf*
wrappers or else they will try to load mime from /usr/share/mime of the
host machine.
(From OE-Core rev: de2848be1b04cf1ff1e0147114f5214be8225877)
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
With 2.38.0 gdk-pixbuf dopped the enable_ prefix from the Meson
build options.
(From OE-Core rev: e11e4ebb521882ec64296e65b901ff1d9bccc23a)
Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop 0001-Disable-tests-in-native-builds.patch as upstream has fixed the issue.
Rework 0001-Fix-a-couple-of-decisions-around-cross-compilation.patch to
enable generation of loaders.cache in target builds (using a native tool),
because otherwise building tests becomes impossible.
Rework 0002-Work-around-thumbnailer-cross-compile-failure.patch into
0003-target-only-Work-around-thumbnailer-cross-compile-fa.patch
(which deals with substituting native tools in cross builds) and
0004-Do-not-run-tests-when-building.patch (which avoids running
test binaries during cross builds).
Rebase fatal-loader.patch.
License checksum updates as COPYING file had 2.0 version of LGPL and
has been replaced with 2.1 version.
Take meson's x11 and installed_tests options into use.
Install gdk-pixbuf-query-loaders also into $bindir, as we need the native
version during cross compile.
(From OE-Core rev: 8fb16df2e6977bb3508239eb8d447b8c5401d5ed)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fix handling of escape characters in regexs and hence fix python
Deprecation warnings which will be problematic in python 3.8.
Note that some show up as:
"""
meta/classes/package.bbclass:1293: DeprecationWarning: invalid escape sequence \.
"""
where the problem isn't on 1293 in package.bbclass but in some _prepend to a
package.bbclass function in a different file like mesa.inc, often from
do_package_split() calls.
(From OE-Core rev: 4b1c0c7d5525fc4cea9e0f02ec54e92a6fbc6199)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Remove upstreamed 0001-queryloaders-Make-output-more-reproducible.patch
Rebase fatal-loader.patch
Add a patch to fix a libtiff detection issue.
(From OE-Core rev: 057fadbaa9948fb26d99ffcbe68145658df64038)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Search made with the following regex: getVar ?\((.*), True\).
(From OE-Core rev: dbc0eaf478feb3f752ae22fd184984494fc85d0a)
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Don't hardcode the package name, it could be gdk-pixbuf or
lib32-gdk-pixbuf.
(From OE-Core rev: 92a299a550b5b9c68c0285fdeb3d4c9defa0dede)
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Smallish releases with bug fixes and minor improvements.
shared-mime-info is now always used for image type sniffing.
The dependency does not seem to currently be a build-time dependency
but configure.ac does check for it: I took the easy route and just
added shared-mime-info to DEPENDS as well.
(From OE-Core rev: ebba8c2999fc6cf94eca988f8d942acd9f0137ba)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Mostly bug fix releases.
Generating the thumbnailer metadata now requires running yet another
tool at build time. This is broken for cross-compiling, add a
work-around.
Add gdk-pixbuf-native to DEPENDS to make the above workaround possible:
We already build gdk-pixbuf-native anyway so this is not a huge deal.
(From OE-Core rev: 645e14bb39d10a50648daaf7a015f2d75bf357db)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch is comparatively large and invasive. It does only do one thing, switching the
system to build using recipe specific sysroots and where changes could be isolated from it,
that has been done.
With the current single sysroot approach, its possible for software to find things which
aren't in their dependencies. This leads to a determinism problem and is a growing issue in
several of the market segments where OE makes sense. The way to solve this problem for OE is
to have seperate sysroots for each recipe and these will only contain the dependencies for
that recipe.
Its worth noting that this is not task specific sysroots and that OE's dependencies do vary
enormously by task. This did result in some implementation challenges. There is nothing stopping
the implementation of task specific sysroots at some later point based on this work but
that as deemed a bridge too far right now.
Implementation details:
* Rather than installing the sysroot artefacts into a combined sysroots, they are now placed in
TMPDIR/sysroot-components/PACKAGE_ARCH/PN.
* WORKDIR/recipe-sysroot and WORKDIR/recipe-sysroot-native are built by hardlinking in files
from the sysroot-component trees. These new directories are known as RECIPE_SYSROOT and
RECIPE_SYSROOT_NATIVE.
* This construction is primarily done by a new do_prepare_recipe_sysroot task which runs
before do_configure and consists of a call to the extend_recipe_sysroot function.
* Other tasks need things in the sysroot before/after this, e.g. do_patch needs quilt-native
and do_package_write_deb needs dpkg-native. The code therefore inspects the dependencies
for each task and adds extend_recipe_sysroot as a prefunc if it has populate_sysroot
dependencies.
* We have to do a search/replace 'fixme' operation on the files installed into the sysroot to
change hardcoded paths into the correct ones. We create a fixmepath file in the component
directory which lists the files which need this operation.
* Some files have "postinstall" commands which need to run against them, e.g. gdk-pixbuf each
time a new loader is added. These are handled by adding files in bindir with the name
prefixed by "postinst-" and are run in each sysroot as its created if they're present.
This did mean most sstate postinstalls have to be rewritten but there shouldn't be many of them.
* Since a recipe can have multiple tasks and these tasks can run against each other at the same
time we have to have a lock when we perform write operations against the sysroot. We also have
to maintain manifests of what we install against a task checksum of the dependency. If the
checksum changes, we remove its files and then add the new ones.
* The autotools logic for filtering the view of m4 files is no longer needed (and was the model
for the way extend_recipe_sysroot works).
* For autotools, we used to build a combined m4 macros directory which had both the native and
target m4 files. We can no longer do this so we use the target sysroot as the default and add
the native sysroot as an extra backup include path. If we don't do this, we'd have to build
target pkg-config before we could built anything using pkg-config for example (ditto gettext).
Such dependencies would be painful so we haven't required that.
* PKDDATA_DIR was moved out the sysroot and works as before using sstate to build a hybrid copy
for each machine. The paths therefore changed, the behaviour did not.
* The ccache class had to be reworked to function with rss.
* The TCBOOTSTRAP sysroot for compiler bootstrap is no longer needed but the -initial data
does have to be filtered out from the main recipe sysroots. Putting "-initial" in a normal
recipe name therefore remains a bad idea.
* The logic in insane needed tweaks to deal with the new path layout, as did the debug source
file extraction code in package.bbclass.
* The logic in sstate.bbclass had to be rewritten since it previously only performed search and
replace on extracted sstate and we now need this to happen even if the compiled path was
"correct". This in theory could cause a mild performance issue but since the sysroot data
was the main data that needed this and we'd have to do it there regardless with rss, I've opted
just to change the way the class for everything. The built output used to build the sstate output
is now retained and installed rather than deleted.
* The search and replace logic used in sstate objects also seemed weak/incorrect and didn't hold
up against testing. This has been rewritten too. There are some assumptions made about paths, we
save the 'proper' search and replace operations to fixmepath.cmd but then ignore this. What is
here works but is a little hardcoded and an area for future improvement.
* In order to work with eSDK we need a way to build something that looks like the old style sysroot.
"bitbake build-sysroots" will construct such a sysroot based on everything in the components
directory that matches the current MACHINE. It will allow transition of external tools and can
built target or native variants or both. It also supports a clean task. I'd suggest not relying on
this for anything other than transitional purposes though. To see XXX in that sysroot, you'd have
to have built that in a previous bitbake invocation.
* pseudo is run out of its components directory. This is fine as its statically linked.
* The hacks for wayland to see allarch dependencies in the multilib case are no longer needed
and can be dropped.
* wic needed more extensive changes to work with rss and the fixes are in a separate commit series
* Various oe-selftest tweaks were needed since tests did assume the location to binaries and the
combined sysroot in several cases.
* Most missing dependencies this work found have been sent out as separate patches as they were found
but a few tweaks are still included here.
* A late addition is that extend_recipe_sysroot became multilib aware and able to populate multilib
sysroots. I had hoped not to have to add that complexity but the meta-environment recipe forced my
hand. That implementation can probably be neater but this is on the list of things to cleanup later
at this point.
In summary, the impact people will likely see after this change:
* Recipes may fail with missing dependencies, particularly native tools like gettext-native,
glib-2.0-native and libxml2.0-native. Some hosts have these installed and will mask these errors
* Any recipe/class using SSTATEPOSTINSTFUNCS will need that code rewriting into a postinst
* There was a separate patch series dealing with roots postinst native dependency issues. Any postinst
which expects native tools at rootfs time will need to mark that dependency with PACKAGE_WRITE_DEPS.
There could well be other issues. This has been tested repeatedly against our autobuilders and oe-selftest
and issues found have been fixed. We believe at least OE-Core is in good shape but that doesn't mean
we've found all the issues.
Also, the logging is a bit chatty at the moment. It does help if something goes wrong and goes to the
task logfiles, not the console so I've intentionally left this like that for now. We can turn it down
easily enough in due course.
(From OE-Core rev: 809746f56df4b91af014bf6a3f28997d6698ac78)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
New binary gdk-pixbuf-thumbnailer packaged in ${PN}-bin.
(From OE-Core rev: 2103089819dd2df27753b4d04789680a26580848)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
getVar() now defaults to expanding by default, thus remove the True
option from getVar() calls with a regex search and replace.
Search made with the following regex: getVar ?\(( ?[^,()]*), True\)
(From OE-Core rev: 7c552996597faaee2fbee185b250c0ee30ea3b5f)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
