Changelog:
==========
* Changed the error handler of oversized chunks (i.e. larger than
PNG_USER_CHUNK_MALLOC_MAX) from png_chunk_error to png_benign_error.
* Fixed a buffer overflow error in contrib/tools/pngfix.
* Fixed a memory leak (CVE-2019-6129) in contrib/tools/pngcp.
* Disabled the ARM Neon optimizations by default in the CMake file,
following the default behavior of the configure script.
* Allowed configure.ac to work with the trunk version of autoconf.
* Removed the support for "install" targets from the legacy makefiles;
removed the obsolete makefile.cegcc.
* Cleaned up the code and updated the internal documentation.
(From OE-Core rev: 19799cb50a00561b318cba1c8c20737f20e4a47f)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function
smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The
manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely.
The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to
fix this issue. The identifier of this vulnerability is VDB-213544.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-3965
Upstream Fix:
13c1310975
(From OE-Core rev: b88c96fe8964614978aa25a65dd34fc3c05c664c)
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file
libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument y_size
leads to out-of-bounds read. It is possible to initiate the attack remotely. The name of the patch is
92f9b28ed84a77138105475beba16c146bdaf984. It is recommended to apply a patch to fix this issue. The associated
identifier of this vulnerability is VDB-213543.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-3964
Upstream Fix:
92f9b28ed8
(From OE-Core rev: 4595f85e7ce867d68ca9d6a6e3ad2544565be3cc)
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- add a PACKAGECONFIG for soup3
- add PACKAGECONFIG_SOUP variable as it is used in webkitgtk and epiphany
(From OE-Core rev: 88d30848981db2cb7b1f2021ba07e40976cd789f)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The CVE number in the patch is a typo. CVE-2022-2053 is not related to
libtiff. So fix it.
(From OE-Core rev: c9f76ef859b0b4edb83ac098816b625f52c78173)
Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport of patch already present upstream to fix issues with invalid
characters for GLIB when combining gstreamer1.0-libav with ffmpeg 5.x.
Remove when gstreamer1.0-libav is upgraded to 1.21.1 or above
(From OE-Core rev: 703ff945557ad307bbe4ba0b0b7f1a2e5b4b847e)
Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a major update with some breaking library changes. Full release
notes are available at: https://xiph.org/flac/changelog.html
As part of this update, make some changes to the recipe:
* Development has moved from sourceforge to github, update BUGTRACKER
link.
* Move ogg support to a PACKAGECONFIG option rather than force enabled.
Keep it enabled by default to retain previous behavior.
* Move altivec, vsx, and sse flags to PACKAGECONFIG as well to make them
easier to toggle. Add new avx flag which enables runtime detection of
AVX/AVX2 instructions.
* Remove liboggflac and liboggflac++ packaging. This was merged into the
main libflac and libflac++ libraries in version 1.1.3, so these
packages have been empty.
License-Update: Updated copyright years
(From OE-Core rev: 2903e36c93eb33d5baa3dc9aa69fc80ee319794e)
Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
License checksum changed to to copyright year changes.
(From OE-Core rev: 47719f3195156aadc23dd4abdba38acfa3f77a1f)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Normally m4-native ends up in the sysroot via the toolchain, but if a
non-standard toolchain is used them m4-native may not be installed.
However Pulseaudio explicitly checks for m4 in the meson.build, so add
it to DEPENDS.
(From OE-Core rev: ddf846635783923d43520c9dd6f63ca59ed6e3b8)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Resurrect sato-icon-theme and move to a version with scalable icons support
to replace adwaita-icon-theme which no longer supports the icons we need
for the sato desktop.
(From OE-Core rev: 6b515037ab710adf7b2c14ae1bb488375655f311)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
CVE-2020-23903.patch
removed since it's included in 1.2.1
License-Update:
Add "Organisation (CSIRO)" to Copyright 2005-2008
Changelog:
===========
Check for _WIN32 instead of WIN32 in preprocessor checks
wav_io: check for EOF when seeking in wav (fixes hang discovered by fuzzing, see #9)
CI: add gitlab CI integration
fixed-point: make left shift macros use unsigned to avoid undefined behaviour
math_approx: use unsigned int for LCG pseudorandom generator (avoids integer overflow)
oss-fuzz: add integration and fuzzing target
speexenc: guard against invalid channel numbers (see #13)
speexdec: make left shift macros use unsigned to avoid undefined behaviour
autotools: do not use deprecated macros
(From OE-Core rev: 4a0bd109d59bd51c98ce31c9a9e7904a88e01215)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
0001-sbc_primitives-Fix-build-on-non-x86.patch
revmoed since it's included in 2.0
(From OE-Core rev: 3151d39eed451a313963adc1c0c49b88acf3b790)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
