openembedded-core.git/meta/recipes-extended/ghostscript, branch pyro

ghostscript : CVE-2016-10219, CVE-2016-10220, CVE-2017-5951

2017-04-28T10:26:07+00:00

The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript
9.20 allows remote attackers to cause a denial of service (divide-by-zero
error and application crash) via a crafted file.

The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc.
Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL
pointer dereference and application crash) via a crafted file that is
mishandled in the PDF Transparency module.

The mem_get_bits_rectangle function in base/gdevmem.c in Artifex Software, Inc.
Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL
pointer dereference and application crash) via a crafted file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10219
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10220
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5951

Upstream patches:
http://git.ghostscript.com/?p=ghostpdl.git;h=4bef1a1d32e29b68855616020dbff574b9cda08f
http://git.ghostscript.com/?p=ghostpdl.git;h=daf85701dab05f17e924a48a81edc9195b4a04e8
http://git.ghostscript.com/?p=ghostpdl.git;h=bfa6b2ecbe48edc69a7d9d22a12419aed25960b8

Signed-off-by: Catalin Enache 
Signed-off-by: Ross Burton

ghostscript: CVE-2017-7207

2017-04-08T21:48:04+00:00

The mem_get_bits_rectangle function in Artifex Software, Inc.
Ghostscript 9.20 allows remote attackers to cause a denial
of service (NULL pointer dereference) via a crafted PostScript
document.

Reference:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7207

Upstream patch:
http://git.ghostscript.com/?p=ghostpdl.git;h=309eca4e0a31ea70dcc844812691439312dad091

Signed-off-by: Catalin Enache 
Signed-off-by: Richard Purdie

ghostscript: fix upstream version check

2016-12-17T09:56:43+00:00

(From OE-Core rev: 10001924baf112a4556c5e85c16c482cbf435950)

Signed-off-by: Alexander Kanavin 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie

ghostscript 9.19 -> 9.20

2016-12-17T09:56:42+00:00

1)Upgrade ghostscript from 9.19 to 9.20.
2)Modify ghostscript-9.15-parallel-make.patch, since the data has been changed.

(From OE-Core rev: 4f3483c3a0ba22f46d768d78d6f56880e8ac5608)

Signed-off-by: Huang Qiyu 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie

ghostscript: Use MIPS MACHINE_OVERRIDES for objarch.h

2016-11-30T15:47:13+00:00

MIPS MACHINE_OVERRIDES can be used to provide the same objarch.h
files for MIPS pre-R2 and R6 ISA versions.

Use them to reduce duplication in supporting MIPS R6 ISA

Signed-off-by: Zubair Lutfullah Kakakhel 
Signed-off-by: Ross Burton

ghostscript: Reduce duplication in MIPS variants.

2016-11-15T15:11:56+00:00

Reduce duplication in MIPS variants now that the MACHINEOVERRIDES
variable is defined

Signed-off-by: Zubair Lutfullah Kakakhel 
Signed-off-by: Ross Burton

ghostscript: upgrade to 9.19

2016-06-14T11:56:33+00:00

- Ghostscript and GhostPDL releases from version 9.19 have been moved to GitHub
  hosting, tweak download site

- Drop 0001-Bug-696497-Fix-support-for-building-with-no-jbig2-de.patch, and
  0002-Bug-696497-part-2-fix-support-for-building-with-a-JP.patch, ghostscript
  9.19 has fixed them.

- Fix QA Warning unrecognised options: --enable-little-endian. It use AC_C_BIGENDIAN
  to detect big/little endian.
  http://www.delorie.com/gnu/docs/autoconf/autoconf_64.html

Signed-off-by: Hongxu Jia 
Signed-off-by: Richard Purdie

ghostcript: Set UPSTREAM_CHECK_URI variable

2016-05-30T08:30:29+00:00

Set UPSTREAM_CHECK_URI (a github location), so package checking system gets the
latest version of the package.

Signed-off-by: Leonardo Sandoval 
Signed-off-by: Ross Burton

ghostscript: Update URL_SRI considered as 'old release'

2016-05-22T15:09:21+00:00

The Ghostcript project started to place their tarballs in two places
starting at 9.19 as explained in [1]. 9.18 version is considered old,
so including the 'old-gs-releases' in the URL.

[1] http://downloads.ghostscript.com/public/

[YOCTO #9573]

Signed-off-by: Leonardo Sandoval 
Signed-off-by: Ross Burton

ghostscript: 9.16 -> 9.18

2016-03-09T16:54:37+00:00

- Backport patches to fix build failure caused by
  '--without-jbig2dec' and '--without-jbig2dec'.
  ...
  |make[1]: *** No rule to make target `obj/sjbig2_.dev',
  needed by `obj/sjbig2.dev'.  Stop.
  ...
  http://bugs.ghostscript.com/show_bug.cgi?id=696497

- Previously, it did not build the whole local libpng
  source in ghostscript, only picked up specific files
  and compile them. But on ghostscript 9.18, when the
  arm's FPU has been set to NEON (-mfpu=neon * with GCC),
  the selected file "libpng/pngrutil.c" needs to link
  'png_init_filter_functions_neon' which should be
  compiled by a non-selected file "libpng/arm/arm_init.c".
  ...
  |./obj/pngrutil.o: In function `png_init_filter_functions':
  |armv7a-neon-poky-linux-gnueabi/ghostscript/9.18-r0/build/../
  ghostscript-9.18/libpng/pngrutil.c:3921: undefined reference to
  `png_init_filter_functions_neon'
  ...
  So do not compile local libpng source in ghostscript,
  use shared libpng to instead.

Signed-off-by: Hongxu Jia 
Signed-off-by: Khem Raj 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie