An integer overflow vulnerability in FreeImageIO.cpp::_MemoryReadProc in FreeImage 3.18.0 allows attackers to obtain sensitive information, cause a denial-of-service attacks and/or run arbitrary code.
An integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive information, cause a denial of service and/or run arbitrary code.
Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.
Buffer Overflow vulnerability in function LoadPixelDataRLE8 in PluginBMP.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.
Buffer Overflow vulnerability in function C_IStream::read in PluginEXR.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.
When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp file, but a memcpy occurs in which the destination address and the size of the copied data are not considered, resulting in a heap overflow.
When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due to improper processing of the file, eventually causing stack exhaustion. An attacker can achieve a remote denial of service attack by sending a specially constructed file.
In FreeImage 3.18.0, an out-of-bounds access occurs because of mishandling of the OpenJPEG j2k_read_ppm_v3 function in j2k.c. The value of l_N_ppm comes from the file read in, and the code does not consider that l_N_ppm may be greater than the size of p_header_data.
An integer overflow in the psdParser::ReadImageData function of FreeImage v3.18.0 and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted PSD file.
An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to cause a denial of service.
Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.
An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_dir in FreeImage 3.18.0 allows attackers to obtain information and cause a denial of service.
all: drop support for FreeBSD 13, mips and risc64sf
Reviewed by: many (*)
Differential Revision: https://reviews.freebsd.org/D55624
Differential Revision: https://reviews.freebsd.org/D55642 (merged in from bofh)
many (*)
acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga
jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka
nobutaka pkubaj se tagattie thj
Anton Saietskii
GenericRikka
Gert Doering
Jan Bramkamp
Oleh Hushchenkov
Oleksandr Kryvulia
Ralf van der Enden
Yamagi
desktop kde python tcltk office
graphics/freeimage: fix build with clang 16
Since clang 16 (and gcc 11) the default C++ standard is now gnu++17.
Because graphics/freeimage's Makefile does not explicitly set its C++
standard, this leads to several errors:
In file included from Source/FreeImage/PluginEXR.cpp:33:
In file included from Source/FreeImage/../OpenEXR/IlmImf/ImfOutputFile.h:46:
In file included from Source/OpenEXR/IlmImf/ImfHeader.h:51:
Source/OpenEXR/Imath/ImathVec.h:228:34: error: ISO C++17 does not allow dynamic exception specifications [-Wdynamic-exception-spec]
const Vec2 & normalizeExc () throw (IEX_NAMESPACE::MathExc);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Source/OpenEXR/Imath/ImathVec.h:228:34: note: use 'noexcept(false)' instead
const Vec2 & normalizeExc () throw (IEX_NAMESPACE::MathExc);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
noexcept(false)
Source/OpenEXR/Imath/ImathVec.h:232:37: error: ISO C++17 does not allow dynamic exception specifications [-Wdynamic-exception-spec]
Vec2<T> normalizedExc () const throw (IEX_NAMESPACE::MathExc);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Source/OpenEXR/Imath/ImathVec.h:232:37: note: use 'noexcept(false)' instead
Vec2<T> normalizedExc () const throw (IEX_NAMESPACE::MathExc);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
noexcept(false)
Because these constructs are no longer available in C++17, add
USE_CXXSTD=gnu++14 to compile for C++14 with GNU extensions instead.
PR: 271493
Approved by: portmgr (build fix blanket)
MFH: 2023Q2
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
graphics/freeimage: fix build on powerpc64 with CPUTYPE=power7 or higher and on powerpc64le
The bundled png is set up for VSX autodetection, but no actual VSX-related code is included.
graphics/freeimage: Amend patch introduced in r479150
While there is an additional check on 'handle' in psdParser::Save()
later it should be done earlier as intended and not just commented
out because of Clang/libc++ regressions.
Bump PORTREVISION for ports depending on the canonical version of GCC in the ports tree (via Mk/bsd.default-versions.mk and lang/gcc) which has now moved from GCC 6 to GCC 7 by default.
This includes ports
- featuring USE_GCC=yes or USE_GCC=any,
- featuring USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and those
- with USES=compiler specifying one of openmp, nestedfct, c11, c++0x,
c++11-lib, c++11-lang, c++14-lang, c++17-lang, or gcc-c++11-lib.
PR: 222542
graphics/freeimage: unbreak on armv7
/usr/bin/ld: ./Source/FreeImage/BitmapAccess.o(.text+0x2d0): unresolvable R_ARM_MOVW_ABS_NC relocation against symbol `_ZSt7nothrow'
/usr/bin/ld: final link failed: Nonrepresentable section on output
cc: error: linker command failed with exit code 1 (use -v to see invocation)
graphics/freeimage: unbreak build with Clang 6 (C++14 by default)
Source/LibRawLite/./internal/dcraw_common.cpp:3786:19: error: constant expression evaluates to 128 which cannot be narrowed to type 'signed char' [-Wc++11-narrowing]
-1,-2,-1,+0,0,0x80, -1,-2,+0,-1,0,0x01, -1,-2,+1,-1,0,0x01,
^~~~
Source/LibRawLite/./internal/dcraw_common.cpp:3786:19: note: insert an explicit cast to silence this issue
-1,-2,-1,+0,0,0x80, -1,-2,+0,-1,0,0x01, -1,-2,+1,-1,0,0x01,
^~~~
static_cast<signed char>( )
Source/LibRawLite/./internal/dcraw_common.cpp:3787:39: error: constant expression evaluates to 136 which cannot be narrowed to type 'signed char' [-Wc++11-narrowing]
-1,-2,+1,+0,1,0x01, -1,-1,-1,+1,0,0x88, -1,-1,+1,-2,0,0x40,
^~~~
Source/LibRawLite/./internal/dcraw_common.cpp:3787:39: note: insert an explicit cast to silence this issue
-1,-2,+1,+0,1,0x01, -1,-1,-1,+1,0,0x88, -1,-1,+1,-2,0,0x40,
^~~~
static_cast<signed char>( )
Source/LibRawLite/./internal/dcraw_common.cpp:3794:19: error: constant expression evaluates to 128 which cannot be narrowed to type 'signed char' [-Wc++11-narrowing]
+0,-2,+0,+0,1,0x80, +0,-1,+0,+1,1,0x88, +0,-1,+1,-2,0,0x40,
^~~~
Source/LibRawLite/./internal/dcraw_common.cpp:3794:19: note: insert an explicit cast to silence this issue
+0,-2,+0,+0,1,0x80, +0,-1,+0,+1,1,0x88, +0,-1,+1,-2,0,0x40,
^~~~
static_cast<signed char>( )
Source/LibRawLite/./internal/dcraw_common.cpp:3794:39: error: constant expression evaluates to 136 which cannot be narrowed to type 'signed char' [-Wc++11-narrowing]
+0,-2,+0,+0,1,0x80, +0,-1,+0,+1,1,0x88, +0,-1,+1,-2,0,0x40,
^~~~
Source/LibRawLite/./internal/dcraw_common.cpp:3794:39: note: insert an explicit cast to silence this issue
+0,-2,+0,+0,1,0x80, +0,-1,+0,+1,1,0x88, +0,-1,+1,-2,0,0x40,
^~~~
static_cast<signed char>( )
Source/LibRawLite/./internal/dcraw_common.cpp:3800:59: error: constant expression evaluates to 128 which cannot be narrowed to type 'signed char' [-Wc++11-narrowing]
+0,+1,+2,+1,0,0x20, +0,+1,+2,+2,0,0x10, +1,-2,+1,+0,0,0x80,
^~~~
Source/LibRawLite/./internal/dcraw_common.cpp:3800:59: note: insert an explicit cast to silence this issue
+0,+1,+2,+1,0,0x20, +0,+1,+2,+2,0,0x10, +1,-2,+1,+0,0,0x80,
^~~~
static_cast<signed char>( )
Source/LibRawLite/./internal/dcraw_common.cpp:3801:19: error: constant expression evaluates to 136 which cannot be narrowed to type 'signed char' [-Wc++11-narrowing]
+1,-1,+1,+1,0,0x88, +1,+0,+1,+2,0,0x08, +1,+0,+2,-1,0,0x40,
^~~~
Source/LibRawLite/./internal/dcraw_common.cpp:3801:19: note: insert an explicit cast to silence this issue
+1,-1,+1,+1,0,0x88, +1,+0,+1,+2,0,0x08, +1,+0,+2,-1,0,0x40,
^~~~
static_cast<signed char>( )
Source/LibRawLite/./internal/dcraw_common.cpp:7384:23: error: constant expression evaluates to 65535 which cannot be narrowed to type 'short' [-Wc++11-narrowing]
{ "Red One", 704, 0xffff, /* DJC */
^~~~~~
Source/LibRawLite/./internal/dcraw_common.cpp:7384:23: note: insert an explicit cast to silence this issue
{ "Red One", 704, 0xffff, /* DJC */
^~~~~~
static_cast<short>( )
Source/LibRawLite/./internal/dcraw_common.cpp:7943:30: warning: use of logical '&&' with constant operand [-Wconstant-logical-operand]
is_raw += (i = get4()) && 1;
^ ~
Source/LibRawLite/./internal/dcraw_common.cpp:7943:30: note: use '&' for a bitwise operation
is_raw += (i = get4()) && 1;
^~
&
Source/LibRawLite/./internal/dcraw_common.cpp:7943:30: note: remove constant to silence this warning
is_raw += (i = get4()) && 1;
~^~~~
Source/LibRawLite/./internal/dcraw_common.cpp:9239:30: error: invalid suffix on literal; C++11 requires a space between literal and identifier [-Wreserved-user-defined-literal]
strcpy (th->soft, "dcraw v"DCRAW_VERSION);
^
Reported by: antoine (via bug 224669)
Obtained from: upstream (LibRaw 0.17.0)
Bump PORTREVISION for ports depending on the canonical version of GCC (via Mk/bsd.default-versions.mk and lang/gcc) which has moved from GCC 5.4 to GCC 6.4 under most circumstances.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c++11-lib, c++11-lang,
c++14-lang, c++0x, c11, or gcc-c++11-lib.
PR: 219275
Bump PORTREVISIONs for ports depending on the canonical version of GCC and lang/gcc which have moved from GCC 4.9.4 to GCC 5.4 (at least under some circumstances such as versions of FreeBSD or platforms).
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using using Mk/bsd.octave.mk which in turn has USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c++11-lib, c++14-lang,
c++11-lang, c++0x, c11, or gcc-c++11-lib.
PR: 216707
Unbreak the build on PowerPC by using modern compiler (GCC). The problem was the same as fixed recently in r401989 since FreeImage bundles its own copy of OpenEXR.
Adds -fPIC to CFLAGS_aarch64 to a number of ports that already have it in the amd64 CFLAGS and are failing to build.
Approved by: bapt
Differential Revision: https://reviews.freebsd.org/D3321
- Update to version 3.16.0 - Make use of CFLAGS_amd64 and thus simplify the Makefile - Do not hardcode ${GMAKE}, correctly call it via ${MAKE_CMD} - Sort USES values, sanitize port-build/install commands
Approved by: gahr (maintainer)
Update to release 3.15.1 which is a maintenance release that brings several fixes for TIFF, JPEG, BMP, PCX, and CUT plugins. The most significant fixes concern the security against malicious images, so that an update is highly recommended.
Approved by: maintainer
Feature safe: yes
- Update to 3.15.0 Release 3.15.0 mainly add support for thumbnail loading / saving, as well as better support for JPEG, Exif, TIFF, TARGA, ICO, PSD, BMP formats. The library has been updated with the new libjpeg (8c), libtiff (3.9.4), libpng (1.4.5), OpenJPEG (1.4.0) and libraw (0.13-Beta3) libraries.
PR: 156303
Submitted by: Pedro Giffuni <giffunip@tutopia.com>