summaryrefslogtreecommitdiffstats
path: root/meta/recipes-graphics
Commit message (Collapse)AuthorAgeFilesLines
...
* xserver-xorg: Fix for CVE-2023-5367 and CVE-2023-5380Vijay Anusuri2023-11-143-0/+188
| | | | | | | | | | | | Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/541ab2ecd41d4d8689e71855d93e492bc554719a & https://gitlab.freedesktop.org/xorg/xserver/-/commit/564ccf2ce9616620456102727acb8b0256b7bbd7] (From OE-Core rev: afc30fc07d806c3f0d2192454344995f19e68575) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libx11: Security Fix for CVE-2023-43785, CVE-2023-43786 and CVE-2023-43787Siddharth Doshi2023-10-256-0/+267
| | | | | | | | | | | | CVE's Fixed: CVE-2023-43785: libX11: out-of-bounds memory access in _XkbReadKeySyms() CVE-2023-43786: libX11: stack exhaustion from infinite recursion in PutSubImage() CVE-2023-43787: libX11: integer overflow in XCreateImage() leading to a heap overflow (From OE-Core rev: 8175d023c203d524d011d8947f90fbd02786c6db) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxpm: upgrade to 3.5.17Siddharth Doshi2023-10-211-1/+1
| | | | | | | | | | | | | This release fixes the following CVEs: - CVE-2023-43788 - CVE-2023-43789 (From OE-Core rev: 1475a47239d77a368bcec69f12e5a63f8bebe14f) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: ignore CVE-2022-3553 as it is XQuartz-specificRoss Burton2023-09-301-0/+2
| | | | | | | | | | | (cherry-pick from commit 769576f36aac9652525beec5c7e8a4d26632b844 ) (From OE-Core rev: 96d36b97d9c6d1f5e79b1bea79f182561423fecb) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pixman: Remove duplication of license MITPoonam Jadhav2023-08-261-1/+1
| | | | | | | | | Remove duplication of license MIT from pixman bbfile. (From OE-Core rev: 76f928359f76d449de0d884c591a5d9fdba9d19c) Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libjpeg-turbo: patch CVE-2023-2804Peter Marko2023-08-023-0/+180
| | | | | | | | | | | | | | Relevant links: * linked fronm NVD: * https://github.com/libjpeg-turbo/libjpeg-turbo/issues/668#issuecomment-1492586118 * follow-up analysis: * https://github.com/libjpeg-turbo/libjpeg-turbo/issues/668#issuecomment-1496473989 * picked commits fix all issues mentioned in this analysis (From OE-Core rev: ca8ede6d29c04159e85c2bdd2b635c58ec6a1484) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libx11: Fix CVE-2023-3138 for kirkstone branchPoonam Jadhav2023-07-212-0/+112
| | | | | | | | | | | Add patch to fix CVE-2023-3138 for kirkstone branch Link: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/304a654a0d57bf0f00d8998185f0360332cfa36c.patch (From OE-Core rev: 5491531d4681d3df5a34ebc180e29a8bf4e09e67) Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xdpyinfo: upgrade 1.3.3 -> 1.3.4Wang Mingyu2023-07-011-1/+1
| | | | | | | | | | | | | | | | Changelog: ========= configure: Make xf86misc support disabled by default Variable scope reduction Remove unnecessary downcast of double to float Call memset() instead of hand-coding our own equivalent (From OE-Core rev: 74fef3bca108017f8a1ce0e451b4b2172ae28fcf) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit d87785189336a69ae998f75394ceaebf63decb16) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxpm: upgrade 3.5.15 -> 3.5.16Wang Mingyu2023-07-011-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Changelog: =========== test: skip compressed file tests when --disable-open-zfile is used itlab CI: build with each of --enable-open-zfile & --disable-open-zfile configure: correct error message to suggest --disable-open-zfile Fix a memleak in ParsePixels error code path Fix CVE-2022-44617: Runaway loop with width of 0 and enormous height open-zfile: Make compress & uncompress commands optional Require LT_INIT from libtool 2 instead of deprecated AC_PROG_LIBTOOL test: Use PACKAGE_BUGREPORT instead of hard-coded URL's test: Add simple test cases for functions in src/rgb.c xpmReadRgbNames: constify filename argument XpmCreateDataFromXpmImage: Fix misleading indentation parse.c: Wrap FREE_CIDX definition in do { ... } while(0) parse.c: remove unused function xstrlcpy() (From OE-Core rev: 22d9e097538f84a12dd262c1ae936fb8107c2768) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 4d9f0958eecdf683434d77a4f65611803cffd247) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* kmscube: Correct DEPENDS to avoid overwriteRanjitsinh Rathod2023-06-231-2/+1
| | | | | | | | | | | | | | | As part of the below commit, DEPENDS gets overwrite which is wrong Link: https://git.yoctoproject.org/poky/commit/?id=bd947d3343dcd96e79fc8157f32a2a087cd710a7 So correct the DEPENDS varibales (From OE-Core rev: 5dec509c33ce3d01fa1cd44408f0ef198dc4f6c0) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 63f338255000874c62bf01ccc11f2c100014c3d9) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* piglit: Add missing glslang dependenciesTom Hochstein2023-05-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | The vulkan configuration requires glslangValidator for build and runtime. Fixes configure error: ``` | CMake Error at CMakeLists.txt:191 (message): | glslangValidator required by vulkan tests not found ``` Fixes runtime error: ``` name: vulkan@shaders@fs-large-local-array result: fail returncode: 1 out: err: glslangValidator: No such file or directory glslangValidator failed ``` (From OE-Core rev: 5e26ead1ca016d1691dccba1b58060ac853bf0d2) Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* piglit: Fix build time dependencyZoltan Boszormenyi2023-05-301-1/+1
| | | | | | | | | | Replace explicit opencl-icd-loader with virtual/opencl-icd. (From OE-Core rev: fadadd3cf258b6d403fdcf537ff4b97aaabb5a40) Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* piglit: Add PACKAGECONFIG for glx and openclTom Hochstein2023-05-304-4/+39
| | | | | | | | | | | | | - Allow GLX tests to be disabled for systems that don't support it. - Allow OpenCL tests to be enabled. (From OE-Core rev: b0f54a3db7877a95a163bd480b93cfe6f0b97dcd) Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* weston: add xwayland to DEPENDS for PACKAGECONFIG xwaylandMing Liu2023-05-301-1/+1
| | | | | | | | | | | | | Otherwise xwayland.pc would not be present in sysroot, this leads to some xwayland configs missing like have_listenfd, have_glamor. (From OE-Core rev: 4e42196754b19926b2219c6ffda47bd389e9d9fb) Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7f1932cb5a408320a5b542e20ba2807718349e8f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* waffle: upgrade 1.7.0 -> 1.7.2Upgrade Helper2023-05-303-27/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Waffle bugfix release 1.7.1 is now available. What is new in this release: - cmake: pass deps' cflags to the build - gbm: fix crash when platform lacks modifier support - gitlab-ci: stabilise CI runs under X - gitlab-ci: add more warnings, make all warnings fatal - gitlab-ci: update to bullseye - meson: add override_* support, when using waffle as submodule - meson: skip installing bash completion when custom prefix is used - meson: silence deprecation warnings - meson: generate cmake files only on Windows - meson: find wayland.xml from wayland-scanner.pc - misc: zsh completion - misc: fix dozens of compiler warnings - misc: update website references - wayland: fix build against wayland 1.20 The Waffle bugfix release 1.7.2 is now available. What is new in this release: - all: use format(gnu_printf), enable in mingw - meson: don't run TLS checks on mingw - wgl: remove unused dummy wgl_error.[ch] Upstream now only generates CMake files on Windows, so remove all references to CMake. A zsh completion is now installed, remove this for now as we don't really use zsh. (From OE-Core rev: 6b1d94fe5d8728e3eb152426cde08634d248e1f7) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 94cf6ef11bba381ab6f65b03ed1ed14022438151) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit e4ebfb5c7892488fc834d9837e9a5a4c28eb676f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: upgrade 21.1.7 -> 21.1.8Wang Mingyu2023-05-121-1/+1
| | | | | | | | | | | | | | | | | | | | | This release contains the fix for CVE-2023-1393 in today's security advisory: https://lists.x.org/archives/xorg-announce/2023-March/003374.html Benno Schulenberg (1): xkbUtils: use existing symbol names instead of deleted deprecated ones Olivier Fourdan (2): composite: Fix use-after-free of the COW xserver 21.1.8 git tag: xorg-server-21.1.8 (From OE-Core rev: 732b51f073105d4c6a0e2e06c559bffcac093fbf) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7b08dff8f46bcaa05f7fbffbe27d524579af4faf) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "xserver-xorg: backport fix for CVE-2023-1393"Steve Sakoman2023-05-122-48/+1
| | | | | | | | | | This reverts commit dc2c777cab0230fc54e078d20d872aaa9287a8b9. Fixed in subsequent version bump (From OE-Core rev: 151149b590a9051a6de58115a6796ccf17894498) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* freetype: fix CVE-2023-2004 integer overflowin in tt_hvadvance_adjust() in ↵Vivek Kumbhar2023-05-102-0/+42
| | | | | | | | | | | src/truetype/ttgxvar.c Fix An integer overflow vulnerability was discovered in Freetype in tt_hvadvance_adjust() function in src/truetype/ttgxvar.c (From OE-Core rev: 6a07e1524746bd3cfa5aec090a882f4a7f954dad) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxpm: upgrade 3.5.13 -> 3.5.15Yogita Urade2023-05-031-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Upgrade libxpm 3.5.13 to 3.5.15 License-update: additional copyright holders f0857c0 man pages: Correct Copyright/License notices The above commit is introduced while upgrading the libxpm 3.5.15. which is mentioned in below changelog. Due to this commit LIC_FILES_CHKSUM is changed. Disable reading compressed files as that requires compress/uncompress executables. Following the approach in oe-core/master: 7de4084634 libxpm: upgrade 3.5.14 -> 3.5.15 Changelog: ------------- ------------- ddd8339 libXpm 3.5.15 8178eb0 Use gzip -d instead of gunzip c5ab17b Prevent a double free in the error code path 515294b Fix CVE-2022-4883: compression commands depend on $PATH f80fa6a Fix CVE-2022-44617: Runaway loop with width of 0 and enormous height f7fbbb9 test: add test cases for CVE-2022-44617 (zero-width w/enormous height) a3a7c6d Fix CVE-2022-46285: Infinite loop on unclosed comments f7a167a test: add test case for CVE-2022-46285 (unclosed comments) 0ff2c6a cxpm: getc/ungetc wrappers should not adjust position when c == EOF 501494c test: Add unit tests using glib framework 4841039 configure: add --disable-open-zfile instead of requiring -DNO_ZPIPE aef0c8d man pages: Apply standard man page style/formatting 5d55a0b man pages: Replace "See Also" entries with more useful ones 392cb8f man pages: Fix typos and other minor editing 08bc174 libXpm 3.5.14 f0857c0 man pages: Correct Copyright/License notices deb81a9 man pages: Fix typos 2d5fa4c man pages: Add missing word 'function' where needed 2b7357e man pages: Make function synopses more consistent with other pages fb8590c man pages: Fix shadow man pages bfaebfd man pages: Make file names consistent with their displayed names 7a138a5 gitlab CI: add a basic build test 3433f43 man: strip trailing whitespace 9612454 Fix spelling/wording issues fa16fbd Build xz tarballs instead of bzip2 83e5427 update man pages e48e649 add man pages based on doc/xpm.PS (From OE-Core rev: a549319e5fdae685f93122627226f9b102307bc3) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xorg-lib-common: Add variable to set tarball typeYogita Urade2023-05-031-1/+2
| | | | | | | | | | | | | | | | | | Upstream has switched some new releases from bz2 to xz compression. Add an XORG_EXT variable so recipes can set the file name extension needed for the compression type. Following the approach in oe-core/master: 6a8068e036b4b2a40b38896275b936916b4db76e xorg-lib-common: Add variable to set tarball type use a variable for the tarball suffix/compression format. (From OE-Core rev: 56ea2b625f81e397e911b3610130d3e838d10938) Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: backport fix for CVE-2023-1393Ross Burton2023-05-032-1/+48
| | | | | | | | | (From OE-Core rev: dc2c777cab0230fc54e078d20d872aaa9287a8b9) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7828f7026b4cd3ae97ebe5d849c09fabbc17272d) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* harfbuzz: Security fix for CVE-2023-25193Siddharth Doshi2023-03-203-1/+323
| | | | | | | | | Upstream-Status: Backport from [https://github.com/harfbuzz/harfbuzz/commit/8708b9e081192786c027bb7f5f23d76dbe5c19e8] (From OE-Core rev: 58e212a6109a639ca0675e73967da74d6c4c5aa3) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xwayland: upgrade 22.1.7 -> 22.1.8Wang Mingyu2023-03-091-1/+1
| | | | | | | | | | | | | | | xwayland 22.1.8 - Security fix for CVE-2023-0494 (From OE-Core rev: c4f35a99a0f840ccd50fd3514a63ea5bb90784a8) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e0ca374267cce807d12d706564989900fe61bd97) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 964ca02debe1e85cb91789dee1d08344f4fcf33a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libjpeg-turbo: upgrade 2.1.5 -> 2.1.5.1Wang Mingyu2023-03-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== 1. The SIMD dispatchers in libjpeg-turbo 2.1.4 and prior stored the list of supported SIMD instruction sets in a global variable, which caused an innocuous race condition whereby the variable could have been initialized multiple times if 'jpeg_start_*compress()' was called simultaneously in multiple threads. libjpeg-turbo 2.1.5 included an undocumented attempt to fix this race condition by making the SIMD support variable thread-local. However, that caused another issue whereby, if 'jpeg_start_*compress()' was called in one thread and 'jpeg_read_*()' or 'jpeg_write_*()' was called in a second thread, the SIMD support variable was never initialized in the second thread. On x86 systems, this led the second thread to incorrectly assume that AVX2 instructions were always available, and when it attempted to use those instructions on older x86 CPUs that do not support them, an illegal instruction error occurred. The SIMD dispatchers now ensure that the SIMD support variable is initialized before dispatching based on its value. (From OE-Core rev: 195aae4fcb14c818629b04fc371910125a4b3277) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 009a1b0390d791d614b8d4a1407e7479c261f60d) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit d57de2a7169de369105ed9bce19a43dad68f350a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xserver-xorg: 21.1.6 -> 21.1.7Kai Kang2023-03-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | According to the ANNOUNCE of xorg-server 21.1.7[1]: This release contains the fix for CVE-2023-0494 in today's security advisory: https://lists.x.org/archives/xorg-announce/2023-February/003320.html It also fixes a second possible OOB access during EnqueueEvent and a crasher caused by ResourceClientBits not correctly honouring the MaxClients value in the configuration file. Finally, a bunch of Xquartz updates including the ability to correctly detect ssh-tunneled clients as remote. [1]: https://lists.x.org/archives/xorg-announce/2023-February/003321.html (From OE-Core rev: b69011d194a39ea7812fdd8fc59ba12b6e0416a9) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 60737bee6466e206d8f3c751910dfce00b60d703) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsdl2: fix CVE-2022-4743Changqing Li2023-03-092-0/+41
| | | | | | | | (From OE-Core rev: 41e13e88dd1f9d251d1e86ee1de543165789a579) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libjpeg-turbo: upgrade 2.1.4 -> 2.1.5Alexander Kanavin2023-02-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Significant changes relative to 2.1.4 Fixed issues in the build system whereby, when using the Ninja Multi-Config CMake generator, a static build of libjpeg-turbo (a build in which ENABLE_SHARED is 0) could not be installed, a Windows installer could not be built, and the Java regression tests failed. Fixed a regression introduced by 2.0 beta1[15] that caused a buffer overrun in the progressive Huffman encoder when attempting to transform a specially-crafted malformed 12-bit-per-component JPEG image into a progressive 12-bit-per-component JPEG image using a 12-bit-per-component build of libjpeg-turbo (-DWITH_12BIT=1.) Given that the buffer overrun was fully contained within the progressive Huffman encoder structure and did not cause a segfault or other user-visible errant behavior, given that the lossless transformer (unlike the decompressor) is not generally exposed to arbitrary data exploits, and given that 12-bit-per-component builds of libjpeg-turbo are uncommon, this issue did not likely pose a security risk. Fixed an issue whereby, when using a 12-bit-per-component build of libjpeg-turbo (-DWITH_12BIT=1), passing samples with values greater than 4095 or less than 0 to jpeg_write_scanlines() caused a buffer overrun or underrun in the RGB-to-YCbCr color converter. Fixed a floating point exception that occurred when attempting to use the jpegtran -drop and -trim options to losslessly transform a specially-crafted malformed JPEG image. Fixed an issue in tjBufSizeYUV2() whereby it returned a bogus result, rather than throwing an error, if the align parameter was not a power of 2. Fixed a similar issue in tjCompressFromYUV() whereby it generated a corrupt JPEG image in certain cases, rather than throwing an error, if the align parameter was not a power of 2. Fixed an issue whereby tjDecompressToYUV2(), which is a wrapper for tjDecompressToYUVPlanes(), used the desired YUV image dimensions rather than the actual scaled image dimensions when computing the plane pointers and strides to pass to tjDecompressToYUVPlanes(). This caused a buffer overrun and subsequent segfault if the desired image dimensions exceeded the scaled image dimensions. Fixed an issue whereby, when decompressing a 12-bit-per-component JPEG image (-DWITH_12BIT=1) using an alpha-enabled output color space such as JCS_EXT_RGBA, the alpha channel was set to 255 rather than 4095. Fixed an issue whereby the Java version of TJBench did not accept a range of quality values. Fixed an issue whereby, when -progressive was passed to TJBench, the JPEG input image was not transformed into a progressive JPEG image prior to decompression. (From OE-Core rev: 1ca7a15d7dece08e18cdb41f897ec37d1349ab70) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f779689c2c766b609be31222d71110c1a15145a8) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit a5d15ae9f4671790d3c5fb3606ec0861c17ed6dd) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glslang: branch rename master -> mainMingli Yu2023-02-151-1/+1
| | | | | | | | | | | | Branch name is changed from master to main. (From OE-Core rev: 04b7643cda2c6d82b017767a537e53ce69a7703a) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 65ee4c1067ee5d73c198eed8ed2f1c9a60d5df96) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vulkan-samples: branch rename master -> mainAlexander Kanavin2023-02-151-1/+1
| | | | | | | | | | (From OE-Core rev: 986af8c9ae9d2cab0bc0376757f40b096448ae2a) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 74bf535ca5cbcfb38c18775ece863d53dd216008) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* spirv-headers: set correct branch nameRoss Burton2023-02-041-1/+1
| | | | | | | | | | | | | | | | As of last week, the SPIRV repositories have renamed their master branches to main: https://github.com/KhronosGroup/SPIRV-Headers/issues/313 (From OE-Core rev: e7d0e6941c7e94f37eb43a3b5dae550513394cc0) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2957da09f13607ac00ddd4a87ec9ad0014326507) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* harfbuzz: remove bindir only if it existsPetr Kubizňák2023-01-261-3/+3
| | | | | | | | | | | | | | In some scenarios (e.g. when "glib" removed from PACKAGECONFIG), "${D}${bindir}" might not exist which caused `rmdir` to fail. (From OE-Core rev: b342790a37c891cf83f24d4f96060e2d0bd79c07) Signed-off-by: Petr Kubizňák <kubiznak@2n.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 21261072cbe0056e85550a0710de142fab8943e4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xserver-xorg: upgrade 21.1.4 -> 21.1.6Alexander Kanavin2023-01-263-104/+1
| | | | | | | | | | | (From OE-Core rev: 9a0efa7ecc55b3f81be20ddc34c14c81ebea7634) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 009e8d6a292690a0c355d12be2368a9677c701f5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xwayland: upgrade 22.1.5 -> 22.1.7Alexander Kanavin2023-01-261-1/+1
| | | | | | | | | | | (From OE-Core rev: 32bdbd7ec920ccc8bcc1a21d57fcd4af40b81fe5) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c37ec8b2d91605d6eb5228f0a447fb83f111edc3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cairo: fix CVE patches assigned wrong CVE numberQuentin Schulz2023-01-262-46/+46
| | | | | | | | | | | | | | | | | | | CVE-2019-6461 and CVE-2019-6462 are fixed, but the reporting is incorrect as the patch for CVE-2019-6461 is actually for CVE-2019-6462 and vice-versa. This swaps both files and edit the CVE field to report the correct identifier. Cc: Quentin Schulz <foss+yocto@0leil.net> (From OE-Core rev: 960f9a9243282da838da655d03bb34261e300498) Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f12c2a5ac94cb29f473f3c7e335463c7fb6d8a6e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* freetype:update mirror site.KARN JYE LAU2023-01-261-1/+1
| | | | | | | | | | | update SAVANNAH_NONGNU_MIRROR to SAVANNAH_GNU_MIRROR to resolve package fetching issues. (From OE-Core rev: 8f1de2127bd8f3f2a182a8532102ec0d3d44be70) Signed-off-by: KARN JYE LAU <karn.jye.lau@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libepoxy: remove upstreamed patchRoss Burton2023-01-062-30/+1
| | | | | | | | | | | | This patch was upstreamed in 6b09a8bc, 1.5.5 onwards. (From OE-Core rev: 50c27f5f98c6f1afca4893594c2c4950cf1b7b10) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 99b6e1ecb18d595e7b66344de882c1e1db6f35c3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cairo: update patch for CVE-2019-6461 with upstream solutionQuentin Schulz2023-01-061-7/+28
| | | | | | | | | | | | | | | | Upstream went with something slightly different so let's update the patch so we don't have to carry a patch that isn't going to be merged. This patch is part of snapshot 1.17.6. Cc: Quentin Schulz <foss+yocto@0leil.net> (From OE-Core rev: dc7b7a757a850187ceaba5cf3eb0fa983b54fdfb) Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 19eb1e388fbbe5bfb8462710c745f2bb5446b5b5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libX11: CVE-2022-3554 & CVE-2022-3555 Fix memory leakHitendra Prajapati2023-01-063-0/+100
| | | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/1d11822601fd24a396b354fa616b04ed3df8b4ef && https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8a368d808fec166b5fb3dfe6312aab22c7ee20af (From OE-Core rev: b0e0cf44fb4f6e1cf562860766a2915ee8718f77) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xwayland: libxshmfence is needed when dri3 is enabledCarlos Alberto Lopez Perez2022-12-231-1/+1
| | | | | | | | | | | | | | * The build error happens already at configure time: | meson.build: ERROR: Problem encountered: DRI3 requested, but xshmfence not found (From OE-Core rev: 7a27f91670d6978433ecab5d3ef694303d5da79e) Signed-off-by: Carlos Alberto Lopez Perez <clopez@igalia.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 451fe4a067432b432b9cd38d2fc78072f6ce5421) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xserver-xorg: backport fixes for CVE-2022-3550 and CVE-2022-3551Ross Burton2022-12-133-0/+103
| | | | | | | | | | (From OE-Core rev: e40a8d939535bbb2f89aabd48c1cf843be5bb564) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit e32401d8bf44afcca88af7e4c5948d2c28e1813f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libepoxy: update 1.5.9 -> 1.5.10Alexander Kanavin2022-12-011-1/+1
| | | | | | | | | | | | | | | Changes since 1.5.9 - Fix for building with MSVC on non-English locale [Seungha Yang] - Fix build on Android [Caolán McNamara] - Add the right include paths for EGL and X11 headers [Alex Richardson] (From OE-Core rev: 6a3e430a776866c05d354d272c0513dbf188ed34) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 436cb3c98c582e17e6ed2491cc6598c56976af46) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libepoxy: convert to gitAlexander Kanavin2022-12-011-2/+3
| | | | | | | | | | | | Latest version doesn't come with stable tarballs. (From OE-Core rev: 1944a5dd84c3629c9c994383e2904731cf28ea87) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 4b6eed2bb323a3c7390ca3ad426afe27e9072bf0) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xwayland: upgrade 22.1.4 -> 22.1.5Wang Mingyu2022-12-011-1/+1
| | | | | | | | | | (From OE-Core rev: 9c1fc7e6c3d96f17f3eed2d8665dd6388ddcf1c5) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 48ca760427f14ae291bf2ebf6f93f8d0fb27e3ab) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xwayland: upgrade 22.1.3 -> 22.1.4Alexander Kanavin2022-12-011-1/+1
| | | | | | | | | | (From OE-Core rev: eafe1a235894790a28a8f951cff9ddc7913ba227) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 553c080e0e30c8f6b69b4c5fae72903ee45ef6ae) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pixman: backport fix for CVE-2022-44638Ross Burton2022-11-202-0/+34
| | | | | | | | | | (From OE-Core rev: 1d2e131d9ba55626354264d454b2808e84751600) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 23df4760ebc153c484d467e51b414910c570a6f8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xserver-xorg: move some recommended dependencies in requiredThomas Perrot2022-11-101-3/+3
| | | | | | | | | | | | | Otherwise, xserver will no longer start when NO_RECOMMENDATIONS = “1”, because dependencies in XSERVER_RRECOMMENDS are missing. (From OE-Core rev: a3607a035b4c9ab89232ccb1d0361791e5892b34) Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit bc7bd3953f3896af0db036250cda34bc9ecbb3ac) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vulkan-samples: add lfs=0 to SRC_URI to avoid git smudge errors in do_unpackMartin Jansa2022-11-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * we don't need other_lib/ios/Debug-iphoneos/libSDL2.a from https://github.com/KhronosGroup/KTX-Software.git so we can explicitly disable LFS here to avoid do_unpack error, bitbake will then use GIT_LFS_SKIP_SMUDGE=1 to override smudge setting in gitconfig, otherwise we would need bitbake patch to fetch LFS objects from the submodules as well * do_fetch won't fetch LFS objects without explicitly requesting lfs in SRC_URI then do_unpack might run git smudge when enabled in .gitconfig (or /etc/gitconfig) with: [filter "lfs"] smudge = git-lfs smudge -- %f process = git-lfs filter-process required = true clean = git-lfs clean -- %f and do_unpack fails as in: http://errors.yoctoproject.org/Errors/Details/672888/ The default /etc/gitconfig in ubuntu has this added automatically by git-lfs postinst: root@ljama:~# rm /etc/gitconfig root@ljama:~# git lfs install --skip-repo --system Git LFS initialized. root@ljama:~# cat /etc/gitconfig [filter "lfs"] clean = git-lfs clean -- %f smudge = git-lfs smudge -- %f process = git-lfs filter-process required = true root@ljama:~# cat /var/lib/dpkg/info/git-lfs.postinst set -e # Set up /etc/gitconfig for git-lfs. The --skip-repo option prevents failure if # / is a Git repository with existing non-git-lfs hooks. git lfs install --skip-repo --system > /dev/null 2>&1 according to https://changelogs.ubuntu.com/changelogs/pool/universe/g/git-lfs/git-lfs_3.0.2-1/changelog it was added in: git-lfs (2.6.0-1) unstable; urgency=medium * New upstream release * Bump standards version to 4.2.1 * Add postinst/prerm to set up/remove git-lfs gitconfig FWIW: vulkan-samples still fail to build with DEBUG_BUILD enabled: http://errors.yoctoproject.org/Errors/Details/672892/ (From OE-Core rev: ef035d9f49c9c974e24709e7824c661e92d819c0) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit b45b1f5dba02a626b7e9040d45198bd17dce4c99) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wayland: fix CVE-2021-3782Narpat Mali2022-11-042-0/+113
| | | | | | | | | | | | | | | | | | | | | | | | | | An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause thereference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time. Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-3782 Upstream patch: https://gitlab.freedesktop.org/wayland/wayland/-/commit/b19488c7154b902354cb26a27f11415d7799b0b2 (From OE-Core rev: 09b8ff8d2361b2db001bc963f481db294ccf2170) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cairo: Adapt the license information based on what is being builtPeter Kjellerstedt2022-09-161-1/+5
| | | | | | | | | | | | | | | | | | If the "trace" PACKAGECONFIG is removed to disable cairo-trace (the only part of the code licensed as GPL-3.0), we can adapt the licenses for cairo-dbg and cairo-src so that they do not include "GPL-3.0-or-later" and thus they can be used also when, e.g., GPL-3.0 is blacklisted in INCOMPATIBLE_LICENSE. Also drop the GPL-3.0 license text from LIC_FILES_CHKSUM in this case. (From OE-Core rev: 654d3542afa8082ef8ec9c34e3f27bc9f22ba2b4) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4f0ea44c80f297d00349b7d3cf9438145aec8a74) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libjpeg-turbo: upgrade 2.1.3 -> 2.1.4Alexander Kanavin2022-08-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Significant changes relative to 2.1.3 - Fixed a regression introduced in 2.1.3 that caused build failures with Visual Studio 2010. - The tjDecompressHeader3() function in the TurboJPEG C API and the TJDecompressor.setSourceImage() method in the TurboJPEG Java API now accept "abbreviated table specification" (AKA "tables-only") datastreams, which can be used to prime the decompressor with quantization and Huffman tables that can be used when decompressing subsequent "abbreviated image" datastreams. - libjpeg-turbo now performs run-time detection of AltiVec instructions on OS X/PowerPC systems if AltiVec instructions are not enabled at compile time. This allows both AltiVec-equipped (PowerPC G4 and G5) and non-AltiVec-equipped (PowerPC G3) CPUs to be supported using the same build of libjpeg-turbo. - Fixed an error ("Bogus virtual array access") that occurred when attempting to decompress a progressive JPEG image with a height less than or equal to one iMCU (8 * the vertical sampling factor) using buffered-image mode with interblock smoothing enabled. This was a regression introduced by 2.1 beta1[6(b)]. - Fixed two issues that prevented partial image decompression from working properly with buffered-image mode: * Attempting to call jpeg_crop_scanline() after jpeg_start_decompress() but before jpeg_start_output() resulted in an error ("Improper call to JPEG library in state 207".) * Attempting to use jpeg_skip_scanlines() resulted in an error ("Bogus virtual array access") under certain circumstances. (From OE-Core rev: cf3e5805ff955e639fa9d9f6a36f75e3f34b4dda) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ec92b905bca2ea773966672283d5f45872091b31) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-08 08:47:25 +0000