gdk-pixbuf: 2.42.0 → 2.42.2

[jtojnar]

Motivation for this change

Fixes CVE-2020-29385

https://ftp.gnome.org/pub/GNOME/sources/gdk-pixbuf/2.42/gdk-pixbuf-2.42.2.news

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[jtojnar]

Changes look okay:

2.42.2 (stable)

• Requre Meson 0.55.3
• Improve the PNG save operation
• Fix leak in the error path of the XPM loader
• Fix loading GIF without a GCE rendering color 0 [Robert Ancell, #162]
• Fix invalid LZW codes in the GIF loader [Robert Ancell, #164, CVE-2020-29385]

[FRidh]

ofborg vm tests seemed to fail

[jtojnar]

Opened https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/94, can be tested using

diff --git a/nixos/tests/installed-tests/gdk-pixbuf.nix b/nixos/tests/installed-tests/gdk-pixbuf.nix
index 3d0011a427a..b6e3a9fa225 100644
--- a/nixos/tests/installed-tests/gdk-pixbuf.nix
+++ b/nixos/tests/installed-tests/gdk-pixbuf.nix
@@ -1,7 +1,22 @@
 { pkgs, makeInstalledTest, ... }:
 
 makeInstalledTest {
-  tested = pkgs.gdk-pixbuf;
+  tested = pkgs.gdk-pixbuf.overrideAttrs (attrs: rec {
+    inherit (attrs) pname;
+    version = "2.42.2";
+    src = pkgs.fetchurl {
+      url = "mirror://gnome/sources/${pname}/${pkgs.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+      sha256 = "05ggmzwvrxq9w4zcvmrnnd6qplsmb4n95lj4q607c7arzlf6mil3";
+    };
+    patches = attrs.patches ++ [
+      # Skip tests that are not built.
+      # https://gitlab.gnome.org/GNOME/gdk-pixbuf/merge_requests/94
+      (pkgs.fetchpatch {
+        url = "https://gitlab.gnome.org/GNOME/gdk-pixbuf/commit/b7611c4bcb5e728db5dba63f46aa71e4473dc23e.patch";
+        sha256 = "73rmPnUgjVKKN+18vFezPIBV5UZC51Hryc99WEN7uDA=";
+      })
+    ];
+  });
 
   testConfig = {
     # Tests allocate a lot of memory trying to exploit a CVE

[SuperSandro2000]

Please target staging.

[jtojnar]

This is a security fix so it should go to master according to NixOS/rfcs#26. Actually, that says staging-next so I am confused because I kept hearing master and even repeated that myself.

[SuperSandro2000]

. Actually, that says staging-next so I am confused because I kept hearing master and even repeated that myself.

This is only true for non 5000+ mass rebuilds.

[TredwellGit]

I rebuilt my personal system with this while testing #104091.

[FRidh]

@jtojnar I commented at NixOS/rfcs#26 (comment)

[dotlambda]

@jtojnar Could you please backport this? See #109165.

[dotlambda]

Actually, the patch for CVE-2020-29385 applies cleanly: #111542