Skip to content

gdk-pixbuf: 2.42.0 → 2.42.2#106302

Merged
jtojnar merged 1 commit intostagingfrom
gdk-pixbuf-2.42.2
Dec 10, 2020
Merged

gdk-pixbuf: 2.42.0 → 2.42.2#106302
jtojnar merged 1 commit intostagingfrom
gdk-pixbuf-2.42.2

Conversation

@jtojnar
Copy link
Member

@jtojnar jtojnar commented Dec 8, 2020

Motivation for this change

Fixes CVE-2020-29385

https://ftp.gnome.org/pub/GNOME/sources/gdk-pixbuf/2.42/gdk-pixbuf-2.42.2.news

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@jtojnar jtojnar added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Dec 8, 2020
@jtojnar
Copy link
Member Author

jtojnar commented Dec 8, 2020

Changes look okay:

2.42.2 (stable)

  • Requre Meson 0.55.3
  • Improve the PNG save operation
  • Fix leak in the error path of the XPM loader
  • Fix loading GIF without a GCE rendering color 0 [Robert Ancell, #162]
  • Fix invalid LZW codes in the GIF loader [Robert Ancell, #164, CVE-2020-29385]

@jtojnar jtojnar added the 8.has: upstream changes reviewed Reviewer checked the changelogs/commit logs associated with the release and did not find any issues. label Dec 8, 2020
@ofborg ofborg bot requested review from edolstra, hedning and worldofpeace December 8, 2020 00:34
@ofborg ofborg bot added 11.by: package-maintainer This PR was created by a maintainer of all the package it changes. 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-darwin: 1001-2500 This PR causes many rebuilds on Darwin and should most likely target the staging branches. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 5001+ This PR causes many rebuilds on Linux and must target the staging branches. labels Dec 8, 2020
@FRidh
Copy link
Member

FRidh commented Dec 8, 2020

ofborg vm tests seemed to fail

@jtojnar
Copy link
Member Author

jtojnar commented Dec 8, 2020

Opened https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/94, can be tested using

diff --git a/nixos/tests/installed-tests/gdk-pixbuf.nix b/nixos/tests/installed-tests/gdk-pixbuf.nix
index 3d0011a427a..b6e3a9fa225 100644
--- a/nixos/tests/installed-tests/gdk-pixbuf.nix
+++ b/nixos/tests/installed-tests/gdk-pixbuf.nix
@@ -1,7 +1,22 @@
 { pkgs, makeInstalledTest, ... }:
 
 makeInstalledTest {
-  tested = pkgs.gdk-pixbuf;
+  tested = pkgs.gdk-pixbuf.overrideAttrs (attrs: rec {
+    inherit (attrs) pname;
+    version = "2.42.2";
+    src = pkgs.fetchurl {
+      url = "mirror://gnome/sources/${pname}/${pkgs.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+      sha256 = "05ggmzwvrxq9w4zcvmrnnd6qplsmb4n95lj4q607c7arzlf6mil3";
+    };
+    patches = attrs.patches ++ [
+      # Skip tests that are not built.
+      # https://gitlab.gnome.org/GNOME/gdk-pixbuf/merge_requests/94
+      (pkgs.fetchpatch {
+        url = "https://gitlab.gnome.org/GNOME/gdk-pixbuf/commit/b7611c4bcb5e728db5dba63f46aa71e4473dc23e.patch";
+        sha256 = "73rmPnUgjVKKN+18vFezPIBV5UZC51Hryc99WEN7uDA=";
+      })
+    ];
+  });
 
   testConfig = {
     # Tests allocate a lot of memory trying to exploit a CVE

@SuperSandro2000
Copy link
Member

SuperSandro2000 commented Dec 8, 2020

Please target staging.

@jtojnar
Copy link
Member Author

jtojnar commented Dec 9, 2020 •
edited
Loading

This is a security fix so it should go to master according to NixOS/rfcs#26. Actually, that says staging-next so I am confused because I kept hearing master and even repeated that myself.

@SuperSandro2000
Copy link
Member

SuperSandro2000 commented Dec 9, 2020

. Actually, that says staging-next so I am confused because I kept hearing master and even repeated that myself.

This is only true for non 5000+ mass rebuilds.

@jtojnar jtojnar changed the base branch from master to staging-next December 9, 2020 05:07
TredwellGit
TredwellGit approved these changes Dec 10, 2020
View reviewed changes
Copy link
Member

@TredwellGit TredwellGit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I rebuilt my personal system with this while testing #104091.

@jtojnar jtojnar changed the base branch from staging-next to staging December 10, 2020 03:43
@jtojnar jtojnar merged commit 0facf25 into staging Dec 10, 2020
@jtojnar jtojnar deleted the gdk-pixbuf-2.42.2 branch December 10, 2020 05:19
@FRidh FRidh mentioned this pull request Dec 10, 2020
Merged
@FRidh
Copy link
Member

FRidh commented Dec 10, 2020

@jtojnar I commented at NixOS/rfcs#26 (comment)

@TredwellGit TredwellGit mentioned this pull request Dec 12, 2020
Closed
@dotlambda dotlambda added the 9.needs: port to stable A PR needs a backport to the stable release. label Feb 1, 2021
@dotlambda
Copy link
Member

dotlambda commented Feb 1, 2021 •
edited
Loading

@jtojnar Could you please backport this? See #109165.

@dotlambda
Copy link
Member

dotlambda commented Feb 1, 2021

Actually, the patch for CVE-2020-29385 applies cleanly: #111542

@TredwellGit TredwellGit removed the 9.needs: port to stable A PR needs a backport to the stable release. label Aug 20, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@edolstra edolstra Awaiting requested review from edolstra

@worldofpeace worldofpeace Awaiting requested review from worldofpeace

@hedning hedning Awaiting requested review from hedning

1 more reviewer

@TredwellGit TredwellGit TredwellGit approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

1.severity: security Issues which raise a security issue, or PRs that fix one 8.has: upstream changes reviewed Reviewer checked the changelogs/commit logs associated with the release and did not find any issues. 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-darwin: 1001-2500 This PR causes many rebuilds on Darwin and should most likely target the staging branches. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 5001+ This PR causes many rebuilds on Linux and must target the staging branches. 11.by: package-maintainer This PR was created by a maintainer of all the package it changes.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@jtojnar @FRidh @SuperSandro2000 @dotlambda @TredwellGit