mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-11-12 03:28:54 -10:00
2b8e5fe2c7
Fixes the following security issues: - CVE-2026-96639, GHSA-v9pv-5gc8-w2m6: Stale native image storage reused after mode transitions - GHSA-5x8w-8jj5-q52h, GHSA-8g5g-8vmr-9782: JPEG decoder buffer overflow from scanlines wider than tile extents - CVE-2026-96644, GHSA-9v9v-9qvf-h2hj: WMF/EMF heap out-of-bounds read from dimension truncation - CVE-2026-96637, GHSA-g842-9rc4-69pw: SPIDER decompression bomb bypass via seek() - CVE-2026-96643, GHSA-g4qv-2jxx-769h: Unbounded Exif header replacement loop - CVE-2026-96778, GHSA-g7cr-3p24-7wf7: JPEG comment write after ICC profile fills encoder buffer - GHSA-462x-pgg6-55fp, GHSA-c6hw-5grf-ff96: TIFF tile and YCbCr decoding out-of-bounds read from undersized libtiff buffers - GHSA-p4wg-p73j-c528: PDF parsing stack exhaustion from long trailer chains and deep or cyclic page trees - CVE-2026-96640, GHSA-mrfp-p49p-3hf2: PDF append resource exhaustion from repeated page tree references - GHSA-pchr-8j38-3x4p: TIFF encoder accepted an incorrectly sized Colormap for non-8-bit images - GHSA-332p-7hrc-92wf: TIFF encoder heap buffer overflow when saving to a file object - GHSA-xcvg-w56q-r89m: TIFF encoder heap buffer overflow when tags override the image size - GHSA-xvh5-g6gv-559v: TIFF encoder memory disclosure and crash from mismatched tag values - GHSA-q45j-58j2-45rg: TIFF decoding returned uninitialized memory for short JPEG strips - GHSA-78g4-xqwv-q3g8: Bundled OpenJPEG heap buffer overflow when reading tile-part data - GHSA-4rr5-89j8-mwwm: TIFF encoder use-after-free write - CVE-2026-96636, GHSA-p8hx-v2p6-rp84: MPO, DCX and MIC decompression bomb bypass via seek() - GHSA-f2g6-542v-9j58: PDF page tree stack exhaustion via cyclic /Kids reference - GHSA-5xm2-6676-qcp9: APNG decompression bomb bypass via delayed disposal-frame sizing - CVE-2026-96642, GHSA-3j72-p6qg-6xp7: TarIO negative size field causes infinite CPU-spin loop - CVE-2026-96638, GHSA-24rc-8hj2-v98c: BMP RLE decoder memory-amplification denial of service - GHSA-gg2r-wvfm-q9rx: MSP RLE decoder expands a tiny file into unbounded memory - GHSA-wqgw-9xfh-qf2g: TIFF and Exif IFD parsing memory and CPU amplification from shared tag data - GHSA-jg86-v3jv-hrpm: Quadratic time when writing many objects to a PDF - GHSA-254f-3936-288h: PdfParser unbounded recursion via deeply nested objects - GHSA-rfgq-q3w2-pmv2: Image.quantize() crash from an empty target palette - GHSA-xgh8-jp6q-p5x8: XBM header parsing regular expression denial of service - GHSA-22hg-r758-rrw9, GHSA-74r2-7ff9-mjj2, GHSA-fc9g-5qg7-mf45: GIF comment handling quadratic-time blowup from repeated concatenation - GHSA-27h8-gf7j-v5hc: Out-of-bounds read in rank-based filters for zero-dimension images - CVE-2026-96641, GHSA-4rm8-3hmm-39fg: Integer underflow in PILfont text width calculation - GHSA-cp9v-662q-vvx9: Image.merge() buffer overflow when merging 32-bit images as narrower bands - GHSA-j4m9-6w36-pw47: Uninitialized glyph pointer freed on font rendering error path - GHSA-7mwm-ghpf-9vrm: Double free in Image.transform() after an allocation failure - GHSA-4558-3h8r-v8xp: P;2L and P;4L raw mode decoders read past the end of their input - GHSA-w889-685w-c8fh: EPS filename argument injection into Ghostscript - GHSA-65qm-jvmh-6pqg: GIF decompression bomb check used a size discarded on failure - GHSA-vx6w-vv9f-6gvg: EPS decompression bomb bypass via Ghostscript rendering - GHSA-58r4-6rv3-gfh8: ImageMorph.MorphOp.apply() out-of-bounds write on zero-width images Fix the AVIF build option: Pillow names it avif, the -Clibavif setting was silently ignored, so AVIF support was only auto-detected instead of following BR2_PACKAGE_LIBAVIF. Pillow 13.0.0 adds the Python installation include and library directories from sysconfig, which are /usr/include and /usr/lib when cross-compiling, so the build fails with: ERROR: unsafe header/library path used in cross-compilation: '-I/usr/include' Add a patch, backported from an upstream pull request, skipping those directories when building against an uninstalled Python, as done by Buildroot. Release notes: https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com> Signed-off-by: Julien Olivain <ju.o@free.fr>
49 lines
1.8 KiB
Diff
49 lines
1.8 KiB
Diff
From d32fb4da510c91ba3596fad8d3d73074b1b287ac Mon Sep 17 00:00:00 2001
|
|
From: James Hilliard <james.hilliard1@gmail.com>
|
|
Date: Sun, 18 Oct 2026 12:37:23 -0600
|
|
Subject: [PATCH] Skip Python installation paths for build-tree Python
|
|
|
|
Upstream: https://github.com/python-pillow/Pillow/pull/10236
|
|
[Angelo: drop the docs/releasenotes/13.1.0.rst change, the file is not
|
|
in the 13.0.0 release]
|
|
Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
|
|
---
|
|
setup.py | 24 ++++++++++++++----------
|
|
1 file changed, 14 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/setup.py b/setup.py
|
|
index 2d02cf129ca..7de22bb78eb 100644
|
|
--- a/setup.py
|
|
+++ b/setup.py
|
|
@@ -572,16 +572,20 @@ def build_extensions(self) -> None:
|
|
for d in os.environ[k].split(os.path.pathsep):
|
|
_add_directory(library_dirs, d)
|
|
|
|
- _add_directory(
|
|
- library_dirs,
|
|
- (sys.prefix == sys.base_prefix and sysconfig.get_config_var("LIBDIR"))
|
|
- or os.path.join(sys.prefix, "lib"),
|
|
- )
|
|
- _add_directory(
|
|
- include_dirs,
|
|
- (sys.prefix == sys.base_prefix and sysconfig.get_config_var("INCLUDEDIR"))
|
|
- or os.path.join(sys.prefix, "include"),
|
|
- )
|
|
+ if not sysconfig.is_python_build():
|
|
+ _add_directory(
|
|
+ library_dirs,
|
|
+ (sys.prefix == sys.base_prefix and sysconfig.get_config_var("LIBDIR"))
|
|
+ or os.path.join(sys.prefix, "lib"),
|
|
+ )
|
|
+ _add_directory(
|
|
+ include_dirs,
|
|
+ (
|
|
+ sys.prefix == sys.base_prefix
|
|
+ and sysconfig.get_config_var("INCLUDEDIR")
|
|
+ )
|
|
+ or os.path.join(sys.prefix, "include"),
|
|
+ )
|
|
|
|
#
|
|
# add platform directories
|