05/17: gnu: optipng: Update to 0.7.7 [security fixes].

[Tobias Geerinckx-Rice]

nckx pushed a commit to branch master
in repository guix.

commit bbf8832f160120d4f78b563653db49ab715e7c6c
Author: Tobias Geerinckx-Rice <address@hidden>
Date:   Fri Feb 23 14:24:42 2018 +0100

    gnu: optipng: Update to 0.7.7 [security fixes].
    
    This release claims to fix 2 vulnerabilities:
    - ‘an integer overflow vulnerability in the TIFF decoder’
      (CVE-2017-1000229, previously patched in Guix), and
    - ‘a buffer overflow vulnerability in the GIF decoder’.
    
    * gnu/packages/image.scm (optipng): Update to 0.7.7.
    [source]: Remove patch.
    [arguments]: Substitute INVOKE for SYSTEM* and end phase with #t.
    * gnu/packages/patches/optipng-CVE-2017-1000229.patch: Delete file.
    * gnu/local.mk (dist_patch_DATA): Remove it.
---
 gnu/local.mk                                       |  1 -
 gnu/packages/image.scm                             | 17 ++++++++---------
 .../patches/optipng-CVE-2017-1000229.patch         | 22 ----------------------
 3 files changed, 8 insertions(+), 32 deletions(-)

diff --git a/gnu/local.mk b/gnu/local.mk
index 2fd7e24..cd1926a 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -950,7 +950,6 @@ dist_patch_DATA =                                           
\
   %D%/packages/patches/openssl-runpath.patch                   \
   %D%/packages/patches/openssl-1.1.0-c-rehash-in.patch         \
   %D%/packages/patches/openssl-c-rehash-in.patch               \
-  %D%/packages/patches/optipng-CVE-2017-1000229.patch          \
   %D%/packages/patches/orpheus-cast-errors-and-includes.patch  \
   %D%/packages/patches/osip-CVE-2017-7853.patch                        \
   %D%/packages/patches/ots-no-include-missing-file.patch       \
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 9052a34..93114d8 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -10,7 +10,7 @@
 ;;; Copyright © 2016 Leo Famulari <address@hidden>
 ;;; Copyright © 2016, 2017 Leo Famulari <address@hidden>
 ;;; Copyright © 2016, 2017 Efraim Flashner <address@hidden>
-;;; Copyright © 2016, 2017 Tobias Geerinckx-Rice <address@hidden>
+;;; Copyright © 2016, 2017, 2018 Tobias Geerinckx-Rice <address@hidden>
 ;;; Copyright © 2016 Eric Bavier <address@hidden>
 ;;; Copyright © 2016, 2017 Arun Isaac <address@hidden>
 ;;; Copyright © 2016, 2017 Kei Kebreau <address@hidden>
@@ -1091,29 +1091,28 @@ installed as @code{stb_image}.")
 (define-public optipng
   (package
     (name "optipng")
-    (version "0.7.6")
+    (version "0.7.7")
     (source
      (origin
        (method url-fetch)
        (uri (string-append 
"http://prdownloads.sourceforge.net/optipng/optipng-";
                            version ".tar.gz"))
-       (patches (search-patches "optipng-CVE-2017-1000229.patch"))
        (sha256
         (base32
-         "105yk5qykvhiahzag67gm36s2kplxf6qn5hay02md0nkrcgn6w28"))))
+         "0lj4clb851fzpaq446wgj0sfy922zs5l5misbpwv6w7qrqrz4cjg"))))
     (build-system gnu-build-system)
     (inputs
      `(("zlib" ,zlib)))
     (arguments
      '(#:phases
        (modify-phases %standard-phases
-         ;; configure script does not accept arguments CONFIG_SHELL and SHELL
          (replace 'configure
            (lambda* (#:key outputs #:allow-other-keys)
-             (zero? (system* "sh" "configure"
-                             (string-append "--prefix=" (assoc-ref outputs 
"out")))))))))
-    (synopsis "Optimizer that recompresses PNG image files to a
-smaller size")
+             ;; configure script doesn't accept arguments CONFIG_SHELL and 
SHELL
+             (invoke "sh" "configure"
+                     (string-append "--prefix=" (assoc-ref outputs "out")))
+             #t)))))
+    (synopsis "Optimizer that recompresses PNG image files to a smaller size")
     (description "OptiPNG is a PNG optimizer that recompresses image
 files to a smaller size, without losing any information.  This program
 also converts external formats (BMP, GIF, PNM and TIFF) to optimized
diff --git a/gnu/packages/patches/optipng-CVE-2017-1000229.patch 
b/gnu/packages/patches/optipng-CVE-2017-1000229.patch
deleted file mode 100644
index 2cb3b2f..0000000
--- a/gnu/packages/patches/optipng-CVE-2017-1000229.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-Fix CVE-2017-1000229:
-
-https://security-tracker.debian.org/tracker/CVE-2017-1000229
-https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000229.html
-https://nvd.nist.gov/vuln/detail/CVE-2017-1000229
-
-Patch copied from upstream bug tracker:
-https://sourceforge.net/p/optipng/bugs/65/
-
-diff --git a/src/minitiff/tiffread.c b/src/minitiff/tiffread.c
-index b4910ec..5f9b376 100644
---- a/src/minitiff/tiffread.c
-+++ b/src/minitiff/tiffread.c
-@@ -350,6 +350,8 @@ minitiff_read_info(struct minitiff_info *tiff_ptr, FILE 
*fp)
-         count = tiff_ptr->strip_offsets_count;
-         if (count == 0 || count > tiff_ptr->height)
-             goto err_invalid;
-+        if (count > (size_t)-1 / sizeof(long))
-+            goto err_memory;
-         tiff_ptr->strip_offsets = (long *)malloc(count * sizeof(long));
-         if (tiff_ptr->strip_offsets == NULL)
-             goto err_memory;