[PATCH 0/2] libpng upgrade

[PATCH 0/2] libpng upgrade

[Scott Garman]

Hello,

This upgrade to libpng addresses some security vulnerabilities. It
has been build tested on all five of our qemu MACHINEs.

The following changes since commit fa4bcfdb73167f8159b88e5a4d711c0d37627a70:

  bb-matrix: correct BB and PM number canonicalization (2011-07-14 22:23:09 +0100)

are available in the git repository at:
  git://git.pokylinux.org/poky-contrib sgarman/libpng-upgrade
  http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=sgarman/libpng-upgrade

Scott Garman (2):
  libpng: upgrade to v1.2.46
  distro-tracking: update libpng

 .../conf/distro/include/distro_tracking_fields.inc |   10 +++++-----
 .../libpng/{libpng_1.2.44.bb => libpng_1.2.46.bb}  |   11 ++++++-----
 2 files changed, 11 insertions(+), 10 deletions(-)
 rename meta/recipes-multimedia/libpng/{libpng_1.2.44.bb => libpng_1.2.46.bb} (55%)

[PATCH 1/2] libpng: upgrade to v1.2.46

[Scott Garman]

This addresses the following security advisories:

* CVE-2011-2690
* CVE-2011-2692

This fixes bug [YOCTO #1255]

The LICENSE and png.h checksum changes were due to trivial changes
in the files.

Signed-off-by: Scott Garman <scott.a.garman@intel.com>
---
 .../libpng/{libpng_1.2.44.bb => libpng_1.2.46.bb}  |   11 ++++++-----
 1 files changed, 6 insertions(+), 5 deletions(-)
 rename meta/recipes-multimedia/libpng/{libpng_1.2.44.bb => libpng_1.2.46.bb} (55%)

diff --git a/meta/recipes-multimedia/libpng/libpng_1.2.44.bb b/meta/recipes-multimedia/libpng/libpng_1.2.46.bb
similarity index 55%
rename from meta/recipes-multimedia/libpng/libpng_1.2.44.bb
rename to meta/recipes-multimedia/libpng/libpng_1.2.46.bb
index d81a5c1..57d9037 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.2.44.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.2.46.bb
@@ -1,16 +1,17 @@
+SUMMARY = "PNG Library"
 DESCRIPTION = "PNG Library"
 HOMEPAGE = "http://www.libpng.org/"
 SECTION = "libs"
 LICENSE = "Libpng"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=a294a2bb08b7f25558119edbfd6b2e92 \
-                    file://png.h;startline=172;endline=261;md5=3253923f0093658f470e52a06ddcf4e7"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=21b4b6e3523afa9f03f00b43b991dad0 \
+                    file://png.h;startline=172;endline=261;md5=996460063a9bf2de35b2d61d2776dabc"
 DEPENDS = "zlib"
 PR = "r0"
 
-SRC_URI = "${SOURCEFORGE_MIRROR}/libpng/libpng-${PV}.tar.bz2"
+SRC_URI = "${SOURCEFORGE_MIRROR}/project/libpng/libpng12/${PV}/libpng-${PV}.tar.bz2"
 
-SRC_URI[md5sum] = "e3ac7879d62ad166a6f0c7441390d12b"
-SRC_URI[sha256sum] = "b9ab20f1c2c3bf6c4448fd9bd8a4a8905b918114d5fada56c97bb758a17b7215"
+SRC_URI[md5sum] = "e8b43dc78ef95b3949af7f961d76874b"
+SRC_URI[sha256sum] = "a5e796e1802b2e221498bda09ff9850bc7ec9068b6788948cc2c42af213914d8"
 
 inherit autotools binconfig pkgconfig
 
-- 
1.7.1

[PATCH 2/2] distro-tracking: update libpng

[Scott Garman]

Signed-off-by: Scott Garman <scott.a.garman@intel.com>
---
 .../conf/distro/include/distro_tracking_fields.inc |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/meta/conf/distro/include/distro_tracking_fields.inc b/meta/conf/distro/include/distro_tracking_fields.inc
index efb4c0b..2f078c9 100644
--- a/meta/conf/distro/include/distro_tracking_fields.inc
+++ b/meta/conf/distro/include/distro_tracking_fields.inc
@@ -255,14 +255,14 @@ RECIPE_MAINTAINER_pn-neon = "Dongxiao Xu <dongxiao.xu@intel.com>"
 
 RECIPE_STATUS_pn-libpng = "green"
 RECIPE_DEPENDENCY_CHECK_pn-libpng = "not done"
-RECIPE_LATEST_VERSION_pn-libpng = "1.4.5"
-RECIPE_NO_UPDATE_REASON_pn-libpng = "1.4.3 has API compatibility issue, e.g. break libmatchbox. choose 1.2.44 instead"
+RECIPE_LATEST_VERSION_pn-libpng = "1.5.4"
+RECIPE_NO_UPDATE_REASON_pn-libpng = "1.4.3 and later changes the API and breaks libmatchbox. Sticking with the 1.2.x series instead"
 RECIPE_PATCH_pn-libpng+makefile = "by RP; 2008; to define ECHO explicitly for lbitool 2.2.2. need check whether it's still valide for new libtool. candidate for upstream"
 RECIPE_INTEL_SECTION_pn-libpng = "base libs"
-RECIPE_TIME_BETWEEN_LAST_TWO_RELEASES_pn-libpng = "1 month"
-RECIPE_LATEST_RELEASE_DATE_pn-libpng = "06/2010"
+RECIPE_TIME_BETWEEN_LAST_TWO_RELEASES_pn-libpng = "unknown"
+RECIPE_LATEST_RELEASE_DATE_pn-libpng = "07/2011"
 RECIPE_COMMENTS_pn-libpng = ""
-RECIPE_LAST_UPDATE_pn-libpng = "Jul 20, 2010"
+RECIPE_LAST_UPDATE_pn-libpng = "Jul 18, 2011"
 RECIPE_MAINTAINER_pn-libpng = "Scott Garman <scott.a.garman@intel.com>"
 
 RECIPE_STATUS_pn-libidn = "green"
-- 
1.7.1

Re: [PATCH 0/2] libpng upgrade

[Saul Wold]

On 07/19/2011 09:29 AM, Scott Garman wrote:
> Hello,
>
> This upgrade to libpng addresses some security vulnerabilities. It
> has been build tested on all five of our qemu MACHINEs.
>
> The following changes since commit fa4bcfdb73167f8159b88e5a4d711c0d37627a70:
>
>    bb-matrix: correct BB and PM number canonicalization (2011-07-14 22:23:09 +0100)
>
> are available in the git repository at:
>    git://git.pokylinux.org/poky-contrib sgarman/libpng-upgrade
>    http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=sgarman/libpng-upgrade
>
> Scott Garman (2):
>    libpng: upgrade to v1.2.46
>    distro-tracking: update libpng
>
>   .../conf/distro/include/distro_tracking_fields.inc |   10 +++++-----
>   .../libpng/{libpng_1.2.44.bb =>  libpng_1.2.46.bb}  |   11 ++++++-----
>   2 files changed, 11 insertions(+), 10 deletions(-)
>   rename meta/recipes-multimedia/libpng/{libpng_1.2.44.bb =>  libpng_1.2.46.bb} (55%)
>
>
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.linuxtogo.org/cgi-bin/mailman/listinfo/openembedded-core
>

Merged into OE-Core

Thanks
	Sau!