gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

freeimage: drop

Browse Source 
Very insecure.
This commit is contained in:
Wolfgang Walther
2025-10-23 13:40:15 +02:00
parent a8204745e5
commit 3e505de718
18 changed files with 5 additions and 917 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lib/licenses.nix
View File

@@ -620,11 +620,6 @@ lib.mapAttrs mkLicense (
fullName = "Unspecified free software license";
};
freeimage = {
spdxId = "FreeImage";
fullName = "FreeImage Public License v1.0";
};
fsl11Mit = {
fullName = "Functional Source License, Version 1.1, MIT Future License";
spdxId = "FSL-1.1-MIT";

13
pkgs/by-name/fr/freeimage/CVE-2020-24292.patch
View File

@@ -1,13 +0,0 @@
diff -rupN --no-dereference freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginICO.cpp freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginICO.cpp
--- freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginICO.cpp 2023-09-28 19:34:45.524031668 +0200
+++ freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginICO.cpp 2023-09-28 19:34:47.717009813 +0200
@@ -301,6 +301,9 @@ LoadStandardIcon(FreeImageIO *io, fi_han
int width = bmih.biWidth;
int height = bmih.biHeight / 2; // height == xor + and mask
unsigned bit_count = bmih.biBitCount;
+ if (bit_count != 1 && bit_count != 2 && bit_count != 4 && bit_count != 8 && bit_count != 16 && bit_count != 24 && bit_count != 32) {
+ return NULL;
+ }
unsigned line = CalculateLine(width, bit_count);
unsigned pitch = CalculatePitch(line);

14
pkgs/by-name/fr/freeimage/CVE-2020-24293.patch
View File

@@ -1,14 +0,0 @@
diff -rupN --no-dereference freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PSDParser.cpp freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PSDParser.cpp
--- freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PSDParser.cpp 2023-09-28 19:34:47.287014100 +0200
+++ freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PSDParser.cpp 2023-09-28 19:34:47.832008666 +0200
@@ -780,6 +780,10 @@ int psdThumbnail::Read(FreeImageIO *io,
FreeImage_Unload(_dib);
}
+ if (_WidthBytes != _Width * _BitPerPixel / 8) {
+ throw "Invalid PSD image";
+ }
+
if(_Format == 1) {
// kJpegRGB thumbnail image
_dib = FreeImage_LoadFromHandle(FIF_JPEG, io, handle);

21
pkgs/by-name/fr/freeimage/CVE-2020-24295.patch
View File

@@ -1,21 +0,0 @@
diff -rupN --no-dereference freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PSDParser.cpp freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PSDParser.cpp
--- freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PSDParser.cpp 2023-09-28 19:34:47.936007630 +0200
+++ freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PSDParser.cpp 2023-09-28 19:34:47.940007590 +0200
@@ -1466,6 +1466,7 @@ FIBITMAP* psdParser::ReadImageData(FreeI
const unsigned dstBpp = (depth == 1) ? 1 : FreeImage_GetBPP(bitmap)/8;
const unsigned dstLineSize = FreeImage_GetPitch(bitmap);
BYTE* const dst_first_line = FreeImage_GetScanLine(bitmap, nHeight - 1);//<*** flipped
+ const unsigned dst_buffer_size = dstLineSize * nHeight;
BYTE* line_start = new BYTE[lineSize]; //< fileline cache
@@ -1481,6 +1482,9 @@ FIBITMAP* psdParser::ReadImageData(FreeI
const unsigned channelOffset = GetChannelOffset(bitmap, c) * bytes;
BYTE* dst_line_start = dst_first_line + channelOffset;
+ if (channelOffset + lineSize > dst_buffer_size) {
+ throw "Invalid PSD image";
+ }
for(unsigned h = 0; h < nHeight; ++h, dst_line_start -= dstLineSize) {//<*** flipped
io->read_proc(line_start, lineSize, 1, handle);
ReadImageLine(dst_line_start, line_start, lineSize, dstBpp, bytes);

19
pkgs/by-name/fr/freeimage/CVE-2021-33367.patch
View File

@@ -1,19 +0,0 @@
diff -rupN --no-dereference freeimage-svn-r1909-FreeImage-trunk/Source/Metadata/Exif.cpp freeimage-svn-r1909-FreeImage-trunk-new/Source/Metadata/Exif.cpp
--- freeimage-svn-r1909-FreeImage-trunk/Source/Metadata/Exif.cpp 2023-09-28 19:34:45.003036859 +0200
+++ freeimage-svn-r1909-FreeImage-trunk-new/Source/Metadata/Exif.cpp 2023-09-28 19:34:47.505011926 +0200
@@ -770,8 +770,13 @@ jpeg_read_exif_dir(FIBITMAP *dib, const
//
const WORD entriesCount0th = ReadUint16(msb_order, ifd0th);
-
- DWORD next_offset = ReadUint32(msb_order, DIR_ENTRY_ADDR(ifd0th, entriesCount0th));
+
+ const BYTE* de_addr = DIR_ENTRY_ADDR(ifd0th, entriesCount0th);
+ if(de_addr+4 >= (BYTE*)(dwLength + ifd0th - tiffp)) {
+ return TRUE; //< no thumbnail
+ }
+
+ DWORD next_offset = ReadUint32(msb_order, de_addr);
if((next_offset == 0) || (next_offset >= dwLength)) {
return TRUE; //< no thumbnail
}

15
pkgs/by-name/fr/freeimage/CVE-2021-40263.patch
View File

@@ -1,15 +0,0 @@
diff -rupN --no-dereference freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginTIFF.cpp freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginTIFF.cpp
--- freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginTIFF.cpp 2023-09-28 19:34:47.713009853 +0200
+++ freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginTIFF.cpp 2023-09-28 19:34:48.043006563 +0200
@@ -2142,6 +2142,11 @@ Load(FreeImageIO *io, fi_handle handle,
uint32_t tileRowSize = (uint32_t)TIFFTileRowSize(tif);
uint32_t imageRowSize = (uint32_t)TIFFScanlineSize(tif);
+ if (width / tileWidth * tileRowSize * 8 > bitspersample * samplesperpixel * width) {
+ free(tileBuffer);
+ throw "Corrupted tiled TIFF file";
+ }
+
// In the tiff file the lines are saved from up to down
// In a DIB the lines must be saved from down to up

14
pkgs/by-name/fr/freeimage/CVE-2021-40266.patch
View File

@@ -1,14 +0,0 @@
diff -rupN --no-dereference freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginTIFF.cpp freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginTIFF.cpp
--- freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginTIFF.cpp 2023-09-28 19:34:47.501011966 +0200
+++ freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginTIFF.cpp 2023-09-28 19:34:47.610010879 +0200
@@ -372,6 +372,10 @@ static void
ReadPalette(TIFF *tiff, uint16_t photometric, uint16_t bitspersample, FIBITMAP *dib) {
RGBQUAD *pal = FreeImage_GetPalette(dib);
+ if (!pal) {
+ return;
+ }
+
switch(photometric) {
case PHOTOMETRIC_MINISBLACK: // bitmap and greyscale image types
case PHOTOMETRIC_MINISWHITE:

14
pkgs/by-name/fr/freeimage/CVE-2023-47995.patch
View File

@@ -1,14 +0,0 @@
diff -rupN --no-dereference freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginJPEG.cpp freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginJPEG.cpp
--- freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginJPEG.cpp 2024-03-10 14:22:17.818579271 +0100
+++ freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginJPEG.cpp 2024-03-10 14:22:18.776573816 +0100
@@ -1086,6 +1086,10 @@ Load(FreeImageIO *io, fi_handle handle,
jpeg_read_header(&cinfo, TRUE);
+ if (cinfo.image_width > JPEG_MAX_DIMENSION || cinfo.image_height > JPEG_MAX_DIMENSION) {
+ throw FI_MSG_ERROR_DIB_MEMORY;
+ }
+
// step 4: set parameters for decompression
unsigned int scale_denom = 1; // fraction by which to scale image

16
pkgs/by-name/fr/freeimage/CVE-2023-47997.patch
View File

@@ -1,16 +0,0 @@
diff -rupN --no-dereference freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginTIFF.cpp freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginTIFF.cpp
--- freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginTIFF.cpp 2024-03-10 14:22:18.669574426 +0100
+++ freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginTIFF.cpp 2024-03-10 14:22:18.673574403 +0100
@@ -1484,6 +1484,12 @@ Load(FreeImageIO *io, fi_handle handle,
(int)bitspersample, (int)samplesperpixel, (int)photometric);
throw (char*)NULL;
}
+ if (planar_config == PLANARCONFIG_SEPARATE && bitspersample < 8) {
+ FreeImage_OutputMessageProc(s_format_id,
+ "Unable to handle this format: bitspersample = 8, TIFFTAG_PLANARCONFIG = PLANARCONFIG_SEPARATE"
+ );
+ throw (char*)NULL;
+ }
// ---------------------------------------------------------------------------------

15
pkgs/by-name/fr/freeimage/libtiff-4.4.0.diff
View File

@@ -1,15 +0,0 @@
Fix build with libtiff 4.4.0 by not using a private libtiff API.
Patch by Kurt Schwehr: https://sourceforge.net/p/freeimage/discussion/36109/thread/2018fdc6e7/
diff -ru a/Source/Metadata/XTIFF.cpp b/Source/Metadata/XTIFF.cpp
--- a/Source/Metadata/XTIFF.cpp
+++ b/Source/Metadata/XTIFF.cpp
@@ -749,7 +749,7 @@
continue;
}
// type of storage may differ (e.g. rationnal array vs float array type)
- if((unsigned)_TIFFDataSize(tif_tag_type) != FreeImage_TagDataWidth(tag_type)) {
+ if((unsigned)TIFFFieldSetGetSize(fld) != FreeImage_TagDataWidth(tag_type)) {
// skip tag or _TIFFmemcpy will fail
continue;
}

170
pkgs/by-name/fr/freeimage/package.nix
View File

@@ -1,170 +0,0 @@
{
lib,
stdenv,
fetchsvn,
cctools,
libtiff,
libpng,
zlib,
libwebp,
libraw,
openexr,
openjpeg,
libjpeg,
jxrlib,
pkg-config,
fixDarwinDylibNames,
}:
stdenv.mkDerivation (finalAttrs: {
pname = "freeimage";
version = "3.18.0-unstable-2024-04-18";
src = fetchsvn {
url = "svn://svn.code.sf.net/p/freeimage/svn/";
rev = "1911";
hash = "sha256-JznVZUYAbsN4FplnuXxCd/ITBhH7bfGKWXep2A6mius=";
};
sourceRoot = "${finalAttrs.src.name}/FreeImage/trunk";
# Ensure that the bundled libraries are not used at all
prePatch = ''
rm -rf Source/Lib* Source/OpenEXR Source/ZLib
'';
# Tell patch to work with trailing carriage returns
patchFlags = [
"-p1"
"--binary"
];
patches = [
./unbundle.diff
./CVE-2020-24292.patch
./CVE-2020-24293.patch
./CVE-2020-24295.patch
./CVE-2021-33367.patch
./CVE-2021-40263.patch
./CVE-2021-40266.patch
./CVE-2023-47995.patch
./CVE-2023-47997.patch
];
postPatch = ''
# To support cross compilation, use the correct `pkg-config`.
substituteInPlace Makefile.fip \
--replace "pkg-config" "$PKG_CONFIG"
substituteInPlace Makefile.gnu \
--replace "pkg-config" "$PKG_CONFIG"
''
+ lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
# Upstream Makefile hardcodes i386 and x86_64 architectures only
substituteInPlace Makefile.osx --replace "x86_64" "arm64"
'';
nativeBuildInputs = [
pkg-config
]
++ lib.optionals stdenv.hostPlatform.isDarwin [
cctools
fixDarwinDylibNames
];
buildInputs = [
libtiff
libtiff.dev_private
libpng
zlib
libwebp
libraw
openexr
openjpeg
libjpeg
libjpeg.dev_private
jxrlib
];
postBuild = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
make -f Makefile.fip
'';
INCDIR = "${placeholder "out"}/include";
INSTALLDIR = "${placeholder "out"}/lib";
preInstall = ''
mkdir -p $INCDIR $INSTALLDIR
''
# Workaround for Makefiles.osx not using ?=
+ lib.optionalString stdenv.hostPlatform.isDarwin ''
makeFlagsArray+=( "INCDIR=$INCDIR" "INSTALLDIR=$INSTALLDIR" )
'';
postInstall =
lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
make -f Makefile.fip install
''
+ lib.optionalString stdenv.hostPlatform.isDarwin ''
ln -s $out/lib/libfreeimage.3.dylib $out/lib/libfreeimage.dylib
'';
enableParallelBuilding = true;
meta = {
description = "Open Source library for accessing popular graphics image file formats";
homepage = "http://freeimage.sourceforge.net/";
license = with lib.licenses; [
freeimage
gpl2Only
gpl3Only
];
knownVulnerabilities = [
"CVE-2024-31570"
"CVE-2024-28584"
"CVE-2024-28583"
"CVE-2024-28582"
"CVE-2024-28581"
"CVE-2024-28580"
"CVE-2024-28579"
"CVE-2024-28578"
"CVE-2024-28577"
"CVE-2024-28576"
"CVE-2024-28575"
"CVE-2024-28574"
"CVE-2024-28573"
"CVE-2024-28572"
"CVE-2024-28571"
"CVE-2024-28570"
"CVE-2024-28569"
"CVE-2024-28568"
"CVE-2024-28567"
"CVE-2024-28566"
"CVE-2024-28565"
"CVE-2024-28564"
"CVE-2024-28563"
"CVE-2024-28562"
"CVE-2024-9029"
# "CVE-2023-47997"
"CVE-2023-47996"
# "CVE-2023-47995"
"CVE-2023-47994"
"CVE-2023-47993"
"CVE-2023-47992"
# "CVE-2021-40266"
"CVE-2021-40265"
"CVE-2021-40264"
# "CVE-2021-40263"
"CVE-2021-40262"
# "CVE-2021-33367"
# "CVE-2020-24295"
"CVE-2020-24294"
# "CVE-2020-24293"
# "CVE-2020-24292"
"CVE-2020-21426"
"CVE-2019-12214"
"CVE-2019-12212"
];
maintainers = [ ];
platforms = with lib.platforms; unix;
};
})

584
pkgs/by-name/fr/freeimage/unbundle.diff
View File

File diff suppressed because one or more lines are too long

3
pkgs/by-name/im/imv/package.nix
View File

@@ -27,7 +27,6 @@
"libheif"
"libnsgif"
],
freeimage,
libtiff,
libjpeg_turbo,
libjxl,
@@ -50,7 +49,6 @@ let
backends = {
inherit
freeimage
libtiff
libpng
librsvg
@@ -59,6 +57,7 @@ let
libnsgif
;
libjpeg = libjpeg_turbo;
freeimage = throw "freeimage backend not supported";
};
backendFlags = map (

2
pkgs/by-name/li/libtiff/package.nix
View File

@@ -32,7 +32,6 @@
graphicsmagick,
gdal,
openimageio,
freeimage,
testers,
}:
@@ -113,7 +112,6 @@ stdenv.mkDerivation (finalAttrs: {
graphicsmagick
gdal
openimageio
freeimage
;
inherit (python3Packages) pillow imread;

9
pkgs/by-name/me/megacmd/package.nix
View File

@@ -7,7 +7,6 @@
curl,
fetchFromGitHub,
ffmpeg,
freeimage,
gcc-unwrapped,
icu,
libmediainfo,
@@ -19,7 +18,6 @@
pkg-config,
readline,
sqlite,
withFreeImage ? false, # default to false because freeimage is insecure
}:
let
@@ -71,8 +69,7 @@ stdenv.mkDerivation {
pcre-cpp
readline
sqlite
]
++ lib.optionals withFreeImage [ freeimage ];
];
configureFlags = [
"--disable-examples"
@@ -88,8 +85,8 @@ stdenv.mkDerivation {
"--with-readline"
"--with-sodium"
"--with-termcap"
]
++ (if withFreeImage then [ "--with-freeimage" ] else [ "--without-freeimage" ]);
"--without-freeimage"
];
# On darwin, some macros defined in AssertMacros.h (from apple-sdk) are conflicting.
postConfigure = ''

3
pkgs/development/lisp-modules/ql.nix
View File

@@ -27,9 +27,6 @@ let
cl-cairo2-xlib = super.cl-cairo2-xlib.overrideLispAttrs (o: {
nativeLibs = [ pkgs.gtk2-x11 ];
});
cl-freeimage = super.cl-freeimage.overrideLispAttrs (o: {
nativeLibs = [ pkgs.freeimage ];
});
cl-freetype2 = super.cl-freetype2.overrideLispAttrs (o: {
nativeLibs = [ pkgs.freetype ];
nativeBuildInputs = [ pkgs.freetype ];

1
pkgs/top-level/aliases.nix
View File

@@ -968,6 +968,7 @@ mapAliases {
francis = kdePackages.francis; # added 2024-07-13
freecad-qt6 = freecad; # added 2025-06-14
freecad-wayland = freecad; # added 2025-06-14
freeimage = throw "freeimage was removed due to numerous vulnerabilities"; # Added 2025-10-23
freerdp3 = freerdp; # added 2025-03-25
freerdpUnstable = freerdp; # added 2025-03-25
frostwire = throw "frostwire was removed, as it was broken due to reproducibility issues, use `frostwire-bin` package instead."; # added 2024-05-17

4
pkgs/top-level/all-packages.nix
View File

@@ -7225,10 +7225,6 @@ with pkgs;
fplll = callPackage ../development/libraries/fplll { };
fplll_20160331 = callPackage ../development/libraries/fplll/20160331.nix { };
freeimage = callPackage ../by-name/fr/freeimage/package.nix {
openexr = openexr_2;
};
freeipa = callPackage ../os-specific/linux/freeipa {
# NOTE: freeipa and sssd need to be built with the same version of python
kerberos = krb5.override {