diff --git a/python-pillow_sphinx-issues.patch b/0001-python-pillow_sphinx-issues.patch similarity index 42% rename from python-pillow_sphinx-issues.patch rename to 0001-python-pillow_sphinx-issues.patch index 1db7a6cd799c4c2e4318457766c653d2a6c35537..76189fbb8d738ac767f0c17e3a532c277cf1e035 100644 --- a/python-pillow_sphinx-issues.patch +++ b/0001-python-pillow_sphinx-issues.patch @@ -1,7 +1,17 @@ -diff -rupN --no-dereference Pillow-9.0.1/docs/conf.py Pillow-9.0.1-new/docs/conf.py ---- Pillow-9.0.1/docs/conf.py 2022-02-03 00:45:27.000000000 +0100 -+++ Pillow-9.0.1-new/docs/conf.py 2022-02-23 09:06:33.169472252 +0100 -@@ -30,12 +30,10 @@ needs_sphinx = "2.4" +From 73338782fc5f18a2e364a43cb2e79b9b7c4a9887 Mon Sep 17 00:00:00 2001 +From: jianli-97 +Date: Wed, 7 Dec 2022 13:55:00 +0800 +Subject: [PATCH] python-pillow_sphinx-issues + +--- + docs/conf.py | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/docs/conf.py b/docs/conf.py +index bc67d93..fa12f25 100644 +--- a/docs/conf.py ++++ b/docs/conf.py +@@ -28,12 +28,10 @@ needs_sphinx = "2.4" # ones. extensions = [ "sphinx_copybutton", @@ -15,3 +25,6 @@ diff -rupN --no-dereference Pillow-9.0.1/docs/conf.py Pillow-9.0.1-new/docs/conf ] intersphinx_mapping = {"python": ("https://docs.python.org/3", None)} +-- +2.33.0 + diff --git a/python-pillow_spinxwarn.patch b/0001-python-pillow_spinxwarn.patch similarity index 34% rename from python-pillow_spinxwarn.patch rename to 0001-python-pillow_spinxwarn.patch index a9698f7c8e1480e91f69dac67719d79a9e0cbe9c..993db3b7c41e8c21ccbf9a0c9a87c859edaccb03 100644 --- a/python-pillow_spinxwarn.patch +++ b/0001-python-pillow_spinxwarn.patch @@ -1,12 +1,25 @@ -diff -rupN --no-dereference Pillow-9.0.1/docs/Makefile Pillow-9.0.1-new/docs/Makefile ---- Pillow-9.0.1/docs/Makefile 2022-02-03 00:45:27.000000000 +0100 -+++ Pillow-9.0.1-new/docs/Makefile 2022-02-23 09:06:33.060472214 +0100 -@@ -42,7 +42,7 @@ clean: - -rm -rf $(BUILDDIR)/* +From b0678c8f15f0ea0ff0c17b0896b0049b6f9f2992 Mon Sep 17 00:00:00 2001 +From: jianli-97 +Date: Wed, 7 Dec 2022 14:01:44 +0800 +Subject: [PATCH] python-pillow_spinxwarn + +--- + docs/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/docs/Makefile b/docs/Makefile +index 458299a..535d736 100644 +--- a/docs/Makefile ++++ b/docs/Makefile +@@ -47,7 +47,7 @@ install-sphinx: html: + $(MAKE) install-sphinx - $(SPHINXBUILD) -b html -W --keep-going $(ALLSPHINXOPTS) $(BUILDDIR)/html + $(SPHINXBUILD) -b html --keep-going $(ALLSPHINXOPTS) $(BUILDDIR)/html @echo @echo "Build finished. The HTML pages are in $(BUILDDIR)/html." +-- +2.33.0 + diff --git a/Pillow-9.0.1.tar.gz b/9.3.0.tar.gz similarity index 79% rename from Pillow-9.0.1.tar.gz rename to 9.3.0.tar.gz index b6733d7e4241100c688d4fc324ab5d83147d7a02..9d3237d68ae2d6c8b90922c1c7bdcf13ff9accc6 100644 Binary files a/Pillow-9.0.1.tar.gz and b/9.3.0.tar.gz differ diff --git a/CVE-2022-45199.patch b/CVE-2022-45199.patch deleted file mode 100644 index 2173fc7e001f7ec24c668f18fd9dd6a457da905e..0000000000000000000000000000000000000000 --- a/CVE-2022-45199.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 9ae8f6b7aa8ea4638cb675267cd20c5425dcfafc Mon Sep 17 00:00:00 2001 -From: qz_cx -Date: Thu, 17 Nov 2022 10:28:59 +0800 -Subject: [PATCH] Merge pull request #6700 from - hugovk/security-samples_per_pixel-sec - -hugovk committed -Prevent DOS with large SAMPLESPERPIXEL in Tiff IFD -A large value in the SAMPLESPERPIXEL tag could lead to a memory and -runtime DOS in TiffImagePlugin.py when setting up the context for -image decoding. ---- - Tests/test_file_tiff.py | 14 +++++++++++++- - src/PIL/TiffImagePlugin.py | 10 ++++++++++ - 2 files changed, 23 insertions(+), 1 deletion(-) - -diff --git a/Tests/test_file_tiff.py b/Tests/test_file_tiff.py -index 5801e17..57fabfa 100644 ---- a/Tests/test_file_tiff.py -+++ b/Tests/test_file_tiff.py -@@ -3,7 +3,7 @@ from io import BytesIO - - import pytest - --from PIL import Image, ImageFile, TiffImagePlugin -+from PIL import Image, ImageFile, TiffImagePlugin, UnidentifiedImageError - from PIL.TiffImagePlugin import RESOLUTION_UNIT, X_RESOLUTION, Y_RESOLUTION - - from .helper import ( -@@ -734,6 +734,18 @@ class TestFileTiff: - im.load() - ImageFile.LOAD_TRUNCATED_IMAGES = False - -+ @pytest.mark.parametrize( -+ "test_file", -+ [ -+ "Tests/images/oom-225817ca0f8c663be7ab4b9e717b02c661e66834.tif", -+ ], -+ ) -+ @pytest.mark.timeout(2) -+ def test_oom(self, test_file): -+ with pytest.raises(UnidentifiedImageError): -+ with pytest.warns(UserWarning): -+ with Image.open(test_file): -+ pass - - @pytest.mark.skipif(not is_win32(), reason="Windows only") - class TestFileTiffW32: -diff --git a/src/PIL/TiffImagePlugin.py b/src/PIL/TiffImagePlugin.py -index 5df5c4f..f2afe63 100644 ---- a/src/PIL/TiffImagePlugin.py -+++ b/src/PIL/TiffImagePlugin.py -@@ -252,6 +252,8 @@ OPEN_INFO = { - (MM, 8, (1,), 1, (8, 8, 8), ()): ("LAB", "LAB"), - } - -+MAX_SAMPLESPERPIXEL = max(len(key_tp[4]) for key_tp in OPEN_INFO.keys()) -+ - PREFIXES = [ - b"MM\x00\x2A", # Valid TIFF header with big-endian byte order - b"II\x2A\x00", # Valid TIFF header with little-endian byte order -@@ -1310,6 +1312,14 @@ class TiffImageFile(ImageFile.ImageFile): - SAMPLESPERPIXEL, - 3 if self._compression == "tiff_jpeg" and photo in (2, 6) else 1, - ) -+ -+ if samplesPerPixel > MAX_SAMPLESPERPIXEL: -+ # DOS check, samplesPerPixel can be a Long, and we extend the tuple below -+ logger.error( -+ "More samples per pixel than can be decoded: %s", samplesPerPixel -+ ) -+ raise SyntaxError("Invalid value for samples per pixel") -+ - if len(bps_tuple) != samplesPerPixel: - raise SyntaxError("unknown data organization") - --- -2.33.0 - diff --git a/backport-Corrected-memory-allocation.patch b/backport-Corrected-memory-allocation.patch deleted file mode 100644 index 798fb625f75b57b94217803d4e6607f644d4328a..0000000000000000000000000000000000000000 --- a/backport-Corrected-memory-allocation.patch +++ /dev/null @@ -1,30 +0,0 @@ -From fe32501922ef5e1be9a7d307132719bd5d52ca35 Mon Sep 17 00:00:00 2001 -From: Andrew Murray -Date: Fri, 14 Jan 2022 10:16:35 +1100 -Subject: [PATCH] Corrected allocation - -Conflict:NA -Reference:https://github.com/python-pillow/Pillow/pull/5958/commits/fe32501922ef5e1be9a7d307132719bd5d52ca35 - -This patch is the rear patch of CVE-2022-22815,CVE-2022-22816 - ---- - src/path.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/path.c b/src/path.c -index dea274e..1180406 100644 ---- a/src/path.c -+++ b/src/path.c -@@ -57,7 +57,7 @@ alloc_array(Py_ssize_t count) { - if ((unsigned long long)count > (SIZE_MAX / (2 * sizeof(double))) - 1) { - return ImagingError_MemoryError(); - } -- xy = calloc(2 * count * sizeof(double) + 1, sizeof(double)); -+ xy = calloc(2 * count + 1, sizeof(double)); - if (!xy) { - ImagingError_MemoryError(); - } --- -2.27.0 - diff --git a/oom-225817ca0f8c663be7ab4b9e717b02c661e66834.tif b/oom-225817ca0f8c663be7ab4b9e717b02c661e66834.tif deleted file mode 100644 index 01dca594f53e22fda9b11ed5b704326680af1b8c..0000000000000000000000000000000000000000 Binary files a/oom-225817ca0f8c663be7ab4b9e717b02c661e66834.tif and /dev/null differ diff --git a/python-pillow.spec b/python-pillow.spec index 97be9cf50a7e2ee12e7ef29ab7283b82f73aeb86..7560abd0f047c2c77c7edb004838d4088196acf1 100644 --- a/python-pillow.spec +++ b/python-pillow.spec @@ -4,19 +4,15 @@ %global with_docs 0 Name: python-pillow -Version: 9.0.1 -Release: 3 +Version: 9.3.0 +Release: 1 Summary: Python image processing library License: MIT URL: http://python-pillow.github.io/ -Source0: https://github.com/python-pillow/Pillow/archive/%{version}/Pillow-%{version}.tar.gz -Source1: oom-225817ca0f8c663be7ab4b9e717b02c661e66834.tif +Source0: https://github.com/python-pillow/Pillow/archive/refs/tags/%{version}.tar.gz -Patch0: python-pillow_spinxwarn.patch -Patch1: python-pillow_sphinx-issues.patch - -Patch6000: backport-Corrected-memory-allocation.patch -Patch6001: CVE-2022-45199.patch +Patch0: 0001-python-pillow_spinxwarn.patch +Patch1: 0001-python-pillow_sphinx-issues.patch BuildRequires: freetype-devel ghostscript lcms2-devel libimagequant-devel libjpeg-devel libtiff-devel BuildRequires: libwebp-devel openjpeg2-devel tk-devel zlib-devel python3-cffi python3-devel python3-numpy python3-olefile @@ -96,7 +92,6 @@ Provides: python3-imaging-qt = %{version}-%{release} Qt pillow image wrapper. %prep %autosetup -p1 -n Pillow-%{version} -cp %{SOURCE1} Tests/images/ %build @@ -155,6 +150,9 @@ pytest --ignore=_build.python2 --ignore=_build.python3 --ignore=_build.pypy3 -v %{python3_sitearch}/PIL/__pycache__/ImageQt* %changelog +* Wed Dec 7 2022 lijian - 9.3.0-1 +- Upgrade to 9.3.0 + * Thu Nov 17 2022 qz_cx - 9.0.1-3 - Type:CVE - ID:NA @@ -173,15 +171,15 @@ pytest --ignore=_build.python2 --ignore=_build.python3 --ignore=_build.pypy3 -v * Thu Aug 19 2021 hanhui - 8.1.2-2 - DESC: enable test case from setup.py -* Wed Jul 14 2021 OpenStack_SIG - 8.1.2-1 -- Update to 8.1.2 - * Thu Jul 15 2021 liuyumeng - 8.1.1-6 - Type:bugfix - CVE:CVE-2021-34552 - SUG:NA - DESC: incorporate community patch +* Wed Jul 14 2021 OpenStack_SIG - 8.1.2-1 +- Update to 8.1.2 + * Tue Jul 6 2021 hanhui - 8.1.1-5 - Type:bugfix - CVE:CVE-2021-28675 CVE-2021-28676 CVE-2021-28677 CVE-2021-28678 CVE-2021-25287 CVE-2021-25288