gnu: openjpeg: Fix CVE-2016-5157.
[jackhill/guix/guix.git] / gnu / packages / image.scm
index 2273e78..fe21d23 100644 (file)
@@ -2,12 +2,14 @@
 ;;; Copyright © 2013, 2015, 2016 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2014, 2015 Alex Kost <alezost@gmail.com>
-;;; Copyright © 2014 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2014, 2016 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
 ;;; Copyright © 2015 Amirouche Boubekki <amirouche@hypermove.net>
 ;;; Copyright © 2014 John Darrington <jmd@gnu.org>
 ;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2016 Eric Bavier <bavier@member.fsf.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
   #:use-module (gnu packages autotools)
   #:use-module (gnu packages boost)
   #:use-module (gnu packages compression)
-  #:use-module (gnu packages doxygen)
+  #:use-module (gnu packages documentation)
   #:use-module (gnu packages fontutils)
+  #:use-module (gnu packages gettext)
   #:use-module (gnu packages ghostscript)
   #:use-module (gnu packages gl)
   #:use-module (gnu packages graphics)
   #:use-module (gnu packages maths)
+  #:use-module (gnu packages mcrypt)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
@@ -76,6 +80,22 @@ library.  It supports almost all PNG features and is extensible.")
    (license license:zlib)
    (home-page "http://www.libpng.org/pub/png/libpng.html")))
 
+(define-public libpng-1.2
+  (package
+    (inherit libpng)
+    (version "1.2.56")
+    (source
+     (origin
+       (method url-fetch)
+       ;; Note: upstream removes older tarballs.
+       (uri (list (string-append "mirror://sourceforge/libpng/libpng12/"
+                                 version "/libpng-" version ".tar.xz")
+                  (string-append
+                   "ftp://ftp.simplesystems.org/pub/libpng/png/src"
+                   "/libpng12/libpng-" version ".tar.xz")))
+       (sha256
+        (base32 "1ghd03p353x0vi4dk83n1nlldg11w7vqdk3f99rkgfb82ic59ki4"))))))
+
 (define-public libjpeg
   (package
    (name "libjpeg")
@@ -130,9 +150,41 @@ maximum quality factor.")
    (license license:gpl2+)
    (home-page "http://www.kokkonen.net/tjko/projects.html#jpegoptim")))
 
+(define-public libicns
+  (package
+    (name "libicns")
+    (version "0.8.1")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "mirror://sourceforge/icns/"
+                    "libicns-" version ".tar.gz"))
+              (sha256
+               (base32
+                "1hjm8lwap7bjyyxsyi94fh5817xzqhk4kb5y0b7mb6675xw10prk"))))
+    (build-system gnu-build-system)
+    (inputs
+     `(("libpng" ,libpng)
+       ("jasper" ,jasper)))
+    (arguments
+     `(#:tests? #t)) ; No tests.
+    (home-page "http://icns.sourceforge.net/")
+    (synopsis "Library for handling Mac OS icns resource files")
+    (description
+     "Libicns is a library for the manipulation of Mac OS IconFamily resource
+type files (ICNS).  @command{icns2png} and @command{png2icns} are provided to
+convert between PNG and ICNS. @command{icns2png} will extract image files from
+ICNS files under names like \"Foo_48x48x32.png\" useful for installing for use
+with .desktop files.  Additionally, @command{icontainer2png} is provided for
+extracting icontainer icon files.")
+    (license (list license:lgpl2.1+     ; libicns
+                   license:lgpl2.0+     ; src/apidocs.*
+                   license:gpl2+))))    ; icns2png, png2icns, icontainer2png
+
 (define-public libtiff
   (package
    (name "libtiff")
+   (replacement libtiff/fixed)
    (version "4.0.6")
    (source (origin
             (method url-fetch)
@@ -140,10 +192,10 @@ maximum quality factor.")
                    version ".tar.gz"))
             (sha256 (base32
                      "136nf1rj9dp5jgv1p7z4dk0xy3wki1w0vfjbk82f645m0w4samsd"))
-            (patches (map search-patch
-                          '("libtiff-oob-accesses-in-decode.patch"
-                            "libtiff-oob-write-in-nextdecode.patch"
-                            "libtiff-CVE-2015-8665+CVE-2015-8683.patch")))))
+            (patches (search-patches
+                      "libtiff-oob-accesses-in-decode.patch"
+                      "libtiff-oob-write-in-nextdecode.patch"
+                      "libtiff-CVE-2015-8665+CVE-2015-8683.patch"))))
    (build-system gnu-build-system)
    (outputs '("out"
               "doc"))                           ;1.3 MiB of HTML documentation
@@ -165,6 +217,23 @@ collection of tools for doing simple manipulations of TIFF images.")
                                   "See COPYRIGHT in the distribution."))
    (home-page "http://www.remotesensing.org/libtiff/")))
 
+(define libtiff/fixed
+  (package
+    (inherit libtiff)
+    (source (origin
+              (inherit (package-source libtiff))
+              (patches (search-patches
+                         "libtiff-oob-accesses-in-decode.patch"
+                         "libtiff-oob-write-in-nextdecode.patch"
+                         "libtiff-CVE-2015-8665+CVE-2015-8683.patch"
+                         "libtiff-CVE-2016-3623.patch"
+                         "libtiff-CVE-2016-3945.patch"
+                         "libtiff-CVE-2016-3990.patch"
+                         "libtiff-CVE-2016-3991.patch"
+                         "libtiff-CVE-2016-5314.patch"
+                         "libtiff-CVE-2016-5321.patch"
+                         "libtiff-CVE-2016-5323.patch"))))))
+
 (define-public libwmf
   (package
     (name "libwmf")
@@ -178,18 +247,18 @@ collection of tools for doing simple manipulations of TIFF images.")
         (sha256
          (base32 "1y3wba4q8pl7kr51212jwrsz1x6nslsx1gsjml1x0i8549lmqd2v"))
         (patches
-         (map search-patch '("libwmf-CAN-2004-0941.patch"
-                             "libwmf-CVE-2006-3376.patch"
-                             "libwmf-CVE-2007-0455.patch"
-                             "libwmf-CVE-2007-2756.patch"
-                             "libwmf-CVE-2007-3472.patch"
-                             "libwmf-CVE-2007-3473.patch"
-                             "libwmf-CVE-2007-3477.patch"
-                             "libwmf-CVE-2009-1364.patch"
-                             "libwmf-CVE-2009-3546.patch"
-                             "libwmf-CVE-2015-0848+CVE-2015-4588.patch"
-                             "libwmf-CVE-2015-4695.patch"
-                             "libwmf-CVE-2015-4696.patch")))))
+         (search-patches "libwmf-CAN-2004-0941.patch"
+                         "libwmf-CVE-2006-3376.patch"
+                         "libwmf-CVE-2007-0455.patch"
+                         "libwmf-CVE-2007-2756.patch"
+                         "libwmf-CVE-2007-3472.patch"
+                         "libwmf-CVE-2007-3473.patch"
+                         "libwmf-CVE-2007-3477.patch"
+                         "libwmf-CVE-2009-1364.patch"
+                         "libwmf-CVE-2009-3546.patch"
+                         "libwmf-CVE-2015-0848+CVE-2015-4588.patch"
+                         "libwmf-CVE-2015-4695.patch"
+                         "libwmf-CVE-2015-4696.patch"))))
 
     (build-system gnu-build-system)
     (inputs
@@ -291,7 +360,7 @@ arithmetic ops.")
                           version ".tar.gz"))
         (sha256
           (base32 "1ffhgmf2fqzk0h4k736pp06z7q5y4x41fg844bd6a9vgncq86bby"))
-        (patches (list (search-patch "jbig2dec-ignore-testtest.patch")))))
+        (patches (search-patches "jbig2dec-ignore-testtest.patch"))))
 
     (build-system gnu-build-system)
     (synopsis "Decoder of the JBIG2 image compression format")
@@ -311,17 +380,19 @@ work.")
 (define-public openjpeg
   (package
     (name "openjpeg")
-    (version "2.1.0")
+    (version "2.1.1")
     (source
       (origin
         (method url-fetch)
         (uri
-         (string-append "mirror://sourceforge/openjpeg.mirror/" name "-"
+         (string-append "https://github.com/uclouvain/openjpeg/archive/v"
                         version ".tar.gz"))
+        (file-name (string-append name "-" version ".tar.gz"))
         (sha256
-         (base32 "00zzm303zvv4ijzancrsb1cqbph3pgz0nky92k9qx3fq9y0vnchj"))
-        (patches (map search-patch '("openjpeg-use-after-free-fix.patch"
-                                     "openjpeg-CVE-2015-6581.patch")))))
+         (base32
+          "1anv0rjkbxw9kx91wvlfpb3dhppibda6kb1papny46bjzi3pzhl2"))
+        (patches (search-patches "openjpeg-CVE-2016-5157.patch"
+                                 "openjpeg-CVE-2016-7163.patch"))))
     (build-system cmake-build-system)
     (arguments
       ;; Trying to run `$ make check' results in a no rule fault.
@@ -353,12 +424,13 @@ error-resilience, a Java-viewer for j2k-images, ...")
      (origin
        (method url-fetch)
        (uri
-        (string-append "mirror://sourceforge/openjpeg.mirror/" name "-"
-                       version ".tar.gz"))
+        (string-append "mirror://sourceforge/openjpeg.mirror/" version "/"
+                       name "-" version ".tar.gz"))
        (sha256
         (base32 "1c2xc3nl2mg511b63rk7hrckmy14681p1m44mzw3n1fyqnjm0b0z"))
-       (patches (map search-patch '("openjpeg-use-after-free-fix.patch"
-                                    "openjpeg-CVE-2015-6581.patch")))))))
+       (patches (search-patches "openjpeg-use-after-free-fix.patch"
+                                "openjpeg-CVE-2015-6581.patch"
+                                "openjpeg-CVE-2016-7163.patch"))))))
 
 (define-public openjpeg-1
   (package (inherit openjpeg)
@@ -368,22 +440,22 @@ error-resilience, a Java-viewer for j2k-images, ...")
      (origin
        (method url-fetch)
        (uri
-        (string-append "mirror://sourceforge/openjpeg.mirror/" name "-"
-                       version ".tar.gz"))
+        (string-append "mirror://sourceforge/openjpeg.mirror/" version "/"
+                       name "-" version ".tar.gz"))
        (sha256
         (base32 "11waq9w215zvzxrpv40afyd18qf79mxc28fda80bm3ax98cpppqm"))))))
 
 (define-public giflib
   (package
     (name "giflib")
-    (version "5.1.2")
+    (version "5.1.4")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://sourceforge/giflib/giflib-"
-                                  (first (string-split version #\.))
-                                  ".x/giflib-" version ".tar.bz2"))
+                                  version ".tar.bz2"))
               (sha256
-               (base32 "0z1adsza46q84chkxwr6x8ph11k117k8nywkzwar6bxhqf2a1h3n"))))
+               (base32
+                "1md83dip8rf29y40cm5r7nn19705f54iraz6545zhwa6y8zyq9yz"))))
     (build-system gnu-build-system)
     (outputs '("bin"                    ; utility programs
                "out"))                  ; library
@@ -392,26 +464,25 @@ error-resilience, a Java-viewer for j2k-images, ...")
               ("libsm" ,libsm)
               ("perl" ,perl)))
     (arguments
-     `(#:phases (alist-cons-after
-                 'unpack 'disable-html-doc-gen
-                 (lambda _
-                   (substitute* "doc/Makefile.in"
-                     (("^all: allhtml manpages") "")))
-                 (alist-cons-after
-                  'install 'install-manpages
-                  (lambda* (#:key outputs #:allow-other-keys)
-                    (let* ((bin (assoc-ref outputs "bin"))
-                           (man1dir (string-append bin "/share/man/man1")))
-                      (mkdir-p man1dir)
-                      (for-each (lambda (file)
-                                  (let ((base (basename file)))
-                                    (format #t "installing `~a' to `~a'~%"
-                                            base man1dir)
-                                    (copy-file file
-                                               (string-append
-                                                man1dir "/" base))))
-                                (find-files "doc" "\\.1"))))
-                  %standard-phases))))
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'disable-html-doc-gen
+           (lambda _
+             (substitute* "doc/Makefile.in"
+               (("^all: allhtml manpages") ""))))
+         (add-after 'install 'install-manpages
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((bin (assoc-ref outputs "bin"))
+                    (man1dir (string-append bin "/share/man/man1")))
+               (mkdir-p man1dir)
+               (for-each (lambda (file)
+                           (let ((base (basename file)))
+                             (format #t "installing `~a' to `~a'~%"
+                                     base man1dir)
+                             (copy-file file
+                                        (string-append
+                                         man1dir "/" base))))
+                         (find-files "doc" "\\.1"))))))))
     (synopsis "Tools and library for working with GIF images")
     (description
      "GIFLIB is a library for reading and writing GIF images.  It is API and
@@ -427,7 +498,8 @@ compose, and analyze GIF images.")
     (version "4.1.4")
     (source (origin
               (method url-fetch)
-              (uri (string-append "mirror://sourceforge/giflib/libungif-"
+              (uri (string-append "mirror://sourceforge/giflib/libungif-4.x/"
+                                  "libungif-" version "/libungif-"
                                   version ".tar.bz2"))
               (sha256
                (base32
@@ -443,15 +515,15 @@ compose, and analyze GIF images.")
 (define-public imlib2
   (package
     (name "imlib2")
-    (version "1.4.7")
+    (version "1.4.9")
     (source (origin
               (method url-fetch)
               (uri (string-append
-                    "mirror://sourceforge/enlightenment/imlib2-"
-                    version ".tar.bz2"))
+                    "mirror://sourceforge/enlightenment/imlib2-src/" version
+                    "/imlib2-" version ".tar.bz2"))
               (sha256
                (base32
-                "00a7jbwj10x3jcvxa5rplnkvhv35gv9rb400zy636zdd4g737mrm"))))
+                "08809xxk2555yj6glixzw9a0x3x8cx55imd89kj3r0h152bn8a3x"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkgconfig" ,pkg-config)))
@@ -485,9 +557,13 @@ more modular, simple, and flexible.")
     (version "1.2.4")
     (source (origin
               (method url-fetch)
-              (uri (string-append
-                    "http://linuxbrit.co.uk/downloads/giblib-"
-                    version ".tar.gz"))
+              (uri (list
+                     (string-append
+                       "http://linuxbrit.co.uk/downloads/giblib-"
+                       version ".tar.gz")
+                     (string-append
+                       "https://sourceforge.net/projects/slackbuildsdirectlinks/"
+                       "files/giblib/giblib-" version ".tar.gz")))
               (sha256
                (base32
                 "1b4bmbmj52glq0s898lppkpzxlprq9aav49r06j2wx4dv3212rhp"))))
@@ -520,7 +596,7 @@ supplies a generic doubly-linked list and some string functions.")
             (sha256
              (base32
               "12bz57asdcfsz3zr9i9nska0fb6h3z2aizy412qjqkixkginbz7v"))
-            (patches (list (search-patch "freeimage-CVE-2015-0852.patch")))))
+            (patches (search-patches "freeimage-CVE-2015-0852.patch"))))
    (build-system gnu-build-system)
    (arguments
     '(#:phases (alist-delete
@@ -643,8 +719,8 @@ channels.")
     (version "2.0.3")
     (source (origin
               (method url-fetch)
-              (uri (string-append "mirror://sourceforge/libmng/"
-                                  name "-" version ".tar.xz"))
+              (uri (string-append "mirror://sourceforge/libmng/libmng-devel/"
+                                  version "/" name "-" version ".tar.xz"))
               (sha256
                (base32
                 "1lvxnpds0vcf0lil6ia2036ghqlbl740c4d2sz0q5g6l93fjyija"))))
@@ -673,7 +749,8 @@ channels.")
                 "1zd850nn7nvkkhasrv7kn17kzgslr5ry933v6db62s4lr0zzlbv8"))
               ;; Backported from upstream:
               ;; https://github.com/DentonW/DevIL/commit/724194d7a9a91221a564579f64bdd6f0abd64219.patch
-              (patches (list (search-patch "devil-fix-libpng.patch")))
+              (patches (search-patches "devil-fix-libpng.patch"
+                                       "devil-CVE-2009-3994.patch"))
               (modules '((guix build utils)))
               (snippet
                ;; Fix old lcms include directives and lib flags.
@@ -723,21 +800,20 @@ convert, manipulate, filter and display a wide variety of image formats.")
               (sha256
                (base32
                 "154l7zk7yh3v8l2l6zm5s2alvd2fzkp6c9i18iajfbna5af5m43b"))
-              (patches
-                (list
-                  (search-patch "jasper-CVE-2007-2721.patch")
-                  (search-patch "jasper-CVE-2008-3520.patch")
-                  (search-patch "jasper-CVE-2008-3522.patch")
-                  (search-patch "jasper-CVE-2011-4516-and-CVE-2011-4517.patch")
-                  (search-patch "jasper-CVE-2014-8137.patch")
-                  (search-patch "jasper-CVE-2014-8138.patch")
-                  (search-patch "jasper-CVE-2014-8157.patch")
-                  (search-patch "jasper-CVE-2014-8158.patch")
-                  (search-patch "jasper-CVE-2014-9029.patch")
-                  (search-patch "jasper-CVE-2016-1577.patch")
-                  (search-patch "jasper-CVE-2016-1867.patch")
-                  (search-patch "jasper-CVE-2016-2089.patch")
-                  (search-patch "jasper-CVE-2016-2116.patch")))))
+              (patches (search-patches
+                        "jasper-CVE-2007-2721.patch"
+                        "jasper-CVE-2008-3520.patch"
+                        "jasper-CVE-2008-3522.patch"
+                        "jasper-CVE-2011-4516-and-CVE-2011-4517.patch"
+                        "jasper-CVE-2014-8137.patch"
+                        "jasper-CVE-2014-8138.patch"
+                        "jasper-CVE-2014-8157.patch"
+                        "jasper-CVE-2014-8158.patch"
+                        "jasper-CVE-2014-9029.patch"
+                        "jasper-CVE-2016-1577.patch"
+                        "jasper-CVE-2016-1867.patch"
+                        "jasper-CVE-2016-2089.patch"
+                        "jasper-CVE-2016-2116.patch"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("unzip" ,unzip)))
@@ -747,3 +823,101 @@ implementation of the codec specified in the JPEG-2000 Part-1 standard (i.e.,
 ISO/IEC 15444-1).")
     (home-page "https://www.ece.uvic.ca/~frodo/jasper/")
     (license (license:x11-style "file://LICENSE"))))
+
+(define-public zimg
+  (package
+    (name "zimg")
+    (version "2.1")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (string-append "https://github.com/sekrit-twc/zimg/archive/"
+                            "release-" version ".tar.gz"))
+        (file-name (string-append name "-" version ".tar.gz"))
+        (sha256
+         (base32
+          "1hqp1gcsa2zhypms5dnasb1srjgxdqm7cip3w5i571kk9nxkn289"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("autoconf" ,autoconf)
+       ("automake" ,automake)
+       ("libtool" ,libtool)))
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'autogen
+           (lambda _
+             (zero? (system* "sh" "autogen.sh")))))))
+    (synopsis "Scaling, colorspace conversion, and dithering library")
+    (description "Zimg implements the commonly required image processing basics
+of scaling, colorspace conversion, and depth conversion.  A simple API enables
+conversion between any supported formats to operate with minimal knowledge from
+the programmer.")
+    (home-page "https://github.com/sekrit-twc/zimg")
+    ;; test/extra/ contains musl-libm, 
+    ;; which is MIT/expat licensed, but only used for tests
+    (license (license:fsf-free "file://COPYING")))) ;WTFPL version 2
+
+(define-public perceptualdiff
+  (package
+    (name "perceptualdiff")
+    (version "1.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/myint/perceptualdiff/archive/v"
+                           version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+        (sha256
+         (base32
+          "0zl6xmp971fffg7fzcz2fbgxg5x2w7l8qa65c008i4kbkc9016ps"))))
+    (build-system cmake-build-system)
+    (inputs `(("freeimage" ,freeimage)))
+    (arguments
+     '(#:phases (modify-phases %standard-phases
+                  (add-after 'unpack 'fix-tests
+                    ;; cmake-build-system uses a build/ directory outside
+                    ;; of the source tree, one level higher than expected
+                    (lambda _
+                      (substitute* "test/run_tests.bash"
+                        (("../build") "../../build")))))))
+    (home-page "https://github.com/myint/perceptualdiff")
+    (synopsis "Perceptual image comparison utility")
+    (description "PerceptualDiff visually compares two images to determine
+whether they look alike.  It uses a computational model of the human visual
+system to detect similarities.  This allows it too see beyond irrelevant
+differences in file encoding, image quality, and other small variations.")
+    (license license:gpl2+)))
+
+(define-public steghide
+  (package
+    (name "steghide")
+    (version "0.5.1")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://sourceforge/steghide/steghide/"
+                                  version "/steghide-" version ".tar.bz2"))
+              (sha256
+               (base32
+                "18bxlhbdc3zsmxj84i417xjh0q28kv26q449k23n0a72ldwziix2"))
+              (patches (list (search-patch "steghide-fixes.patch")))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("gettext" ,gnu-gettext)
+       ("libtool" ,libtool)
+       ("perl" ,perl)))                 ;for tests
+    (inputs
+     `(("libmhash" ,libmhash)
+       ("libmcrypt" ,libmcrypt)
+       ("libjpeg" ,libjpeg)
+       ("zlib" ,zlib)))
+    (arguments
+     `(#:make-flags '("CXXFLAGS=-fpermissive"))) ;required for MHashPP.cc
+    (home-page "http://steghide.sourceforge.net")
+    (synopsis "Image and audio steganography")
+    (description
+     "Steghide is a steganography program that is able to hide data in various
+kinds of image- and audio-files.  The color- respectivly sample-frequencies
+are not changed thus making the embedding resistant against first-order
+statistical tests.")
+    (license license:gpl2+)))