gnu: openjpeg: Fix CVE-2016-5157.
[jackhill/guix/guix.git] / gnu / packages / image.scm
index 188d142..fe21d23 100644 (file)
@@ -8,6 +8,8 @@
 ;;; Copyright © 2014 John Darrington <jmd@gnu.org>
 ;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2016 Eric Bavier <bavier@member.fsf.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
   #:use-module (gnu packages compression)
   #:use-module (gnu packages documentation)
   #:use-module (gnu packages fontutils)
+  #:use-module (gnu packages gettext)
   #:use-module (gnu packages ghostscript)
   #:use-module (gnu packages gl)
   #:use-module (gnu packages graphics)
   #:use-module (gnu packages maths)
+  #:use-module (gnu packages mcrypt)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
@@ -146,9 +150,41 @@ maximum quality factor.")
    (license license:gpl2+)
    (home-page "http://www.kokkonen.net/tjko/projects.html#jpegoptim")))
 
+(define-public libicns
+  (package
+    (name "libicns")
+    (version "0.8.1")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "mirror://sourceforge/icns/"
+                    "libicns-" version ".tar.gz"))
+              (sha256
+               (base32
+                "1hjm8lwap7bjyyxsyi94fh5817xzqhk4kb5y0b7mb6675xw10prk"))))
+    (build-system gnu-build-system)
+    (inputs
+     `(("libpng" ,libpng)
+       ("jasper" ,jasper)))
+    (arguments
+     `(#:tests? #t)) ; No tests.
+    (home-page "http://icns.sourceforge.net/")
+    (synopsis "Library for handling Mac OS icns resource files")
+    (description
+     "Libicns is a library for the manipulation of Mac OS IconFamily resource
+type files (ICNS).  @command{icns2png} and @command{png2icns} are provided to
+convert between PNG and ICNS. @command{icns2png} will extract image files from
+ICNS files under names like \"Foo_48x48x32.png\" useful for installing for use
+with .desktop files.  Additionally, @command{icontainer2png} is provided for
+extracting icontainer icon files.")
+    (license (list license:lgpl2.1+     ; libicns
+                   license:lgpl2.0+     ; src/apidocs.*
+                   license:gpl2+))))    ; icns2png, png2icns, icontainer2png
+
 (define-public libtiff
   (package
    (name "libtiff")
+   (replacement libtiff/fixed)
    (version "4.0.6")
    (source (origin
             (method url-fetch)
@@ -181,6 +217,23 @@ collection of tools for doing simple manipulations of TIFF images.")
                                   "See COPYRIGHT in the distribution."))
    (home-page "http://www.remotesensing.org/libtiff/")))
 
+(define libtiff/fixed
+  (package
+    (inherit libtiff)
+    (source (origin
+              (inherit (package-source libtiff))
+              (patches (search-patches
+                         "libtiff-oob-accesses-in-decode.patch"
+                         "libtiff-oob-write-in-nextdecode.patch"
+                         "libtiff-CVE-2015-8665+CVE-2015-8683.patch"
+                         "libtiff-CVE-2016-3623.patch"
+                         "libtiff-CVE-2016-3945.patch"
+                         "libtiff-CVE-2016-3990.patch"
+                         "libtiff-CVE-2016-3991.patch"
+                         "libtiff-CVE-2016-5314.patch"
+                         "libtiff-CVE-2016-5321.patch"
+                         "libtiff-CVE-2016-5323.patch"))))))
+
 (define-public libwmf
   (package
     (name "libwmf")
@@ -327,17 +380,19 @@ work.")
 (define-public openjpeg
   (package
     (name "openjpeg")
-    (version "2.1.0")
+    (version "2.1.1")
     (source
       (origin
         (method url-fetch)
         (uri
-         (string-append "mirror://sourceforge/openjpeg.mirror/" version "/"
-                        name "-" version ".tar.gz"))
+         (string-append "https://github.com/uclouvain/openjpeg/archive/v"
+                        version ".tar.gz"))
+        (file-name (string-append name "-" version ".tar.gz"))
         (sha256
-         (base32 "00zzm303zvv4ijzancrsb1cqbph3pgz0nky92k9qx3fq9y0vnchj"))
-        (patches (search-patches "openjpeg-use-after-free-fix.patch"
-                                 "openjpeg-CVE-2015-6581.patch"))))
+         (base32
+          "1anv0rjkbxw9kx91wvlfpb3dhppibda6kb1papny46bjzi3pzhl2"))
+        (patches (search-patches "openjpeg-CVE-2016-5157.patch"
+                                 "openjpeg-CVE-2016-7163.patch"))))
     (build-system cmake-build-system)
     (arguments
       ;; Trying to run `$ make check' results in a no rule fault.
@@ -374,7 +429,8 @@ error-resilience, a Java-viewer for j2k-images, ...")
        (sha256
         (base32 "1c2xc3nl2mg511b63rk7hrckmy14681p1m44mzw3n1fyqnjm0b0z"))
        (patches (search-patches "openjpeg-use-after-free-fix.patch"
-                                "openjpeg-CVE-2015-6581.patch"))))))
+                                "openjpeg-CVE-2015-6581.patch"
+                                "openjpeg-CVE-2016-7163.patch"))))))
 
 (define-public openjpeg-1
   (package (inherit openjpeg)
@@ -801,3 +857,67 @@ the programmer.")
     ;; test/extra/ contains musl-libm, 
     ;; which is MIT/expat licensed, but only used for tests
     (license (license:fsf-free "file://COPYING")))) ;WTFPL version 2
+
+(define-public perceptualdiff
+  (package
+    (name "perceptualdiff")
+    (version "1.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/myint/perceptualdiff/archive/v"
+                           version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+        (sha256
+         (base32
+          "0zl6xmp971fffg7fzcz2fbgxg5x2w7l8qa65c008i4kbkc9016ps"))))
+    (build-system cmake-build-system)
+    (inputs `(("freeimage" ,freeimage)))
+    (arguments
+     '(#:phases (modify-phases %standard-phases
+                  (add-after 'unpack 'fix-tests
+                    ;; cmake-build-system uses a build/ directory outside
+                    ;; of the source tree, one level higher than expected
+                    (lambda _
+                      (substitute* "test/run_tests.bash"
+                        (("../build") "../../build")))))))
+    (home-page "https://github.com/myint/perceptualdiff")
+    (synopsis "Perceptual image comparison utility")
+    (description "PerceptualDiff visually compares two images to determine
+whether they look alike.  It uses a computational model of the human visual
+system to detect similarities.  This allows it too see beyond irrelevant
+differences in file encoding, image quality, and other small variations.")
+    (license license:gpl2+)))
+
+(define-public steghide
+  (package
+    (name "steghide")
+    (version "0.5.1")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://sourceforge/steghide/steghide/"
+                                  version "/steghide-" version ".tar.bz2"))
+              (sha256
+               (base32
+                "18bxlhbdc3zsmxj84i417xjh0q28kv26q449k23n0a72ldwziix2"))
+              (patches (list (search-patch "steghide-fixes.patch")))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("gettext" ,gnu-gettext)
+       ("libtool" ,libtool)
+       ("perl" ,perl)))                 ;for tests
+    (inputs
+     `(("libmhash" ,libmhash)
+       ("libmcrypt" ,libmcrypt)
+       ("libjpeg" ,libjpeg)
+       ("zlib" ,zlib)))
+    (arguments
+     `(#:make-flags '("CXXFLAGS=-fpermissive"))) ;required for MHashPP.cc
+    (home-page "http://steghide.sourceforge.net")
+    (synopsis "Image and audio steganography")
+    (description
+     "Steghide is a steganography program that is able to hide data in various
+kinds of image- and audio-files.  The color- respectivly sample-frequencies
+are not changed thus making the embedding resistant against first-order
+statistical tests.")
+    (license license:gpl2+)))