Apply fix for CVE-2025-9300

[skip changelog]

.gitignore

@@ -1 +1 @@
-/libsixel-1.10.3.tar.gz
+/libsixel-*.tar.gz

changelog

@@ -0,0 +1,17 @@
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Wed Aug 30 2023 ErrorNoInternet <errornointernet@envs.net> - 1.10.3-3
+- Enabled tests
+
+* Wed Aug 30 2023 ErrorNoInternet <errornointernet@envs.net> - 1.10.3-2
+- Fix a few package review issues
+
+* Sat Jul 29 2023 ErrorNoInternet <errornointernet@envs.net> - 1.10.3-1
+- Initial packaging

libsixel-fix-bash-completions.patch

@@ -0,0 +1,38 @@
+From 0614b54ffb3d1c66965f05d5865db80c44dd6b97 Mon Sep 17 00:00:00 2001
+From: Yao Zi <ziyao@disroot.org>
+Date: Mon, 27 Jan 2025 17:17:11 +0000
+Subject: [PATCH] Make completion file compatible with newer bash-completion
+
+Function _have was renamed as _comp_have_command in bash-completion
+commit 6381fd1f ("refactor: `_have => _comp_have_command`") in 2022.
+Since it's relatively recent, let's provide a wrapper to handle the
+API change.
+
+This fixes error message like "bash: have: command not found" when
+completing img2sixel command with bash-completion 2.16.0.
+
+Signed-off-by: Yao Zi <ziyao@disroot.org>
+---
+ converters/shell-completion/bash/img2sixel | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/converters/shell-completion/bash/img2sixel b/converters/shell-completion/bash/img2sixel
+index 028651bd..306cf895 100644
+--- a/converters/shell-completion/bash/img2sixel
++++ b/converters/shell-completion/bash/img2sixel
+@@ -1,6 +1,14 @@
+ # bash completion for img2sixel
+ 
+-have img2sixel &&
++_libsixel_command_exist() {
++    if declare -F _comp_have_command > /dev/null; then
++        _comp_have_command "$1"
++    else
++        have "$1"
++    fi
++}
++
++_libsixel_command_exist img2sixel &&
+ _img2sixel()
+ {
+     local cur prev

libsixel-fix-cve-2025-9300.patch

@@ -0,0 +1,30 @@
+From a384e96ac83a141c3e752026123325436eb5b8e8 Mon Sep 17 00:00:00 2001
+From: ErrorNoInternet <errornointernet@envs.net>
+Date: Tue, 26 Aug 2025 23:24:14 +0800
+Subject: [PATCH] Fix CVE-2025-9300
+
+Modified version of
+https://github.com/saitoha/libsixel/commit/316c086e79d66b62c0c4bc66229ee894e4fdb7d1.
+---
+ src/encoder.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/encoder.c b/src/encoder.c
+index 4a6a038..45061a1 100644
+--- a/src/encoder.c
++++ b/src/encoder.c
+@@ -700,9 +700,9 @@ sixel_debug_print_palette(
+     fprintf(stderr, "palette:\n");
+     for (i = 0; i < sixel_dither_get_num_of_palette_colors(dither); ++i) {
+         fprintf(stderr, "%d: #%02x%02x%02x\n", i,
++                palette[i * 3 + 0],
+                 palette[i * 3 + 1],
+-                palette[i * 3 + 2],
+-                palette[i * 3 + 3]);
++                palette[i * 3 + 2]);
+     }
+ }
+ 
+-- 
+2.49.0
+

libsixel.spec

@@ -1,38 +1,44 @@
-Name: libsixel
-Version: 1.10.3
-Release: 6%{?dist}
-Summary: SIXEL encoding and decoding
+Name:           libsixel
+Version:        1.10.5
+Release:        %autorelease
+Summary:        SIXEL encoding and decoding
 
-License: MIT
-URL: https://github.com/libsixel/libsixel
-Source0: %{url}/archive/v%{version}/%{name}-%{version}.tar.gz
-Patch0: meson.patch
+License:        MIT
+URL:            https://github.com/libsixel/libsixel
+Source:         %{url}/archive/v%{version}/%{name}-%{version}.tar.gz
 
-BuildRequires: gcc
-BuildRequires: meson
-BuildRequires: pkgconfig(gdlib)
-BuildRequires: pkgconfig(libjpeg)
-BuildRequires: pkgconfig(libpng)
+# https://github.com/libsixel/libsixel/issues/81
+# Taken from https://github.com/libsixel/libsixel/pull/89
+Patch:          libsixel-fix-bash-completions.patch
+
+# https://github.com/saitoha/libsixel/issues/200
+Patch:          libsixel-fix-cve-2025-9300.patch
+
+BuildRequires:  gcc
+BuildRequires:  meson
+BuildRequires:  pkgconfig(gdlib)
+BuildRequires:  pkgconfig(libjpeg)
+BuildRequires:  pkgconfig(libpng)
 
 %description
 An encoder/decoder implementation for DEC SIXEL graphics.
 
 %package devel
-Summary: Development files for %{name}
-Requires: %{name}%{?_isa} = %{version}-%{release}
+Summary:        Development files for %{name}
+Requires:       %{name}%{?_isa} = %{version}-%{release}
 
 %description devel
 %{summary}.
 
 %package utils
-Summary: SIXEL encoder and decoder utilities
-Requires: %{name}%{?_isa} = %{version}-%{release}
+Summary:        SIXEL encoder and decoder utilities
+Requires:       %{name}%{?_isa} = %{version}-%{release}
 
 %description utils
 %{summary}.
 
 %prep
-%autosetup -n %{name}-%{version} -p1
+%autosetup -p1
 
 %build
 %meson -Dtests=enabled
@@ -40,7 +46,6 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
 
 %install
 %meson_install
-rm %{buildroot}/%{_libdir}/libsixel.a
 
 %check
 %meson_test
@@ -68,20 +73,4 @@ rm %{buildroot}/%{_libdir}/libsixel.a
 %{zsh_completions_dir}/_img2sixel
 
 %changelog
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Wed Aug 30 2023 ErrorNoInternet <errornointernet@envs.net> - 1.10.3-3
-- Enabled tests
-
-* Wed Aug 30 2023 ErrorNoInternet <errornointernet@envs.net> - 1.10.3-2
-- Fix a few package review issues
-
-* Sat Jul 29 2023 ErrorNoInternet <errornointernet@envs.net> - 1.10.3-1
-- Initial packaging
+%autochangelog

meson.patch

@@ -1,25 +0,0 @@
---- a/meson.build
-+++ b/meson.build
-@@ -101,17 +101,17 @@
- python2_installation = pymod.find_installation('python2', required: get_option('python2'))
- 
- if get_option('libcurl').enabled() and curl_found.found()
--  conf_data.set('HAVE_LIBCURL', true)
-+  conf_data.set('HAVE_LIBCURL', 1)
-   libsixel_deps += [curl_found]
- endif
- 
--if get_option('jpeg').enabled() and jpeg_found
--  conf_data.set('HAVE_JPEG', true)
-+if get_option('jpeg').enabled() and jpeg_found.found()
-+  conf_data.set('HAVE_JPEG', 1)
-   libsixel_deps += [jpeg_found]
- endif
- 
--if get_option('png').enabled() and png_found
--  conf_data.set('HAVE_PNG', true)
-+if get_option('png').enabled() and png_found.found()
-+  conf_data.set('HAVE_PNG', 1)
-   libsixel_deps += [png_found]
- endif
- 

sources

@@ -1 +1 @@
-SHA512 (libsixel-1.10.3.tar.gz) = ef16f9ccecec8289728ec84ce9f24145648f8a38184c1ec3df8ead3499c6cf7d3e0a0c738f8bfcb1093e16ee8ae7ce5e46d3890707c8104752ce4ab7eb3bc7ac
+SHA512 (libsixel-1.10.5.tar.gz) = 94fc972ee304885936d5d8fbc3dadc5feadebf1ab262bb49c9ae9b1eed19c528ed823f4d31c17326340f06a5b7ee28a1817be15ae55c3e9d0c4437cd36b3e49d