Security fix for CVE-2022-28041

Rebuild with an appropriate minimum version of stb_image-devel.
Move bundled library virtual Provides to -libs
2022-04-20 11:02:19 -04:00 · 2022-04-20 11:02:14 -04:00 · 2022-04-20 11:01:47 -04:00 · 2022-04-20 11:00:50 -04:00 · 2021-12-11 13:09:21 -05:00 · 2021-10-07 08:23:47 -07:00
4 changed files with 3509 additions and 214 deletions
--- a/8f9bb9563980b41e7695148b63bf09f7abd38a41.patch
+++ b/8f9bb9563980b41e7695148b63bf09f7abd38a41.patch
--- a/USD-21.08-OpenEXR3.patch
+++ b/USD-21.08-OpenEXR3.patch
@ -1,186 +0,0 @@
-diff -Naur USD-21.08-original/cmake/defaults/Packages.cmake USD-21.08/cmake/defaults/Packages.cmake
--- USD-21.08-original/cmake/defaults/Packages.cmake	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/cmake/defaults/Packages.cmake	2021-08-10 10:41:05.317624337 -0400
-@@ -188,6 +188,7 @@
-     # --OpenImageIO
-     if (PXR_BUILD_OPENIMAGEIO_PLUGIN)
-         find_package(OpenEXR REQUIRED)
-+	find_package(Imath REQUIRED)
-         find_package(OpenImageIO REQUIRED)
-         add_definitions(-DPXR_OIIO_PLUGIN_ENABLED)
-     endif()
-@@ -254,7 +255,7 @@
-     endif()
-     # --OpenVDB
-     if (PXR_ENABLE_OPENVDB_SUPPORT)
-        find_package(OpenEXR REQUIRED)
-+        find_package(Imath REQUIRED)
-         find_package(OpenVDB REQUIRED)
-         add_definitions(-DPXR_OPENVDB_SUPPORT_ENABLED)
-     endif()
-@@ -283,7 +284,7 @@
- 
- if (PXR_BUILD_ALEMBIC_PLUGIN)
-     find_package(Alembic REQUIRED)
-    find_package(OpenEXR REQUIRED)
-+    find_package(Imath REQUIRED)
-     if (PXR_ENABLE_HDF5_SUPPORT)
-         find_package(HDF5 REQUIRED
-             COMPONENTS
-@@ -305,6 +306,7 @@
- if(PXR_ENABLE_OSL_SUPPORT)
-     find_package(OSL REQUIRED)
-     find_package(OpenEXR REQUIRED)
-+    find_package(Imath REQUIRED)
-     add_definitions(-DPXR_OSL_SUPPORT_ENABLED)
- endif()
- 
-diff -Naur USD-21.08-original/cmake/modules/FindOpenEXR.cmake USD-21.08/cmake/modules/FindOpenEXR.cmake
--- USD-21.08-original/cmake/modules/FindOpenEXR.cmake	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/cmake/modules/FindOpenEXR.cmake	1969-12-31 19:00:00.000000000 -0500
-@@ -1,101 +0,0 @@
-#
-# Copyright 2016 Pixar
-#
-# Licensed under the Apache License, Version 2.0 (the "Apache License")
-# with the following modification; you may not use this file except in
-# compliance with the Apache License and the following modification to it:
-# Section 6. Trademarks. is deleted and replaced with:
-#
-# 6. Trademarks. This License does not grant permission to use the trade
-#    names, trademarks, service marks, or product names of the Licensor
-#    and its affiliates, except as required to comply with Section 4(c) of
-#    the License and to reproduce the content of the NOTICE file.
-#
-# You may obtain a copy of the Apache License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the Apache License with the above modification is
-# distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the Apache License for the specific
-# language governing permissions and limitations under the Apache License.
-#
-
-find_path(OPENEXR_INCLUDE_DIR
-    OpenEXR/half.h
-HINTS
-    "${OPENEXR_LOCATION}"
-    "$ENV{OPENEXR_LOCATION}"
-PATH_SUFFIXES
-    include/
-DOC
-    "OpenEXR headers path"
-)
-
-if(OPENEXR_INCLUDE_DIR)
-  set(openexr_config_file "${OPENEXR_INCLUDE_DIR}/OpenEXR/OpenEXRConfig.h")
-  if(EXISTS ${openexr_config_file})
-      file(STRINGS
-           ${openexr_config_file}
-           TMP
-           REGEX "#define OPENEXR_VERSION_STRING.*$")
-      string(REGEX MATCHALL "[0-9.]+" OPENEXR_VERSION ${TMP})
-
-      file(STRINGS
-           ${openexr_config_file}
-           TMP
-           REGEX "#define OPENEXR_VERSION_MAJOR.*$")
-      string(REGEX MATCHALL "[0-9]" OPENEXR_MAJOR_VERSION ${TMP})
-
-      file(STRINGS
-           ${openexr_config_file}
-           TMP
-           REGEX "#define OPENEXR_VERSION_MINOR.*$")
-      string(REGEX MATCHALL "[0-9]" OPENEXR_MINOR_VERSION ${TMP})
-  endif()
-endif()
-
-foreach(OPENEXR_LIB
-    Half
-    Iex
-    Imath
-    IlmImf
-    IlmThread
-    IlmImfUtil
-    IexMath
-    )
-
-    # OpenEXR libraries may be suffixed with the version number, so we search
-    # using both versioned and unversioned names.
-    find_library(OPENEXR_${OPENEXR_LIB}_LIBRARY
-        NAMES
-            ${OPENEXR_LIB}-${OPENEXR_MAJOR_VERSION}_${OPENEXR_MINOR_VERSION}
-            ${OPENEXR_LIB}
-        HINTS
-            "${OPENEXR_LOCATION}"
-            "$ENV{OPENEXR_LOCATION}"
-        PATH_SUFFIXES
-            lib/
-        DOC
-            "OPENEXR's ${OPENEXR_LIB} library path"
-    )
-
-    if(OPENEXR_${OPENEXR_LIB}_LIBRARY)
-        list(APPEND OPENEXR_LIBRARIES ${OPENEXR_${OPENEXR_LIB}_LIBRARY})
-    endif()
-endforeach(OPENEXR_LIB)
-
-# So #include <half.h> works
-list(APPEND OPENEXR_INCLUDE_DIRS ${OPENEXR_INCLUDE_DIR})
-list(APPEND OPENEXR_INCLUDE_DIRS ${OPENEXR_INCLUDE_DIR}/OpenEXR)
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(OpenEXR
-    REQUIRED_VARS
-        OPENEXR_INCLUDE_DIRS
-        OPENEXR_LIBRARIES
-    VERSION_VAR
-        OPENEXR_VERSION
-)
-
-diff -Naur USD-21.08-original/pxr/imaging/hioOpenVDB/CMakeLists.txt USD-21.08/pxr/imaging/hioOpenVDB/CMakeLists.txt
--- USD-21.08-original/pxr/imaging/hioOpenVDB/CMakeLists.txt	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/pxr/imaging/hioOpenVDB/CMakeLists.txt	2021-08-10 10:39:27.478207730 -0400
-@@ -14,7 +14,7 @@
-         hio
-         tf
-         usd
-        ${OPENEXR_Half_LIBRARY}
-+	${IMATH_LIBRARIES}
-         ${OPENVDB_LIBRARY}
- 
-     INCLUDE_DIRS
-diff -Naur USD-21.08-original/pxr/imaging/plugin/hioOiio/CMakeLists.txt USD-21.08/pxr/imaging/plugin/hioOiio/CMakeLists.txt
--- USD-21.08-original/pxr/imaging/plugin/hioOiio/CMakeLists.txt	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/pxr/imaging/plugin/hioOiio/CMakeLists.txt	2021-08-10 10:39:31.578183423 -0400
-@@ -17,6 +17,7 @@
-         tf
-         ${OIIO_LIBRARIES}
-         ${OPENEXR_LIBRARIES}
-+	${IMATH_LIBRARIES}
- 
-     INCLUDE_DIRS
-         ${OIIO_INCLUDE_DIRS}
-diff -Naur USD-21.08-original/pxr/usd/plugin/usdAbc/CMakeLists.txt USD-21.08/pxr/usd/plugin/usdAbc/CMakeLists.txt
--- USD-21.08-original/pxr/usd/plugin/usdAbc/CMakeLists.txt	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/pxr/usd/plugin/usdAbc/CMakeLists.txt	2021-08-10 11:55:33.840880041 -0400
-@@ -23,15 +23,12 @@
-         usd
-         usdGeom
-         ${ALEMBIC_LIBRARIES}
-        ${OPENEXR_Half_LIBRARY} 
-        ${OPENEXR_Imath_LIBRARY} 
-        ${OPENEXR_Iex_LIBRARY} 
-        ${OPENEXR_IexMath_LIBRARY}
-+	${IMATH_LIBRARIES}
-         ${optionalLibs}
- 
-     INCLUDE_DIRS
-         ${ALEMBIC_INCLUDE_DIR}
-        ${OPENEXR_INCLUDE_DIRS}
-+	${IMATH_INCLUDE_DIRS}
-         ${optionalIncludeDirs}
- 
-     PRIVATE_CLASSES
--- a/3
+++ b/3
@ -4,9 +4,6 @@
 - Resolves rhbz#1982974
 - Uses autorelease and autochangelog macros

-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 21.05-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
 * Sun Jun 6 2021 Luya Tshimbalanga <luya@fedoraproject.org> - 21.05-5
 - Disable open shading language support

--- a/usd.spec
+++ b/usd.spec
@ -40,14 +40,22 @@ Summary:        3D VFX pipeline interchange file format
 # do not contribute their license terms to the built RPMs.)
 License:        ASL 2.0 and BSD and MIT and (MIT or Unlicense)
 URL:            http://www.openusd.org/
-Source0:         https://github.com/PixarAnimationStudios/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
+Source0:        https://github.com/PixarAnimationStudios/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
 Source1:        org.open%{name}.%{name}view.desktop

 # https://github.com/PixarAnimationStudios/USD/issues/1387
 Patch1:         %{srcname}-20.05-soversion.patch

-# https://github.com/PixarAnimationStudios/USD/issues/1591
-Patch2:         USD-21.08-OpenEXR3.patch
+# Backport 8f9bb9563980b41e7695148b63bf09f7abd38a41 from dev branch:
+# hio: Update stb_image code to latest versions, enable UTF-8 filename support
+# for Windows
+#
+# This gives us Pixar-specific patches that we can apply to the Fedora-packaged
+# stb libraries. These include patches for CVE-2021-42715 and CVE-2021-42716,
+# not yet merged upstream.
+#
+# It also ensures that a fix for CVE-2021-28021 (RHBZ#2015229) is present.
+Patch2:         https://github.com/PixarAnimationStudios/USD/commit/8f9bb9563980b41e7695148b63bf09f7abd38a41.patch

 # Base
 BuildRequires:  boost-devel
@ -89,7 +97,7 @@ BuildRequires:  pkgconfig(OpenColorIO) < 2
 BuildRequires:  pkgconfig(OpenImageIO)
 %endif
 BuildRequires:  cmake(OpenEXR)
-BuildRequires:  cmake(Imath)
+BuildRequires:  pkgconfig(IlmBase) >= 2.0
 BuildRequires:  pkgconfig(Ptex)
 %endif
 %if %{with alembic}
@ -98,6 +106,13 @@ BuildRequires:  hdf5-devel
 %endif

 # Header-only library: -static is for tracking per guidelines
+#
+# stb_image 2.27^20210910gitaf1a5bc-0.2 is the minimum EVR to contain fixes for
+# all of CVE-2021-28021, CVE-2021-42715, CVE-2021-42716, and CVE-2022-28041.
+BuildRequires:  stb_image-devel >= 2.27^20210910gitaf1a5bc-0.2
+BuildRequires:  stb_image-static
+BuildRequires:  stb_image_write-devel
+BuildRequires:  stb_image_write-static
 BuildRequires:  stb_image_resize-devel
 BuildRequires:  stb_image_resize-static

@ -106,21 +121,6 @@ Requires:       %{name}-libs%{?_isa} = %{version}-%{release}
 Requires:       python3-%{name}%{?_isa} = %{version}-%{release}
 %endif

-# Upstream bundles
-# Filed ticket to convince upstream to use system libraries
-# https://github.com/PixarAnimationStudios/USD/issues/1490
-Provides:       bundled(double-conversion) = 2.0.0
-Provides:       bundled(ilmbase) = 2.5.3
-Provides:       bundled(lz4) = 1.9.2
-Provides:       bundled(pugixml) = 1.9
-Provides:       bundled(rapidjson) = 1.0.2
-Provides:       bundled(SPIRV-Reflect) = 1.0
-Provides:       bundled(VulkanMemoryAllocator) = 3.0.0~development
-# Both of these are packaged in Fedora, but USD uses patched versions, so they
-# must be bundled.
-Provides:       bundled(stb_image) = 2.19
-Provides:       bundled(stb_image_write) = 1.09
-
 # This package is only available for x86_64 and aarch64
 # Will fail to build on other architectures
 # https://bugzilla.redhat.com/show_bug.cgi?id=1960848
@ -133,6 +133,26 @@ description for interchange between graphics applications.
 %package        libs
 Summary:        Universal Scene Description library

+# Upstream bundles
+# Filed ticket to convince upstream to use system libraries
+# https://github.com/PixarAnimationStudios/USD/issues/1490
+# Version from: pxr/base/tf/pxrDoubleConversion/README
+Provides:       bundled(double-conversion) = 2.0.0
+# Version from: pxr/base/gf/ilmbase_half.README
+Provides:       bundled(ilmbase) = 2.5.3
+# Version from: pxr/base/tf/pxrLZ4/lz4.h (LZ4_VERSION_{MAJOR,MINOR_PATCH})
+Provides:       bundled(lz4) = 1.9.2
+# Version from:
+# third_party/renderman-24/plugin/rmanArgsParser/pugixml/pugiconfig.hpp
+# (header comment)
+Provides:       bundled(pugixml) = 1.9
+# Version from: pxr/base/js/rapidjson/rapidjson.h
+# (RAPIDJSON_{MAJOR,MINOR,PATCH}_VERSION)
+Provides:       bundled(rapidjson) = 1.0.2
+# Version from: pxr/imaging/hgiVulkan/spirv_reflect.h (header comment)
+Provides:       bundled(SPIRV-Reflect) = 1.0
+# Version from: pxr/imaging/hgiVulkan/vk_mem_alloc.h (header comment)
+Provides:       bundled(VulkanMemoryAllocator) = 3.0.0~development

 %description libs
 Universal Scene Description (USD) is an efficient, scalable system for
@ -205,8 +225,12 @@ ln -s %{_datadir}/fonts/google-roboto pxr/usdImaging/usdviewq/fonts/Roboto
 ln -s %{_datadir}/fonts/google-roboto-mono \
    pxr/usdImaging/usdviewq/fonts/Roboto_Mono

-# Unbundle stb_image_resize:
-ln -svf %{_includedir}/stb_image_resize.h pxr/imaging/hio/stb/
+# Unbundle stb_image, stb_image_write, stb_image_resize:
+pushd pxr/imaging/hio/stb
+cp -p %{_includedir}/stb_image.h %{_includedir}/stb_image_write.h .
+cat stb_image.patch stb_image_write.patch | patch -p1
+ln -svf %{_includedir}/stb_image_resize.h ./
+popd

 # Use c++17 standard otherwise build fails
 sed -i 's|set(CMAKE_CXX_STANDARD 14)|set(CMAKE_CXX_STANDARD 17)|g' \
@ -240,10 +264,6 @@ chmod +x uic-wrapper
 # https://github.com/PixarAnimationStudios/USD/issues/1419

 flags="%{optflags} -Wl,--as-needed -DTBB_SUPPRESS_DEPRECATED_MESSAGES=1" \
-# Patch2 was not good enough to get the include path for Imath everywhere it
-# was needed. Add it globally.
-# https://github.com/PixarAnimationStudios/USD/issues/1591
-flags="${flags} $(pkgconf --cflags Imath)"

 %cmake \
     -DCMAKE_CXX_FLAGS_RELEASE="${flags}" \
Author	SHA1	Message	Date
Benjamin A. Beasley	5761ddd304	Security fix for CVE-2022-28041 Rebuild with an appropriate minimum version of stb_image-devel.	2022-04-20 11:02:19 -04:00
Benjamin A. Beasley	0b99a4bb1b	Move bundled library virtual Provides to -libs	2022-04-20 11:02:14 -04:00
Benjamin A. Beasley	6ac9efa9de	Patch CVE-2021-28021, CVE-2021-42715, and CVE-2021-42716 - Backport 8f9bb9563980b41e7695148b63bf09f7abd38a41 from upstream dev branch to update bundled stb libraries - Use the included patch files on externally-packaged copies to create forked versions that contain fixes for the mentioned CVEs (unbundles stb_image, stb_image_write)	2022-04-20 11:01:47 -04:00
Benjamin A. Beasley	2fd1fcb88a	Add comments explaining where to find versions for bundled deps	2022-04-20 11:00:50 -04:00
Benjamin A. Beasley	20b9c11c50	Fix still trying to link against Imath on F34	2021-12-11 13:09:21 -05:00
Luya Tshimbalanga	55dedbd583	Build Requires Imath for Fedora 35 and up	2021-10-07 08:23:47 -07:00
Luya Tshimbalanga	722697c0c4	Merge branch 'rawhide' into f34	2021-10-07 00:51:14 -07:00
Luya Tshimbalanga	2fa3c9cff0	Update to 21.08	2021-08-28 11:57:13 -07:00
Luya Tshimbalanga	d41d54a637	Update to 21.08	2021-08-01 10:48:08 -07:00