Security fix for CVE-2022-28041

Rebuild with an appropriate minimum version of stb_image-devel.

USD-21.08-OpenEXR3.patch

@@ -1,186 +0,0 @@
-diff -Naur USD-21.08-original/cmake/defaults/Packages.cmake USD-21.08/cmake/defaults/Packages.cmake
---- USD-21.08-original/cmake/defaults/Packages.cmake	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/cmake/defaults/Packages.cmake	2021-08-10 10:41:05.317624337 -0400
-@@ -188,6 +188,7 @@
-     # --OpenImageIO
-     if (PXR_BUILD_OPENIMAGEIO_PLUGIN)
-         find_package(OpenEXR REQUIRED)
-+	find_package(Imath REQUIRED)
-         find_package(OpenImageIO REQUIRED)
-         add_definitions(-DPXR_OIIO_PLUGIN_ENABLED)
-     endif()
-@@ -254,7 +255,7 @@
-     endif()
-     # --OpenVDB
-     if (PXR_ENABLE_OPENVDB_SUPPORT)
--        find_package(OpenEXR REQUIRED)
-+        find_package(Imath REQUIRED)
-         find_package(OpenVDB REQUIRED)
-         add_definitions(-DPXR_OPENVDB_SUPPORT_ENABLED)
-     endif()
-@@ -283,7 +284,7 @@
- 
- if (PXR_BUILD_ALEMBIC_PLUGIN)
-     find_package(Alembic REQUIRED)
--    find_package(OpenEXR REQUIRED)
-+    find_package(Imath REQUIRED)
-     if (PXR_ENABLE_HDF5_SUPPORT)
-         find_package(HDF5 REQUIRED
-             COMPONENTS
-@@ -305,6 +306,7 @@
- if(PXR_ENABLE_OSL_SUPPORT)
-     find_package(OSL REQUIRED)
-     find_package(OpenEXR REQUIRED)
-+    find_package(Imath REQUIRED)
-     add_definitions(-DPXR_OSL_SUPPORT_ENABLED)
- endif()
- 
-diff -Naur USD-21.08-original/cmake/modules/FindOpenEXR.cmake USD-21.08/cmake/modules/FindOpenEXR.cmake
---- USD-21.08-original/cmake/modules/FindOpenEXR.cmake	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/cmake/modules/FindOpenEXR.cmake	1969-12-31 19:00:00.000000000 -0500
-@@ -1,101 +0,0 @@
--#
--# Copyright 2016 Pixar
--#
--# Licensed under the Apache License, Version 2.0 (the "Apache License")
--# with the following modification; you may not use this file except in
--# compliance with the Apache License and the following modification to it:
--# Section 6. Trademarks. is deleted and replaced with:
--#
--# 6. Trademarks. This License does not grant permission to use the trade
--#    names, trademarks, service marks, or product names of the Licensor
--#    and its affiliates, except as required to comply with Section 4(c) of
--#    the License and to reproduce the content of the NOTICE file.
--#
--# You may obtain a copy of the Apache License at
--#
--#     http://www.apache.org/licenses/LICENSE-2.0
--#
--# Unless required by applicable law or agreed to in writing, software
--# distributed under the Apache License with the above modification is
--# distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
--# KIND, either express or implied. See the Apache License for the specific
--# language governing permissions and limitations under the Apache License.
--#
--
--find_path(OPENEXR_INCLUDE_DIR
--    OpenEXR/half.h
--HINTS
--    "${OPENEXR_LOCATION}"
--    "$ENV{OPENEXR_LOCATION}"
--PATH_SUFFIXES
--    include/
--DOC
--    "OpenEXR headers path"
--)
--
--if(OPENEXR_INCLUDE_DIR)
--  set(openexr_config_file "${OPENEXR_INCLUDE_DIR}/OpenEXR/OpenEXRConfig.h")
--  if(EXISTS ${openexr_config_file})
--      file(STRINGS
--           ${openexr_config_file}
--           TMP
--           REGEX "#define OPENEXR_VERSION_STRING.*$")
--      string(REGEX MATCHALL "[0-9.]+" OPENEXR_VERSION ${TMP})
--
--      file(STRINGS
--           ${openexr_config_file}
--           TMP
--           REGEX "#define OPENEXR_VERSION_MAJOR.*$")
--      string(REGEX MATCHALL "[0-9]" OPENEXR_MAJOR_VERSION ${TMP})
--
--      file(STRINGS
--           ${openexr_config_file}
--           TMP
--           REGEX "#define OPENEXR_VERSION_MINOR.*$")
--      string(REGEX MATCHALL "[0-9]" OPENEXR_MINOR_VERSION ${TMP})
--  endif()
--endif()
--
--foreach(OPENEXR_LIB
--    Half
--    Iex
--    Imath
--    IlmImf
--    IlmThread
--    IlmImfUtil
--    IexMath
--    )
--
--    # OpenEXR libraries may be suffixed with the version number, so we search
--    # using both versioned and unversioned names.
--    find_library(OPENEXR_${OPENEXR_LIB}_LIBRARY
--        NAMES
--            ${OPENEXR_LIB}-${OPENEXR_MAJOR_VERSION}_${OPENEXR_MINOR_VERSION}
--            ${OPENEXR_LIB}
--        HINTS
--            "${OPENEXR_LOCATION}"
--            "$ENV{OPENEXR_LOCATION}"
--        PATH_SUFFIXES
--            lib/
--        DOC
--            "OPENEXR's ${OPENEXR_LIB} library path"
--    )
--
--    if(OPENEXR_${OPENEXR_LIB}_LIBRARY)
--        list(APPEND OPENEXR_LIBRARIES ${OPENEXR_${OPENEXR_LIB}_LIBRARY})
--    endif()
--endforeach(OPENEXR_LIB)
--
--# So #include <half.h> works
--list(APPEND OPENEXR_INCLUDE_DIRS ${OPENEXR_INCLUDE_DIR})
--list(APPEND OPENEXR_INCLUDE_DIRS ${OPENEXR_INCLUDE_DIR}/OpenEXR)
--
--include(FindPackageHandleStandardArgs)
--find_package_handle_standard_args(OpenEXR
--    REQUIRED_VARS
--        OPENEXR_INCLUDE_DIRS
--        OPENEXR_LIBRARIES
--    VERSION_VAR
--        OPENEXR_VERSION
--)
--
-diff -Naur USD-21.08-original/pxr/imaging/hioOpenVDB/CMakeLists.txt USD-21.08/pxr/imaging/hioOpenVDB/CMakeLists.txt
---- USD-21.08-original/pxr/imaging/hioOpenVDB/CMakeLists.txt	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/pxr/imaging/hioOpenVDB/CMakeLists.txt	2021-08-10 10:39:27.478207730 -0400
-@@ -14,7 +14,7 @@
-         hio
-         tf
-         usd
--        ${OPENEXR_Half_LIBRARY}
-+	${IMATH_LIBRARIES}
-         ${OPENVDB_LIBRARY}
- 
-     INCLUDE_DIRS
-diff -Naur USD-21.08-original/pxr/imaging/plugin/hioOiio/CMakeLists.txt USD-21.08/pxr/imaging/plugin/hioOiio/CMakeLists.txt
---- USD-21.08-original/pxr/imaging/plugin/hioOiio/CMakeLists.txt	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/pxr/imaging/plugin/hioOiio/CMakeLists.txt	2021-08-10 10:39:31.578183423 -0400
-@@ -17,6 +17,7 @@
-         tf
-         ${OIIO_LIBRARIES}
-         ${OPENEXR_LIBRARIES}
-+	${IMATH_LIBRARIES}
- 
-     INCLUDE_DIRS
-         ${OIIO_INCLUDE_DIRS}
-diff -Naur USD-21.08-original/pxr/usd/plugin/usdAbc/CMakeLists.txt USD-21.08/pxr/usd/plugin/usdAbc/CMakeLists.txt
---- USD-21.08-original/pxr/usd/plugin/usdAbc/CMakeLists.txt	2021-07-15 02:00:41.000000000 -0400
-+++ USD-21.08/pxr/usd/plugin/usdAbc/CMakeLists.txt	2021-08-10 11:55:33.840880041 -0400
-@@ -23,15 +23,12 @@
-         usd
-         usdGeom
-         ${ALEMBIC_LIBRARIES}
--        ${OPENEXR_Half_LIBRARY} 
--        ${OPENEXR_Imath_LIBRARY} 
--        ${OPENEXR_Iex_LIBRARY} 
--        ${OPENEXR_IexMath_LIBRARY}
-+	${IMATH_LIBRARIES}
-         ${optionalLibs}
- 
-     INCLUDE_DIRS
-         ${ALEMBIC_INCLUDE_DIR}
--        ${OPENEXR_INCLUDE_DIRS}
-+	${IMATH_INCLUDE_DIRS}
-         ${optionalIncludeDirs}
- 
-     PRIVATE_CLASSES

changelog

@@ -4,9 +4,6 @@
 - Resolves rhbz#1982974
 - Uses autorelease and autochangelog macros
 
-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 21.05-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
 * Sun Jun 6 2021 Luya Tshimbalanga <luya@fedoraproject.org> - 21.05-5
 - Disable open shading language support
 

usd.spec

@@ -40,14 +40,22 @@ Summary:        3D VFX pipeline interchange file format
 # do not contribute their license terms to the built RPMs.)
 License:        ASL 2.0 and BSD and MIT and (MIT or Unlicense)
 URL:            http://www.openusd.org/
-Source0:         https://github.com/PixarAnimationStudios/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
+Source0:        https://github.com/PixarAnimationStudios/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
 Source1:        org.open%{name}.%{name}view.desktop
 
 # https://github.com/PixarAnimationStudios/USD/issues/1387
 Patch1:         %{srcname}-20.05-soversion.patch
 
-# https://github.com/PixarAnimationStudios/USD/issues/1591
+# Backport 8f9bb9563980b41e7695148b63bf09f7abd38a41 from dev branch:
-Patch2:         USD-21.08-OpenEXR3.patch
+# hio: Update stb_image code to latest versions, enable UTF-8 filename support
+# for Windows
+#
+# This gives us Pixar-specific patches that we can apply to the Fedora-packaged
+# stb libraries. These include patches for CVE-2021-42715 and CVE-2021-42716,
+# not yet merged upstream.
+#
+# It also ensures that a fix for CVE-2021-28021 (RHBZ#2015229) is present.
+Patch2:         https://github.com/PixarAnimationStudios/USD/commit/8f9bb9563980b41e7695148b63bf09f7abd38a41.patch
 
 # Base
 BuildRequires:  boost-devel
@@ -89,7 +97,7 @@ BuildRequires:  pkgconfig(OpenColorIO) < 2
 BuildRequires:  pkgconfig(OpenImageIO)
 %endif
 BuildRequires:  cmake(OpenEXR)
-BuildRequires:  cmake(Imath)
+BuildRequires:  pkgconfig(IlmBase) >= 2.0
 BuildRequires:  pkgconfig(Ptex)
 %endif
 %if %{with alembic}
@@ -98,6 +106,13 @@ BuildRequires:  hdf5-devel
 %endif
 
 # Header-only library: -static is for tracking per guidelines
+#
+# stb_image 2.27^20210910gitaf1a5bc-0.2 is the minimum EVR to contain fixes for
+# all of CVE-2021-28021, CVE-2021-42715, CVE-2021-42716, and CVE-2022-28041.
+BuildRequires:  stb_image-devel >= 2.27^20210910gitaf1a5bc-0.2
+BuildRequires:  stb_image-static
+BuildRequires:  stb_image_write-devel
+BuildRequires:  stb_image_write-static
 BuildRequires:  stb_image_resize-devel
 BuildRequires:  stb_image_resize-static
 
@@ -106,21 +121,6 @@ Requires:       %{name}-libs%{?_isa} = %{version}-%{release}
 Requires:       python3-%{name}%{?_isa} = %{version}-%{release}
 %endif
 
-# Upstream bundles
-# Filed ticket to convince upstream to use system libraries
-# https://github.com/PixarAnimationStudios/USD/issues/1490
-Provides:       bundled(double-conversion) = 2.0.0
-Provides:       bundled(ilmbase) = 2.5.3
-Provides:       bundled(lz4) = 1.9.2
-Provides:       bundled(pugixml) = 1.9
-Provides:       bundled(rapidjson) = 1.0.2
-Provides:       bundled(SPIRV-Reflect) = 1.0
-Provides:       bundled(VulkanMemoryAllocator) = 3.0.0~development
-# Both of these are packaged in Fedora, but USD uses patched versions, so they
-# must be bundled.
-Provides:       bundled(stb_image) = 2.19
-Provides:       bundled(stb_image_write) = 1.09
-
 # This package is only available for x86_64 and aarch64
 # Will fail to build on other architectures
 # https://bugzilla.redhat.com/show_bug.cgi?id=1960848
@@ -133,6 +133,26 @@ description for interchange between graphics applications.
 %package        libs
 Summary:        Universal Scene Description library
 
+# Upstream bundles
+# Filed ticket to convince upstream to use system libraries
+# https://github.com/PixarAnimationStudios/USD/issues/1490
+# Version from: pxr/base/tf/pxrDoubleConversion/README
+Provides:       bundled(double-conversion) = 2.0.0
+# Version from: pxr/base/gf/ilmbase_half.README
+Provides:       bundled(ilmbase) = 2.5.3
+# Version from: pxr/base/tf/pxrLZ4/lz4.h (LZ4_VERSION_{MAJOR,MINOR_PATCH})
+Provides:       bundled(lz4) = 1.9.2
+# Version from:
+# third_party/renderman-24/plugin/rmanArgsParser/pugixml/pugiconfig.hpp
+# (header comment)
+Provides:       bundled(pugixml) = 1.9
+# Version from: pxr/base/js/rapidjson/rapidjson.h
+# (RAPIDJSON_{MAJOR,MINOR,PATCH}_VERSION)
+Provides:       bundled(rapidjson) = 1.0.2
+# Version from: pxr/imaging/hgiVulkan/spirv_reflect.h (header comment)
+Provides:       bundled(SPIRV-Reflect) = 1.0
+# Version from: pxr/imaging/hgiVulkan/vk_mem_alloc.h (header comment)
+Provides:       bundled(VulkanMemoryAllocator) = 3.0.0~development
 
 %description libs
 Universal Scene Description (USD) is an efficient, scalable system for
@@ -205,8 +225,12 @@ ln -s %{_datadir}/fonts/google-roboto pxr/usdImaging/usdviewq/fonts/Roboto
 ln -s %{_datadir}/fonts/google-roboto-mono \
     pxr/usdImaging/usdviewq/fonts/Roboto_Mono
 
-# Unbundle stb_image_resize:
+# Unbundle stb_image, stb_image_write, stb_image_resize:
-ln -svf %{_includedir}/stb_image_resize.h pxr/imaging/hio/stb/
+pushd pxr/imaging/hio/stb
+cp -p %{_includedir}/stb_image.h %{_includedir}/stb_image_write.h .
+cat stb_image.patch stb_image_write.patch | patch -p1
+ln -svf %{_includedir}/stb_image_resize.h ./
+popd
 
 # Use c++17 standard otherwise build fails
 sed -i 's|set(CMAKE_CXX_STANDARD 14)|set(CMAKE_CXX_STANDARD 17)|g' \
@@ -240,10 +264,6 @@ chmod +x uic-wrapper
 # https://github.com/PixarAnimationStudios/USD/issues/1419
 
 flags="%{optflags} -Wl,--as-needed -DTBB_SUPPRESS_DEPRECATED_MESSAGES=1" \
-# Patch2 was not good enough to get the include path for Imath everywhere it
-# was needed. Add it globally.
-# https://github.com/PixarAnimationStudios/USD/issues/1591
-flags="${flags} $(pkgconf --cflags Imath)"
 
 %cmake \
      -DCMAKE_CXX_FLAGS_RELEASE="${flags}" \