guix_mirror_bot pushed a commit to branch world-rebuild in repository guix.
commit 455d05cd7db425a33469731a6aca52d5df14735a Author: Nguyễn Gia Phong <[email protected]> AuthorDate: Mon Aug 31 10:27:56 2026 +0900 gnu: libde265: Ungraft and update to 1.1.1. * gnu/packages/patches/libde265-CVE-2023-49465.patch: Remove patch. * gnu/packages/patches/libde265-CVE-2023-49467.patch: Remove patch. * gnu/packages/patches/libde265-CVE-2023-49468.patch: Remove patch. * gnu/packages/patches/libde265-CVE-2026-33164-CVE-2026-33165.patch: Remove patch. * gnu/packages/patches/libde265-CVE-2026-49295.patch: Remove patch. * gnu/local.mk: Deregister removed patches. * gnu/packages/video.scm (libde265): Update to 1.1.1. [replacement]: Unset. [arguments]: Use G-expression. (libde265/fixed): Delete variable. --- gnu/local.mk | 5 --- gnu/packages/patches/libde265-CVE-2023-49465.patch | 33 ---------------- gnu/packages/patches/libde265-CVE-2023-49467.patch | 29 -------------- gnu/packages/patches/libde265-CVE-2023-49468.patch | 33 ---------------- .../libde265-CVE-2026-33164-CVE-2026-33165.patch | 44 ---------------------- gnu/packages/patches/libde265-CVE-2026-49295.patch | 40 -------------------- gnu/packages/video.scm | 21 ++--------- 7 files changed, 3 insertions(+), 202 deletions(-) diff --git a/gnu/local.mk b/gnu/local.mk index e30fc4e0ca..5ff1045518 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -1719,11 +1719,6 @@ dist_patch_DATA = \ %D%/packages/patches/libcamera-ipa_manager-disable-signature-verification.patch \ %D%/packages/patches/libconfuse-CVE-2022-40320.patch \ %D%/packages/patches/libcss-check-format.patch \ - %D%/packages/patches/libde265-CVE-2023-49465.patch \ - %D%/packages/patches/libde265-CVE-2023-49467.patch \ - %D%/packages/patches/libde265-CVE-2023-49468.patch \ - %D%/packages/patches/libde265-CVE-2026-33164-CVE-2026-33165.patch \ - %D%/packages/patches/libde265-CVE-2026-49295.patch \ %D%/packages/patches/libeb-gcc-14.patch \ %D%/packages/patches/libftdi-fix-paths-when-FTDIPP-set.patch \ %D%/packages/patches/libgeotiff-fix-tests-with-proj-9.1.1.patch \ diff --git a/gnu/packages/patches/libde265-CVE-2023-49465.patch b/gnu/packages/patches/libde265-CVE-2023-49465.patch deleted file mode 100644 index 4feaebf608..0000000000 --- a/gnu/packages/patches/libde265-CVE-2023-49465.patch +++ /dev/null @@ -1,33 +0,0 @@ -https://github.com/strukturag/libde265/commit/1475c7d2f0a6dc35c27e18abc4db9679bfd32568.patch -Patch came straight from upstream. -To be removed with libde265-1.0.15 or later. - -From 1475c7d2f0a6dc35c27e18abc4db9679bfd32568 Mon Sep 17 00:00:00 2001 -From: Dirk Farin <[email protected]> -Date: Thu, 23 Nov 2023 19:43:55 +0100 -Subject: [PATCH] possible fix for #435 - ---- - libde265/motion.cc | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/libde265/motion.cc b/libde265/motion.cc -index 6645f8b6..73b88eb7 100644 ---- a/libde265/motion.cc -+++ b/libde265/motion.cc -@@ -1864,7 +1864,14 @@ void derive_spatial_luma_vector_prediction(base_context* ctx, - logmvcand(vi); - - const de265_image* imgX = NULL; -- if (vi.predFlag[X]) imgX = ctx->get_image(shdr->RefPicList[X][ vi.refIdx[X] ]); -+ if (vi.predFlag[X]) { -+ if (vi.refIdx[X] < 0 || vi.refIdx[X] >= MAX_NUM_REF_PICS) { -+ return; -+ } -+ -+ imgX = ctx->get_image(shdr->RefPicList[X][ vi.refIdx[X] ]); -+ } -+ - const de265_image* imgY = NULL; - if (vi.predFlag[Y]) { - if (vi.refIdx[Y] < 0 || vi.refIdx[Y] >= MAX_NUM_REF_PICS) { diff --git a/gnu/packages/patches/libde265-CVE-2023-49467.patch b/gnu/packages/patches/libde265-CVE-2023-49467.patch deleted file mode 100644 index ed1e96463f..0000000000 --- a/gnu/packages/patches/libde265-CVE-2023-49467.patch +++ /dev/null @@ -1,29 +0,0 @@ -https://github.com/strukturag/libde265/commit/7e4faf254bbd2e52b0f216cb987573a2cce97b54 -Straight from upstream -To be removed with libde265-1.0.15 or later - -From 7e4faf254bbd2e52b0f216cb987573a2cce97b54 Mon Sep 17 00:00:00 2001 -From: Dirk Farin <[email protected]> -Date: Thu, 23 Nov 2023 19:38:34 +0100 -Subject: [PATCH] prevent endless loop for #434 input - ---- - libde265/slice.cc | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/libde265/slice.cc b/libde265/slice.cc -index 435123dc..3a8a8de1 100644 ---- a/libde265/slice.cc -+++ b/libde265/slice.cc -@@ -2582,6 +2582,11 @@ static int decode_rqt_root_cbf(thread_context* tctx) - - static int decode_ref_idx_lX(thread_context* tctx, int numRefIdxLXActive) - { -+ // prevent endless loop when 'numRefIdxLXActive' is invalid -+ if (numRefIdxLXActive <= 1) { -+ return 0; -+ } -+ - logtrace(LogSlice,"# ref_idx_lX\n"); - - int cMax = numRefIdxLXActive-1; diff --git a/gnu/packages/patches/libde265-CVE-2023-49468.patch b/gnu/packages/patches/libde265-CVE-2023-49468.patch deleted file mode 100644 index 1eede9b939..0000000000 --- a/gnu/packages/patches/libde265-CVE-2023-49468.patch +++ /dev/null @@ -1,33 +0,0 @@ -https://github.com/strukturag/libde265/commit/3e822a3ccf88df1380b165d6ce5a00494a27ceeb -Straight from upstream -To be removed with libde265-1.0.15 or later - -From 3e822a3ccf88df1380b165d6ce5a00494a27ceeb Mon Sep 17 00:00:00 2001 -From: Dirk Farin <[email protected]> -Date: Thu, 23 Nov 2023 19:11:34 +0100 -Subject: [PATCH] fix #432 (undefined IPM) - ---- - libde265/image.h | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/libde265/image.h b/libde265/image.h -index 0b536054..0a0c0e32 100644 ---- a/libde265/image.h -+++ b/libde265/image.h -@@ -624,7 +624,14 @@ struct de265_image { - - enum IntraPredMode get_IntraPredMode(int x,int y) const - { -- return (enum IntraPredMode)intraPredMode.get(x,y); -+ uint8_t ipm = intraPredMode.get(x,y); -+ -+ // sanitize values if IPM is uninitialized (because of earlier read error) -+ if (ipm > 34) { -+ ipm = 0; -+ } -+ -+ return static_cast<enum IntraPredMode>(ipm); - } - - enum IntraPredMode get_IntraPredMode_atIndex(int idx) const diff --git a/gnu/packages/patches/libde265-CVE-2026-33164-CVE-2026-33165.patch b/gnu/packages/patches/libde265-CVE-2026-33164-CVE-2026-33165.patch deleted file mode 100644 index 710dfb03e4..0000000000 --- a/gnu/packages/patches/libde265-CVE-2026-33164-CVE-2026-33165.patch +++ /dev/null @@ -1,44 +0,0 @@ -https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658 -Straight from upstream -To be removed with libde265-1.0.17 or later - -From c7891e412106130b83f8e8ea8b7f907e9449b658 Mon Sep 17 00:00:00 2001 -From: Dirk Farin <[email protected]> -Date: Sun, 15 Mar 2026 22:58:39 +0100 -Subject: [PATCH] fix reallocation of metadata array when ctb size changes - (thanks to Ana K.) - ---- - libde265/image.cc | 5 +++-- - libde265/image.h | 2 +- - 2 files changed, 4 insertions(+), 3 deletions(-) - -diff --git a/libde265/image.cc b/libde265/image.cc -index d388901b..204faa5c 100644 ---- a/libde265/image.cc -+++ b/libde265/image.cc -@@ -452,8 +452,9 @@ de265_error de265_image::alloc_image(int w,int h, enum de265_chroma c, - - // CTB info - -- if (ctb_info.width_in_units != sps->PicWidthInCtbsY || -- ctb_info.height_in_units != sps->PicHeightInCtbsY) -+ if (ctb_info.width_in_units != sps->PicWidthInCtbsY || -+ ctb_info.height_in_units != sps->PicHeightInCtbsY || -+ ctb_info.log2unitSize != sps->Log2CtbSizeY) - { - delete[] ctb_progress; - -diff --git a/libde265/image.h b/libde265/image.h -index 2bbe34b6..e062fd33 100644 ---- a/libde265/image.h -+++ b/libde265/image.h -@@ -149,7 +149,7 @@ template <class DataUnit> class MetaDataArray - // private: - DataUnit* data; - int data_size; -- int log2unitSize; -+ uint8_t log2unitSize; - int width_in_units; - int height_in_units; - }; diff --git a/gnu/packages/patches/libde265-CVE-2026-49295.patch b/gnu/packages/patches/libde265-CVE-2026-49295.patch deleted file mode 100644 index e46d5808db..0000000000 --- a/gnu/packages/patches/libde265-CVE-2026-49295.patch +++ /dev/null @@ -1,40 +0,0 @@ -https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652 -Straight from upstream -To be removed with libde265-1.1.0 or later - -From 691f3a3c55b3d32478c4a49895dee061a282652b Mon Sep 17 00:00:00 2001 -From: Dirk Farin <[email protected]> -Date: Mon, 25 May 2026 20:14:07 +0200 -Subject: [PATCH] bound aggregate short-term RPS size (GHSA-g2rg-wj66-w594) - ---- - libde265/refpic.cc | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) - -diff --git a/libde265/refpic.cc b/libde265/refpic.cc -index ea4db4b0..dcd2b214 100644 ---- a/libde265/refpic.cc -+++ b/libde265/refpic.cc -@@ -322,6 +322,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue, - - out_set->compute_derived_values(); - -+ // The unused short-term references are all collected into a single PocStFoll array -+ // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set). -+ // While each individual list is bounded above, the predicted-RPS construction can -+ // append the current-picture delta to an already-full source set, pushing the -+ // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds -+ // write when filling PocStFoll. -+ if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) { -+ out_set->NumNegativePics = 0; -+ out_set->NumPositivePics = 0; -+ out_set->NumDeltaPocs = 0; -+ out_set->NumPocTotalCurr_shortterm_only = 0; -+ -+ errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false); -+ return false; -+ } -+ - return true; - } - diff --git a/gnu/packages/video.scm b/gnu/packages/video.scm index ac32b06a43..b95d5994f8 100644 --- a/gnu/packages/video.scm +++ b/gnu/packages/video.scm @@ -720,8 +720,7 @@ and mmsh protocols.") (define-public libde265 (package (name "libde265") - (version "1.0.14") - (replacement libde265/fixed) + (version "1.1.1") (source (origin (method git-fetch) @@ -731,11 +730,9 @@ and mmsh protocols.") (commit (string-append "v" version)))) (file-name (git-file-name name version)) (sha256 - (base32 "1a4n1hnr9ybji87irg2kya95slf4jnybnkg4x2zihnqqihbnv539")))) + (base32 "1qln88z6jxhwkiay5hby4na0l46s054ylwxa9s69iz6sfihf7fxp")))) (build-system gnu-build-system) - (arguments - `(#:configure-flags - (list "--disable-static"))) + (arguments (list #:configure-flags #~'("--disable-static"))) (native-inputs (list autoconf automake libtool pkg-config python-wrapper)) (inputs @@ -754,18 +751,6 @@ other software.") ;; Library. license:lgpl3+)))) -(define libde265/fixed - (package - (inherit libde265) - (source - (origin - (inherit (package-source libde265)) - (patches (search-patches "libde265-CVE-2023-49465.patch" - "libde265-CVE-2023-49467.patch" - "libde265-CVE-2023-49468.patch" - "libde265-CVE-2026-33164-CVE-2026-33165.patch" - "libde265-CVE-2026-49295.patch")))))) - (define-public tslib (package (name "tslib")
