All of lore.kernel.org
 help / color / mirror / Atom feed
* [meta-python][PATCH] python3-pillow: upgrade 8.3.1 -> 8.3.2
@ 2021-09-08 16:53 Trevor Gamblin
  0 siblings, 0 replies; only message in thread
From: Trevor Gamblin @ 2021-09-08 16:53 UTC (permalink / raw)
  To: openembedded-devel

From the release notes:

- CVE-2021-23437: Avoid a potential ReDoS (regular expression denial
of service) in ImageColor’s getrgb() by raising ValueError if the
color specifier is too long. Present since Pillow 5.2.0.
- Fix 6-byte out-of-bounds (OOB) read. The previous bounds check in
FliDecode.c incorrectly calculated the required read buffer size when
copying a chunk, potentially reading six extra bytes off the end of
the allocated buffer from the heap. Present since Pillow 7.1.0. This
bug was found by Google’s OSS-Fuzz CIFuzz runs.
- Pillow now includes binary wheels for Python 3.10.
- Ensure TIFF RowsPerStrip is multiple of 8 for JPEG compression
(#5588).
- Updates for ImagePalette channel order (#5599).
- Hide FriBiDi shim symbols to avoid conflict with real FriBiDi
library (#5651).

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
---
 .../python/{python3-pillow_8.3.1.bb => python3-pillow_8.3.2.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-python/recipes-devtools/python/{python3-pillow_8.3.1.bb => python3-pillow_8.3.2.bb} (93%)

diff --git a/meta-python/recipes-devtools/python/python3-pillow_8.3.1.bb b/meta-python/recipes-devtools/python/python3-pillow_8.3.2.bb
similarity index 93%
rename from meta-python/recipes-devtools/python/python3-pillow_8.3.1.bb
rename to meta-python/recipes-devtools/python/python3-pillow_8.3.2.bb
index d0a17cb1a..68b80a739 100644
--- a/meta-python/recipes-devtools/python/python3-pillow_8.3.1.bb
+++ b/meta-python/recipes-devtools/python/python3-pillow_8.3.2.bb
@@ -9,7 +9,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=8.3.x \
            file://0001-support-cross-compiling.patch \
            file://0001-explicitly-set-compile-options.patch \
 "
-SRCREV ?= "92933b86574b9c80764bf52c357ed29e1ef53382"
+SRCREV ?= "8013f130a5077b238a4346b73e149432b180a8ea"
 
 inherit setuptools3
 
-- 
2.31.1


^ permalink raw reply related	[flat|nested] only message in thread

only message in thread, other threads:[~2021-09-08 16:54 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-08 16:53 [meta-python][PATCH] python3-pillow: upgrade 8.3.1 -> 8.3.2 Trevor Gamblin

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.