Build: update 3.3 libraries to address CVEs #112530

Brecht Van Lommel · 2023-09-18T15:54:41+02:00

Brecht Van Lommel commented

2023-09-18 15:54:41 +02:00

And ignore a few CVEs that do not affect Blender.

ffmpeg 6.0.0
libxml2 2.10.4
openssl 3.1.2
python 3.10.13 (with changes to use our own ssl)
sndfile 1.2.2
tiff 4.5.1
webp 1.3.2

Ref #98555

And ignore a few CVEs that do not affect Blender. ffmpeg 6.0.0 libxml2 2.10.4 openssl 3.1.2 python 3.10.13 (with changes to use our own ssl) sndfile 1.2.2 tiff 4.5.1 webp 1.3.2 Ref #98555

Brecht Van Lommel added 1 commit 2023-09-18 15:54:48 +02:00

42b87d7ff3 Build: update 3.3 libraries to address CVEs

And ignore a few CVEs that do not affect Blender.

ffmpeg 6.0.0
libxml2 2.10.4
openssl 3.1.2
python 3.10.13 (with changes to use our own ssl)
sndfile 1.2.2
tiff 4.5.1
webp 1.3.2

Brecht Van Lommel added this to the 3.3 LTS milestone 2023-09-18 15:55:35 +02:00

Brecht Van Lommel requested review from Campbell Barton 2023-09-18 16:04:15 +02:00

Brecht Van Lommel requested review from Ray molenkamp 2023-09-18 16:04:15 +02:00

Brecht Van Lommel added the

Module

Platforms, Builds & Tests

label 2023-09-18 16:05:04 +02:00

Ray molenkamp commented

2023-09-28 02:32:20 +02:00

this will need the following fixes from 4.0

af9523d7c2
3735a4d104
974bb38c51

will likely require some more rework after that for ffmpeg but i'll deal with that at a later point in time

this will need the following fixes from 4.0 af9523d7c2e1536adef07a54422b6b4d624eafdf 3735a4d104936ecd13dc8163d611c499d96a3046 974bb38c51364611cf9862bff2268c8d6de27d00 will likely require some more rework after that for ffmpeg but i'll deal with that at a later point in time

Brecht Van Lommel added 3 commits 2023-09-28 15:30:03 +02:00

783bf99909 deps_builder: OIIO validate deps at configure time

The last webp update changed the filenames of the webp libraries
on windows causing oiio not to find them and oiio silently build
without webp support, which only came to light after all of
blender was build and a test failed.

This change makes the OIIO validate and error out if certain
dependencies are not found at configure time so these mistakes
are caught early.

bb0f3ece3c deps_builder: Fix missing Webp support in OIIO build on windows

webp 1.3 changed the filenames on windows to include a `lib` prefix
(ie libwebp.lib rather than webp.lib) now this is a common thing
on linux and cmake has a `CMAKE_FIND_LIBRARY_PREFIXES` variable that
has a list of prefixes to look for during a `find_library` call.

`CMAKE_FIND_LIBRARY_PREFIXES` gets set during the call to the
`project` method in the main CMakeLists of a project. Now for windows
`lib` is *not* a common prefix by CMake, and it doesn't add "lib" to
CMAKE_FIND_LIBRARY_PREFIXES during that call.

so find library doesn't look for it, the libs are not found and an
unhappy time is had by all. Now the most obvious solution would be to
pass `-DCMAKE_FIND_LIBRARY_PREFIXES=lib` to CMake to sidestep this
however, the `project` call will set the variable overwriting
anything you passed through the CLI.

So the fix here is to have `find_library` counter-intuitively look
for both `libwebp` and `webp`

buildbot/vexp-code-patch-coordinator Build done. Details

1ee103a1ff CMake: Update platform_win32.cmake with webp 1.3 support

WebP 1.3 changed the library filenames to include a lib prefix and
added an additional library.

Brecht Van Lommel commented

2023-09-28 15:30:26 +02:00

@blender-bot build

Brecht Van Lommel commented

2023-10-02 19:10:47 +02:00

@LazyDodo do you want to check this before I merge it, or can I go ahead?

Ray molenkamp commented

2023-10-02 19:15:30 +02:00

I'm really short on spare time recently, I'm hoping to get 3.6 done this hopefully in the first half of this week, then move on to 3.3 so up to you if you want to wait that long, I'm not expecting many changes, as the bulk of the work has already been done for 4.0, it likely just be small tweaks at best. (famous last words though)

Brecht Van Lommel referenced this pull request

2023-10-09 15:46:34 +02:00

Library changes for Blender 3.3 #98555

Brecht Van Lommel added 1 commit 2023-10-09 15:48:32 +02:00

d4d21e339d Fix USD hash for renamed repo

Brecht Van Lommel merged commit 96c5cc5d45 into blender-v3.3-release

2023-10-09 15:49:16 +02:00

Brecht Van Lommel referenced this issue from a commit

2023-10-09 15:49:17 +02:00

Build: update 3.3 libraries to address CVEs

Brecht Van Lommel deleted branch fix-cves-3.3

2023-10-09 15:49:18 +02:00