blender
/
blender
136
407
Fork 590
Code Issues 6.3k Pull Requests 779 Projects 19 Wiki Activity

Build: update 3.6 libraries to address CVEs and bugs #112528

Merged
Brecht Van Lommel merged 11 commits from brecht/blender:fix-cves-3.6 into blender-v3.6-release 2023-10-09 14:24:44 +02:00
Conversation 4 Commits 11 Files Changed 12 +196 -64
12 changed files with 196 additions and 64 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
build_files/build_environment/cmake/cve_check.csv.in
View File

@ -4,6 +4,8 @@ vendor,product,version,cve_number,remarks,comment
@PYTHON_ID@,CVE-2020-29396,Ignored,issue in odoo not used by blender
@PYTHON_ID@,CVE-2021-32052,Ignored,issue in django not used by blender
@PYTHON_ID@,CVE-2009-3720,Ignored,already fixed in libexpat version used
@PYTHON_ID@,CVE-2023-36632,Ignored,not used in blender and not considered a bug upstream
@PYTHON_ID@,CVE-2023-27043,Ignored,not used in blender
@SSL_ID@,CVE-2009-1390,Ignored,issue in mutt not used by blender
@SSL_ID@,CVE-2009-3765,Ignored,issue in mutt not used by blender
@SSL_ID@,CVE-2009-3766,Ignored,issue in mutt not used by blender
@ -24,6 +26,8 @@ vendor,product,version,cve_number,remarks,comment
@TIFF_ID@,CVE-2022-3626,Ignored,issue in tiff command line tool not used by blender
@TIFF_ID@,CVE-2022-3627,Ignored,issue in tiff command line tool not used by blender
@XML2_ID@,CVE-2016-3709,Ignored,not affecting blender and not considered a security issue upstream
@XML2_ID@,CVE-2023-39615,Ignored,not affecting blender and not considered a security issue upstream
@XML2_ID@,CVE-2020-7595,Ignored,already fixed in the libxml2 version used
@GMP_ID@,CVE-2021-43618,Mitigated,patched using upstream commit 561a9c25298e
@SQLITE_ID@,CVE-2022-35737,Ignored,only affects SQLITE_ENABLE_STAT4 compile option not used by blender or python
@SBOMCONTENTS@

6
build_files/build_environment/cmake/openimageio.cmake
View File

@ -45,6 +45,7 @@ set(OPENIMAGEIO_EXTRA_ARGS
-DBUILD_SHARED_LIBS=ON
${OPENIMAGEIO_LINKSTATIC}
${DEFAULT_BOOST_FLAGS}
-DREQUIRED_DEPS=WebP$<SEMICOLON>JPEGTurbo$<SEMICOLON>TIFF$<SEMICOLON>OpenEXR$<SEMICOLON>PNG$<SEMICOLON>OpenJPEG$<SEMICOLON>fmt$<SEMICOLON>Robinmap$<SEMICOLON>ZLIB$<SEMICOLON>pugixml$<SEMICOLON>Python
-DUSE_LIBSQUISH=OFF
-DUSE_QT5=OFF
-DUSE_NUKE=OFF
@ -106,9 +107,10 @@ ExternalProject_Add(external_openimageio
CMAKE_GENERATOR ${PLATFORM_ALT_GENERATOR}
PREFIX ${BUILD_DIR}/openimageio
PATCH_COMMAND ${PATCH_CMD} -p 1 -N -d ${BUILD_DIR}/openimageio/src/external_openimageio/ < ${PATCH_DIR}/openimageio.diff &&
${PATCH_CMD} -p 1 -N -d ${BUILD_DIR}/openimageio/src/external_openimageio/ < ${PATCH_DIR}/oiio_3832.diff &&
${PATCH_CMD} -p 1 -N -d ${BUILD_DIR}/openimageio/src/external_openimageio/ < ${PATCH_DIR}/oiio_deadlock.diff &&
${PATCH_CMD} -p 1 -N -d ${BUILD_DIR}/openimageio/src/external_openimageio/ < ${PATCH_DIR}/oiio_psd_8da473e254.diff
${PATCH_CMD} -p 1 -N -d ${BUILD_DIR}/openimageio/src/external_openimageio/ < ${PATCH_DIR}/oiio_3984.diff &&
${PATCH_CMD} -p 1 -N -d ${BUILD_DIR}/openimageio/src/external_openimageio/ < ${PATCH_DIR}/oiio_3996.diff &&
${PATCH_CMD} -p 1 -N -d ${BUILD_DIR}/openimageio/src/external_openimageio/ < ${PATCH_DIR}/oiio_webp.diff
CMAKE_ARGS -DCMAKE_INSTALL_PREFIX=${LIBDIR}/openimageio ${DEFAULT_CMAKE_FLAGS} ${OPENIMAGEIO_EXTRA_ARGS}
INSTALL_DIR ${LIBDIR}/openimageio
)

2
build_files/build_environment/cmake/python.cmake
View File

@ -86,7 +86,7 @@ else()
export CFLAGS=${PYTHON_CFLAGS} &&
export CPPFLAGS=${PYTHON_CFLAGS} &&
export LDFLAGS=${PYTHON_LDFLAGS} &&
export PKG_CONFIG_PATH=${LIBDIR}/ffi/lib/pkgconfig:${LIBDIR}/ssl/lib64/pkgconfig)
export PKG_CONFIG_PATH=${LIBDIR}/ffi/lib/pkgconfig:${LIBDIR}/ssl/lib/pkgconfig:${LIBDIR}/ssl/lib64/pkgconfig)
# NOTE: untested on APPLE so far.
if(NOT APPLE)

24
build_files/build_environment/cmake/versions.cmake
View File

@ -9,7 +9,7 @@
# dependencies have one assigned.
set(ZLIB_VERSION 1.2.13)
set(ZLIB_URI https://zlib.net/zlib-${ZLIB_VERSION}.tar.gz)
set(ZLIB_URI https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz)
set(ZLIB_HASH 9b8aa094c4e5765dabf4da391f00d15c)
set(ZLIB_HASH_TYPE MD5)
set(ZLIB_FILE zlib-${ZLIB_VERSION}.tar.gz)
@ -164,9 +164,9 @@ set(OPENMP_URI https://github.com/llvm/llvm-project/releases/download/llvmorg-${
set(OPENMP_HASH_TYPE MD5)
set(OPENMP_FILE openmp-${OPENMP_VERSION}.src.tar.xz)
set(OPENIMAGEIO_VERSION v2.4.11.0)
set(OPENIMAGEIO_VERSION v2.4.15.0)
set(OPENIMAGEIO_URI https://github.com/OpenImageIO/oiio/archive/refs/tags/${OPENIMAGEIO_VERSION}.tar.gz)
set(OPENIMAGEIO_HASH 7eb997479ecfe7d9fa59cc8ddd35d0ae)
set(OPENIMAGEIO_HASH 784391406ee309075a3f82e60a42f023)
brecht marked this conversation as resolved Outdated
Ray molenkamp commented 2023-10-03 01:06:29 +02:00
Outdated
Review
Copy Link

set(OPENIMAGEIO_HASH 784391406ee309075a3f82e60a42f023)

`set(OPENIMAGEIO_HASH 784391406ee309075a3f82e60a42f023)`
set(OPENIMAGEIO_HASH_TYPE MD5)
set(OPENIMAGEIO_FILE OpenImageIO-${OPENIMAGEIO_VERSION}.tar.gz)
@ -208,11 +208,11 @@ set(OSL_FILE OpenShadingLanguage-${OSL_VERSION}.tar.gz)
# BZIP2, FFI, SQLITE and change the versions in this file as well. For compliance
# reasons there can be no exceptions to this.
set(PYTHON_VERSION 3.10.12)
set(PYTHON_VERSION 3.10.13)
set(PYTHON_SHORT_VERSION 3.10)
set(PYTHON_SHORT_VERSION_NO_DOTS 310)
set(PYTHON_URI https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tar.xz)
set(PYTHON_HASH 49b0342476b984e106d308c25d657f12)
set(PYTHON_HASH 8847dc6458d1431d0ae0f55942deeb89)
set(PYTHON_HASH_TYPE MD5)
set(PYTHON_FILE Python-${PYTHON_VERSION}.tar.xz)
set(PYTHON_CPE "cpe:2.3:a:python:python:${PYTHON_VERSION}:-:*:*:*:*:*:*")
@ -354,16 +354,16 @@ set(ICONV_HASH 7d2a800b952942bb2880efb00cfd524c)
set(ICONV_HASH_TYPE MD5)
set(ICONV_FILE libiconv-${ICONV_VERSION}.tar.gz)
set(SNDFILE_VERSION 1.1.0)
set(SNDFILE_URI https://github.com/libsndfile/libsndfile/releases/download/1.1.0/libsndfile-${SNDFILE_VERSION}.tar.xz)
set(SNDFILE_HASH e63dead2b4f0aaf323687619d007ee6a)
set(SNDFILE_VERSION 1.2.2)
set(SNDFILE_URI https://github.com/libsndfile/libsndfile/releases/download/1.2.2/libsndfile-${SNDFILE_VERSION}.tar.xz)
set(SNDFILE_HASH 04e2e6f726da7c5dc87f8cf72f250d04)
set(SNDFILE_HASH_TYPE MD5)
set(SNDFILE_FILE libsndfile-${SNDFILE_VERSION}.tar.xz)
set(SNDFILE_CPE "cpe:2.3:a:libsndfile_project:libsndfile:${SNDFILE_VERSION}:*:*:*:*:*:*:*")
set(WEBP_VERSION 1.2.2)
set(WEBP_VERSION 1.3.2)
set(WEBP_URI https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-${WEBP_VERSION}.tar.gz)
set(WEBP_HASH b5e2e414a8adee4c25fe56b18dd9c549)
set(WEBP_HASH 34869086761c0e2da6361035f7b64771)
set(WEBP_HASH_TYPE MD5)
set(WEBP_FILE libwebp-${WEBP_VERSION}.tar.gz)
set(WEBP_CPE "cpe:2.3:a:webmproject:libwebp:${WEBP_VERSION}:*:*:*:*:*:*:*")
@ -459,9 +459,9 @@ set(LZMA_HASH_TYPE SHA256)
set(LZMA_FILE xz-${LZMA_VERSION}.tar.bz2)
# NOTE: Python's build has been modified to use our ssl version.
set(SSL_VERSION 3.0.9)
set(SSL_VERSION 3.1.2)
set(SSL_URI https://www.openssl.org/source/openssl-${SSL_VERSION}.tar.gz)
set(SSL_HASH eb1ab04781474360f77c318ab89d8c5a03abc38e63d65a603cabbf1b00a1dc90)
set(SSL_HASH a0ce69b8b97ea6a35b96875235aa453b966ba3cba8af2de23657d8b6767d6539)
set(SSL_HASH_TYPE SHA256)
set(SSL_FILE openssl-${SSL_VERSION}.tar.gz)
set(SSL_CPE "cpe:2.3:a:openssl:openssl:${SSL_VERSION}:*:*:*:*:*:*:*")

13
build_files/build_environment/patches/oiio_3832.diff
View File

@ -1,13 +0,0 @@
diff --git a/src/python/py_oiio.cpp b/src/python/py_oiio.cpp
index 6031d2c23..e71105da5 100644
--- a/src/python/py_oiio.cpp
+++ b/src/python/py_oiio.cpp
@@ -153,7 +153,7 @@ oiio_bufinfo::oiio_bufinfo(const py::buffer_info& pybuf, int nchans, int width,
format = TypeUnknown; // No idea what's going on -- error
error = Strutil::fmt::format(
"Python array shape is [{:,}] but expecting h={}, w={}, ch={}",
- cspan<ssize_t>(pybuf.shape), height, width, nchans);
+ cspan<py::ssize_t>(pybuf.shape), height, width, nchans);
}
} else if (pixeldims == 1) {
// Reading a 1D scanline span

13
build_files/build_environment/patches/oiio_3984.diff Normal file
View File

@ -0,0 +1,13 @@
diff --git a/src/libOpenImageIO/exif.cpp b/src/libOpenImageIO/exif.cpp
index 90eaaec6e9..1fbf04140e 100644
--- a/src/libOpenImageIO/exif.cpp
+++ b/src/libOpenImageIO/exif.cpp
@@ -1302,6 +1302,8 @@ encode_exif(const ImageSpec& spec, std::vector<char>& blob,
TIFFHeader head;
head.tiff_magic = (endianreq == endian::little) ? 0x4949 : 0x4d4d;
head.tiff_version = 42;
+ if (endianreq != endian::native)
+ swap_endian(&head.tiff_version);
// N.B. need to swap_endian head.tiff_diroff below, once we know the sizes
append(blob, head);

29
build_files/build_environment/patches/oiio_3996.diff Normal file
View File

@ -0,0 +1,29 @@
diff --git a/src/include/OpenImageIO/fmath.h b/src/include/OpenImageIO/fmath.h
index 0bd71ba9b..419e5e378 100644
--- a/src/include/OpenImageIO/fmath.h
+++ b/src/include/OpenImageIO/fmath.h
@@ -1229,6 +1229,7 @@ convert_type (const S &src)
/// shifted fully to the right.
template<unsigned int FROM_BITS, unsigned int TO_BITS>
inline OIIO_HOSTDEVICE unsigned int bit_range_convert(unsigned int in) {
+ static_assert(FROM_BITS > 0, "FROM_BITS cannot be 0");
unsigned int out = 0;
int shift = TO_BITS - FROM_BITS;
for (; shift > 0; shift -= FROM_BITS)
@@ -1244,10 +1245,12 @@ inline OIIO_HOSTDEVICE unsigned int
bit_range_convert(unsigned int in, unsigned int FROM_BITS, unsigned int TO_BITS)
{
unsigned int out = 0;
- int shift = TO_BITS - FROM_BITS;
- for (; shift > 0; shift -= FROM_BITS)
- out |= in << shift;
- out |= in >> -shift;
+ if (FROM_BITS) {
+ int shift = TO_BITS - FROM_BITS;
+ for (; shift > 0; shift -= FROM_BITS)
+ out |= in << shift;
+ out |= in >> -shift;
+ }
return out;
}

34
build_files/build_environment/patches/oiio_psd_8da473e254.diff
View File

@ -1,34 +0,0 @@
diff --git a/src/psd.imageio/psdinput.cpp b/src/psd.imageio/psdinput.cpp
index 9dc240281..05b008e0a 100644
--- a/src/psd.imageio/psdinput.cpp
+++ b/src/psd.imageio/psdinput.cpp
@@ -1344,9 +1344,27 @@ PSDInput::load_resource_thumbnail(uint32_t length, bool isBGR)
if (!ioread(&jpeg_data[0], jpeg_length))
return false;
+ // Create an IOMemReader that references the thumbnail JPEG blob and read
+ // it with an ImageInput, into the memory owned by an ImageBuf.
Filesystem::IOMemReader thumbblob(jpeg_data.data(), jpeg_length);
- m_thumbnail = ImageBuf("thumbnail.jpg", 0, 0, nullptr, nullptr, &thumbblob);
- m_thumbnail.read(0, 0, true);
+ m_thumbnail.clear();
+ auto imgin = ImageInput::open("thumbnail.jpg", nullptr, &thumbblob);
+ if (imgin) {
+ ImageSpec spec = imgin->spec(0);
+ m_thumbnail.reset(spec, InitializePixels::No);
+ ok = imgin->read_image(0, 0, 0, m_thumbnail.spec().nchannels,
+ m_thumbnail.spec().format,
+ m_thumbnail.localpixels());
+ imgin.reset();
+ } else {
+ errorfmt("Failed to open thumbnail");
+ return false;
+ }
+ if (!ok) {
+ errorfmt("Failed to read thumbnail: {}", m_thumbnail.geterror());
+ m_thumbnail.clear();
+ return false;
+ }
// Set these attributes for the merged composite only (subimage 0)
composite_attribute("thumbnail_width", (int)m_thumbnail.spec().width);

78
build_files/build_environment/patches/oiio_webp.diff Normal file
View File

@ -0,0 +1,78 @@
diff -Naur oiio-2.4.15.0/src/cmake/modules/FindWebP.cmake external_openimageio/src/cmake/modules/FindWebP.cmake
--- oiio-2.4.15.0/src/cmake/modules/FindWebP.cmake 2023-09-01 10:48:29.000000000 -0600
+++ external_openimageio/src/cmake/modules/FindWebP.cmake 2023-09-21 14:47:19.366083900 -0600
@@ -25,15 +25,30 @@
ENV WEBP_INCLUDE_PATH
DOC "The directory where Webp headers reside")
-find_library (WEBP_LIBRARY webp
+find_library (WEBP_LIBRARY
+ NAMES
+ webp
+ libwebp
HINTS
${WEBP_LIBRARY_PATH}
ENV WEBP_LIBRARY_PATH)
-find_library (WEBPDEMUX_LIBRARY webpdemux
+find_library (WEBPDEMUX_LIBRARY
+ NAMES
+ webpdemux
+ libwebpdemux
+ HINTS
+ ${WEBP_LIBRARY_PATH}
+ ENV WEBP_LIBRARY_PATH)
+# New in WebP 1.3
+find_library (WEBP_SHARPYUV_LIBRARY
+ NAMES
+ sharpyuv
+ libsharpyuv
HINTS
${WEBP_LIBRARY_PATH}
ENV WEBP_LIBRARY_PATH)
+
include (FindPackageHandleStandardArgs)
find_package_handle_standard_args (WebP
REQUIRED_VARS WEBP_INCLUDE_DIR
@@ -42,7 +57,7 @@
if (WebP_FOUND)
set (WEBP_INCLUDES "${WEBP_INCLUDE_DIR}")
- set (WEBP_LIBRARIES ${WEBP_LIBRARY} ${WEBPDEMUX_LIBRARY})
+ set (WEBP_LIBRARIES ${WEBP_LIBRARY} ${WEBPDEMUX_LIBRARY} ${WEBP_SHARPYUV_LIBRARY})
if (NOT TARGET WebP::webp)
add_library(WebP::webp UNKNOWN IMPORTED)
@@ -58,10 +73,18 @@
set_property(TARGET WebP::webpdemux APPEND PROPERTY
IMPORTED_LOCATION ${WEBPDEMUX_LIBRARY})
endif ()
+ if (WEBP_SHARPYUV_LIBRARY AND NOT TARGET WebP::sharpyuv)
+ add_library(WebP::sharpyuv UNKNOWN IMPORTED)
+ set_target_properties(WebP::sharpyuv PROPERTIES
+ INTERFACE_INCLUDE_DIRECTORIES ${WEBP_INCLUDES})
+ set_property(TARGET WebP::sharpyuv APPEND PROPERTY
+ IMPORTED_LOCATION ${WEBP_SHARPYUV_LIBRARY})
+ endif ()
endif ()
mark_as_advanced (
WEBP_INCLUDE_DIR
WEBP_LIBRARY
WEBPDEMUX_LIBRARY
+ WEBP_SHARPYUV_LIBRARY
)
diff --git a/src/webp.imageio/CMakeLists.txt b/src/webp.imageio/CMakeLists.txt
index ccf1146..c646e99 100644
--- a/src/webp.imageio/CMakeLists.txt
+++ b/src/webp.imageio/CMakeLists.txt
@@ -4,7 +4,7 @@
if (WebP_FOUND)
add_oiio_plugin (webpinput.cpp webpoutput.cpp
- LINK_LIBRARIES WebP::webp WebP::webpdemux
+ LINK_LIBRARIES WebP::webp WebP::webpdemux WebP::sharpyuv
DEFINITIONS "-DUSE_WEBP=1")
else ()
message (STATUS "WebP plugin will not be built")

36
build_files/build_environment/patches/osl.diff
View File

@ -75,3 +75,39 @@ index 46e4529..8e86486 100644
return false;
}
diff --git a/src/liboslexec/CMakeLists.txt b/src/liboslexec/CMakeLists.txt
index 6bb0d175..19f13513 100644
--- a/src/liboslexec/CMakeLists.txt
+++ b/src/liboslexec/CMakeLists.txt
@@ -148,7 +148,9 @@ file (GLOB exec_headers "*.h")
file (GLOB compiler_headers "../liboslcomp/*.h")
FLEX_BISON ( osolex.l osogram.y oso lib_src exec_headers )
-FLEX_BISON ( ../liboslcomp/osllex.l ../liboslcomp/oslgram.y osl lib_src compiler_headers )
+if (BUILD_SHARED_LIBS)
+ FLEX_BISON ( ../liboslcomp/osllex.l ../liboslcomp/oslgram.y osl lib_src compiler_headers )
+endif()
set ( CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -D__STDC_LIMIT_MACROS -D__STDC_CONSTANT_MACROS" )
diff --git a/src/include/OSL/mask.h b/src/include/OSL/mask.h
index 24197af..b9275f6 100644
--- a/src/include/OSL/mask.h
+++ b/src/include/OSL/mask.h
@@ -4,7 +4,6 @@
#pragma once
-#include <immintrin.h>
#include <type_traits>
#include <OSL/oslconfig.h>
@@ -23,6 +22,8 @@ using std::countr_zero;
#elif OSL_INTEL_CLASSIC_COMPILER_VERSION
+#include <immintrin.h>
+
OSL_FORCEINLINE int popcount(uint32_t x) noexcept { return _mm_popcnt_u32(x);}
OSL_FORCEINLINE int popcount(uint64_t x) noexcept { return _mm_popcnt_u64(x); }
OSL_FORCEINLINE int countr_zero(uint32_t x) noexcept { return _bit_scan_forward(x); }

6
build_files/cmake/Modules/FindWebP.cmake
View File

@ -36,6 +36,7 @@ SET(_webp_FIND_COMPONENTS
webp
webpmux
webpdemux
sharpyuv # New in 1.3
)
SET(_webp_LIBRARIES)
@ -51,7 +52,9 @@ FOREACH(COMPONENT ${_webp_FIND_COMPONENTS})
PATH_SUFFIXES
lib64 lib lib/static
)
LIST(APPEND _webp_LIBRARIES "${WEBP_${UPPERCOMPONENT}_LIBRARY}")
if (WEBP_${UPPERCOMPONENT}_LIBRARY)
LIST(APPEND _webp_LIBRARIES "${WEBP_${UPPERCOMPONENT}_LIBRARY}")
ENDIF()
ENDFOREACH()
IF(${WEBP_WEBP_LIBRARY_NOTFOUND})
@ -79,4 +82,5 @@ MARK_AS_ADVANCED(
WEBP_WEBPDEMUX_LIBRARY
WEBP_WEBPMUX_LIBRARY
WEBP_WEBP_LIBRARY
WEBP_SHARPYUV_LIBRARY
)

15
build_files/cmake/platform/platform_win32.cmake
View File

@ -381,7 +381,20 @@ endif()
if(WITH_IMAGE_WEBP)
set(WEBP_INCLUDE_DIRS ${LIBDIR}/webp/include)
set(WEBP_ROOT_DIR ${LIBDIR}/webp)
set(WEBP_LIBRARIES ${LIBDIR}/webp/lib/webp.lib ${LIBDIR}/webp/lib/webpdemux.lib ${LIBDIR}/webp/lib/webpmux.lib)
if(EXISTS ${LIBDIR}/webp/lib/libsharpyuv.lib) # webp 1.3.x+
set(WEBP_LIBRARIES
${LIBDIR}/webp/lib/libwebp.lib
${LIBDIR}/webp/lib/libwebpdemux.lib
${LIBDIR}/webp/lib/libwebpmux.lib
${LIBDIR}/webp/lib/libsharpyuv.lib
)
else()
set(WEBP_LIBRARIES
${LIBDIR}/webp/lib/webp.lib
${LIBDIR}/webp/lib/webpdemux.lib
${LIBDIR}/webp/lib/webpmux.lib
)
endif()
set(WEBP_FOUND ON)
endif()