feat: update giflib to 5.2.2-1

Makefile

@@ -24,7 +24,7 @@ MANDIR = $(PREFIX)/share/man
 
 VERSION:=$(shell ./getversion)
 LIBMAJOR=7
-LIBMINOR=1
+LIBMINOR=2
 LIBPOINT=0
 LIBVER=$(LIBMAJOR).$(LIBMINOR).$(LIBPOINT)
 
@@ -37,17 +37,15 @@ USOURCES = qprintf.c quantize.c getarg.c
 UHEADERS = getarg.h
 UOBJECTS = $(USOURCES:.c=.o)
 
+UNAME:=$(shell uname)
+
 # Some utilities are installed
 INSTALLABLE = \
 	gif2rgb \
 	gifbuild \
-	gifecho \
-	giffilter \
 	giffix \
-	gifinto \
 	giftext \
 	giftool \
-	gifsponge \
 	gifclrmp
 
 # Some utilities are only used internally for testing.
@@ -56,41 +54,87 @@ INSTALLABLE = \
 UTILS = $(INSTALLABLE) \
 	gifbg \
 	gifcolor \
+	gifecho \
+	giffilter \
 	gifhisto \
+	gifinto \
 	gifsponge \
 	gifwedge
 
 LDLIBS=libgif.a -lm
 
-all: libgif.so libgif.a libutil.so libutil.a $(UTILS)
+MANUAL_PAGES = \
+	doc/gif2rgb.xml \
+	doc/gifbuild.xml \
+	doc/gifclrmp.xml \
+	doc/giffix.xml \
+	doc/giflib.xml \
+	doc/giftext.xml \
+	doc/giftool.xml
+
+SOEXTENSION	= so
+LIBGIFSO	= libgif.$(SOEXTENSION)
+LIBGIFSOMAJOR	= libgif.$(SOEXTENSION).$(LIBMAJOR)
+LIBGIFSOVER	= libgif.$(SOEXTENSION).$(LIBVER)
+LIBUTILSO	= libutil.$(SOEXTENSION)
+LIBUTILSOMAJOR	= libutil.$(SOEXTENSION).$(LIBMAJOR)
+ifeq ($(UNAME), Darwin)
+SOEXTENSION	= dylib
+LIBGIFSO        = libgif.$(SOEXTENSION)
+LIBGIFSOMAJOR   = libgif.$(LIBMAJOR).$(SOEXTENSION)
+LIBGIFSOVER	= libgif.$(LIBVER).$(SOEXTENSION)
+LIBUTILSO	= libutil.$(SOEXTENSION)
+LIBUTILSOMAJOR	= libutil.$(LIBMAJOR).$(SOEXTENSION)
+endif
+
+all: $(LIBGIFSO) libgif.a $(LIBUTILSO) libutil.a $(UTILS)
+ifeq ($(UNAME), Darwin)
+else
 	$(MAKE) -C doc
+endif
 
 $(UTILS):: libgif.a libutil.a
 
-libgif.so: $(OBJECTS) $(HEADERS)
-	$(CC) $(CFLAGS) -shared $(LDFLAGS) -Wl,-soname -Wl,libgif.so.$(LIBMAJOR) -o libgif.so $(OBJECTS)
+$(LIBGIFSO): $(OBJECTS) $(HEADERS)
+ifeq ($(UNAME), Darwin)
+	$(CC) $(CFLAGS) -dynamiclib -current_version $(LIBVER) $(OBJECTS) -o $(LIBGIFSO)
+else
+	$(CC) $(CFLAGS) -shared $(LDFLAGS) -Wl,-soname -Wl,$(LIBGIFSOMAJOR) -o $(LIBGIFSO) $(OBJECTS)
+endif
 
 libgif.a: $(OBJECTS) $(HEADERS)
 	$(AR) rcs libgif.a $(OBJECTS)
 
-libutil.so: $(UOBJECTS) $(UHEADERS)
-	$(CC) $(CFLAGS) -shared $(LDFLAGS) -Wl,-soname -Wl,libutil.so.$(LIBMAJOR) -o libutil.so $(UOBJECTS)
+$(LIBUTILSO): $(UOBJECTS) $(UHEADERS)
+ifeq ($(UNAME), Darwin)
+	$(CC) $(CFLAGS) -dynamiclib -current_version $(LIBVER) $(OBJECTS) -o $(LIBUTILSO)
+else
+	$(CC) $(CFLAGS) -shared $(LDFLAGS) -Wl,-soname -Wl,$(LIBUTILMAJOR) -o $(LIBUTILSO) $(UOBJECTS)
+endif
 
 libutil.a: $(UOBJECTS) $(UHEADERS)
 	$(AR) rcs libutil.a $(UOBJECTS)
 
 clean:
-	rm -f $(UTILS) $(TARGET) libgetarg.a libgif.a libgif.so libutil.a libutil.so *.o
-	rm -f libgif.so.$(LIBMAJOR).$(LIBMINOR).$(LIBPOINT)
-	rm -f libgif.so.$(LIBMAJOR)
+	rm -f $(UTILS) $(TARGET) libgetarg.a libgif.a $(LIBGIFSO) libutil.a $(LIBUTILSO) *.o
+	rm -f $(LIBGIFSOVER)
+	rm -f $(LIBGIFSOMAJOR)
 	rm -fr doc/*.1 *.html doc/staging
 
 check: all
 	$(MAKE) -C tests
 
+reflow:
+	@clang-format --style="{IndentWidth: 8, UseTab: ForIndentation}" -i $$(find . -name "*.[ch]")
+
 # Installation/uninstallation
 
+ifeq ($(UNAME), Darwin)
+install: all install-bin install-include install-lib
+else
 install: all install-bin install-include install-lib install-man
+endif
+
 install-bin: $(INSTALLABLE)
 	$(INSTALL) -d "$(DESTDIR)$(BINDIR)"
 	$(INSTALL) $^ "$(DESTDIR)$(BINDIR)"
@@ -100,22 +144,23 @@ install-include:
 install-lib:
 	$(INSTALL) -d "$(DESTDIR)$(LIBDIR)"
 	$(INSTALL) -m 644 libgif.a "$(DESTDIR)$(LIBDIR)/libgif.a"
-	$(INSTALL) -m 755 libgif.so "$(DESTDIR)$(LIBDIR)/libgif.so.$(LIBVER)"
-	ln -sf libgif.so.$(LIBVER) "$(DESTDIR)$(LIBDIR)/libgif.so.$(LIBMAJOR)"
-	ln -sf libgif.so.$(LIBMAJOR) "$(DESTDIR)$(LIBDIR)/libgif.so"
+	$(INSTALL) -m 755 $(LIBGIFSO) "$(DESTDIR)$(LIBDIR)/$(LIBGIFSOVER)"
+	ln -sf $(LIBGIFSOVER) "$(DESTDIR)$(LIBDIR)/$(LIBGIFSOMAJOR)"
+	ln -sf $(LIBGIFSOMAJOR) "$(DESTDIR)$(LIBDIR)/$(LIBGIFSO)"
 install-man:
 	$(INSTALL) -d "$(DESTDIR)$(MANDIR)/man1"
-	$(INSTALL) -m 644 doc/*.1 "$(DESTDIR)$(MANDIR)/man1"
+	$(INSTALL) -m 644 $(MANUAL_PAGES) "$(DESTDIR)$(MANDIR)/man1"
 uninstall: uninstall-man uninstall-include uninstall-lib uninstall-bin
 uninstall-bin:
 	cd "$(DESTDIR)$(BINDIR)" && rm -f $(INSTALLABLE)
 uninstall-include:
 	rm -f "$(DESTDIR)$(INCDIR)/gif_lib.h"
 uninstall-lib:
 	cd "$(DESTDIR)$(LIBDIR)" && \
-		rm -f libgif.a libgif.so libgif.so.$(LIBMAJOR) libgif.so.$(LIBVER)
+		rm -f libgif.a $(LIBGIFSO) $(LIBGIFSOMAJOR) $(LIBGIFSOVER)
 uninstall-man:
 	cd "$(DESTDIR)$(MANDIR)/man1" && rm -f $(shell cd doc >/dev/null && echo *.1)
+	cd "$(DESTDIR)$(MANDIR)/man7" && rm -f $(shell cd doc >/dev/null && echo *.7)
 
 # Make distribution tarball
 #
@@ -132,9 +177,10 @@ EXTRAS =     README \
 	     history.adoc \
 	     control \
 	     doc/whatsinagif \
+	     doc/gifstandard \
 
 DSOURCES = Makefile *.[ch]
-DOCS = doc/*.xml doc/*.1 doc/*.html doc/index.html.in doc/00README doc/Makefile
+DOCS = doc/*.xml doc/*.1 doc/*.7 doc/*.html doc/index.html.in doc/00README doc/Makefile
 ALL =  $(DSOURCES) $(DOCS) tests pic $(EXTRAS)
 giflib-$(VERSION).tar.gz: $(ALL)
 	$(TAR) --transform='s:^:giflib-$(VERSION)/:' -czf giflib-$(VERSION).tar.gz $(ALL)
@@ -151,7 +197,7 @@ version:
 
 # cppcheck should run clean
 cppcheck:
-	cppcheck --inline-suppr --template gcc --enable=all --suppress=unusedFunction --force *.[ch]
+	cppcheck --quiet --inline-suppr --template gcc --enable=all --suppress=unusedFunction --suppress=missingInclude --force *.[ch]
 
 # Verify the build
 distcheck: all

NEWS

@@ -1,5 +1,97 @@
 			GIFLIB NEWS
 
+Repository head
+===============
+
+This is a point release intended to clear up a couple of CVEs and
+apply point fixes that have been accumulating since 5.2.1
+
+There are a few unresolved (but minor) memory leaks related to design
+issues in the API that still need to be resolved. Expect those fixes
+in the next release.
+
+Code Fixes
+----------
+
+* Fixes for CVE-2023-48161, CVE-2022-28506, 
+
+* Address SF issue #138 Documentation for obsolete utilities still installed
+
+* Address SF issue #139: Typo in "LZW image data" page ("110_2 = 4_10")
+
+* Address SF issue #140: Typo in "LZW image data" page ("LWZ")
+
+* Address SF issue #141: Typo in "Bits and bytes" page ("filed")
+
+* Note as already fixed SF issue #143: cannot compile under mingw
+
+* Address SF issue #144: giflib-5.2.1 cannot be build on windows and other platforms using c89
+
+* Address SF issue #145: Remove manual pages installation for binaries that are not installed too
+
+* Address SF issue #146: [PATCH] Limit installed man pages to binaries, move giflib to section 7
+
+* Address SF issue #147 [PATCH] Fixes to doc/whatsinagif/ content
+
+* Address SF issue #148: heap Out of Bound Read in gif2rgb.c:298 DumpScreen2RGB
+
+* Declared no-info on SF issue #150: There is a denial of service vulnerability in GIFLIB 5.2.1
+
+* Declared Won't-fix on SF issue 149: Out of source builds no longer possible
+
+* Address SF issue #151: A heap-buffer-overflow in gif2rgb.c:294:45
+
+* Address SF issue #152: Fix some typos on the html documentation and man pages
+
+* Address SF issue #153: Fix segmentation faults due to non correct checking for args
+
+* Address SF issue #154: Recover the giffilter manual page
+
+* Address SF issue #155: Add gifsponge docs
+
+* Address SF issue #157: An OutofMemory-Exception or Memory Leak in gif2rgb
+
+* Address SF issue #158: There is a null pointer problem in gif2rgb
+
+* Address SF issue #159 A heap-buffer-overflow in GIFLIB5.2.1 DumpScreen2RGB() in gif2rgb.c:298:45
+
+* Address SF issue #163: detected memory leaks in openbsd_reallocarray giflib/openbsd-reallocarray.c
+
+* Address SF issue #164: detected memory leaks in GifMakeMapObject giflib/gifalloc.c
+
+* Address SF issue #166: a read zero page leads segment fault in getarg.c and memory leaks in gif2rgb.c and gifmalloc.c
+
+* Address SF issue #167: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function at Line 321 of gif2rgb.c
+
+Version 5.2.1
+==============
+
+This is the "Maybe I shouldn't have done a release while in surgical recovery" release.
+
+* In gifbuild.c, avoid a core dump on no color map.
+
+* Restore inadvertently removed library version numbers in Makefile.
+
+Version 5.2.0
+=============
+
+The undocumented and deprecated GifQuantizeBuffer() entry point
+has been moved to the util library to reduce libgif size and attack
+surface. Applications needing this function are couraged to link the
+util library or make their own copy.
+
+The following obsolete utility programs are no longer installed:
+gifecho, giffilter, gifinto, gifsponge. These were either installed in
+error or have been obsolesced by modern image-transformation tools
+like ImageMagick convert. They may be removed entirely in a future
+release.
+
+* Address SourceForge issue #136: Stack-buffer-overflow in gifcolor.c:84
+
+* Address SF bug #134: Giflib fails to slurp significant number of gifs
+
+* Apply SPDX convention for license tagging.
+
 Version 5.1.9
 =============
 
@@ -14,7 +106,7 @@ is applied to GIFs.
 Version 5.1.8
 =============
 
-* Address SF bug #119: MemorySanitizer: FPE on unknown address
+* Address SF bug #119: MemorySanitizer: FPE on unknown address. This is CVE-2019-15133
 
 * Address SF bug #125: 5.1.7: xmlto is still required for tarball
 
@@ -50,19 +142,19 @@ Code Fixes
 * Fix SF bug #113: Heap Buffer Overflow-2 in function DGifDecompressLine()
   in cgif.c.  This had been assigned CVE-2018-11490.
 
-# Fix SF bug #111: segmentation fault in PrintCodeBlock
+* Fix SF bug #111: segmentation fault in PrintCodeBlock
 
 * Fix SF bug #109: Segmentation fault of giftool reading a crafted file
 
 * Fix SF bug #107: Floating point exception in giftext utility
 
-* Fix SF bug: #105 heap buffer overflow in DumpScreen2RGB in gif2rgb.c:317
+* Fix SF bug #105: heap buffer overflow in DumpScreen2RGB in gif2rgb.c:317
 
 * Fix SF bug #104: Ineffective bounds check in DGifSlurp
 
 ^ Fix SF bug #103: GIFLIB 5.1.4: DGifSlurp fails on empty comment
 
-* Fix SF bug #87 Heap buffer overflow in 5.1.2 (gif2rgb).
+* Fix SF bug #87: Heap buffer overflow in 5.1.2 (gif2rgb).
 
 Build Fixes
 -----------

build.adoc

@@ -33,7 +33,7 @@ Microsoft's toolchains are unlikely be looked on favorably.
 
 1. Check the SourceForge tracker for bugs and patches.
 
-2. Bump the version number in the gif_lib.h.  Do "make version"
+2. Bump the version number in gif_lib.h.  Do "make version"
    to confirm that it looks sane when extracted to the Makefile.
 
 3. Version-stamp the top entry in the NEWS file.