aboutsummaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia
AgeCommit message (Collapse)Author
2018-05-07libpng: update SRC_URI to use oslArmin Kuster
ERROR: libpng-1.6.28-r0 do_checkuri: Fetcher failure for URL: 'http://downloads.sourceforge.net/project/libpng/libpng16/1.6.28/libpng-1.6.28.tar.xz'. URL http://downloads.sourceforge.net/project/libpng/libpng16/1.6.28/libpng-1.6.28.tar.xz doesn't work ERROR: libpng-1.6.28-r0 do_checkuri: Function failed: do_checkuri Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-05-07libpng: fix MIRRORS usageRoss Burton
MIRRORS needs to be pairs of values for the original URL to match and the location find it on the mirror. (From OE-Core rev: a649f3da630e8ca2d3ca58b610f3918720dd5229) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-05-07libpng: use SourceForge mirrorRoss Burton
The Gentoo mirror also deletes old versions when they're not used, so revert back to the canonical SourceForge site, adding /older-releases/ to MIRRORS to handle new releases moving the version we want. Original idea by Maxin B. John <maxin.john@intel.com>. (From OE-Core rev: 791a3493c88c9c249f21f6d893b2061e1d8a0af6) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> [Updated for Pyro context] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-03-31libvorbis: CVE-2018-5146Tanu Kaskinen
Prevent out-of-bounds write in codebook decoding. The bug could allow code execution from a specially crafted Ogg Vorbis file. References: https://www.debian.org/security/2018/dsa-4140 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5146 Signed-off-by: Tanu Kaskinen <tanuk@iki.fi> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-03-31libvorbis: CVE-2017-14632Tanu Kaskinen
Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14632 Signed-off-by: Tanu Kaskinen <tanuk@iki.fi> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-03-31libvorbis: CVE-2017-14633Tanu Kaskinen
In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis(). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14633 Signed-off-by: Tanu Kaskinen <tanuk@iki.fi> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-11-05tiff: Security fix for CVE-2017-7593Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Security fix for CVE-2017-7602Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Security fix for CVE-2017-7601Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Security fix for CVE-2017-7598Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Security fix for CVE-2017-7596Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Security fix for CVE-2017-7595Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Security fix for CVE-2017-7594Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Security fix for CVE-2017-7592Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Security fix for CVE-2016-10270Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Security fix for CVE-2016-10269Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Security fix CVE-2016-10267Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Security fix CVE-2016-10266Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Security fix CVE-2016-10268Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Secruity fix CVE-2016-10093Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-11-05tiff: Security fix for CVE-2016-10271Rajkumar Veer
Signed-off-by: Rajkumar Veer <rveer@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2017-09-21alsa-utils: Do not hardcode path to /lib/udevPeter Kjellerstedt
Use ${nonarch_base_libdir}/udev instead. This avoids problems when usrmerge is enabled in DISTRO_FEATURES and udev support is disabled. (From OE-Core rev: 0a4372705a030ca54ed420cdfec33d46ab93499c) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8e9ceff887eb270be34f224811799f86e9dc91a8) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-09-11tiff: Security fixesYi Zhao
Fix CVE-2017-9147, CVE-2017-9936, CVE-2017-10668, CVE-2017-11335 References: https://nvd.nist.gov/vuln/detail/CVE-2017-9147 https://nvd.nist.gov/vuln/detail/CVE-2017-9936 https://nvd.nist.gov/vuln/detail/CVE-2017-10668 https://nvd.nist.gov/vuln/detail/CVE-2017-11335 Patches from: CVE-2017-9147: https://github.com/vadz/libtiff/commit/4d4fa0b68ae9ae038959ee4f69ebe288ec892f06 CVE-2017-9936: https://github.com/vadz/libtiff/commit/fe8d7165956b88df4837034a9161dc5fd20cf67a CVE-2017-10688: https://github.com/vadz/libtiff/commit/6173a57d39e04d68b139f8c1aa499a24dbe74ba1 CVE-2017-11355: https://github.com/vadz/libtiff/commit/69bfeec247899776b1b396651adb47436e5f1556 (From OE-Core rev: 5c89539edb17d01ffe82a1b2e7d092816003ecf3) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> minor fixes to get to apply Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-09-11libsndfile1: Fix CVE-2017-8363Jackie Huang
Backport the patch to fix CVE-2017-8363: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-8363 (From OE-Core rev: 9cc9956c5ed09f9016cb23bd763652e5ab55f3cd) Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-09-11libsndfile1: Fix CVE-2017-8362Jackie Huang
Backport the patch to fix CVE-2017-8362: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-8362 (From OE-Core rev: 0c8da3f6f85962196f2ad54fffd839239f5c2274) Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> with minor changes Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-09-11libsndfile1: Fix CVE-2017-8361 and CVE-2017-8365Jackie Huang
Backport the patch to fix two CVEs: CVE-2017-8361: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file. CVE-2017-8365: The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-8361 https://nvd.nist.gov/vuln/detail/CVE-2017-8365 (From OE-Core rev: d92877ade8fd4dd9b548c6b664bf4357a1f9428a) Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-09-11libsndfile1: Fix CVE-2017-6892Fan Xin
Backport upstream patch to fix CVE-2017-6892. CVE: CVE-2017-6892 (From OE-Core rev: cc9b8d0afe64b83f585843f3aff1c077f69fd656) Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-08-29libsndfile1_1.0.28.bb: set CVE_PRODUCT to libsndfileMikko Rapeli
It is used in NVD to CVE's like: https://nvd.nist.gov/vuln/detail/CVE-2017-6892 Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit adfb1c7fe28a6ef2bcf698f7415fd86b01bdc489) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-08-29libsamplerate0_0.1.9.bb: set CVE_PRODUCT to libsamplerateMikko Rapeli
It is used in NVD for CVE's like: https://nvd.nist.gov/vuln/detail/CVE-2017-7697 Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit baafa21919082a8b61af3345c35922d205b254c6) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-08-29flac_1.3.1.bb: set CVE_PRODUCT to libflacMikko Rapeli
NVD uses product name libflac for CVE's like: https://nvd.nist.gov/vuln/detail/CVE-2014-8962 Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit e09bd27059b26affddf466f4e55a7f4c719c3b17) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-04-29gst-player: Disable visualizations as workaroundJussi Kukkonen
Audio playback in gtk-play is broken with vaapi because the visualizations do not work: disable visualizations as workaround. This should be reverted as soon as [YOCTO #11410] is fixed. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-04-28gstreamer1.0-vaapi: Fix playback breaking bugJussi Kukkonen
gstreamer-vaapi fails to play files with specific frame sizes because of buffer allocation issues. Fix is a backport. Fixes [YOCTO #11311]. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-04-11gstreamer1.0-plugins-good: Backport patch for v4l2object videometaCarlos Rafael Giani
This patch ensures videometa is added to mem2mem decoder output in case the output frames have padding rows/columns Signed-off-by: Carlos Rafael Giani <dv@pseudoterminal.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-04-11gstreamer1.0-plugins-bad: Update packageconfigs and config flagsCarlos Rafael Giani
Signed-off-by: Carlos Rafael Giani <dv@pseudoterminal.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-23libvorbis: Contain gcc specific compiler flags using configure optionKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-21meta: replace uses of bb.data.expand(VARNAME, d) with d.expand(VARNAME)Joshua Lock
bb.data.expand(x, d) is deprecated API. [YOCTO #10678] Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-16gstreamer1.0-vaapi: Remove unused patchJussi Kukkonen
This patch has seemingly never been applied in the recipe (even when it lived in meta-intel). I don't think we should have unused patches in the repo: If the patch is useful it could be reintroduced so that the binaries are packaged into a separate package. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-16gstreamer1.0-omx: Remove unused patchJussi Kukkonen
The patch was only used in the ancient and recently removed git recipe. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-10gstreamer: remove git recipesRoss Burton
Yet again these were checking out 1.8.2 tags and then trying to apply 1.10.4 patches on top. Clearly nobody is actually using them, so delete them so they can't go stale again. Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-04gstreamer1.0-omx_1.2.0: remove recipeMaxin B. John
Removing this recipe since we have the latest gstreamer1.0-omx_1.10.4 in place. Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01ffmpeg: use static package listAndreas Oberritter
Dynamic packaging isn't useful if every library needs to be listed manually. This also merges the -dev packages into a single ffmpeg-dev, as is typical. Signed-off-by: Andreas Oberritter <obi@opendreambox.org> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01gstreamer: update to 1.10.4Maxin B. John
bug-fix release: *) Various fixes for crashes, assertions, deadlocks and memory leaks on fuzzed input files and in other situations (CVE-2017-5847, CVE-2017-5848) *) gst-libav was updated to ffmpeg 3.2.4, fixing a couple of CVEs Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01libwebp: update to 0.6.0Alexander Kanavin
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01ffmpeg: update to 3.2.4Alexander Kanavin
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01x264: Upgrade to stable branch headJussi Kukkonen
Small number of bug fixes and x86 optimizations. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01gst-player: Upgrade to recent git revisionJussi Kukkonen
The update contains a small number of bug fixes. Removed one upstreamed patch. gst-player does not have releases: this is the current git master. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01recipes: Make use of the new bb.utils.filter() functionPeter Kjellerstedt
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-23ffmpeg: Fix the license descriptionAndreas Oberritter
FFmpeg has complicated licensing options, so it should also have complicated license statements in its recipe. Signed-off-by: Andreas Oberritter <obi@opendreambox.org> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-02-23alsa-lib: merge alsa-conf-base into alsa-confTanu Kaskinen
As far as I can see, there's no benefit in having separate alsa-conf and alsa-conf-base packages. libasound depended on both, so it was not really possible to only install alsa-conf-base. Signed-off-by: Tanu Kaskinen <tanuk@iki.fi> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-02-23alsa-lib: fix softfloat enablingTanu Kaskinen
EXTRA_OECONF = "--disable-python" overrode the previous EXTRA_OECONF assignment, so softfloat didn't get enabled when needed. Fixed this by replacing "=" with "+=". Bitbake then complained about tabs in alsa-fpu.inc, changed them to spaces. Signed-off-by: Tanu Kaskinen <tanuk@iki.fi> Signed-off-by: Ross Burton <ross.burton@intel.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-09-25 21:27:25 +0000