933162 – dev-util/diffoscope: consider dropping or masking USE=gif due to problematic media-libs/giflib dependency

Bug 933162 - dev-util/diffoscope: consider dropping or masking USE=gif due to problematic media-libs/giflib dependency

Summary: dev-util/diffoscope: consider dropping or masking USE=gif due to problematic ...

Status:	CONFIRMED

Alias:	None

Product:	Gentoo Linux
Classification:	Unclassified
Component:	Current packages (show other bugs)
Hardware:	All Linux

Importance:	Normal normal
Assignee:	Sam James

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:	933163
	Show dependency tree

Reported:	2024-05-30 04:04 UTC by Sam James
Modified:	2024-05-30 04:12 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sam James archtester

2024-05-30 04:04:14 UTC

giflib appears to have a terrible security profile:
* bug 785664 	
* bug 851945
* bug 918539

In the latest upstream release, they indicated that they aren't interested in any sort of bug reports on invalid input.

Please consider, if appropriate, either dropping USE=gif support, package.use.masking it, or perhaps disabling it by default via package.use (given the desktop profiles enable USE=gif by default).

If this package is expected to only interact with trusted gifs or you feel it's critical to the functionality of this package, feel free to close as WONTFIX. Thanks.