On Sat, Oct 15, 2016 at 02:57:37PM -0400, Kei Kebreau wrote: > Efraim Flashner <efr...@flashner.co.il> writes: > > On Fri, Oct 14, 2016 at 08:09:08PM -0400, Kei Kebreau wrote: > >> Leo Famulari <l...@famulari.name> writes: > >> > Debian has a patch to make it use "system" copies of the libraries: > >> > > >> > https://anonscm.debian.org/cgit/debian-science/packages/freeimage.git/tree/debian/patches/Disable-vendored-dependencies.patch?h=debian/sid > >> > > >> > For now, our freeimage package is probably vulnerable to many publicly > >> > disclosed security bugs. > >> > > >> > Who volunteers to try fixing this? > >> > >> The patch is attached. I've removed the bit from Debian that disables JPEG > >> transformation functions, as seen below. JPEGTransform.cpp (in > >> Source/FreeImageToolkit) gave me some trouble when I left that part of > >> the patch alone. > > > I was looking at it and I thought it was going to be much more than 400 > > lines in the end. > > > > Did we also need the other patch? > > https://sources.debian.net/src/freeimage/3.17.0%2Bds1-3/debian/patches/Use-system-dependencies.patch/ > > > > On one hand we could carry a modified version of Debian's patch, on the > > other hand some of these look like they could be a series of substitute* > > commands. I started looking through the patch and thinking how to > > convert them from "../path/to/header.h" to <header.h> and realizing I > > myself wouldn't want to do that, so that could easily be an option for > > another time :). > > Looking at its contents, adding that patch would make a lot of sense. :-)
Yes, I think we need to use both patches. Will you submit an updated version of your patch?
signature.asc
Description: PGP signature