ghostscript: upgrade 10.05.1 -> 10.06.0

From: Vijay Anusuri <vanusuri@mvista.com>

Dropped 0001-Bug-708160-Fix-compatibility-with-C23-compilers.patch

Added fPIC flag needed to prevent a linker error during the build process.

This upgrade addresses CVEs:
CVE-2025-59798, CVE-2025-59799, CVE-2025-59800, CVE-2025-59801

Changelog:
https://ghostscript.readthedocs.io/en/gs10.06.0/News.html

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 ...Fix-compatibility-with-C23-compilers.patch | 67 -------------------
 ...ript_10.05.1.bb => ghostscript_10.06.0.bb} |  5 +-
 2 files changed, 2 insertions(+), 70 deletions(-)
 delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/0001-Bug-708160-Fix-compatibility-with-C23-compilers.patch
 rename meta/recipes-extended/ghostscript/{ghostscript_10.05.1.bb => ghostscript_10.06.0.bb} (93%)

On Mon Sep 29, 2025 at 12:47 PM CEST, Vijay Anusuri via lists.openembedded.org wrote:
> From: Vijay Anusuri <vanusuri@mvista.com>
>
> Dropped 0001-Bug-708160-Fix-compatibility-with-C23-compilers.patch
>
> Added fPIC flag needed to prevent a linker error during the build process.
>
> This upgrade addresses CVEs:
> CVE-2025-59798, CVE-2025-59799, CVE-2025-59800, CVE-2025-59801
>
> Changelog:
> https://ghostscript.readthedocs.io/en/gs10.06.0/News.html
>
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---

Hi Vijay,

Thanks for your patch.

We got some build issues on the autobuilder:

ERROR: ghostscript-10.06.0-r0 do_compile: Execution of '/srv/pokybuild/yocto-worker/musl-qemux86/build/build/tmp/work/core2-32-poky-linux-musl/ghostscript/10.06.0/temp/run.do_compile.9882' failed with exit code 1
...
| ./base/gdevmpla.c: In function 'mem_planar_strip_copy_rop2':
| ./base/gdevmpla.c:1962:58: error: passing argument 3 of 'check_64bit_multiply' from incompatible pointer type [-Wincompatible-pointer-types]
|  1962 |         if (check_64bit_multiply(height, chunky_sraster, (size_t *)&nbytes) != 0)
|       |                                                          ^~~~~~~~~~~~~~~~~
|       |                                                          |
|       |                                                          size_t * {aka unsigned int *}
| In file included from ./base/gdevmpla.c:21:
| ./base/gxdevice.h:694:71: note: expected 'int64_t *' {aka 'long long int *'} but argument is of type 'size_t *' {aka 'unsigned int *'}
|   694 | static inline int check_64bit_multiply(int64_t x, int64_t y, int64_t *result)
|       |                                                              ~~~~~~~~~^~~~~~
| ./base/gdevmpla.c:2022:68: error: passing argument 3 of 'check_64bit_multiply' from incompatible pointer type [-Wincompatible-pointer-types]
|  2022 |         if (check_64bit_multiply(chunky_t_height, chunky_t_raster, &nbytes) != 0)
|       |                                                                    ^~~~~~~
|       |                                                                    |
|       |                                                                    intptr_t * {aka int *}
| ./base/gxdevice.h:694:71: note: expected 'int64_t *' {aka 'long long int *'} but argument is of type 'intptr_t *' {aka 'int *'}
|   694 | static inline int check_64bit_multiply(int64_t x, int64_t y, int64_t *result)
|       |                                                              ~~~~~~~~~^~~~~~
| make: *** [base/lib.mak:1207: obj/gdevmpla.o] Error 1

https://autobuilder.yoctoproject.org/valkyrie/#/builders/6/builds/2498
https://autobuilder.yoctoproject.org/valkyrie/#/builders/17/builds/2316
https://autobuilder.yoctoproject.org/valkyrie/#/builders/59/builds/2476

Can you look into these, please?

Thanks,
Mathieu

Hi Mathieu,

Thank you for testing the patch.

I tested the patch on a 64-bit system and didn't checked on 32-bit builds.

It appears the following commit from ArtifexSoftware might address the
issue you're seeing:
[
https://github.com/ArtifexSoftware/ghostpdl/commit/3c0be6e4fcffa63e4a5a1b0aec057cebc4d2562f
].
I will try to reproduce the error locally and check if this commit indeed
resolves the problem.

Thanks,
Vijay

On Tue, Sep 30, 2025 at 3:55 PM Mathieu Dubois-Briand <
mathieu.dubois-briand@bootlin.com> wrote:

> On Mon Sep 29, 2025 at 12:47 PM CEST, Vijay Anusuri via
> lists.openembedded.org wrote:
> > From: Vijay Anusuri <vanusuri@mvista.com>
> >
> > Dropped 0001-Bug-708160-Fix-compatibility-with-C23-compilers.patch
> >
> > Added fPIC flag needed to prevent a linker error during the build
> process.
> >
> > This upgrade addresses CVEs:
> > CVE-2025-59798, CVE-2025-59799, CVE-2025-59800, CVE-2025-59801
> >
> > Changelog:
> > https://ghostscript.readthedocs.io/en/gs10.06.0/News.html
> >
> > Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > ---
>
> Hi Vijay,
>
> Thanks for your patch.
>
> We got some build issues on the autobuilder:
>
> ERROR: ghostscript-10.06.0-r0 do_compile: Execution of
> '/srv/pokybuild/yocto-worker/musl-qemux86/build/build/tmp/work/core2-32-poky-linux-musl/ghostscript/10.06.0/temp/run.do_compile.9882'
> failed with exit code 1
> ...
> | ./base/gdevmpla.c: In function 'mem_planar_strip_copy_rop2':
> | ./base/gdevmpla.c:1962:58: error: passing argument 3 of
> 'check_64bit_multiply' from incompatible pointer type
> [-Wincompatible-pointer-types]
> |  1962 |         if (check_64bit_multiply(height, chunky_sraster, (size_t
> *)&nbytes) != 0)
> |       |
> ^~~~~~~~~~~~~~~~~
> |       |                                                          |
> |       |                                                          size_t
> * {aka unsigned int *}
> | In file included from ./base/gdevmpla.c:21:
> | ./base/gxdevice.h:694:71: note: expected 'int64_t *' {aka 'long long int
> *'} but argument is of type 'size_t *' {aka 'unsigned int *'}
> |   694 | static inline int check_64bit_multiply(int64_t x, int64_t y,
> int64_t *result)
> |       |
> ~~~~~~~~~^~~~~~
> | ./base/gdevmpla.c:2022:68: error: passing argument 3 of
> 'check_64bit_multiply' from incompatible pointer type
> [-Wincompatible-pointer-types]
> |  2022 |         if (check_64bit_multiply(chunky_t_height,
> chunky_t_raster, &nbytes) != 0)
> |       |
>   ^~~~~~~
> |       |
>   |
> |       |
>   intptr_t * {aka int *}
> | ./base/gxdevice.h:694:71: note: expected 'int64_t *' {aka 'long long int
> *'} but argument is of type 'intptr_t *' {aka 'int *'}
> |   694 | static inline int check_64bit_multiply(int64_t x, int64_t y,
> int64_t *result)
> |       |
> ~~~~~~~~~^~~~~~
> | make: *** [base/lib.mak:1207: obj/gdevmpla.o] Error 1
>
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/6/builds/2498
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/17/builds/2316
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/59/builds/2476
>
> Can you look into these, please?
>
> Thanks,
> Mathieu
>
> --
> Mathieu Dubois-Briand, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com
>
>

This was accepted onto master, and we are seeing different a different 
32bit build failure:

./brotli/c/dec/decode.c: In function 'PreloadSymbol':
./brotli/c/dec/huffman.h:83:47: error: ISO C90 forbids mixed 
declarations and code [-Werror=declaration-after-statement]
    83 | #define BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD(H) uint32_t 
__fastload_##H = (*H)
       |                                               ^~~~~~~~
./brotli/c/dec/decode.c:440:3: note: in expansion of macro 
'BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD'
   440 |   BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD(table);
       |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




On 9/29/2025 5:47 AM, Vijay Anusuri via lists.openembedded.org wrote:
> From: Vijay Anusuri <vanusuri@mvista.com>
> 
> Dropped 0001-Bug-708160-Fix-compatibility-with-C23-compilers.patch
> 
> Added fPIC flag needed to prevent a linker error during the build process.
> 
> This upgrade addresses CVEs:
> CVE-2025-59798, CVE-2025-59799, CVE-2025-59800, CVE-2025-59801
> 
> Changelog:
> https://ghostscript.readthedocs.io/en/gs10.06.0/News.html
> 
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---
>   ...Fix-compatibility-with-C23-compilers.patch | 67 -------------------
>   ...ript_10.05.1.bb => ghostscript_10.06.0.bb} |  5 +-
>   2 files changed, 2 insertions(+), 70 deletions(-)
>   delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/0001-Bug-708160-Fix-compatibility-with-C23-compilers.patch
>   rename meta/recipes-extended/ghostscript/{ghostscript_10.05.1.bb => ghostscript_10.06.0.bb} (93%)
> 
> diff --git a/meta/recipes-extended/ghostscript/ghostscript/0001-Bug-708160-Fix-compatibility-with-C23-compilers.patch b/meta/recipes-extended/ghostscript/ghostscript/0001-Bug-708160-Fix-compatibility-with-C23-compilers.patch
> deleted file mode 100644
> index 78f3fc1c34..0000000000
> --- a/meta/recipes-extended/ghostscript/ghostscript/0001-Bug-708160-Fix-compatibility-with-C23-compilers.patch
> +++ /dev/null
> @@ -1,67 +0,0 @@
> -From c595086bfe206776676e290df98cd09e91210e27 Mon Sep 17 00:00:00 2001
> -From: Alex Cherepanov <alex@coscript.biz>
> -Date: Thu, 3 Apr 2025 17:19:41 +0100
> -Subject: [PATCH] Bug 708160: Fix compatibility with C23 compilers
> -MIME-Version: 1.0
> -Content-Type: text/plain; charset=UTF-8
> -Content-Transfer-Encoding: 8bit
> -
> -* fixes:
> -  http://errors.yoctoproject.org/Errors/Details/853021/
> -
> -In file included from ./base/genconf.c:18:
> -./base/stdpre.h:348:13: error: ‘bool’ cannot be defined via ‘typedef’
> -  348 | typedef int bool;
> -      |             ^~~~
> -./base/stdpre.h:348:13: note: ‘bool’ is a keyword with ‘-std=c23’ onwards
> -./base/stdpre.h:348:1: warning: useless type name in empty declaration
> -  348 | typedef int bool;
> -      | ^~~~~~~
> -
> -Upstream-Status: Backport [Partial backport of https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/base/stdpre.h?id=ae940946473ceb8c5353bc6e7f04673c6e60502d]
> -
> -Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
> ----
> - base/stdpre.h | 6 ++++--
> - 1 file changed, 4 insertions(+), 2 deletions(-)
> -
> -diff --git a/base/stdpre.h b/base/stdpre.h
> -index dda30b6..2f9c84e 100644
> ---- a/base/stdpre.h
> -+++ b/base/stdpre.h
> -@@ -1,4 +1,4 @@
> --/* Copyright (C) 2001-2023 Artifex Software, Inc.
> -+/* Copyright (C) 2001-2025 Artifex Software, Inc.
> -    All Rights Reserved.
> -
> -    This software is provided AS-IS with no warranty, either express or
> -@@ -341,7 +341,9 @@ typedef signed char schar;
> -  * and the MetroWerks C++ compiler insists that bool be equivalent to
> -  * unsigned char.
> -  */
> --#ifndef __cplusplus
> -+
> -+/* C23 has bool as a builtin type. */
> -+#if !defined(__cplusplus) && (!defined(__STDC_VERSION__) || __STDC_VERSION__ < 202311L)
> - #ifdef __BEOS__
> - typedef unsigned char bool;
> - #else
> -diff --git a/base/gp.h b/base/gp.h
> -index ad5bb61..cf2c9cf 100644
> ---- a/base/gp.h
> -+++ b/base/gp.h
> -@@ -1,4 +1,4 @@
> --/* Copyright (C) 2001-2023 Artifex Software, Inc.
> -+/* Copyright (C) 2001-2025 Artifex Software, Inc.
> -    All Rights Reserved.
> -
> -    This software is provided AS-IS with no warranty, either express or
> -@@ -646,7 +646,7 @@ int gp_fseek_impl(FILE *strm, gs_offset_t offset, int origin);
> - /* Create a second open gp_file on the basis of a given one */
> - FILE *gp_fdup_impl(FILE *f, const char *mode);
> -
> --int gp_fseekable_impl(FILE *f);
> -+bool gp_fseekable_impl(FILE *f);
> -
> - /* Force given file into binary mode (no eol translations, etc) */
> - /* if 2nd param true, text mode if 2nd param false */
> diff --git a/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb b/meta/recipes-extended/ghostscript/ghostscript_10.06.0.bb
> similarity index 93%
> rename from meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb
> rename to meta/recipes-extended/ghostscript/ghostscript_10.06.0.bb
> index 417bf52a99..8bb5bb985c 100644
> --- a/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb
> +++ b/meta/recipes-extended/ghostscript/ghostscript_10.06.0.bb
> @@ -24,10 +24,9 @@ def gs_verdir(v):
>   SRC_URI = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs${@gs_verdir("${PV}")}/${BPN}-${PV}.tar.gz \
>              file://ghostscript-9.16-Werror-return-type.patch \
>              file://avoid-host-contamination.patch \
> -           file://0001-Bug-708160-Fix-compatibility-with-C23-compilers.patch \
>              "
>   
> -SRC_URI[sha256sum] = "121861b6d29b2461dec6575c9f3cab665b810bd408d4ec02c86719fa708b0a49"
> +SRC_URI[sha256sum] = "5bd6da34794928cc7e616f288e32bd0be7f9a5ca2d3c206a0af2c19a4e3a318f"
>   
>   PACKAGECONFIG ??= ""
>   PACKAGECONFIG[gtk] = "--enable-gtk,--disable-gtk,gtk+3"
> @@ -47,7 +46,7 @@ EXTRA_OECONF:append:mipsarcho32 = " --with-large_color_index=0"
>   EXTRA_OECONF:append:armv7a = "${@bb.utils.contains('TUNE_FEATURES','neon','',' --disable-neon',d)}"
>   EXTRA_OECONF:append:armv7ve = "${@bb.utils.contains('TUNE_FEATURES','neon','',' --disable-neon',d)}"
>   
> -TARGET_CFLAGS += "-std=gnu17"
> +TARGET_CFLAGS += "-std=gnu17 -fPIC"
>   
>   # Uses autoconf but not automake, can't do out-of-tree
>   inherit autotools-brokensep pkgconfig
> 
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#224134): https://lists.openembedded.org/g/openembedded-core/message/224134
> Mute This Topic: https://lists.openembedded.org/mt/115492575/6551054
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [reatmon@ti.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>

On Fri Oct 3, 2025 at 3:36 PM CEST, Ryan Eatmon via lists.openembedded.org wrote:
>
> This was accepted onto master, and we are seeing different a different 
> 32bit build failure:
>
> ./brotli/c/dec/decode.c: In function 'PreloadSymbol':
> ./brotli/c/dec/huffman.h:83:47: error: ISO C90 forbids mixed 
> declarations and code [-Werror=declaration-after-statement]
>     83 | #define BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD(H) uint32_t 
> __fastload_##H = (*H)
>        |                                               ^~~~~~~~
> ./brotli/c/dec/decode.c:440:3: note: in expansion of macro 
> 'BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD'
>    440 |   BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD(table);
>        |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>

Hi Ryan,

Just for reference, this is not the version of the patch that was
accepted: the v2 was.

Message-ID: <20250930153901.246829-1-vanusuri@mvista.com>

Thanks,
Mathieu

On 10/3/2025 9:46 AM, Mathieu Dubois-Briand wrote:
> On Fri Oct 3, 2025 at 3:36 PM CEST, Ryan Eatmon via lists.openembedded.org wrote:
>>
>> This was accepted onto master, and we are seeing different a different
>> 32bit build failure:
>>
>> ./brotli/c/dec/decode.c: In function 'PreloadSymbol':
>> ./brotli/c/dec/huffman.h:83:47: error: ISO C90 forbids mixed
>> declarations and code [-Werror=declaration-after-statement]
>>      83 | #define BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD(H) uint32_t
>> __fastload_##H = (*H)
>>         |                                               ^~~~~~~~
>> ./brotli/c/dec/decode.c:440:3: note: in expansion of macro
>> 'BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD'
>>     440 |   BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD(table);
>>         |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>
> 
> Hi Ryan,
> 
> Just for reference, this is not the version of the patch that was
> accepted: the v2 was.

Doh!  I didn't see a v2 in my mail client... I'll reply to that thread...


> Message-ID: <20250930153901.246829-1-vanusuri@mvista.com>
> 
> Thanks,
> Mathieu
>