Dear Maintainer,

nvidia-texture-tools contains an embedded copy of libsquish:
in src/nvtt/squish

I have recently packaged libsquish, and it is now avilable in the archive:
https://tracker.debian.org/pkg/libsquish

In doing this I examined all the embedded copies, checking them for
changes, and have merged all the extra features into the Debian
package. Thus it should be straighforward to start using the system
library instead of the embedded copy, without any API changes.

The changes have also been sent upstream and will hopefully appear
in libsquish 1.14 at some point.

The nvidia-texture-tools version was forked around v1.7. It has a
1-character change which does not obviously have a reason:
"Vec4 m_unweighted[16];" changed to "Vec4 m_unweighted[17];" in
fastclusterfit.h.

This change has not been included, because it's not in any of the
other versions, and seems odd, so if there really is a reason for
this then then debian package should be updated.

Debian policy https://www.debian.org/doc/debian-policy/ch-source.html#s-embeddedfiles
say that embedded copies should not be used if the library is available in Debian, and
https://wiki.debian.org/EmbeddedCodeCopies gives a bit more background.

I am not familiar with the nvidia-texture-tools build system, so have
not attempted to provide a patch as that should be much easier for
you, but of course I'll help if you need some.

The full set of packages affected is:
   - nvidia-texture-tools 1.7 (src/nvtt/squish)
   - 0ad         1.7 (libraries/source/nvtt/src/src/nvtt/squish/)
   - spring      1.10  (rts/lib/squish)
   - openimageio 1.10+ (1.10+metric) (src/dds.imageio/squish)
   - xbmc        1.10+ (1.10+metric/BC45) (lib/libsquish)
   - kodi        1.10+ (1.10+metric/BC45) (tools/depends/native/libsquish-native)
   - mame        1.13+ (BC45) (3rdparty/bgfx/3rdparty/libsquish)

Hope this is useful.

Wookey

On 2016-09-17 00:57 +0000, Debian Bug Tracking System wrote:

OK. The change in nvidia-texture-tools is in fact a valid buffer
overflow fix. However it is incomplete and should currently look like
the code below:

#if SQUISH_USE_SIMD
	Vec4 m_unweighted[17];
	Vec4 m_metric;
	Vec4 m_metricSqr;
	Vec4 m_xxsum;
	Vec4 m_xsum;
	Vec4 m_besterror;
#else
	Vec3 m_unweighted[17];
	Vec3 m_metric;
	Vec3 m_metricSqr;
	Vec3 m_xxsum;
	Vec3 m_xsum;
	float m_besterror;
#endif

However that only applied in v1.7 which ntt is using, because that
contained an incorrect <=16 test.

In the current 1.13 the <=16 test has been corrected to <16 so the
overflow no longer occurs. This is the correct fix, so this version
should work fine if used by ntt.

Wookey
--
Principal hats:  Linaro, Debian, Wookware, ARM
http://wookware.org/

After some time away from this hogwash of builtin and modified libraries in nvtt im back to work on it.
Right now I think I have to rewrite the use of libsquish in the project before i can link it with the system library,
as it uses internal and deprecated header files to do colourspace compressions in DXT1 and 3.

I'll try to get this in though and replace one more bundled library in exchange for three new ones added in 2.1.0 ...

Control: tag -1 wontfix

In the last upstream release nvtt seems to apply more changes to the
embedded libsquish, e.g. relabeling it as 'nvsqish', thus I don't think
switching to the separately packaged libsquish is feasible.

As nvtt upstream is dead (the github project has been archived), it is
unlikely anyone will look into this.


Andreas