Update glib, cairo, harfbuzz, pango, openssl, sqlite

modulesets/bootstrap.modules

@@ -182,7 +182,7 @@
   </autotools>
 
   <meson id="glib" mesonargs="--buildtype=release -Dlibmount=disabled -Dman=false -Dgtk_doc=false -Dtests=false">
-    <branch module="glib/2.72/glib-2.72.2.tar.xz" version="2.72.2"/>
+    <branch module="glib/2.72/glib-2.72.3.tar.xz" version="2.72.3"/>
     <dependencies>
       <dep package="libffi"/>
       <dep package="libpcre"/>
@@ -208,6 +208,8 @@
       <!-- https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/329 -->
       <patch file="0008-Fix-deadlock-in-cairo-scaled-font.c.patch" strip="1"/>
       <patch file="0009-Fix-deadlock-in-cairo-scaled-font.c.patch" strip="1"/>
+      <!-- https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/337 -->
+      <patch file="0010-quartz-Avoid-reading-beyond-the-end-of-image-surface.patch" strip="1"/>
     </branch>
     <dependencies>
       <dep package="pixman"/>
@@ -216,7 +218,7 @@
   </meson>
 
   <meson id="harfbuzz" mesonargs="--buildtype=release -Dcoretext=enabled -Dfreetype=disabled -Ddocs=disabled -Dbenchmark=disabled -Dintrospection=disabled -Dtests=disabled">
-    <branch repo="github-tarball" version="4.3.0" module="harfbuzz/harfbuzz/releases/download/4.3.0/harfbuzz-4.3.0.tar.xz"/>
+    <branch repo="github-tarball" version="4.4.1" module="harfbuzz/harfbuzz/releases/download/4.4.1/harfbuzz-4.4.1.tar.xz"/>
     <dependencies>
       <dep package="cairo"/>
     </dependencies>
@@ -227,7 +229,7 @@
   </meson>
 
   <meson id="pango" mesonargs="--buildtype=release -Dintrospection=disabled -Dfontconfig=disabled -Dfreetype=disabled">
-    <branch version="1.50.7" module="pango/1.50/pango-1.50.7.tar.xz"/>
+    <branch version="1.50.8" module="pango/1.50/pango-1.50.8.tar.xz"/>
     <dependencies>
       <dep package="glib"/>
       <dep package="cairo"/>
@@ -343,7 +345,10 @@
 
   <!-- of the many arguments such as prefix and libdir that jhbuild might pass to configure, openssl only understands prefix, and only with =. -->
   <autotools id="openssl" autogen-sh="Configure" autogenargs="shared " autogen-template="%(srcdir)s/%(autogen-sh)s --prefix=%(prefix)s --openssldir=%(prefix)s/etc/ssl %(autogenargs)s" makeinstallargs="install_sw" supports-non-srcdir-builds="no">
-    <branch module="openssl-1.1.1o.tar.gz" version="1.1.1o" repo="openssl"/>
+    <branch module="openssl-1.1.1q.tar.gz" version="1.1.1q" repo="openssl">
+        <!-- https://github.com/openssl/openssl/pull/18719 -->
+        <patch file="openssl-fix-missing-header.patch" strip="1"/>
+    </branch>
   </autotools>
 
   <autotools id="compface" autogen-sh="configure" supports-non-srcdir-builds="no">
@@ -373,7 +378,7 @@
   </autotools>
 
   <autotools id="sqlite" autogenargs="--enable-threadsafe --disable-static" autogen-sh="configure">
-    <branch repo="sqlite" module="2022/sqlite-autoconf-3380500.tar.gz" version="3.38.5"/>
+    <branch repo="sqlite" module="2022/sqlite-autoconf-3390100.tar.gz" version="3.39.1"/>
   </autotools>
 
 </moduleset>

patches/0001-quartz-font-Add-support-for-color-emoji-glyphs.patch

@@ -1,7 +1,7 @@
-From 54add68aecec4351f1e148241366ccf2d659e784 Mon Sep 17 00:00:00 2001
+From 6a07c0ab69f630aea1282b3a285fb30cbe4c5564 Mon Sep 17 00:00:00 2001
 From: Suyuan Chang <[email protected]>
 Date: Sun, 27 Jan 2019 22:56:54 -0800
-Subject: [PATCH 1/9] quartz-font: Add support for color emoji glyphs.
+Subject: [PATCH 01/10] quartz-font: Add support for color emoji glyphs.
 
 Treat the macOS system font 'Apple Color Emoji' as color glyphs and
 use color surface to render it.

patches/0002-Check-font-status-in-show_text_glyphs.patch

@@ -1,7 +1,7 @@
-From 4bbb1705f9247409baf0c7a948232402beeea332 Mon Sep 17 00:00:00 2001
+From 3825561ef06b1ba7b614ad49bbedd4d7f05b59b3 Mon Sep 17 00:00:00 2001
 From: Adrian Johnson <[email protected]>
 Date: Tue, 5 Apr 2022 17:38:13 +0930
-Subject: [PATCH 2/9] Check font status in show_text_glyphs
+Subject: [PATCH 02/10] Check font status in show_text_glyphs
 
 to prevent asserting in _cairo_scaled_font_freeze_cache()
 

patches/0003-Fix-a-double-free-in-_cairo_mono_scan_converter_crea.patch

@@ -1,7 +1,7 @@
-From 98b85ae5704b3e5cbbeb5f9ea4fd06ff1862a9ef Mon Sep 17 00:00:00 2001
+From f53dc4f559575acd6643d11f3f7f3d6875627aaf Mon Sep 17 00:00:00 2001
 From: Feysh INC <[email protected]>
 Date: Fri, 22 Apr 2022 16:43:59 +0800
-Subject: [PATCH 3/9] Fix a double free in _cairo_mono_scan_converter_create
+Subject: [PATCH 03/10] Fix a double free in _cairo_mono_scan_converter_create
 
 When `_mono_scan_converter_init` failed,
 `self->converter->polygon` will be freed by `polygon_fini()`. However,

patches/0004-Fix-a-use-after-free-in-cairo_scaled_font_create.patch

@@ -1,7 +1,7 @@
-From 426f05307808a7df6bfe93bad3c24fbb24673b4b Mon Sep 17 00:00:00 2001
+From 39d4ffa1361171ba00f177ce3a8c16359794f9d1 Mon Sep 17 00:00:00 2001
 From: Feysh INC <[email protected]>
 Date: Fri, 22 Apr 2022 17:09:47 +0800
-Subject: [PATCH 4/9] Fix a use after free in cairo_scaled_font_create
+Subject: [PATCH 04/10] Fix a use after free in cairo_scaled_font_create
 
 When `font_face` is freed by `cairo_font_face_destroy()` at line 1,150,
 the following call `_cairo_font_face_set_error (font_face, status)`

patches/0005-Fix-a-use-after-free-in-_cairo_svg_surface_create_fo.patch

@@ -1,7 +1,7 @@
-From 0279943104094aa7aef00aa30f3052569360ece1 Mon Sep 17 00:00:00 2001
+From 589a39678e24ad72e8f6d45920f939e9788cae34 Mon Sep 17 00:00:00 2001
 From: Feysh INC <[email protected]>
 Date: Fri, 22 Apr 2022 21:24:09 +0800
-Subject: [PATCH 5/9] Fix a use after free in
+Subject: [PATCH 05/10] Fix a use after free in
  _cairo_svg_surface_create_for_stream_internal
 
 When `_cairo_svg_surface_create_for_document()` failed, it will free the

patches/0006-fixed-double-free-in-_cairo_ps_surface_emit_base85_s.patch

@@ -1,7 +1,8 @@
-From 8f15bbf327adac48262e6fe329baf76581a42a73 Mon Sep 17 00:00:00 2001
+From 65b0175f297347713a6438bab6569e48cde00e04 Mon Sep 17 00:00:00 2001
 From: Ayman El Didi <[email protected]>
 Date: Wed, 20 Apr 2022 15:11:14 -0600
-Subject: [PATCH 6/9] fixed double free in _cairo_ps_surface_emit_base85_string
+Subject: [PATCH 06/10] fixed double free in
+ _cairo_ps_surface_emit_base85_string
 
 When taking the CAIRO_PS_COMPRESS_DEFLATE branch of the switch
 statement in _cairo_ps_surface_emit_base85_string, memory is freed

patches/0007-quartz-Destroy-local-copy-of-snapshot-after-attachin.patch

@@ -1,7 +1,7 @@
-From b9ed20e5d2df31f29f360c8c253a21e713cfce5f Mon Sep 17 00:00:00 2001
+From b6f7719ce43d143b996a07571e65849771ade971 Mon Sep 17 00:00:00 2001
 From: John Ralls <[email protected]>
 Date: Sat, 23 Apr 2022 16:38:01 -0700
-Subject: [PATCH 7/9] [quartz] Destroy local copy of snapshot after attaching
+Subject: [PATCH 07/10] [quartz] Destroy local copy of snapshot after attaching
  it.
 
 Because cairo_surface_snapshot_attach refs the snapshot.

patches/0008-Fix-deadlock-in-cairo-scaled-font.c.patch

@@ -1,7 +1,7 @@
-From 196e253174a6df0a13451d16f666bd8f44eccab2 Mon Sep 17 00:00:00 2001
+From d1f7fad5ff81476e7d767fde903f17f839e53903 Mon Sep 17 00:00:00 2001
 From: Adrian Johnson <[email protected]>
 Date: Fri, 27 May 2022 21:36:31 +0930
-Subject: [PATCH 8/9] Fix deadlock in cairo-scaled-font.c
+Subject: [PATCH 08/10] Fix deadlock in cairo-scaled-font.c
 
 When cairo_scaled_glyph_page_cache needs to remove entries,
 cairo-cache calls _cairo_hash_table_random_entry() with the predicate

patches/0009-Fix-deadlock-in-cairo-scaled-font.c.patch

@@ -1,7 +1,7 @@
-From a2af073404701dd5651ba635fb626b928e02b90a Mon Sep 17 00:00:00 2001
+From 7a1d689610fc0a8e27459694a365d15bf41eb835 Mon Sep 17 00:00:00 2001
 From: Adrian Johnson <[email protected]>
 Date: Sat, 28 May 2022 07:14:52 +0930
-Subject: [PATCH 9/9] Fix deadlock in cairo-scaled-font.c
+Subject: [PATCH 09/10] Fix deadlock in cairo-scaled-font.c
 
 A user font glyph containing a font can cause deadlock in
 _cairo_scaled_glyph_fini due to the destroy recording surface while

patches/0010-quartz-Avoid-reading-beyond-the-end-of-image-surface.patch

@@ -0,0 +1,34 @@
+From f007412eb3f95e6e7e489d53301f23dfa92621a1 Mon Sep 17 00:00:00 2001
+From: Jeff Muizelaar <[email protected]>
+Date: Wed, 29 Jun 2022 11:41:47 -0400
+Subject: [PATCH 10/10] quartz: Avoid reading beyond the end of image surfaces.
+
+The last row of data may have less than stride bytes so make sure we
+only copy what we need.
+
+(cherry picked from commit cccc81ccba99600483621e02ae9438a4a5a3d024)
+---
+ src/cairo-quartz-surface.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/cairo-quartz-surface.c b/src/cairo-quartz-surface.c
+index fa6d9b1c9..14feb0f41 100644
+--- a/src/cairo-quartz-surface.c
++++ b/src/cairo-quartz-surface.c
+@@ -881,8 +881,12 @@ _cairo_surface_to_cgimage (cairo_surface_t       *source,
+ 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+     }
+
++    // The last row of data may have less than stride bytes so make sure we
++    // only copy the minimum amount required from that row.
+     memcpy (image_data, image_surface->data,
+-	    image_surface->height * image_surface->stride);
++	    (image_surface->height - 1) * image_surface->stride +
++	    cairo_format_stride_for_width (image_surface->format,
++					   image_surface->width));
+     *image_out = CairoQuartzCreateCGImage (image_surface->format,
+ 					   image_surface->width,
+ 					   image_surface->height,
+-- 
+2.32.1 (Apple Git-133)
+

patches/openssl-fix-missing-header.patch

@@ -0,0 +1,30 @@
+From 60f011f584d80447e86cae1d1bd3ae24bc13235b Mon Sep 17 00:00:00 2001
+From: Gregor Jasny <[email protected]>
+Date: Tue, 5 Jul 2022 12:57:06 +0200
+Subject: [PATCH] Add missing header for memcmp
+
+CLA: trivial
+
+Reviewed-by: Paul Dale <[email protected]>
+Reviewed-by: Dmitry Belyavskiy <[email protected]>
+Reviewed-by: Todd Short <[email protected]>
+Reviewed-by: Richard Levitte <[email protected]>
+(Merged from https://github.com/openssl/openssl/pull/18719)
+
+(cherry picked from commit f9e578e720bb35228948564192adbe3bc503d5fb)
+---
+ test/v3ext.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/test/v3ext.c b/test/v3ext.c
+index 386135fed8ab..7a240cd70603 100644
+--- a/test/v3ext.c
++++ b/test/v3ext.c
+@@ -8,6 +8,7 @@
+  */
+
+ #include <stdio.h>
++#include <string.h>
+ #include <openssl/x509.h>
+ #include <openssl/x509v3.h>
+ #include <openssl/pem.h>