From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ricardo Wurmus Subject: Re: Building AbiWord without libwmf and removing libwmf from Guix Date: Sat, 27 May 2017 23:13:36 +0200 Message-ID: <87a85yf1fj.fsf@elephly.net> References: <20170527170600.GA16269@jasmine> <87tw46140a.fsf@netris.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:55593) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dEj1t-0000m0-1M for guix-devel@gnu.org; Sat, 27 May 2017 17:13:46 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dEj1p-0004do-TG for guix-devel@gnu.org; Sat, 27 May 2017 17:13:45 -0400 Received: from sender-of-o51.zoho.com ([135.84.80.216]:21146) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dEj1p-0004dg-Lr for guix-devel@gnu.org; Sat, 27 May 2017 17:13:41 -0400 In-reply-to: <87tw46140a.fsf@netris.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Mark H Weaver Cc: guix-devel@gnu.org Mark H Weaver writes: > Leo Famulari writes: > >> The last update to libwmf was twelve years ago, in 2005. In the >> meantime, a large number of security issues have been discovered in this >> library. These bugs are fixed somewhat haphazardly by the distributions. >> >> While working on patching CVE-2016-9011 in libwmf, and backporting fixes >> for CVE-2016-{9317,10167,10168} in the ancient bundled libgd, I find >> myself wondering if we need this library at all. The patches from this >> 12 year span of 3rd party fixes begin to conflict with each other... >> >> Libwmf is only used as a "plugin" by AbiWord, and AbiWord can be >> configured to build without it. > > What functionality would be lost? I guess that AbiWord would lose the > ability to open some kinds of files, but it would be good to know > whether or not such files are still in common use. WMF is the native vector format for Microsoft Office applications, according to Wikipedia, so this would probably affect the rendering of some images in Word documents that are opened with Abiword. The format has continuously been developed, so it’s possible that libwmf (with a last release in 2005) isn’t even able to handle recent versions of WMF. I think it would be better to remove libwmf. -- Ricardo GPG: BCA6 89B6 3655 3801 C3C6 2150 197A 5888 235F ACAC https://elephly.net