community/acme.sh/APKBUILD

 # Contributor: Francesco Colista <fcolista@alpinelinux.org>
 # Maintainer: Francesco Colista <fcolista@alpinelinux.org>
 pkgname=acme.sh
-pkgver=2.8.9
+pkgver=2.9.0
 pkgrel=0
 pkgdesc="An ACME Shell script, an acme client alternative to certbot"
 options="!check" # No testsuite
@@ -26,5 +26,5 @@ package() {
 }
 
 sha512sums="
-94f771fcbc5b12a2a9992659884d16b543d70db52bccf20eddad931b4a5c233c0fd7362ce525e0cbebfdbd841824b815f5b419572f97b549fea7f2663c92c0a8  acme.sh-2.8.9.tar.gz
+bfe19e322b18830406f372a920873b6a4ced0dd2358bdf2f59a97d6b6e163276dd362b51d3b6eef5eb941fd6245d77768bb7b9ed8cfc5182ed171a4263bfb1a1  acme.sh-2.9.0.tar.gz
 "

community/bear/APKBUILD

 # Contributor: Sören Tempel <soeren+alpine@soeren-tempel.net>
 # Maintainer: Sören Tempel <soeren+alpine@soeren-tempel.net>
 pkgname=bear
-pkgver=3.0.11
+pkgver=3.0.12
 pkgrel=0
 pkgdesc="Tool which generates a compilation database for clang tooling"
 url="https://github.com/rizsotto/Bear"
@@ -34,4 +34,6 @@ package() {
 	make -C build DESTDIR="$pkgdir" install
 }
 
-sha512sums="6d362aede911a8ad35be30638a698579582ca5de770a7c3199bb205046f08f355387099261b8d857188d526ab62024f78e3d06a225734c5f9acca03e5dfea1ec  bear-3.0.11.tar.gz"
+sha512sums="
+e45e842793e9f5f2cd6b13a9795c2b6753c2fffd516e4af9f0362644c9d0952a2b0e505a4a9d53e9a1a4aa063d7368c6466367a78fececb70582ec7c4e8d7f10  bear-3.0.12.tar.gz
+"

community/bfs/APKBUILD

 # Contributor: dai9ah <dai9ah@protonmail.com>
 # Maintainer: dai9ah <dai9ah@protonmail.com>
 pkgname=bfs
-pkgver=2.2
+pkgver=2.2.1
 pkgrel=0
 pkgdesc="Breadth-first variant of the UNIX find command"
 url="https://github.com/tavianator/bfs"
@@ -24,4 +24,6 @@ package() {
 	make DESTDIR="$pkgdir" install
 }
 
-sha512sums="da4ac71f96a3f5f3ba3dd31bffb861e781d68b8466ce77a5b72cbdab87f685882fc648de47a4ad3a38e322008a6c54d09c2b03b5ea5423a390a5f3116789b72e  bfs-2.2.tar.gz"
+sha512sums="
+6203e23affbd0644f4f5cdd9c3e659fa319e9c93187e6e8684cac893f6fa6d943a815038e7c10c96b975285f8112a6b17b79794f679e8ece9442244ca8b83f24  bfs-2.2.1.tar.gz
+"

community/black/APKBUILD

 # Contributor: Michał Polański <michal@polanski.me>
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=black
-pkgver=21.5_beta1
+pkgver=21.5_beta2
 _pkgver=${pkgver/_beta/b}
 pkgrel=0
 pkgdesc="The uncompromising Python code formatter"
@@ -33,5 +33,5 @@ package() {
 }
 
 sha512sums="
-94b34411bb62df80604441877460a4e04e881fc3e664978080209c90fa7613abacc427ec4419e76cf87ad29d64d8d99d2f4418d22cdf547bf7291219fbb735d8  black-21.5b1.tar.gz
+b9d75f48a903632b95c327946493931bf008aceee05821e5b29a5899854b8c034e7bc0eceec5ad94914339729efb295a32684eba77823eb934d5d599e6e61eab  black-21.5b2.tar.gz
 "

community/cage/APKBUILD

 # Maintainer: Will Sinatra <wpsinatra@gmail.com>
 # Contributor: Will Sinatra <wpsinatra@gmail.com>
 pkgname=cage
-pkgver=0.1.2.1
-pkgrel=3
+pkgver=0.1.3
+pkgrel=0
 pkgdesc="Wayland Kiosk"
 url="https://www.hjdskes.nl/projects/cage/"
 options="!check" # no test suite
@@ -24,4 +24,4 @@ package() {
 	DESTDIR="$pkgdir" meson install --no-rebuild -C build
 }
 
-sha512sums="ae332d747da7b59fd8b53b50ed3033959601db0eade435aff953a2789505eb0cbf4839cb41fe537457158327685c60e4367bfb664d2d524a270a22b1f8707d5e  cage-0.1.2.1.tar.gz"
+sha512sums="34d2dca963810f6173343ae280e2692645a79e263aa1c01d22730db5cc14e68c0b0ec19dd947134ef27841f2ee28a28d5d71e64c396b81b6230426220517471b  cage-0.1.3.tar.gz"

community/composer/APKBUILD

 # Contributor: Nathan Johnson <nathan@nathanjohnson.info>
 # Maintainer: Dave Hall <skwashd@gmail.com>
 pkgname=composer
-pkgver=2.0.14
+pkgver=2.1.1
 pkgrel=0
 pkgdesc="Dependency manager for PHP"
 url="https://getcomposer.org/"
@@ -27,5 +27,5 @@ package() {
 }
 
 sha512sums="
-f29deccb41464c1ae105880f6e4127a72c2a27c4571ee4b7942a32cbc8acf57448024d9c649008f004e9bed930628d03b21ce8dbe579b71d487162313bb2f98c  composer-2.0.14.phar
+9349a1997b8558a06261894b049969bea0d3b1130a74e3c9ea2a8f1bef3d1dd35e617c6c876a65b66dd0d0ce4080f747d97db4416d25d2e53cbd23d351d3ea43  composer-2.1.1.phar
 "

community/conmon/APKBUILD

 # Contributor: Michał Polański <michal@polanski.me>
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=conmon
-pkgver=2.0.28
+pkgver=2.0.29
 pkgrel=0
-pkgdesc="An OCI container runtime monitor"
+pkgdesc="OCI container runtime monitor"
 url="https://github.com/containers/conmon"
 license="Apache-2.0"
 arch="all"
@@ -31,5 +31,5 @@ package() {
 }
 
 sha512sums="
-f36e92a31bb9ea5c2fd4dd82843f3a603a98ba4bce0c563b41d81909251de9127cdcb453a60a0a3f35c3558a8f723c1f65d00b5ea8f3e09c4746c6f02501f4de  conmon-2.0.28.tar.gz
+0eec0322ee209efacae93b6e96c3bea2468a309d6211c8c047b49fa3bd8b5d1a198a16b3ff1ffe629dc37a12e2e0db1979e8876833c5cef0f69be35d4be8b550  conmon-2.0.29.tar.gz
 "

community/crun/APKBUILD

@@ -2,8 +2,8 @@
 # Contributor: Michał Polański <michal@polanski.me>
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=crun
-pkgver=0.19.1
-pkgrel=1
+pkgver=0.20
+pkgrel=0
 pkgdesc="Fast and lightweight fully featured OCI runtime and C library for running containers"
 url="https://github.com/containers/crun"
 arch="all"
@@ -27,4 +27,6 @@ package() {
 	make DESTDIR="$pkgdir" install
 }
 
-sha512sums="2b5f5913274a6f349ba1d0814aaa1feb13048e752032c3a85830f7d8c641e72a9470a15add061ce8eec0772ad10dd306161191eff32398a9362d6ac6dc1c023c  crun-0.19.1.tar.xz"
+sha512sums="
+19adb5cc5a340444b1a9f5c892bfa9b5453a113e29086c3575d188c6c94a0037830f9a046bccd11c01b6babcb8c3698a4e66f7ab108bead3155f25e6abeaf844  crun-0.20.tar.xz
+"

community/docker/APKBUILD

@@ -2,10 +2,10 @@
 # Contributor: Jake Buchholz <tomalok@gmail.com>
 # Maintainer: Jake Buchholz <tomalok@gmail.com>
 pkgname=docker
-pkgver=20.10.6
-_cli_commit=370c28948e3c12dce3d1df60b6f184990618553f	# https://github.com/docker/cli/commits/v$pkgver
-_moby_commit=8728dd246c3ab53105434eef8ffe997b6fd14dc6   # https://github.com/moby/moby/commits/v$pkgver
-pkgrel=1
+pkgver=20.10.7
+_cli_commit=f0df35096d5f5e6b559b42c7fde6c65a2909f7c5	# https://github.com/docker/cli/commits/v$pkgver
+_moby_commit=b0f5bc36fea9dfb9672e1e9b1278ebab797b9ee0   # https://github.com/moby/moby/commits/v$pkgver
+pkgrel=0
 pkgdesc="Pack, ship and run any application as a lightweight container"
 url="https://www.docker.io/"
 arch="all"
@@ -15,7 +15,7 @@ makedepends="go go-md2man btrfs-progs-dev bash linux-headers coreutils lvm2-dev
 install="$pkgname.pre-install"
 
 # from https://github.com/moby/moby:	grep libnetwork vendor.conf
-_libnetwork_commit=b3507428be5b458cb0e2b4086b13531fb0706e46
+_libnetwork_commit=64b7a4574d1426139437d20e81c0b6d391130ec8
 # from https://github.com/docker/cli:	grep cobra vendor.conf
 _cobra_ver="1.1.1"
 
@@ -193,9 +193,11 @@ cli_zshcomp() {
 		"$subpkgdir"/usr/share/zsh/site-functions/_$pkgname
 }
 
-sha512sums="6b0ed4c756418cd38f9e5d614910a5b4fc3b2bc286f7e69950e031c5c571c705d7b7ce11cb5a7e94814cbb44fd830921a568f30ef30d783ef129c050c999666b  cli-20.10.6.tar.gz
-ade6307fe31a3b8f144898ab9c4f2db965965294f15e313b0080ce7aa8bf3296f6f34912b45926ac8c5e74eaf475eef869072878123d27aa432e955f594a94ab  moby-20.10.6.tar.gz
-93339b4720069b50589021e8769d8820d195ea076655f23c6f35b18e52d5ca6e1a8b84cd1a6941ce9728028e807e5248a86d302c99b7158d2e1514eb7c8a3d7f  libnetwork-b3507428be5b458cb0e2b4086b13531fb0706e46.tar.gz
+sha512sums="
+4523ae70cb27d848da119070171af2eb84e974ac39d70be4feee105e37c949487c7f72a9bc30c32ce71bffb0787e27b7b9194ce5a8aeae57bdfeb3f2d730010f  cli-20.10.7.tar.gz
+2341faa3ebb903d74fa434712fce45e7acf0423710b97cdca11e3999db2819c4385d9a7fb3850925592f20f02c6261edbade6c9d6a2fefbc32f05a6b44ec3073  moby-20.10.7.tar.gz
+6a94fe23ce1bab0a428ee4bbe20089f5a4470e72c5da156b2b1a89de01cca803374fd9cdcd4c5b25b86af1c4e956c75a1a5ad7fb6639def7bcec69859a77c047  libnetwork-64b7a4574d1426139437d20e81c0b6d391130ec8.tar.gz
 a27debc5c971f468e672826659e5c46946187e2307dded8c496084b9fabc5602e68bdfdc08f444f42d6f82f0f2704d01a0c4bde3e5fbe674c7cb14309f0a3328  cobra-1.1.1.tar.gz
 4d03065e3bf5261dba5f02848c60ac790149f79985c9819814b576fafb8dcd86af0c78a58041cd676cf9e570fbc74bfd382647351db73ed2765f4395522de15b  docker.initd
-f25523f43376ccef71a49618e556e0a16db3acad29eb09fe86c4e572562bdea0bc1eabab00159278835ad9d7c007f2cd10b2ed31f7213b0d9074582dc80a976f  docker.confd"
+f25523f43376ccef71a49618e556e0a16db3acad29eb09fe86c4e572562bdea0bc1eabab00159278835ad9d7c007f2cd10b2ed31f7213b0d9074582dc80a976f  docker.confd
+"

community/dssim/APKBUILD

 # Contributor: Adam Jensen <adam@acj.sh>
 # Maintainer: Adam Jensen <adam@acj.sh>
 pkgname=dssim
-pkgver=3.0.2
+pkgver=3.1.0
 pkgrel=0
 pkgdesc="Tool for image similarity comparison, simulating human perception"
 url="https://kornel.ski/dssim"
@@ -24,5 +24,5 @@ package() {
 }
 
 sha512sums="
-cda4ad6e1f04fef4575933c6b43ee42c268e54cde7643ab663247e42548aa98de055b6bda67ab383a67105e6a985f89841cd5255d96f0bf61a58a08d5b21ce78  dssim-3.0.2.tar.gz
+ebeeba309f522df6977a3d1a881f2d1aca2a7a091d274a161a01fa86f0a21f4354bebec6b876193dc6411d237175629ce0e9abbef26d8452b7e222eaddec594a  dssim-3.1.0.tar.gz
 "

community/dub/APKBUILD

@@ -5,7 +5,7 @@ pkgver=1.25.0
 pkgrel=0
 pkgdesc="Package and build management system for D"
 url="https://code.dlang.org/"
-arch="aarch64 x86_64" # gdc does not work on 32 bit at this point
+#arch="aarch64 x86_64" # gdc does not work on 32 bit at this point
 license="MIT"
 depends="libcurl"
 makedepends="ldc bash curl-dev"

community/e2guardian/APKBUILD

 # Contributor: Noel Kuntze <noel.kuntze@thermi.consulting>
 # Maintainer: Noel Kuntze <noel.kuntze@thermi.consulting>
 pkgname=e2guardian
-pkgver=5.3.4
+pkgver=5.4.3r
 pkgrel=0
 pkgdesc="fork of dansguardian, an open source web content filter"
 url="http://e2guardian.org"
@@ -57,6 +57,6 @@ package() {
 	install -d -o e2guard -g e2guard "$pkgdir"/var/log/e2guardian
 }
 
-sha512sums="28bd19ba4ca9d79e14787fe6e6b819e7a7b331c1951128060bef1342c9216e6b8af012624752689d06bc87c71c2e8f17b7722b63ec13ac9bcd60dd08ec8706ce  e2guardian-5.3.4.tar.gz
+sha512sums="2111290db925aa4fc514517a10ffe0a63c170dc09dae7178680831e166d86f8f9c1a05c01e603948858422b0a4456efee08a8fd2b802314d73c451480ccb7d12  e2guardian-5.4.3r.tar.gz
 0be16552e4a4b5541d11de50bef1122462bce71a2ad619d9308a8b92afd6bf350acdf1e3a2ccb40442dd5a70d3ca2c40ba70111798f7d356d5c68a0615aebf1a  e2guardian.initd
 480188f7f94e0a08707d4c79ff259f0514b8071499e6112a61df56e7bea6407c0d7f323dcdf998cff17c7187d7eafbf0da5d29ce2ab6f819bf0ba38774f43da5  e2guardian.logrotate"

community/eg25-manager/APKBUILD

@@ -2,7 +2,7 @@
 # Maintainer: Dylan Van Assche <me@dylanvanassche.be>
 pkgname=eg25-manager
 pkgver=0.3.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Daemon for managing the Quectel EG25 modem"
 url="https://gitlab.com/mobian1/devices/eg25-manager"
 arch="all !s390x !mips64"  # no modemmanager
@@ -17,6 +17,7 @@ makedepends="
 	"
 source="
 	https://gitlab.com/mobian1/devices/eg25-manager/-/archive/$pkgver/eg25-manager-$pkgver.tar.gz
+	parallel-build-fix.patch
 	eg25-manager.confd
 	eg25-manager.initd
 	"
@@ -34,6 +35,9 @@ package() {
 	install -Dm644 "$srcdir"/eg25-manager.confd "$pkgdir"/etc/conf.d/eg25-manager
 }
 
-sha512sums="af9b36cb5922afcca7e148b829d8a27b8583b63186567b26750fddd6a97c938c1347d96c4c52d63cb6dc6b207a6ffa71942393c423bc5eaee65c30537032cb03  eg25-manager-0.3.0.tar.gz
+sha512sums="
+af9b36cb5922afcca7e148b829d8a27b8583b63186567b26750fddd6a97c938c1347d96c4c52d63cb6dc6b207a6ffa71942393c423bc5eaee65c30537032cb03  eg25-manager-0.3.0.tar.gz
+15c0bf162b28b170af9c3773baee6915564df79cd0e10291ba6cda8da9528113841da66cec7eca180999857dbb693e294b0de6e427c71416fbb4de2224648f91  parallel-build-fix.patch
 55936830afad2968a214fb39cfe1a9db50421dc2ff4f67d04f08f6bd2b094c3ab46799cfc7743bbc5032682d98d1216203adf5264353a05134bea58524ac070b  eg25-manager.confd
-6422ffb1014fee5315fbc82f811471e9bdef7e6bfedfd97c9e1928ff5dd2c761df8d3c54c05e132063365861e224cf344500ae6809fd2172795f48c7b6b483c8  eg25-manager.initd"
+6422ffb1014fee5315fbc82f811471e9bdef7e6bfedfd97c9e1928ff5dd2c761df8d3c54c05e132063365861e224cf344500ae6809fd2172795f48c7b6b483c8  eg25-manager.initd
+"

community/eg25-manager/parallel-build-fix.patch

+From 63ba5e2d60fc01c0e82287a1459e68f999859bea Mon Sep 17 00:00:00 2001
+From: Natanael Copa <ncopa@alpinelinux.org>
+Date: Thu, 3 Jun 2021 17:51:03 +0200
+Subject: [PATCH] Fix parallel build issue
+
+Tell meson that the generated gdbofono headers are needed at compile
+time.
+
+fixes https://gitlab.com/mobian1/devices/eg25-manager/-/issues/14
+---
+ src/meson.build | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/meson.build b/src/meson.build
+index f9eb27f..1bfcd3a 100644
+--- a/src/meson.build
++++ b/src/meson.build
+@@ -15,6 +15,7 @@ src = [
+         'suspend.c', 'suspend.h',
+         'toml.c', 'toml.h',
+         'udev.c', 'udev.h',
++        gdbofono_headers,
+ ]
+ 
+ if mmglib_dep.found()
+-- 
+GitLab
+

community/exiv2/APKBUILD

 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=exiv2
 pkgver=0.27.3
-pkgrel=1
+pkgrel=2
 pkgdesc="Exif and Iptc metadata manipulation library and tools."
 url="https://exiv2.org"
 arch="all"
@@ -13,7 +13,12 @@ subpackages="$pkgname-dev $pkgname-doc"
 source="https://exiv2.org/builds/exiv2-$pkgver-Source.tar.gz
 	CVE-2021-3482.patch
 	CVE-2021-29457.patch
-	CVE-2021-29458.patch"
+	CVE-2021-29458.patch
+	CVE-2021-29463.patch
+	CVE-2021-29470.patch
+	CVE-2021-29473.patch
+	CVE-2021-29623.patch
+	CVE-2021-32617.patch"
 builddir="$srcdir"/$pkgname-$pkgver-Source
 
 prepare() {
@@ -29,6 +34,12 @@ prepare() {
 }
 
 # secfixes:
+#   0.27.3-r2:
+#     - CVE-2021-29463
+#     - CVE-2021-29470
+#     - CVE-2021-29473
+#     - CVE-2021-29623
+#     - CVE-2021-32617
 #   0.27.3-r1:
 #     - CVE-2021-3482
 #     - CVE-2021-29457
@@ -68,4 +79,9 @@ sha512sums="
 9c3f52881df19ca2be9a66480642f5fb91d4be0dd3e513902ec4336536736ec37447df452a775dd933dc011de9d8c4ca3760e3c7545ab5d150876d9dab64bd06  CVE-2021-3482.patch
 27c187c1eb1b3118e8dc3342c1ba7700a522f6e05083b3a4540c2490580320f3e59eb06a1f6abc98ad28f6a3ccb91351ee56caaa9befbb2dc6c5ea1567c711f2  CVE-2021-29457.patch
 d892622c53b1ba5ac48c33a599f37853c8471cce82ae14679d33df17f1251b2e353ce2436c1c730a9a8d1e8bfd9175f7b79263e9b402ecf3ac024db69d10c0e0  CVE-2021-29458.patch
+e885b5bb23b317a7050869b2bcb244fd8744ce2f6019285c8bf5dc2f16c37cb4fc76b9e214fe0fff14529bd49c63d968c8c04908841c5c9cf74c5bb9a6eb9363  CVE-2021-29463.patch
+5fac2406f45439983cc6334968c238952e6ce1d84b6f665114a2dfee306bbafc02279ebcb6bda06dd22ac47117496126d9e2e1ff9882e0c03794bce781670c33  CVE-2021-29470.patch
+fcb726d7fb2de1709f7f7a43ceb55b29c18c3f55f4872671e13874af219c563a05aa0d6b87c7e86b9e544d618e9ea3638cf3e830f597587b5ae0736222cccc80  CVE-2021-29473.patch
+fbe5daabbcedd40474d4a5bdf79886408325768dd3cd81ab0f6332efca48e26239a600ff770788461b825146e2ad97ec334f74ea8e2d4121e8204bd95f3bfabb  CVE-2021-29623.patch
+565a43fb1fef12d82adc77f01ffbb90a410c8061b1cf20e1fe95faece9727274ebaa3ba3b50c4d08a6e8e7b9b5daf624198d32b02e9d88c2b8f01bf93bd9046b  CVE-2021-32617.patch
 "

community/exiv2/CVE-2021-29463.patch

+From 783b3a6ff15ed6f82a8f8e6c8a6f3b84a9b04d4b Mon Sep 17 00:00:00 2001
+From: Kevin Backhouse <kevinbackhouse@github.com>
+Date: Mon, 19 Apr 2021 18:06:00 +0100
+Subject: [PATCH] Improve bound checking in WebPImage::doWriteMetadata()
+
+---
+ src/webpimage.cpp | 41 ++++++++++++++++++++++++++++++-----------
+ 1 file changed, 30 insertions(+), 11 deletions(-)
+
+diff --git a/src/webpimage.cpp b/src/webpimage.cpp
+index 4ddec544c..fee110bca 100644
+--- a/src/webpimage.cpp
++++ b/src/webpimage.cpp
+@@ -145,7 +145,7 @@ namespace Exiv2 {
+         DataBuf chunkId(WEBP_TAG_SIZE+1);
+         chunkId.pData_ [WEBP_TAG_SIZE] = '\0';
+ 
+-        io_->read(data, WEBP_TAG_SIZE * 3);
++        readOrThrow(*io_, data, WEBP_TAG_SIZE * 3, Exiv2::kerCorruptedMetadata);
+         uint64_t filesize = Exiv2::getULong(data + WEBP_TAG_SIZE, littleEndian);
+ 
+         /* Set up header */
+@@ -185,13 +185,20 @@ namespace Exiv2 {
+          case we have any exif or xmp data, also check
+          for any chunks with alpha frame/layer set */
+         while ( !io_->eof() && (uint64_t) io_->tell() < filesize) {
+-            io_->read(chunkId.pData_, WEBP_TAG_SIZE);
+-            io_->read(size_buff, WEBP_TAG_SIZE);
+-            long size = Exiv2::getULong(size_buff, littleEndian);
++            readOrThrow(*io_, chunkId.pData_, WEBP_TAG_SIZE, Exiv2::kerCorruptedMetadata);
++            readOrThrow(*io_, size_buff, WEBP_TAG_SIZE, Exiv2::kerCorruptedMetadata);
++            const uint32_t size_u32 = Exiv2::getULong(size_buff, littleEndian);
++
++            // Check that `size_u32` is safe to cast to `long`.
++            enforce(size_u32 <= static_cast<size_t>(std::numeric_limits<unsigned int>::max()),
++                    Exiv2::kerCorruptedMetadata);
++            const long size = static_cast<long>(size_u32);
+             DataBuf payload(size);
+-            io_->read(payload.pData_, payload.size_);
+-            byte c;
+-            if ( payload.size_ % 2 ) io_->read(&c,1);
++            readOrThrow(*io_, payload.pData_, payload.size_, Exiv2::kerCorruptedMetadata);
++            if ( payload.size_ % 2 ) {
++              byte c;
++              readOrThrow(*io_, &c, 1, Exiv2::kerCorruptedMetadata);
++            }
+ 
+             /* Chunk with information about features
+              used in the file. */
+@@ -199,6 +206,7 @@ namespace Exiv2 {
+                 has_vp8x = true;
+             }
+             if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_VP8X) && !has_size) {
++                enforce(size >= 10, Exiv2::kerCorruptedMetadata);
+                 has_size = true;
+                 byte size_buf[WEBP_TAG_SIZE];
+ 
+@@ -227,6 +235,7 @@ namespace Exiv2 {
+             }
+ #endif
+             if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_VP8) && !has_size) {
++                enforce(size >= 10, Exiv2::kerCorruptedMetadata);
+                 has_size = true;
+                 byte size_buf[2];
+ 
+@@ -244,11 +253,13 @@ namespace Exiv2 {
+ 
+             /* Chunk with with lossless image data. */
+             if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_VP8L) && !has_alpha) {
++                enforce(size >= 5, Exiv2::kerCorruptedMetadata);
+                 if ((payload.pData_[4] & WEBP_VP8X_ALPHA_BIT) == WEBP_VP8X_ALPHA_BIT) {
+                     has_alpha = true;
+                 }
+             }
+             if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_VP8L) && !has_size) {
++                enforce(size >= 5, Exiv2::kerCorruptedMetadata);
+                 has_size = true;
+                 byte size_buf_w[2];
+                 byte size_buf_h[3];
+@@ -276,11 +287,13 @@ namespace Exiv2 {
+ 
+             /* Chunk with animation frame. */
+             if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_ANMF) && !has_alpha) {
++                enforce(size >= 6, Exiv2::kerCorruptedMetadata);
+                 if ((payload.pData_[5] & 0x2) == 0x2) {
+                     has_alpha = true;
+                 }
+             }
+             if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_ANMF) && !has_size) {
++                enforce(size >= 12, Exiv2::kerCorruptedMetadata);
+                 has_size = true;
+                 byte size_buf[WEBP_TAG_SIZE];
+ 
+@@ -309,16 +322,22 @@ namespace Exiv2 {
+ 
+         io_->seek(12, BasicIo::beg);
+         while ( !io_->eof() && (uint64_t) io_->tell() < filesize) {
+-            io_->read(chunkId.pData_, 4);
+-            io_->read(size_buff, 4);
++            readOrThrow(*io_, chunkId.pData_, 4, Exiv2::kerCorruptedMetadata);
++            readOrThrow(*io_, size_buff, 4, Exiv2::kerCorruptedMetadata);
++
++            const uint32_t size_u32 = Exiv2::getULong(size_buff, littleEndian);
+ 
+-            long size = Exiv2::getULong(size_buff, littleEndian);
++            // Check that `size_u32` is safe to cast to `long`.
++            enforce(size_u32 <= static_cast<size_t>(std::numeric_limits<unsigned int>::max()),
++                    Exiv2::kerCorruptedMetadata);
++            const long size = static_cast<long>(size_u32);
+ 
+             DataBuf payload(size);
+-            io_->read(payload.pData_, size);
++            readOrThrow(*io_, payload.pData_, size, Exiv2::kerCorruptedMetadata);
+             if ( io_->tell() % 2 ) io_->seek(+1,BasicIo::cur); // skip pad
+ 
+             if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_VP8X)) {
++                enforce(size >= 1, Exiv2::kerCorruptedMetadata);
+                 if (has_icc){
+                     payload.pData_[0] |= WEBP_VP8X_ICC_BIT;
+                 } else {

community/exiv2/CVE-2021-29470.patch

+diff --git a/src/jp2image.cpp b/src/jp2image.cpp
+index 0de088d..6310c08 100644
+--- a/src/jp2image.cpp
++++ b/src/jp2image.cpp
+@@ -645,13 +645,16 @@ static void boxes_check(size_t b,size_t m)
+         DataBuf output(boxBuf.size_ + iccProfile_.size_ + 100); // allocate sufficient space
+         int     outlen = sizeof(Jp2BoxHeader) ; // now many bytes have we written to output?
+         int      inlen = sizeof(Jp2BoxHeader) ; // how many bytes have we read from boxBuf?
++        enforce(sizeof(Jp2BoxHeader) <= static_cast<size_t>(output.size_), Exiv2::kerCorruptedMetadata);
+         Jp2BoxHeader* pBox   = (Jp2BoxHeader*) boxBuf.pData_;
+         int32_t       length = getLong((byte*)&pBox->length, bigEndian);
++        enforce(length <= static_cast<size_t>(output.size_), Exiv2::kerCorruptedMetadata);
+         int32_t       count  = sizeof (Jp2BoxHeader);
+         char*         p      = (char*) boxBuf.pData_;
+         bool          bWroteColor = false ;
+ 
+         while ( count < length || !bWroteColor ) {
++            enforce(sizeof(Jp2BoxHeader) <= length - count, Exiv2::kerCorruptedMetadata);
+             Jp2BoxHeader* pSubBox = (Jp2BoxHeader*) (p+count) ;
+ 
+             // copy data.  pointer could be into a memory mapped file which we will decode!

community/exiv2/CVE-2021-29473.patch

+From e6a0982f7cd9282052b6e3485a458d60629ffa0b Mon Sep 17 00:00:00 2001
+From: Kevin Backhouse <kevinbackhouse@github.com>
+Date: Fri, 23 Apr 2021 11:44:44 +0100
+Subject: [PATCH 2/2] Add bounds check in Jp2Image::doWriteMetadata().
+
+---
+ src/jp2image.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/jp2image.cpp b/src/jp2image.cpp
+index 1694fed27..ca8c9ddbb 100644
+--- a/src/jp2image.cpp
++++ b/src/jp2image.cpp
+@@ -908,6 +908,7 @@ static void boxes_check(size_t b,size_t m)
+
+                 case kJp2BoxTypeUuid:
+                 {
++                    enforce(boxBuf.size_ >= 24, Exiv2::kerCorruptedMetadata);
+                     if(memcmp(boxBuf.pData_ + 8, kJp2UuidExif, 16) == 0)
+                     {
+ #ifdef EXIV2_DEBUG_MESSAGES

community/exiv2/CVE-2021-29623.patch

+From 82e46b5524fb904e6660dadd2c6d8e5e47375a1a Mon Sep 17 00:00:00 2001
+From: Kevin Backhouse <kevinbackhouse@github.com>
+Date: Tue, 11 May 2021 12:14:33 +0100
+Subject: [PATCH] Use readOrThrow to check error conditions of iIo.read().
+
+---
+ src/webpimage.cpp | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/webpimage.cpp b/src/webpimage.cpp
+index 7c64ff3d7..ca26e514a 100644
+--- a/src/webpimage.cpp
++++ b/src/webpimage.cpp
+@@ -754,9 +754,9 @@ namespace Exiv2 {
+         byte webp[len];
+         byte data[len];
+         byte riff[len];
+-        iIo.read(riff, len);
+-        iIo.read(data, len);
+-        iIo.read(webp, len);
++        readOrThrow(iIo, riff, len, Exiv2::kerCorruptedMetadata);
++        readOrThrow(iIo, data, len, Exiv2::kerCorruptedMetadata);
++        readOrThrow(iIo, webp, len, Exiv2::kerCorruptedMetadata);
+         bool matched_riff = (memcmp(riff, RiffImageId, len) == 0);
+         bool matched_webp = (memcmp(webp, WebPImageId, len) == 0);
+         iIo.seek(-12, BasicIo::cur);