[libvips] build against lcms/libspng, fix AVIF/JXL fuzzer (#5707)

* libvips: add lcms and libspng as dependencies

* libvips: fix AVIF fuzzer

- Ensure libheif is able to detect the headers provided by libaom.
- Disable the build of dynamic modules.

* libvips: fix JXL fuzzer

projects/libvips/Dockerfile

@@ -32,8 +32,10 @@ RUN curl https://lcamtuf.coredump.cx/afl/demo/afl_testcases.tgz | tar xzC afl-te
 RUN git clone --depth 1 https://github.com/libvips/libvips
 RUN git clone --depth 1 https://github.com/madler/zlib.git
 RUN git clone --depth 1 https://github.com/libexif/libexif
+RUN git clone --depth 1 https://github.com/mm2/Little-CMS.git lcms
 RUN git clone --depth 1 https://github.com/libjpeg-turbo/libjpeg-turbo
 RUN git clone --depth 1 https://github.com/glennrp/libpng.git
+RUN git clone --depth 1 https://github.com/randy408/libspng.git
 RUN git clone --depth 1 https://chromium.googlesource.com/webm/libwebp
 RUN git clone --depth 1 https://gitlab.com/libtiff/libtiff 
 RUN git clone --depth 1 https://aomedia.googlesource.com/aom

projects/libvips/build.sh

@@ -29,7 +29,8 @@ popd
 pushd $SRC/libexif
 autoreconf -fi
 ./configure \
-  --enable-shared=no \
+  --enable-static \
+  --disable-shared \
   --disable-docs \
   --disable-dependency-tracking \
   --prefix=$WORK
@@ -37,6 +38,17 @@ make -j$(nproc)
 make install
 popd
 
+# lcms
+pushd $SRC/lcms
+./configure \
+  --enable-static \
+  --disable-shared \
+  --disable-dependency-tracking \
+  --prefix=$WORK
+make -j$(nproc)
+make install
+popd
+
 # aom
 pushd $SRC/aom
 mkdir -p build/linux
@@ -45,7 +57,7 @@ cmake -G "Unix Makefiles" \
   -DCMAKE_C_COMPILER=$CC -DCMAKE_CXX_COMPILER=$CXX \
   -DCMAKE_C_FLAGS="$CFLAGS" -DCMAKE_CXX_FLAGS="$CXXFLAGS" \
   -DCMAKE_INSTALL_PREFIX=$WORK -DCMAKE_INSTALL_LIBDIR=lib \
-  -DENABLE_SHARED:bool=off -DCONFIG_PIC=1 \
+  -DENABLE_SHARED=FALSE -DCONFIG_PIC=1 \
   -DENABLE_EXAMPLES=0 -DENABLE_DOCS=0 -DENABLE_TESTS=0 \
   -DCONFIG_SIZE_LIMIT=1 \
   -DDECODE_HEIGHT_LIMIT=12288 -DDECODE_WIDTH_LIMIT=12288 \
@@ -66,7 +78,8 @@ autoreconf -fi
   --enable-static \
   --disable-examples \
   --disable-go \
-  --prefix=$WORK
+  --prefix=$WORK \
+  CPPFLAGS=-I$WORK/include
 make clean
 make -j$(nproc)
 make install
@@ -74,14 +87,14 @@ popd
 
 # libjpeg-turbo
 pushd $SRC/libjpeg-turbo
-cmake . -DCMAKE_INSTALL_PREFIX=$WORK -DENABLE_STATIC:bool=on
+cmake . -DCMAKE_INSTALL_PREFIX=$WORK -DENABLE_STATIC=TRUE -DENABLE_SHARED=FALSE -DWITH_TURBOJPEG=FALSE
 make -j$(nproc)
 make install
 popd
 
 # libpng
 pushd $SRC/libpng
-sed -ie "s/option WARNING /option WARNING disabled/" scripts/pnglibconf.dfa
+sed -ie "s/option WARNING /& disabled/" scripts/pnglibconf.dfa
 autoreconf -fi
 ./configure \
   --prefix=$WORK \
@@ -91,6 +104,15 @@ make -j$(nproc)
 make install
 popd
 
+# libspng
+pushd $SRC/libspng
+cmake . -DCMAKE_INSTALL_PREFIX=$WORK -DSPNG_STATIC=TRUE -DSPNG_SHARED=FALSE -DZLIB_ROOT=$WORK
+make -j$(nproc)
+make install
+# Fix pkg-config file of libspng
+sed -i'.bak' "s/-lspng/&_static/" $WORK/lib/pkgconfig/libspng.pc
+popd
+
 # libwebp
 pushd $SRC/libwebp
 autoreconf -fi
@@ -125,6 +147,11 @@ popd
 # jpeg-xl (libjxl)
 pushd $SRC/jpeg-xl
 sed -i'.bak' "/add_subdirectory(tools)/d" CMakeLists.txt
+# Don't overwrite our linker flags
+sed -i'.bak' "/set(CMAKE_EXE_LINKER_FLAGS/{N;d;}" CMakeLists.txt
+# Ensure pkg-config file is installed when -DJPEGXL_STATIC=1, see:
+# https://gitlab.com/wg1/jpeg-xl/-/issues/224
+curl -Ls https://gist.github.com/kleisauke/d54b5e62367d20e66dd58ca19a2234c9/raw/1dfd4398de87e1997f21a216a1c28de730deb2d9/jpeg-xl-pkg-config.patch | patch -p1 || true
 cmake -G "Unix Makefiles" \
   -DCMAKE_BUILD_TYPE=Release \
   -DCMAKE_C_COMPILER=$CC \
@@ -138,21 +165,29 @@ cmake -G "Unix Makefiles" \
   -DCMAKE_USE_PTHREADS_INIT=1 \
   -DBUILD_SHARED_LIBS=0 \
   -DBUILD_TESTING=0 \
+  -DJPEGXL_STATIC=1 \
   -DJPEGXL_ENABLE_FUZZERS=0 \
   -DJPEGXL_ENABLE_MANPAGES=0 \
   -DJPEGXL_ENABLE_BENCHMARK=0 \
   -DJPEGXL_ENABLE_EXAMPLES=0 \
+  -DJPEGXL_ENABLE_SKCMS=0 \
   .
 make -j$(nproc)
 make install
 # libbrotli-dev package is too old in Ubuntu 16.04, use jpeg-xl version
 cp -r third_party/brotli/c/include/brotli $WORK/include
 cp third_party/brotli/*.a $WORK/lib
+cp third_party/brotli/*.pc $WORK/lib/pkgconfig
+# Fix pkg-config files of libbrotli
+sed -i'.bak' "s/-lbrotlienc/&-static/" $WORK/lib/pkgconfig/libbrotlienc.pc
+sed -i'.bak' "s/-lbrotlidec/&-static/" $WORK/lib/pkgconfig/libbrotlidec.pc
+sed -i'.bak' "s/-lbrotlicommon/&-static/" $WORK/lib/pkgconfig/libbrotlicommon.pc
 popd
 
 # libvips
-./autogen.sh \
+PKG_CONFIG="pkg-config --static" ./autogen.sh \
   --disable-shared \
+  --disable-modules \
   --disable-gtk-doc \
   --disable-gtk-doc-html \
   --disable-dependency-tracking \
@@ -179,8 +214,10 @@ for fuzzer in fuzz/*_fuzzer.cc; do
     -I/usr/lib/x86_64-linux-gnu/glib-2.0/include \
     $WORK/lib/libvips.a \
     $WORK/lib/libexif.a \
-    $WORK/lib/libturbojpeg.a \
+    $WORK/lib/liblcms2.a \
+    $WORK/lib/libjpeg.a \
     $WORK/lib/libpng.a \
+    $WORK/lib/libspng_static.a \
     $WORK/lib/libz.a \
     $WORK/lib/libwebpmux.a \
     $WORK/lib/libwebpdemux.a \
@@ -190,6 +227,10 @@ for fuzzer in fuzz/*_fuzzer.cc; do
     $WORK/lib/libaom.a \
     $WORK/lib/libjxl.a \
     $WORK/lib/libjxl_threads.a \
+    $WORK/lib/libhwy.a \
+    $WORK/lib/libbrotlienc-static.a \
+    $WORK/lib/libbrotlidec-static.a \
+    $WORK/lib/libbrotlicommon-static.a \
     $LIB_FUZZING_ENGINE \
     -Wl,-Bstatic \
     -lfftw3 -lgmodule-2.0 -lgio-2.0 -lgobject-2.0 -lffi -lglib-2.0 -lpcre -lexpat \