[bug#64676] [PATCH] gnu: libwebp: Replace with 1.3.1. [fixes CVE-2023-1999]

[Hilton Chain]

* gnu/packages/image.scm (libwebp/fixed): New variable.
(libwebp)[replacement]: Assign it to new field.
---
 gnu/packages/image.scm | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 50af2001ad..d4390fe3f3 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -1432,6 +1432,7 @@ (define-public libwebp
   (package
     (name "libwebp")
     (version "1.2.4")
+    (replacement libwebp/fixed)
     (source
      (origin
        ;; No tarballs are provided for >0.6.1.
@@ -1470,6 +1471,22 @@ (define-public libwebp
 channels.")
     (license license:bsd-3)))
 
+(define libwebp/fixed
+  (package
+    (inherit libwebp)
+    (name "libwebp")
+    (version "1.3.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://chromium.googlesource.com/webm/libwebp";)
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32
+         "1aas6gwy7kfcq34cil781kcsl286khh9grwcx7k4d2n1g7zcpl3m"))))))
+
 (define-public libmng
   (package
     (name "libmng")

base-commit: 3755941f038ec66fba568fa88d6b2d295e196723
-- 
2.41.0