From d8d7b85719eb37e8c41490c270beb6272bd8da12c1f54e050ecc4cd2dab0e1fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B8rn=20Lie?= Date: Tue, 5 Dec 2017 03:17:28 +0000 Subject: [PATCH] Accepting request 548496 from home:mgorse:branches:GNOME:Factory - Add at-spi2-core-bgo791124-buffer-overflow.patch: fix possible buffer overflow reading dbus address in at-spi-bus-launcher (bgo#791124). - Add at-spi2-core-bgo791167-reproducible-build.patch: use @basename@ in templates, rather than @filename@; fixes build reproducibility and multiarch conflict (bgo#791167). OBS-URL: https://build.opensuse.org/request/show/548496 OBS-URL: https://build.opensuse.org/package/show/GNOME:Factory/at-spi2-core?expand=0&rev=172 --- at-spi2-core-bgo791124-buffer-overflow.patch | 28 +++++++++++++ ...i2-core-bgo791167-reproducible-build.patch | 42 +++++++++++++++++++ at-spi2-core.changes | 10 +++++ at-spi2-core.spec | 6 ++- 4 files changed, 85 insertions(+), 1 deletion(-) create mode 100644 at-spi2-core-bgo791124-buffer-overflow.patch create mode 100644 at-spi2-core-bgo791167-reproducible-build.patch diff --git a/at-spi2-core-bgo791124-buffer-overflow.patch b/at-spi2-core-bgo791124-buffer-overflow.patch new file mode 100644 index 0000000..8a19f8c --- /dev/null +++ b/at-spi2-core-bgo791124-buffer-overflow.patch @@ -0,0 +1,28 @@ +From c2e87fe00b596dba20c9d57d406ab8faa744b15a Mon Sep 17 00:00:00 2001 +From: Maya Rashish +Date: Sat, 2 Dec 2017 13:24:29 +0200 +Subject: [PATCH 1/2] Fix inverted logic. + +Don't write more into a buffer than it can hold. + +https://bugzilla.gnome.org/show_bug.cgi?id=791124 +--- + bus/at-spi-bus-launcher.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/bus/at-spi-bus-launcher.c b/bus/at-spi-bus-launcher.c +index 261353f..eb2b8e3 100644 +--- a/bus/at-spi-bus-launcher.c ++++ b/bus/at-spi-bus-launcher.c +@@ -244,7 +244,7 @@ unix_read_all_fd_to_string (int fd, + { + ssize_t bytes_read; + +- while (max_bytes > 1 && (bytes_read = read (fd, buf, MAX (4096, max_bytes - 1)))) ++ while (max_bytes > 1 && (bytes_read = read (fd, buf, MIN (4096, max_bytes - 1)))) + { + if (bytes_read < 0) + return FALSE; +-- +2.15.0 + diff --git a/at-spi2-core-bgo791167-reproducible-build.patch b/at-spi2-core-bgo791167-reproducible-build.patch new file mode 100644 index 0000000..68b0701 --- /dev/null +++ b/at-spi2-core-bgo791167-reproducible-build.patch @@ -0,0 +1,42 @@ +From 0e9de9eb62088d251b95a7990b35f52ea961a608 Mon Sep 17 00:00:00 2001 +From: Chris Lamb +Date: Mon, 4 Dec 2017 14:15:01 -0600 +Subject: [PATCH 2/2] Make the build reproducible + +atspi-enum-types.(c|h).template should use @basename@ rather than @filename@ + +https://bugzilla.gnome.org/show_bug.cgi?id=791167 +--- + atspi/atspi-enum-types.c.template | 2 +- + atspi/atspi-enum-types.h.template | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/atspi/atspi-enum-types.c.template b/atspi/atspi-enum-types.c.template +index cd92f99..385d0ee 100644 +--- a/atspi/atspi-enum-types.c.template ++++ b/atspi/atspi-enum-types.c.template +@@ -4,7 +4,7 @@ + /*** END file-header ***/ + + /*** BEGIN file-production ***/ +-/* enumerations from "@filename@" */ ++/* enumerations from "@basename@" */ + #include "@filename@" + + /*** END file-production ***/ +diff --git a/atspi/atspi-enum-types.h.template b/atspi/atspi-enum-types.h.template +index bd297b5..789ad2e 100644 +--- a/atspi/atspi-enum-types.h.template ++++ b/atspi/atspi-enum-types.h.template +@@ -9,7 +9,7 @@ G_BEGIN_DECLS + /*** END file-header ***/ + + /*** BEGIN file-production ***/ +-/* Enumerations from "@filename@" */ ++/* Enumerations from "@basename@" */ + + /*** END file-production ***/ + +-- +2.15.0 + diff --git a/at-spi2-core.changes b/at-spi2-core.changes index 07d9bed..b55d03c 100644 --- a/at-spi2-core.changes +++ b/at-spi2-core.changes @@ -1,3 +1,13 @@ +------------------------------------------------------------------- +Mon Dec 4 21:53:40 UTC 2017 - mgorse@suse.com + +- Add at-spi2-core-bgo791124-buffer-overflow.patch: fix possible + buffer overflow reading dbus address in at-spi-bus-launcher + (bgo#791124). +- Add at-spi2-core-bgo791167-reproducible-build.patch: use + @basename@ in templates, rather than @filename@; fixes build + reproducibility and multiarch conflict (bgo#791167). + ------------------------------------------------------------------- Fri Dec 1 07:39:41 UTC 2017 - zaitor@opensuse.org diff --git a/at-spi2-core.spec b/at-spi2-core.spec index 8e8d6dc..8931288 100644 --- a/at-spi2-core.spec +++ b/at-spi2-core.spec @@ -25,6 +25,10 @@ Group: System/GUI/GNOME Url: http://www.gnome.org/ Source0: http://download.gnome.org/sources/at-spi2-core/2.26/%{name}-%{version}.tar.xz Source99: baselibs.conf +# PATCH-FIX-UPSTREAM at-spi2-core-bgo791124-buffer-overflow.patch bgo#791124 mgorse@suse.com -- Fix possible buffer overflow reading dbus address in at-spi-bus-launcher. +Patch0: at-spi2-core-bgo791124-buffer-overflow.patch +# PATCH-FIX-UPSTREAM at-spi2-core-bgo791167-reproducible-build.patch bgo#791167 mgorse@suse.com -- use @basename@ rather than @filename@ in templates. +Patch1: at-spi2-core-bgo791167-reproducible-build.patch BuildRequires: gtk-doc BuildRequires: intltool @@ -83,7 +87,7 @@ to develop applications that require these. %lang_package %prep -%autosetup +%autosetup -p1 %build %meson \