diff options
| -rw-r--r-- | gnu/local.mk | 2 | ||||
| -rw-r--r-- | gnu/packages/gnunet.scm | 8 | ||||
| -rw-r--r-- | gnu/packages/patches/libextractor-CVE-2018-20430.patch | 60 | ||||
| -rw-r--r-- | gnu/packages/patches/libextractor-CVE-2018-20431.patch | 53 |
4 files changed, 3 insertions, 120 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index af2bf87273..49537e19f8 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -968,8 +968,6 @@ dist_patch_DATA = \ %D%/packages/patches/libevent-2.1-skip-failing-test.patch \ %D%/packages/patches/libexif-CVE-2016-6328.patch \ %D%/packages/patches/libexif-CVE-2017-7544.patch \ - %D%/packages/patches/libextractor-CVE-2018-20430.patch \ - %D%/packages/patches/libextractor-CVE-2018-20431.patch \ %D%/packages/patches/libgcrypt-make-yat2m-reproducible.patch \ %D%/packages/patches/libgit2-mtime-0.patch \ %D%/packages/patches/libgit2-oom-test.patch \ diff --git a/gnu/packages/gnunet.scm b/gnu/packages/gnunet.scm index 93c905406f..19e99644dd 100644 --- a/gnu/packages/gnunet.scm +++ b/gnu/packages/gnunet.scm @@ -5,7 +5,7 @@ ;;; Copyright © 2015, 2017, 2019 Efraim Flashner <efraim@flashner.co.il> ;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net> ;;; Copyright © 2016 Mark H Weaver <mhw@netris.org> -;;; Copyright © 2016, 2017, 2018 ng0 <ng0@n0.is> +;;; Copyright © 2016, 2017, 2018, 2019 ng0 <ng0@n0.is> ;;; Copyright © 2016, 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr> ;;; Copyright © 2018 Alex Vong <alexvong1995@gmail.com> ;;; @@ -68,16 +68,14 @@ (define-public libextractor (package (name "libextractor") - (version "1.8") + (version "1.9") (source (origin (method url-fetch) (uri (string-append "mirror://gnu/libextractor/libextractor-" version ".tar.gz")) - (patches (search-patches "libextractor-CVE-2018-20430.patch" - "libextractor-CVE-2018-20431.patch")) (sha256 (base32 - "1z1cb35griqzvshqdv5ck98dy0sgpsswn7fgiy7lbzi34sma8dg2")))) + "1zz2zvikvfibxnk1va3kgzs7djsmiqy7bmk8y01vbsf54ryjb3zh")))) (build-system gnu-build-system) ;; WARNING: Checks require /dev/shm to be in the build chroot, especially ;; not to be a symbolic link to /run/shm. diff --git a/gnu/packages/patches/libextractor-CVE-2018-20430.patch b/gnu/packages/patches/libextractor-CVE-2018-20430.patch deleted file mode 100644 index 570cd7c006..0000000000 --- a/gnu/packages/patches/libextractor-CVE-2018-20430.patch +++ /dev/null @@ -1,60 +0,0 @@ -Fix CVE-2018-20430: - -https://gnunet.org/bugs/view.php?id=5493 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20430 -https://security-tracker.debian.org/tracker/CVE-2018-20430 - -Patch copied from upstream source repository: - -https://gnunet.org/git/libextractor.git/commit/?id=b405d707b36e0654900cba78e89f49779efea110 - -From b405d707b36e0654900cba78e89f49779efea110 Mon Sep 17 00:00:00 2001 -From: Christian Grothoff <christian@grothoff.org> -Date: Thu, 20 Dec 2018 22:47:53 +0100 -Subject: [PATCH] fix #5493 (out of bounds read) - ---- - src/common/convert.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/src/common/convert.c b/src/common/convert.c -index c0edf21..2be2108 100644 ---- a/src/common/convert.c -+++ b/src/common/convert.c -@@ -36,8 +36,8 @@ - * string is returned. - */ - char * --EXTRACTOR_common_convert_to_utf8 (const char *input, -- size_t len, -+EXTRACTOR_common_convert_to_utf8 (const char *input, -+ size_t len, - const char *charset) - { - #if HAVE_ICONV -@@ -52,7 +52,7 @@ EXTRACTOR_common_convert_to_utf8 (const char *input, - i = input; - cd = iconv_open ("UTF-8", charset); - if (cd == (iconv_t) - 1) -- return strdup (i); -+ return strndup (i, len); - if (len > 1024 * 1024) - { - iconv_close (cd); -@@ -67,11 +67,11 @@ EXTRACTOR_common_convert_to_utf8 (const char *input, - } - itmp = tmp; - finSize = tmpSize; -- if (iconv (cd, (char **) &input, &len, &itmp, &finSize) == SIZE_MAX) -+ if (iconv (cd, (char **) &input, &len, &itmp, &finSize) == ((size_t) -1)) - { - iconv_close (cd); - free (tmp); -- return strdup (i); -+ return strndup (i, len); - } - ret = malloc (tmpSize - finSize + 1); - if (ret == NULL) --- -2.20.1 - diff --git a/gnu/packages/patches/libextractor-CVE-2018-20431.patch b/gnu/packages/patches/libextractor-CVE-2018-20431.patch deleted file mode 100644 index 855c5ba64b..0000000000 --- a/gnu/packages/patches/libextractor-CVE-2018-20431.patch +++ /dev/null @@ -1,53 +0,0 @@ -Fix CVE-2018-20431: - -https://gnunet.org/bugs/view.php?id=5494 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20431 -https://security-tracker.debian.org/tracker/CVE-2018-20431 - -Patch copied from upstream source repository: - -https://gnunet.org/git/libextractor.git/commit/?id=489c4a540bb2c4744471441425b8932b97a153e7 - -To apply the patch to libextractor 1.8 release tarball, -hunk #1 which patches ChangeLog is removed. - -From 489c4a540bb2c4744471441425b8932b97a153e7 Mon Sep 17 00:00:00 2001 -From: Christian Grothoff <christian@grothoff.org> -Date: Thu, 20 Dec 2018 23:02:28 +0100 -Subject: [PATCH] fix #5494 - ---- - ChangeLog | 3 ++- - src/plugins/ole2_extractor.c | 9 +++++++-- - 2 files changed, 9 insertions(+), 3 deletions(-) - -diff --git a/src/plugins/ole2_extractor.c b/src/plugins/ole2_extractor.c -index 53fa1b9..a48b726 100644 ---- a/src/plugins/ole2_extractor.c -+++ b/src/plugins/ole2_extractor.c -@@ -173,7 +173,7 @@ struct ProcContext - EXTRACTOR_MetaDataProcessor proc; - - /** -- * Closure for 'proc'. -+ * Closure for @e proc. - */ - void *proc_cls; - -@@ -213,7 +213,12 @@ process_metadata (gpointer key, - - if (G_VALUE_TYPE(gval) == G_TYPE_STRING) - { -- contents = strdup (g_value_get_string (gval)); -+ const char *gvals; -+ -+ gvals = g_value_get_string (gval); -+ if (NULL == gvals) -+ return; -+ contents = strdup (gvals); - } - else - { --- -2.20.1 - |