rpms/graphviz
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fixed format string vulnerability

Browse Source 
Resolves: rhbz#1167868
This commit is contained in:
Jaroslav Škarvada 2014-11-25 17:49:39 +01:00
parent f89560b1ae
commit 1fe8c83158
2 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
graphviz-2.38.0-format-string.patch Normal file
View File

@ -0,0 +1,13 @@
diff --git a/lib/cgraph/scan.l b/lib/cgraph/scan.l
index 87db5d4..4edda50 100644
--- a/lib/cgraph/scan.l
+++ b/lib/cgraph/scan.l
@@ -225,7 +225,7 @@ void yyerror(char *str)
agxbput (&xb, buf);
agxbput (&xb, yytext);
agxbput (&xb,"'\n");
- agerr(AGERR,agxbuse(&xb));
+ agerr(AGERR, "%s", agxbuse(&xb));
agxbfree(&xb);
}
/* must be here to see flex's macro defns */

9
graphviz.spec
View File

@ -47,7 +47,7 @@
Name: graphviz Name: graphviz
Summary: Graph Visualization Tools Summary: Graph Visualization Tools
Version: 2.38.0 Version: 2.38.0
Release: 16%{?dist} Release: 17%{?dist}
Group: Applications/Multimedia Group: Applications/Multimedia
License: EPL License: EPL
URL: http://www.graphviz.org/ URL: http://www.graphviz.org/
@ -57,6 +57,8 @@ Patch0: graphviz-2.38.0-rtest-fix.patch
Patch1: graphviz-2.38.0-find-fix.patch Patch1: graphviz-2.38.0-find-fix.patch
# Not upstream patch to fix build with OCaml > 4.02.0 (upstream) and Fedora. # Not upstream patch to fix build with OCaml > 4.02.0 (upstream) and Fedora.
Patch2: graphviz-2.38.0-ocaml-fix-ints.patch Patch2: graphviz-2.38.0-ocaml-fix-ints.patch
# Backported from upstream
Patch3: graphviz-2.38.0-format-string.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildRequires: zlib-devel, libpng-devel, libjpeg-devel, expat-devel, freetype-devel >= 2 BuildRequires: zlib-devel, libpng-devel, libjpeg-devel, expat-devel, freetype-devel >= 2
BuildRequires: ksh, bison, m4, flex, tk-devel, tcl-devel >= 8.3, swig BuildRequires: ksh, bison, m4, flex, tk-devel, tcl-devel >= 8.3, swig
@ -263,6 +265,7 @@ Various tcl packages (extensions) for the graphviz tools.
%patch0 -p1 -b .rtest-fix %patch0 -p1 -b .rtest-fix
%patch1 -p1 -b .find-fix %patch1 -p1 -b .find-fix
%patch2 -p1 %patch2 -p1
%patch3 -p1 -b .format-string
# Attempt to fix rpmlint warnings about executable sources # Attempt to fix rpmlint warnings about executable sources
find -type f -regex '.*\.\(c\|h\)$' -exec chmod a-x {} ';' find -type f -regex '.*\.\(c\|h\)$' -exec chmod a-x {} ';'
@ -552,6 +555,10 @@ rm -rf %{buildroot}
%changelog %changelog
* Tue Nov 25 2014 Jaroslav Škarvada <jskarvad@redhat.com> - 2.38.0-17
- Fixed format string vulnerability
Resolves: rhbz#1167868
* Tue Nov 11 2014 Jaroslav Škarvada <jskarvad@redhat.com> - 2.38.0-16 * Tue Nov 11 2014 Jaroslav Škarvada <jskarvad@redhat.com> - 2.38.0-16
- Added ISO8859-1 fonts as requirement - Added ISO8859-1 fonts as requirement
Resolves: rhbz#1058323 Resolves: rhbz#1058323