rpms/liblouis
5
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

merge into: rpms:c8
Branches Tags
rpms:c8
rpms:c10s
rpms:c9
rpms:c8-beta
rpms:c9-beta
rpms:c8s
rpms:c9s
rpms:imports/c10s/liblouis-3.28.0-7.el10
rpms:imports/c10s/liblouis-3.28.0-6.el10
rpms:imports/c8/liblouis-2.6.2-23.el8
rpms:imports/c9/liblouis-3.16.1-5.el9
rpms:imports/c8-beta/liblouis-2.6.2-23.el8
rpms:imports/c9-beta/liblouis-3.16.1-5.el9
rpms:imports/c9/liblouis-3.16.1-4.el9
rpms:imports/c9-beta/liblouis-3.16.1-4.el9
rpms:imports/c8-beta/liblouis-2.6.2-22.el8
rpms:imports/c8-beta/liblouis-2.6.2-21.el8
rpms:imports/c8-beta/liblouis-2.6.2-19.el8
rpms:imports/c8-beta/liblouis-2.6.2-16.el8
rpms:imports/c8s/liblouis-2.6.2-22.el8
rpms:imports/c8s/liblouis-2.6.2-21.el8
rpms:imports/c8/liblouis-2.6.2-21.el8
rpms:imports/c8/liblouis-2.6.2-16.el8
...
pull from: rpms:c9s
Branches Tags
rpms:c10s
rpms:c8
rpms:c9
rpms:c8-beta
rpms:c9-beta
rpms:c8s
rpms:c9s
rpms:imports/c10s/liblouis-3.28.0-7.el10
rpms:imports/c10s/liblouis-3.28.0-6.el10
rpms:imports/c8/liblouis-2.6.2-23.el8
rpms:imports/c9/liblouis-3.16.1-5.el9
rpms:imports/c8-beta/liblouis-2.6.2-23.el8
rpms:imports/c9-beta/liblouis-3.16.1-5.el9
rpms:imports/c9/liblouis-3.16.1-4.el9
rpms:imports/c9-beta/liblouis-3.16.1-4.el9
rpms:imports/c8-beta/liblouis-2.6.2-22.el8
rpms:imports/c8-beta/liblouis-2.6.2-21.el8
rpms:imports/c8-beta/liblouis-2.6.2-19.el8
rpms:imports/c8-beta/liblouis-2.6.2-16.el8
rpms:imports/c8s/liblouis-2.6.2-22.el8
rpms:imports/c8s/liblouis-2.6.2-21.el8
rpms:imports/c8/liblouis-2.6.2-21.el8
rpms:imports/c8/liblouis-2.6.2-16.el8

No commits in common. "c8" and "c9s" have entirely different histories.
c8 ... c9s

15 changed files with 395 additions and 1045 deletions
Show Stats Expand all files Collapse all files

19
.gitignore vendored
View File

@ -1 +1,18 @@
SOURCES/liblouis-2.6.2.tar.gz
/liblouis-2.2.0.tar.gz
/liblouis-2.3.0.tar.gz
/liblouis-2.4.0.tar.gz
/liblouis-2.4.1.tar.gz
/liblouis-2.5.2.tar.gz
/liblouis-2.5.3.tar.gz
/liblouis-2.5.4.tar.gz
/liblouis-2.6.0.tar.gz
/liblouis-2.6.2.tar.gz
/liblouis-3.6.0.tar.gz
/liblouis-3.7.0.tar.gz
/liblouis-3.8.0.tar.gz
/liblouis-3.9.0.tar.gz
/liblouis-3.10.0.tar.gz
/liblouis-3.12.0.tar.gz
/liblouis-3.15.0.tar.gz
/liblouis-3.16.0.tar.gz
/liblouis-3.16.1.tar.gz

27
SOURCES/0001-Update-configure.ac-to-reconize-texi2any.patch
View File

@ -1,27 +0,0 @@
From e2fa19ed1a1463cbea37bbdd27481aeb80d5d7a0 Mon Sep 17 00:00:00 2001
From: Martin Michlmayr <tbm@cyrius.com>
Date: Tue, 30 Jun 2015 12:40:49 -0400
Subject: [PATCH] Update configure.ac to reconize texi2any
makeinfo, which is nowadays provided by texi2any, reports texi2any as
of version 6.0.
---
configure.ac | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure.ac b/configure.ac
index 10a5efe..13041bd 100644
--- a/configure.ac
+++ b/configure.ac
@@ -89,7 +89,7 @@ if test x"${MAKEINFO_FOUND}" = xyes
then
MAKEINFO_VERSION_REQ=5
AC_MSG_CHECKING([for makeinfo version >= $MAKEINFO_VERSION_REQ])
- MAKEINFO_VERSION=`makeinfo --version | sed -ne 's/^makeinfo .* \([[0-9]][[0-9]]*\)\.[[0-9]][[0-9]]*$/\1/p'`
+ MAKEINFO_VERSION=`makeinfo --version | sed -ne 's/^\(makeinfo\|texi2any\) .* \([[0-9]][[0-9]]*\)\.[[0-9]][[0-9]]*$/\2/p'`
if test x$MAKEINFO_VERSION = x -o 0$MAKEINFO_VERSION -lt $MAKEINFO_VERSION_REQ
then
AC_MSG_RESULT([no])
--
2.5.0

51
SOURCES/liblouis-2.6.2-CVE-2018-11577.patch
View File

@ -1,51 +0,0 @@
From 7e135b9313ad06218dfcf9ed63070edede7745a1 Mon Sep 17 00:00:00 2001
From: Christian Egli <christian.egli@sbs.ch>
Date: Thu, 31 May 2018 12:08:56 +0200
Subject: [PATCH] Fix yet another buffer overflow in the braille table parser
Reported by Edward-L
Fixes #582
diff --git a/liblouis/compileTranslationTable.c b/liblouis/compileTranslationTable.c
index 777e1da..b6bd010 100644
--- a/liblouis/compileTranslationTable.c
+++ b/liblouis/compileTranslationTable.c
@@ -2855,6 +2855,10 @@ compilePassOpcode (FileInfo * nested, TranslationTableOpcode opcode)
passLinepos = 0;
while (passLinepos <= endTest)
{
+ if (passIC >= MAXSTRING) {
+ compileError(passNested, "Test part in multipass operand too long");
+ return 0;
+ }
switch ((passSubOp = passLine.chars[passLinepos]))
{
case pass_lookback:
@@ -3050,6 +3054,10 @@ compilePassOpcode (FileInfo * nested, TranslationTableOpcode opcode)
while (passLinepos < passLine.length &&
passLine.chars[passLinepos] > 32)
{
+ if (passIC >= MAXSTRING) {
+ compileError(passNested, "Action part in multipass operand too long");
+ return 0;
+ }
switch ((passSubOp = passLine.chars[passLinepos]))
{
case pass_string:
@@ -3077,8 +3085,15 @@ compilePassOpcode (FileInfo * nested, TranslationTableOpcode opcode)
if (passHoldString.length == 0)
return 0;
passInstructions[passIC++] = passHoldString.length;
- for (kk = 0; kk < passHoldString.length; kk++)
+ for (kk = 0; kk < passHoldString.length; kk++)
+ {
+ if (passIC >= MAXSTRING)
+ {
+ compileError(passNested, "@ operand in action part of multipass operand too long");
+ return 0;
+ }
passInstructions[passIC++] = passHoldString.chars[kk];
+ }
break;
case pass_variable:
passLinepos++;

38
SOURCES/liblouis-2.6.2-CVE-2018-11683.patch
View File

@ -1,38 +0,0 @@
diff -urN liblouis-2.6.2.old/tools/lou_translate.c liblouis-2.6.2/tools/lou_translate.c
--- liblouis-2.6.2.old/tools/lou_translate.c 2020-05-17 07:37:40.572000000 +0100
+++ liblouis-2.6.2/tools/lou_translate.c 2020-05-17 07:43:28.596000000 +0100
@@ -36,8 +36,6 @@
#include "progname.h"
#include "version-etc.h"
-#define BUFSIZE MAXSTRING - 4
-
static int forward_flag = 0;
static int backward_flag = 0;
@@ -58,10 +56,10 @@
static void
translate_input (int forward_translation, char *table_name)
{
- char charbuf[BUFSIZE];
+ char charbuf[MAXSTRING];
char *outputbuf;
- widechar inbuf[BUFSIZE];
- widechar transbuf[BUFSIZE];
+ widechar inbuf[MAXSTRING];
+ widechar transbuf[MAXSTRING];
int inlen;
int translen;
int k;
@@ -69,9 +67,9 @@
int result;
while (1)
{
- translen = BUFSIZE;
+ translen = MAXSTRING;
k = 0;
- while ((ch = getchar ()) != '\n' && ch != EOF && k < BUFSIZE-1)
+ while ((ch = getchar ()) != '\n' && ch != EOF && k < MAXSTRING-1)
charbuf[k++] = ch;
if (ch == EOF && k == 0)
break;

34
SOURCES/liblouis-2.6.2-CVE-2018-11684.patch
View File

@ -1,34 +0,0 @@
From fb2bfce4ed49ac4656a8f7e5b5526e4838da1dde Mon Sep 17 00:00:00 2001
From: Christian Egli <christian.egli@sbs.ch>
Date: Mon, 4 Jun 2018 14:11:50 +0200
Subject: [PATCH] Fix yet another buffer overflow in the braille table parser
Reported by Henri Salo
Fixes #592
diff --git a/liblouis/compileTranslationTable.c b/liblouis/compileTranslationTable.c
index 2dc4c46..81a2ea1 100644
--- a/liblouis/compileTranslationTable.c
+++ b/liblouis/compileTranslationTable.c
@@ -4789,6 +4789,10 @@ includeFile (FileInfo * nested, CharsString * includedFile)
int rv;
for (k = 0; k < includedFile->length && k < MAXSTRING; k++)
includeThis[k] = (char) includedFile->chars[k];
+ if (k >= MAXSTRING) {
+ compileError(nested, "Include statement too long: 'include %s'", includeThis);
+ return 0;
+ }
includeThis[k] = 0;
tableFiles = resolveTable (includeThis, nested->fileName);
if (tableFiles == NULL)
@@ -4798,9 +4802,8 @@ includeFile (FileInfo * nested, CharsString * includedFile)
}
if (tableFiles[1] != NULL)
{
- errorCount++;
free_tablefiles(tableFiles);
- logMessage (LOG_ERROR, "Table list not supported in include statement: 'include %s'", includeThis);
+ compileError(nested, "Table list not supported in include statement: 'include %s'", includeThis);
return 0;
}
rv = compileFile (*tableFiles);

21
SOURCES/liblouis-2.6.2-CVE-2018-11685.patch
View File

@ -1,21 +0,0 @@
From b5049cb17ae3d15b2b26890de0e24d0fecc080f5 Mon Sep 17 00:00:00 2001
From: Christian Egli <christian.egli@sbs.ch>
Date: Mon, 4 Jun 2018 15:47:28 +0200
Subject: [PATCH] Fix yet another buffer overflow in the braille table parser
Reported by Henri Salo
Fixes #593
diff --git a/liblouis/compileTranslationTable.c b/liblouis/compileTranslationTable.c
index 81a2ea1..ba50064 100644
--- a/liblouis/compileTranslationTable.c
+++ b/liblouis/compileTranslationTable.c
@@ -3596,7 +3596,7 @@ compileHyphenation (FileInfo * nested, CharsString * encoding)
HyphenationTrans *holdPointer;
HyphenHashTab *hashTab;
CharsString word;
- char pattern[MAXSTRING];
+ char pattern[MAXSTRING + 1];
unsigned int stateNum = 0, lastState = 0;
int i, j, k = encoding->length;
widechar ch;

25
SOURCES/liblouis-2.6.2-CVE-2018-12085.patch
View File

@ -1,25 +0,0 @@
From dbfa58bb128cae86729578ac596056b3385817ef Mon Sep 17 00:00:00 2001
From: Christian Egli <christian.egli@sbs.ch>
Date: Wed, 6 Jun 2018 16:41:53 +0200
Subject: [PATCH] Check index before writing to result->chars
Fixes #595
Index: liblouis-2.6.4/liblouis/compileTranslationTable.c
===================================================================
--- liblouis-2.6.4.orig/liblouis/compileTranslationTable.c
+++ liblouis-2.6.4/liblouis/compileTranslationTable.c
@@ -1517,12 +1517,12 @@ parseChars (FileInfo * nested, CharsStri
}
in++;
}
- result->chars[out++] = (widechar) ch;
if (out >= MAXSTRING)
{
result->length = out;
return 1;
}
+ result->chars[out++] = (widechar) ch;
continue;
}
lastOutSize = out;

82
SOURCES/liblouis-2.6.2-coverity-fixes.patch
View File

@ -1,82 +0,0 @@
diff -urN liblouis-2.6.2.new/liblouis/compileTranslationTable.c liblouis-2.6.2/liblouis/compileTranslationTable.c
--- liblouis-2.6.2.new/liblouis/compileTranslationTable.c 2020-02-25 09:58:32.322000000 +0000
+++ liblouis-2.6.2/liblouis/compileTranslationTable.c 2020-03-02 09:20:23.017000000 +0000
@@ -1517,9 +1517,10 @@
}
in++;
}
- if (out >= MAXSTRING)
+ if (out >= MAXSTRING - 1)
{
- result->length = out;
+ compileError(nested, "Token too long");
+ result->length = MAXSTRING - 1;
return 1;
}
result->chars[out++] = (widechar) ch;
@@ -1533,15 +1534,16 @@
utf32 = ch & (0XFF - first0Bit[numBytes]);
for (k = 0; k < numBytes; k++)
{
- if (in >= MAXSTRING)
+ if (in >= MAXSTRING - 1)
break;
if (token->chars[in] < 128 || (token->chars[in] & 0x0040))
{
compileWarning (nested, "invalid UTF-8. Assuming Latin-1.");
result->chars[out++] = token->chars[lastIn];
- if (out >= MAXSTRING)
+ if (out >= MAXSTRING - 1)
{
- result->length = out;
+ compileError(nested, "Token too long");
+ result->length = lastOutSize;
return 1;
}
in = lastIn + 1;
@@ -1552,8 +1554,9 @@
if (CHARSIZE == 2 && utf32 > 0xffff)
utf32 = 0xffff;
result->chars[out++] = (widechar) utf32;
- if (out >= MAXSTRING)
+ if (out >= MAXSTRING - 1)
{
+ compileError(nested, "Token too long");
result->length = lastOutSize;
return 1;
}
@@ -1823,6 +1826,7 @@
if (!(ch->attributes & CTC_Letter))
{
compileError (nested, "a name may contain only letters");
+ free(nameRule);
return 0;
}
nameRule->name[k] = name->chars[k];
@@ -2856,7 +2860,7 @@
passLinepos = 0;
while (passLinepos <= endTest)
{
- if (passIC >= MAXSTRING) {
+ if (passIC >= MAXSTRING - 5) {
compileError(passNested, "Test part in multipass operand too long");
return 0;
}
@@ -3055,7 +3059,7 @@
while (passLinepos < passLine.length &&
passLine.chars[passLinepos] > 32)
{
- if (passIC >= MAXSTRING) {
+ if (passIC >= MAXSTRING - 2) {
compileError(passNested, "Action part in multipass operand too long");
return 0;
}
@@ -4229,7 +4233,7 @@
if (ruleDots.chars[0] == '#')
ruleDots.length = ruleDots.chars[0] = 0;
else if (ruleDots.chars[0] == '\\' && ruleDots.chars[1] == '#')
- memcpy (&ruleDots.chars[0], &ruleDots.chars[1],
+ memmove (&ruleDots.chars[0], &ruleDots.chars[1],
ruleDots.length-- * CHARSIZE);
}
}

635
SOURCES/liblouis-security-fixes.patch
View File

@ -1,635 +0,0 @@
diff --git a/liblouis/compileTranslationTable.c b/liblouis/compileTranslationTable.c
--- a/liblouis/compileTranslationTable.c
+++ b/liblouis/compileTranslationTable.c
@@ -365,12 +365,13 @@
char *
showString (widechar const *chars, int length)
{
-/*Translate a string of characters to the encoding used in character
-* operands */
+ /*Translate a string of characters to the encoding used in character
+ * operands */
int charPos;
int bufPos = 0;
+ static char scratchBuf[MAXSTRING];
scratchBuf[bufPos++] = '\'';
- for (charPos = 0; charPos < length; charPos++)
+ for (charPos = 0; charPos < length && bufPos < (MAXSTRING-2); charPos++)
{
if (chars[charPos] >= 32 && chars[charPos] < 127)
scratchBuf[bufPos++] = (char) chars[charPos];
@@ -407,7 +408,7 @@
leadingZeros = 0;
break;
}
- if ((bufPos + leadingZeros + hexLength + 4) >= sizeof (scratchBuf))
+ if ((bufPos + leadingZeros + hexLength + 4) >= (MAXSTRING-2))
break;
scratchBuf[bufPos++] = '\\';
scratchBuf[bufPos++] = escapeLetter;
@@ -422,87 +423,88 @@
return scratchBuf;
}
+typedef struct intCharTupple {
+ int key;
+ char value;
+} intCharTupple;
+
+/**
+ * Mapping between braille dot and textual representation as used in dots operands
+ */
+const static intCharTupple dotMapping[] = {
+ {B1, '1'},
+ {B2, '2'},
+ {B3, '3'},
+ {B4, '4'},
+ {B5, '5'},
+ {B6, '6'},
+ {B7, '7'},
+ {B8, '8'},
+ {B9, '9'},
+ {B10, 'A'},
+ {B11, 'B'},
+ {B12, 'C'},
+ {B13, 'D'},
+ {B14, 'E'},
+ {B15, 'F'},
+ 0
+};
+
+/**
+ * Translate a sequence of dots to the encoding used in dots operands.
+ */
char *
showDots (widechar const *dots, int length)
{
-/* Translate a sequence of dots to the encoding used in dots operands.
-*/
int bufPos = 0;
- int dotsPos;
- for (dotsPos = 0; bufPos < sizeof (scratchBuf) && dotsPos < length;
- dotsPos++)
- {
- if ((dots[dotsPos] & B1))
- scratchBuf[bufPos++] = '1';
- if ((dots[dotsPos] & B2))
- scratchBuf[bufPos++] = '2';
- if ((dots[dotsPos] & B3))
- scratchBuf[bufPos++] = '3';
- if ((dots[dotsPos] & B4))
- scratchBuf[bufPos++] = '4';
- if ((dots[dotsPos] & B5))
- scratchBuf[bufPos++] = '5';
- if ((dots[dotsPos] & B6))
- scratchBuf[bufPos++] = '6';
- if ((dots[dotsPos] & B7))
- scratchBuf[bufPos++] = '7';
- if ((dots[dotsPos] & B8))
- scratchBuf[bufPos++] = '8';
- if ((dots[dotsPos] & B9))
- scratchBuf[bufPos++] = '9';
- if ((dots[dotsPos] & B10))
- scratchBuf[bufPos++] = 'A';
- if ((dots[dotsPos] & B11))
- scratchBuf[bufPos++] = 'B';
- if ((dots[dotsPos] & B12))
- scratchBuf[bufPos++] = 'C';
- if ((dots[dotsPos] & B13))
- scratchBuf[bufPos++] = 'D';
- if ((dots[dotsPos] & B14))
- scratchBuf[bufPos++] = 'E';
- if ((dots[dotsPos] & B15))
- scratchBuf[bufPos++] = 'F';
- if ((dots[dotsPos] == B16))
- scratchBuf[bufPos++] = '0';
- if (dotsPos != length - 1)
- scratchBuf[bufPos++] = '-';
+ static char scratchBuf[MAXSTRING];
+ for (int dotsPos = 0; dotsPos < length && bufPos < (MAXSTRING-1); dotsPos++) {
+ for (int mappingPos = 0; dotMapping[mappingPos].key; mappingPos++) {
+ if ((dots[dotsPos] & dotMapping[mappingPos].key) && (bufPos < (MAXSTRING-1)))
+ scratchBuf[bufPos++] = dotMapping[mappingPos].value;
}
+ if ((dots[dotsPos] == B16) && (bufPos < (MAXSTRING-1)))
+ scratchBuf[bufPos++] = '0';
+ if ((dotsPos != length - 1) && (bufPos < (MAXSTRING-1)))
+ scratchBuf[bufPos++] = '-';
+ }
scratchBuf[bufPos] = 0;
- return &scratchBuf[0];
+ return scratchBuf;
}
+/**
+ * Mapping between character attribute and textual representation
+ */
+const static intCharTupple attributeMapping[] = {
+ {CTC_Space, 's'},
+ {CTC_Letter, 'l'},
+ {CTC_Digit, 'd'},
+ {CTC_Punctuation, 'p'},
+ {CTC_UpperCase, 'U'},
+ {CTC_LowerCase, 'u'},
+ {CTC_Math, 'm'},
+ {CTC_Sign, 'S'},
+ {CTC_LitDigit, 'D'},
+ {CTC_Class1, 'w'},
+ {CTC_Class2, 'x'},
+ {CTC_Class3, 'y'},
+ {CTC_Class4, 'z'},
+ 0
+};
+
+/**
+ * Show attributes using the letters used after the $ in multipass
+ * opcodes.
+ */
char *
showAttributes (TranslationTableCharacterAttributes a)
{
-/* Show attributes using the letters used after the $ in multipass
-* opcodes. */
int bufPos = 0;
- if ((a & CTC_Space))
- scratchBuf[bufPos++] = 's';
- if ((a & CTC_Letter))
- scratchBuf[bufPos++] = 'l';
- if ((a & CTC_Digit))
- scratchBuf[bufPos++] = 'd';
- if ((a & CTC_Punctuation))
- scratchBuf[bufPos++] = 'p';
- if ((a & CTC_UpperCase))
- scratchBuf[bufPos++] = 'U';
- if ((a & CTC_LowerCase))
- scratchBuf[bufPos++] = 'u';
- if ((a & CTC_Math))
- scratchBuf[bufPos++] = 'm';
- if ((a & CTC_Sign))
- scratchBuf[bufPos++] = 'S';
- if ((a & CTC_LitDigit))
- scratchBuf[bufPos++] = 'D';
- if ((a & CTC_Class1))
- scratchBuf[bufPos++] = 'w';
- if ((a & CTC_Class2))
- scratchBuf[bufPos++] = 'x';
- if ((a & CTC_Class3))
- scratchBuf[bufPos++] = 'y';
- if ((a & CTC_Class4))
- scratchBuf[bufPos++] = 'z';
+ static char scratchBuf[MAXSTRING];
+ for (int mappingPos = 0; attributeMapping[mappingPos].key; mappingPos++) {
+ if ((a & attributeMapping[mappingPos].key) && bufPos < (MAXSTRING - 1))
+ scratchBuf[bufPos++] = attributeMapping[mappingPos].value;
+ }
scratchBuf[bufPos] = 0;
return scratchBuf;
}
@@ -592,9 +594,10 @@
if (pch == '\\' && ch == 10)
{
nested->linelen--;
+ pch = ch;
continue;
}
- if (ch == 10 || nested->linelen >= MAXSTRING)
+ if (ch == 10 || nested->linelen >= MAXSTRING-1)
break;
nested->line[nested->linelen++] = (widechar) ch;
pch = ch;
@@ -957,43 +960,22 @@
return 1;
}
+/**
+ * Print out dot numbers
+ *
+ * @return a string containing the dot numbers. The longest possible
+ * output is "\123456789ABCDEF0/"
+ */
static char *
unknownDots (widechar dots)
{
-/*Print out dot numbers */
static char buffer[20];
int k = 1;
buffer[0] = '\\';
- if ((dots & B1))
- buffer[k++] = '1';
- if ((dots & B2))
- buffer[k++] = '2';
- if ((dots & B3))
- buffer[k++] = '3';
- if ((dots & B4))
- buffer[k++] = '4';
- if ((dots & B5))
- buffer[k++] = '5';
- if ((dots & B6))
- buffer[k++] = '6';
- if ((dots & B7))
- buffer[k++] = '7';
- if ((dots & B8))
- buffer[k++] = '8';
- if ((dots & B9))
- buffer[k++] = '9';
- if ((dots & B10))
- buffer[k++] = 'A';
- if ((dots & B11))
- buffer[k++] = 'B';
- if ((dots & B12))
- buffer[k++] = 'C';
- if ((dots & B13))
- buffer[k++] = 'D';
- if ((dots & B14))
- buffer[k++] = 'E';
- if ((dots & B15))
- buffer[k++] = 'F';
+ for (int mappingPos = 0; dotMapping[mappingPos].key; mappingPos++) {
+ if (dots & dotMapping[mappingPos].key)
+ buffer[k++] = dotMapping[mappingPos].value;
+ }
buffer[k++] = '/';
buffer[k] = 0;
return buffer;
@@ -1557,6 +1539,11 @@
{
compileWarning (nested, "invalid UTF-8. Assuming Latin-1.");
result->chars[out++] = token->chars[lastIn];
+ if (out >= MAXSTRING)
+ {
+ result->length = out;
+ return 1;
+ }
in = lastIn + 1;
continue;
}
@@ -1582,7 +1569,7 @@
CharsString wideIn;
CharsString result;
int k;
- for (k = 0; inString[k] && k < MAXSTRING; k++)
+ for (k = 0; inString[k] && k < MAXSTRING-1; k++)
wideIn.chars[k] = inString[k];
wideIn.chars[k] = 0;
wideIn.length = k;
@@ -1713,7 +1700,7 @@
CharsString wideIn;
CharsString result;
int k;
- for (k = 0; inString[k] && k < MAXSTRING; k++)
+ for (k = 0; inString[k] && k < MAXSTRING-1; k++)
wideIn.chars[k] = inString[k];
wideIn.chars[k] = 0;
wideIn.length = k;
@@ -3244,8 +3231,7 @@
static int
compileBrailleIndicator (FileInfo * nested, char *ermsg,
- TranslationTableOpcode opcode,
- TranslationTableOffset * rule)
+ TranslationTableOpcode opcode)
{
CharsString token;
CharsString cells;
@@ -3253,7 +3239,6 @@
if (parseDots (nested, &cells, &token))
if (!addRule (nested, opcode, NULL, &cells, 0, 0))
return 0;
- *rule = newRuleOffset;
return 1;
}
@@ -3869,18 +3854,22 @@
case CTO_Undefined:
ok =
compileBrailleIndicator (nested, "undefined character opcode",
- CTO_Undefined, &table->undefined);
+ CTO_Undefined);
+ if (ok)
+ table->undefined = newRuleOffset;
break;
case CTO_CapitalSign:
ok =
- compileBrailleIndicator (nested, "capital sign", CTO_CapitalRule,
- &table->capitalSign);
+ compileBrailleIndicator (nested, "capital sign", CTO_CapitalRule);
+ if (ok)
+ table->capitalSign = newRuleOffset;
break;
case CTO_BeginCapitalSign:
ok =
compileBrailleIndicator (nested, "begin capital sign",
- CTO_BeginCapitalRule,
- &table->beginCapitalSign);
+ CTO_BeginCapitalRule);
+ if (ok)
+ table->beginCapitalSign = newRuleOffset;
break;
case CTO_LenBegcaps:
ok = table->lenBeginCaps = compileNumber (nested);
@@ -3888,33 +3877,39 @@
case CTO_EndCapitalSign:
ok =
compileBrailleIndicator (nested, "end capitals sign",
- CTO_EndCapitalRule, &table->endCapitalSign);
+ CTO_EndCapitalRule);
+ if (ok)
+ table->endCapitalSign = newRuleOffset;
break;
case CTO_FirstWordCaps:
ok =
compileBrailleIndicator (nested, "first word capital sign",
- CTO_FirstWordCapsRule,
- &table->firstWordCaps);
+ CTO_FirstWordCapsRule);
+ if (ok)
+ table->firstWordCaps = newRuleOffset;
break;
case CTO_LastWordCapsBefore:
ok =
compileBrailleIndicator (nested, "capital sign before last word",
- CTO_LastWordCapsBeforeRule,
- &table->lastWordCapsBefore);
+ CTO_LastWordCapsBeforeRule);
+ if (ok)
+ table->lastWordCapsBefore = newRuleOffset;
break;
case CTO_LastWordCapsAfter:
ok =
compileBrailleIndicator (nested, "capital sign after last word",
- CTO_LastWordCapsAfterRule,
- &table->lastWordCapsAfter);
+ CTO_LastWordCapsAfterRule);
+ if (ok)
+ table->lastWordCapsAfter = newRuleOffset;
break;
case CTO_LenCapsPhrase:
ok = table->lenCapsPhrase = compileNumber (nested);
break;
case CTO_LetterSign:
ok =
- compileBrailleIndicator (nested, "letter sign", CTO_LetterRule,
- &table->letterSign);
+ compileBrailleIndicator (nested, "letter sign", CTO_LetterRule);
+ if (ok)
+ table->letterSign = newRuleOffset;
break;
case CTO_NoLetsignBefore:
if (getRuleCharsText (nested, &ruleChars))
@@ -3959,52 +3954,60 @@
break;
case CTO_NumberSign:
ok =
- compileBrailleIndicator (nested, "number sign", CTO_NumberRule,
- &table->numberSign);
+ compileBrailleIndicator (nested, "number sign", CTO_NumberRule);
+ if (ok)
+ table->numberSign = newRuleOffset;
break;
case CTO_FirstWordItal:
ok =
compileBrailleIndicator (nested, "first word italic",
- CTO_FirstWordItalRule,
- &table->firstWordItal);
+ CTO_FirstWordItalRule);
+ if (ok)
+ table->firstWordItal = newRuleOffset;
break;
case CTO_ItalSign:
case CTO_LastWordItalBefore:
ok =
compileBrailleIndicator (nested, "first word italic before",
- CTO_LastWordItalBeforeRule,
- &table->lastWordItalBefore);
+ CTO_LastWordItalBeforeRule);
+ if (ok)
+ table->lastWordItalBefore = newRuleOffset;
break;
case CTO_LastWordItalAfter:
ok =
compileBrailleIndicator (nested, "last word italic after",
- CTO_LastWordItalAfterRule,
- &table->lastWordItalAfter);
+ CTO_LastWordItalAfterRule);
+ if (ok)
+ table->lastWordItalAfter = newRuleOffset;
break;
case CTO_BegItal:
case CTO_FirstLetterItal:
ok =
compileBrailleIndicator (nested, "first letter italic",
- CTO_FirstLetterItalRule,
- &table->firstLetterItal);
+ CTO_FirstLetterItalRule);
+ if (ok)
+ table->firstLetterItal = newRuleOffset;
break;
case CTO_EndItal:
case CTO_LastLetterItal:
ok =
compileBrailleIndicator (nested, "last letter italic",
- CTO_LastLetterItalRule,
- &table->lastLetterItal);
+ CTO_LastLetterItalRule);
+ if (ok)
+ table->lastLetterItal = newRuleOffset;
break;
case CTO_SingleLetterItal:
ok =
compileBrailleIndicator (nested, "single letter italic",
- CTO_SingleLetterItalRule,
- &table->singleLetterItal);
+ CTO_SingleLetterItalRule);
+ if (ok)
+ table->singleLetterItal = newRuleOffset;
break;
case CTO_ItalWord:
ok =
- compileBrailleIndicator (nested, "italic word", CTO_ItalWordRule,
- &table->italWord);
+ compileBrailleIndicator (nested, "italic word", CTO_ItalWordRule);
+ if (ok)
+ table->italWord = newRuleOffset;
break;
case CTO_LenItalPhrase:
ok = table->lenItalPhrase = compileNumber (nested);
@@ -4012,46 +4015,53 @@
case CTO_FirstWordBold:
ok =
compileBrailleIndicator (nested, "first word bold",
- CTO_FirstWordBoldRule,
- &table->firstWordBold);
+ CTO_FirstWordBoldRule);
+ if (ok)
+ table->firstWordBold = newRuleOffset;
break;
case CTO_BoldSign:
case CTO_LastWordBoldBefore:
ok =
compileBrailleIndicator (nested, "last word bold before",
- CTO_LastWordBoldBeforeRule,
- &table->lastWordBoldBefore);
+ CTO_LastWordBoldBeforeRule);
+ if (ok)
+ table->lastWordBoldBefore = newRuleOffset;
break;
case CTO_LastWordBoldAfter:
ok =
compileBrailleIndicator (nested, "last word bold after",
- CTO_LastWordBoldAfterRule,
- &table->lastWordBoldAfter);
+ CTO_LastWordBoldAfterRule);
+ if (ok)
+ table->lastWordBoldAfter = newRuleOffset;
break;
case CTO_BegBold:
case CTO_FirstLetterBold:
ok =
compileBrailleIndicator (nested, "first letter bold",
- CTO_FirstLetterBoldRule,
- &table->firstLetterBold);
+ CTO_FirstLetterBoldRule);
+ if (ok)
+ table->firstLetterBold = newRuleOffset;
break;
case CTO_EndBold:
case CTO_LastLetterBold:
ok =
compileBrailleIndicator (nested, "last letter bold",
- CTO_LastLetterBoldRule,
- &table->lastLetterBold);
+ CTO_LastLetterBoldRule);
+ if (ok)
+ table->lastLetterBold = newRuleOffset;
break;
case CTO_SingleLetterBold:
ok =
compileBrailleIndicator (nested, "single letter bold",
- CTO_SingleLetterBoldRule,
- &table->singleLetterBold);
+ CTO_SingleLetterBoldRule);
+ if (ok)
+ table->singleLetterBold = newRuleOffset;
break;
case CTO_BoldWord:
ok =
- compileBrailleIndicator (nested, "bold word", CTO_BoldWordRule,
- &table->boldWord);
+ compileBrailleIndicator (nested, "bold word", CTO_BoldWordRule);
+ if (ok)
+ table->boldWord = newRuleOffset;
break;
case CTO_LenBoldPhrase:
ok = table->lenBoldPhrase = compileNumber (nested);
@@ -4059,46 +4069,53 @@
case CTO_FirstWordUnder:
ok =
compileBrailleIndicator (nested, "first word underline",
- CTO_FirstWordUnderRule,
- &table->firstWordUnder);
+ CTO_FirstWordUnderRule);
+ if (ok)
+ table->firstWordUnder = newRuleOffset;
break;
case CTO_UnderSign:
case CTO_LastWordUnderBefore:
ok =
compileBrailleIndicator (nested, "last word underline before",
- CTO_LastWordUnderBeforeRule,
- &table->lastWordUnderBefore);
+ CTO_LastWordUnderBeforeRule);
+ if (ok)
+ table->lastWordUnderBefore = newRuleOffset;
break;
case CTO_LastWordUnderAfter:
ok =
compileBrailleIndicator (nested, "last word underline after",
- CTO_LastWordUnderAfterRule,
- &table->lastWordUnderAfter);
+ CTO_LastWordUnderAfterRule);
+ if (ok)
+ table->lastWordUnderAfter = newRuleOffset;
break;
case CTO_BegUnder:
case CTO_FirstLetterUnder:
ok =
compileBrailleIndicator (nested, "first letter underline",
- CTO_FirstLetterUnderRule,
- &table->firstLetterUnder);
+ CTO_FirstLetterUnderRule);
+ if (ok)
+ table->firstLetterUnder = newRuleOffset;
break;
case CTO_EndUnder:
case CTO_LastLetterUnder:
ok =
compileBrailleIndicator (nested, "last letter underline",
- CTO_LastLetterUnderRule,
- &table->lastLetterUnder);
+ CTO_LastLetterUnderRule);
+ if (ok)
+ table->lastLetterUnder = newRuleOffset;
break;
case CTO_SingleLetterUnder:
ok =
compileBrailleIndicator (nested, "single letter underline",
- CTO_SingleLetterUnderRule,
- &table->singleLetterUnder);
+ CTO_SingleLetterUnderRule);
+ if (ok)
+ table->singleLetterUnder = newRuleOffset;
break;
case CTO_UnderWord:
ok =
- compileBrailleIndicator (nested, "underlined word", CTO_UnderWordRule,
- &table->underWord);
+ compileBrailleIndicator (nested, "underlined word", CTO_UnderWordRule);
+ if (ok)
+ table->underWord = newRuleOffset;
break;
case CTO_LenUnderPhrase:
ok = table->lenUnderPhrase = compileNumber (nested);
@@ -4106,12 +4123,16 @@
case CTO_BegComp:
ok =
compileBrailleIndicator (nested, "begin computer braille",
- CTO_BegCompRule, &table->begComp);
+ CTO_BegCompRule);
+ if (ok)
+ table->begComp = newRuleOffset;
break;
case CTO_EndComp:
ok =
compileBrailleIndicator (nested, "end computer braslle",
- CTO_EndCompRule, &table->endComp);
+ CTO_EndCompRule);
+ if (ok)
+ table->endComp = newRuleOffset;
break;
case CTO_Syllable:
table->syllables = 1;
@@ -4748,10 +4769,10 @@
includeFile (FileInfo * nested, CharsString * includedFile)
{
int k;
- char includeThis[MAXSTRING];
+ char includeThis[MAXSTRING+1];
char **tableFiles;
int rv;
- for (k = 0; k < includedFile->length; k++)
+ for (k = 0; k < includedFile->length && k < MAXSTRING; k++)
includeThis[k] = (char) includedFile->chars[k];
includeThis[k] = 0;
tableFiles = resolveTable (includeThis, nested->fileName);
diff --git a/tools/lou_translate.c b/tools/lou_translate.c
--- a/tools/lou_translate.c
+++ b/tools/lou_translate.c
@@ -71,7 +71,7 @@
{
translen = BUFSIZE;
k = 0;
- while ((ch = getchar ()) != '\n' && ch != EOF && k < BUFSIZE)
+ while ((ch = getchar ()) != '\n' && ch != EOF && k < BUFSIZE-1)
charbuf[k++] = ch;
if (ch == EOF && k == 0)
break;

6
gating.yaml Normal file
View File

@ -0,0 +1,6 @@
--- !Policy
product_versions:
- rhel-9
decision_context: osci_compose_gate
rules:
- !PassingTestCaseRule {test_case_name: desktop-qe.desktop-ci.tier1-gating.functional}

42
liblouis-3.16.1-fix-CVE-2023-26767.patch Normal file
View File

@ -0,0 +1,42 @@
From f432de31058b5a94874d47405216d07910c18a9a Mon Sep 17 00:00:00 2001
From: Christian Egli <christian.egli@sbs.ch>
Date: Wed, 8 Feb 2023 11:18:27 +0100
Subject: [PATCH] Check the length of path before copying into dataPath
See https://lwn.net/Articles/507319/ for more background on the
security problems of strcpy.
Fixes #1292
---
NEWS | 2 ++
liblouis/compileTranslationTable.c | 2 +-
liblouis/liblouis.h.in | 3 ++-
3 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/liblouis/compileTranslationTable.c b/liblouis/compileTranslationTable.c
index cbc6ae1614..3c74929bcb 100644
--- a/liblouis/compileTranslationTable.c
+++ b/liblouis/compileTranslationTable.c
@@ -58,7 +58,7 @@ char *EXPORT_CALL
lou_setDataPath(const char *path) {
static char dataPath[MAXSTRING];
dataPathPtr = NULL;
- if (path == NULL) return NULL;
+ if (path == NULL || strlen(path) >= MAXSTRING) return NULL;
strcpy(dataPath, path);
dataPathPtr = dataPath;
return dataPathPtr;
diff --git a/liblouis/liblouis.h.in b/liblouis/liblouis.h.in
index 88d7996895..c51305f7ad 100644
--- a/liblouis/liblouis.h.in
+++ b/liblouis/liblouis.h.in
@@ -283,7 +283,8 @@ lou_getEmphClasses(const char *tableList);
/**
* Set the path used for searching for tables and liblouisutdml files.
*
- * Overrides the installation path. */
+ * Overrides the installation path. Returns NULL if `path` is NULL or
+ * if the length of `path` is equal or longer than `MAXSTRING`. */
LIBLOUIS_API
char *EXPORT_CALL
lou_setDataPath(const char *path);

57
liblouis-3.16.1-fix-CVE-2023-26768.patch Normal file
View File

@ -0,0 +1,57 @@
From 565ac66ec0c187ffb442226487de3db376702958 Mon Sep 17 00:00:00 2001
From: Marsman1996 <lqliuyuwei@outlook.com>
Date: Thu, 9 Feb 2023 18:56:21 +0800
Subject: [PATCH 1/2] Check filename before coping to initialLogFileName
---
liblouis/logging.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/liblouis/logging.c b/liblouis/logging.c
index 9f470b45e5..7498deb758 100644
--- a/liblouis/logging.c
+++ b/liblouis/logging.c
@@ -126,7 +126,7 @@ lou_logFile(const char *fileName) {
fclose(logFile);
logFile = NULL;
}
- if (fileName == NULL || fileName[0] == 0) return;
+ if (fileName == NULL || fileName[0] == 0 || strlen(fileName) >= 256) return;
if (initialLogFileName[0] == 0) strcpy(initialLogFileName, fileName);
logFile = fopen(fileName, "a");
if (logFile == NULL && initialLogFileName[0] != 0)
From 47822bb418fb77564c159469e3be79989b11aced Mon Sep 17 00:00:00 2001
From: Marsman1996 <lqliuyuwei@outlook.com>
Date: Thu, 9 Feb 2023 21:00:36 +0800
Subject: [PATCH 2/2] replace the magic number with a define
---
liblouis/logging.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/liblouis/logging.c b/liblouis/logging.c
index 7498deb758..2849cf26d4 100644
--- a/liblouis/logging.c
+++ b/liblouis/logging.c
@@ -117,8 +117,10 @@ _lou_logMessage(logLevels level, const char *format, ...) {
}
}
+#define FILENAMESIZE 256
+
static FILE *logFile = NULL;
-static char initialLogFileName[256] = "";
+static char initialLogFileName[FILENAMESIZE] = "";
void EXPORT_CALL
lou_logFile(const char *fileName) {
@@ -126,7 +128,7 @@ lou_logFile(const char *fileName) {
fclose(logFile);
logFile = NULL;
}
- if (fileName == NULL || fileName[0] == 0 || strlen(fileName) >= 256) return;
+ if (fileName == NULL || fileName[0] == 0 || strlen(fileName) >= FILENAMESIZE) return;
if (initialLogFileName[0] == 0) strcpy(initialLogFileName, fileName);
logFile = fopen(fileName, "a");
if (logFile == NULL && initialLogFileName[0] != 0)

162
liblouis-3.16.1-fix-CVE-2023-26769.patch Normal file
View File

@ -0,0 +1,162 @@
From d45430431f8c75941f863328eb3f7fc09f902b2e Mon Sep 17 00:00:00 2001
From: Marsman1996 <lqliuyuwei@outlook.com>
Date: Wed, 8 Feb 2023 22:10:01 +0800
Subject: [PATCH 1/3] Check the path length before coping into tableFile
---
liblouis/compileTranslationTable.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/liblouis/compileTranslationTable.c b/liblouis/compileTranslationTable.c
index 3c74929bcb..2da766e169 100644
--- a/liblouis/compileTranslationTable.c
+++ b/liblouis/compileTranslationTable.c
@@ -4539,7 +4539,9 @@ resolveSubtable(const char *table, const char *base, const char *searchPath) {
char *tableFile;
static struct stat info;
- if (table == NULL || table[0] == '\0') return NULL;
+ if (table == NULL || table[0] == '\0' ||
+ strlen(table) >= MAXSTRING * sizeof(char) * 2)
+ return NULL;
tableFile = (char *)malloc(MAXSTRING * sizeof(char) * 2);
//
@@ -4547,10 +4549,13 @@ resolveSubtable(const char *table, const char *base, const char *searchPath) {
//
if (base) {
int k;
+ if (strlen(base) >= MAXSTRING * sizeof(char) * 2) goto failure;
strcpy(tableFile, base);
k = (int)strlen(tableFile);
while (k >= 0 && tableFile[k] != '/' && tableFile[k] != '\\') k--;
tableFile[++k] = '\0';
+ if (strlen(tableFile) + strlen(table) >= MAXSTRING * sizeof(char) * 2)
+ goto failure;
strcat(tableFile, table);
if (stat(tableFile, &info) == 0 && !(info.st_mode & S_IFDIR)) {
_lou_logMessage(LOU_LOG_DEBUG, "found table %s", tableFile);
@@ -4582,6 +4587,10 @@ resolveSubtable(const char *table, const char *base, const char *searchPath) {
last = (*cp == '\0');
*cp = '\0';
if (dir == cp) dir = ".";
+ if (strlen(dir) + strlen(table) + 1 >= MAXSTRING * sizeof(char) * 2) {
+ free(searchPath_copy);
+ goto failure;
+ }
sprintf(tableFile, "%s%c%s", dir, DIR_SEP, table);
if (stat(tableFile, &info) == 0 && !(info.st_mode & S_IFDIR)) {
_lou_logMessage(LOU_LOG_DEBUG, "found table %s", tableFile);
@@ -4589,6 +4598,10 @@ resolveSubtable(const char *table, const char *base, const char *searchPath) {
return tableFile;
}
if (last) break;
+ if (strlen(dir) + strlen(table) + 16 >= MAXSTRING * sizeof(char) * 2) {
+ free(searchPath_copy);
+ goto failure;
+ }
sprintf(tableFile, "%s%c%s%c%s%c%s", dir, DIR_SEP, "liblouis", DIR_SEP,
"tables", DIR_SEP, table);
if (stat(tableFile, &info) == 0 && !(info.st_mode & S_IFDIR)) {
@@ -4600,6 +4613,7 @@ resolveSubtable(const char *table, const char *base, const char *searchPath) {
}
free(searchPath_copy);
}
+failure:
free(tableFile);
return NULL;
}
From 6f39e88745e8ec602ccc46042c305a6188f28b0a Mon Sep 17 00:00:00 2001
From: Marsman1996 <lqliuyuwei@outlook.com>
Date: Wed, 8 Feb 2023 22:40:52 +0800
Subject: [PATCH 2/3] fix format: 1. define MAX_TABLEFILE_SIZE 2. parse the
magic number
---
liblouis/compileTranslationTable.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/liblouis/compileTranslationTable.c b/liblouis/compileTranslationTable.c
index 2da766e169..f334a38371 100644
--- a/liblouis/compileTranslationTable.c
+++ b/liblouis/compileTranslationTable.c
@@ -4539,23 +4539,21 @@ resolveSubtable(const char *table, const char *base, const char *searchPath) {
char *tableFile;
static struct stat info;
- if (table == NULL || table[0] == '\0' ||
- strlen(table) >= MAXSTRING * sizeof(char) * 2)
- return NULL;
- tableFile = (char *)malloc(MAXSTRING * sizeof(char) * 2);
+#define MAX_TABLEFILE_SIZE MAXSTRING * sizeof(char) * 2
+ if (table == NULL || table[0] == '\0') return NULL;
+ tableFile = (char *)malloc(MAX_TABLEFILE_SIZE);
//
// First try to resolve against base
//
if (base) {
int k;
- if (strlen(base) >= MAXSTRING * sizeof(char) * 2) goto failure;
+ if (strlen(base) >= MAX_TABLEFILE_SIZE) goto failure;
strcpy(tableFile, base);
k = (int)strlen(tableFile);
while (k >= 0 && tableFile[k] != '/' && tableFile[k] != '\\') k--;
tableFile[++k] = '\0';
- if (strlen(tableFile) + strlen(table) >= MAXSTRING * sizeof(char) * 2)
- goto failure;
+ if (strlen(tableFile) + strlen(table) >= MAX_TABLEFILE_SIZE) goto failure;
strcat(tableFile, table);
if (stat(tableFile, &info) == 0 && !(info.st_mode & S_IFDIR)) {
_lou_logMessage(LOU_LOG_DEBUG, "found table %s", tableFile);
@@ -4567,6 +4565,7 @@ resolveSubtable(const char *table, const char *base, const char *searchPath) {
// It could be an absolute path, or a path relative to the current working
// directory
//
+ if (strlen(table) >= MAX_TABLEFILE_SIZE) goto failure;
strcpy(tableFile, table);
if (stat(tableFile, &info) == 0 && !(info.st_mode & S_IFDIR)) {
_lou_logMessage(LOU_LOG_DEBUG, "found table %s", tableFile);
@@ -4587,7 +4586,7 @@ resolveSubtable(const char *table, const char *base, const char *searchPath) {
last = (*cp == '\0');
*cp = '\0';
if (dir == cp) dir = ".";
- if (strlen(dir) + strlen(table) + 1 >= MAXSTRING * sizeof(char) * 2) {
+ if (strlen(dir) + strlen(table) + 1 >= MAX_TABLEFILE_SIZE) {
free(searchPath_copy);
goto failure;
}
@@ -4598,7 +4597,8 @@ resolveSubtable(const char *table, const char *base, const char *searchPath) {
return tableFile;
}
if (last) break;
- if (strlen(dir) + strlen(table) + 16 >= MAXSTRING * sizeof(char) * 2) {
+ if (strlen(dir) + strlen("liblouis") + strlen("tables") + strlen(table) + 3 >=
+ MAX_TABLEFILE_SIZE) {
free(searchPath_copy);
goto failure;
}
From 9f6cec9b63c1d9396fcc32fed77267a2815b648f Mon Sep 17 00:00:00 2001
From: Marsman1996 <lqliuyuwei@outlook.com>
Date: Wed, 8 Feb 2023 23:01:56 +0800
Subject: [PATCH 3/3] add parentheses for define expression
---
liblouis/compileTranslationTable.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/liblouis/compileTranslationTable.c b/liblouis/compileTranslationTable.c
index f334a38371..3575792796 100644
--- a/liblouis/compileTranslationTable.c
+++ b/liblouis/compileTranslationTable.c
@@ -4539,7 +4539,7 @@ resolveSubtable(const char *table, const char *base, const char *searchPath) {
char *tableFile;
static struct stat info;
-#define MAX_TABLEFILE_SIZE MAXSTRING * sizeof(char) * 2
+#define MAX_TABLEFILE_SIZE (MAXSTRING * sizeof(char) * 2)
if (table == NULL || table[0] == '\0') return NULL;
tableFile = (char *)malloc(MAX_TABLEFILE_SIZE);

240
SPECS/liblouis.spec → liblouis.spec
View File

@ -1,61 +1,33 @@
%if !( 0%{?rhel} > 0 && 0%{?rhel} <= 7)
# Turn off the brp-python-bytecompile script
%global __os_install_post %(echo '%{__os_install_post}' | sed -e 's!/usr/lib[^[:space:]]*/brp-python-bytecompile[[:space:]].*$!!g')
%endif
%if 0%{?rhel} > 7
# Disable python2 build by default
%bcond_with python2
%else
%bcond_without python2
%endif
Name: liblouis
Version: 2.6.2
Release: 23%{?dist}
Version: 3.16.1
Release: 5%{?dist}
Summary: Braille translation and back-translation library
Group: System Environment/Libraries
License: LGPLv3+
URL: http://liblouis.org
Source0: https://github.com/%{name}/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.gz
# Backported upstream patch to fix the build with texinfo 6.0
Patch0: 0001-Update-configure.ac-to-reconize-texi2any.patch
# security patch taken from
# https://git.centos.org/raw/rpms/liblouis.git/9f94aa24d3308691c575e2659e42321f4aff1cf3/SOURCES!security-fixes.patch
# fixes CVE-2014-8184, CVE-2017-13738, CVE-2017-13740, CVE-2017-13741, CVE-2017-13742, CVE-2017-13743, CVE-2017-13744
Patch1: %{name}-security-fixes.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1585906
Patch2: liblouis-2.6.2-CVE-2018-11577.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1588632
Patch3: liblouis-2.6.2-CVE-2018-11684.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1588637
Patch4: liblouis-2.6.2-CVE-2018-11685.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1589942
Patch5: liblouis-2.6.2-CVE-2018-12085.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1602585
Patch6: liblouis-2.6.2-coverity-fixes.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1588626
Patch7: liblouis-2.6.2-CVE-2018-11683.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2181151
Patch0: liblouis-3.16.1-fix-CVE-2023-26767.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2181151
Patch1: liblouis-3.16.1-fix-CVE-2023-26768.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2181149
Patch2: liblouis-3.16.1-fix-CVE-2023-26769.patch
BuildRequires: chrpath
BuildRequires: gcc
BuildRequires: help2man
BuildRequires: libyaml-devel
BuildRequires: texinfo
BuildRequires: texinfo-tex
%if %{with python2}
BuildRequires: python2-devel
%endif # with python2
BuildRequires: texlive-eurosym
BuildRequires: texlive-xetex
BuildRequires: python3-devel
BuildRequires: make
# For patch0
BuildRequires: autoconf automake libtool
Requires(post): info
Requires(preun): info
# gnulib is a copylib that has been granted an exception from the no-bundled-libraries policy
# http://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries#Copylibs
Provides: bundled(gnulib) = 20130621
Provides: bundled(gnulib)
%description
Liblouis is an open-source braille translator and back-translator named in
@ -74,7 +46,6 @@ Linux. It has, however, gone far beyond these routines.
%package devel
Summary: Development files for %{name}
Group: Development/Libraries
Requires: %{name}%{?_isa} = %{version}-%{release}
Requires: pkgconfig
@ -85,9 +56,7 @@ developing applications that use %{name}.
%package utils
Summary: Command-line utilities to test %{name}
Group: Applications/Text
Requires: %{name}%{?_isa} = %{version}-%{release}
Requires: python3-louis = %{version}-%{release}
License: GPLv3+
%description utils
@ -95,23 +64,9 @@ Six test programs are provided as part of the liblouis package. They
are intended for testing liblouis and for debugging tables. None of
them is suitable for braille transcription.
%if %{with python2}
%package -n python2-louis
Summary: Python 2 language bindings for %{name}
Group: Development/Languages
BuildArch: noarch
Requires: %{name} = %{version}-%{release}
Obsoletes: %{name}-python < 2.6.2-3
Provides: %{name}-python = %{version}-%{release}
%{?python_provide:%python_provide python2-louis}
%description -n python2-louis
This package provides Python 2 language bindings for %{name}.
%endif # with python2
%package -n python3-louis
Summary: Python 3 language bindings for %{name}
Group: Development/Languages
BuildArch: noarch
Requires: %{name} = %{version}-%{release}
Obsoletes: %{name}-python3 < 2.6.2-3
@ -124,7 +79,6 @@ This package provides Python 3 language bindings for %{name}.
%package doc
Summary: Documentation for %{name}
Group: Documentation
BuildArch: noarch
Requires: %{name} = %{version}-%{release}
@ -133,27 +87,14 @@ This package provides the documentation for liblouis.
%prep
%setup -q
%patch0 -p1
%patch1 -p1
%patch2 -p1
%patch3 -p1
%patch4 -p1
%patch5 -p1
%patch6 -p1
%patch7 -p1
%autosetup -p1
# For patch0
autoreconf -fi
# Change the shebang of check_doctests to point to python3
pathfix.py -i "%{__python3}" -pn \
tests/check_doctests.py
%build
%configure --disable-static --enable-ucs4
make %{?_smp_mflags}
make -C doc %{name}.pdf
# parallel builds fail
make
cd doc; xetex %{name}.texi
%check
@ -161,50 +102,30 @@ make check
%install
make install DESTDIR=%{buildroot}
%make_install
rm -f %{buildroot}/%{_infodir}/dir
rm -f %{buildroot}/%{_libdir}/%{name}.la
rm -rf %{buildroot}/%{_bindir}/lou_maketable*
rm -rf %{buildroot}/%{_defaultdocdir}/%{name}/
cd python/louis
%if %{with python2}
install -d %{buildroot}%{python2_sitelib}/louis
install -pm 0644 __init__.py %{buildroot}%{python2_sitelib}/louis/
%endif # with python2
%if !( 0%{?rhel} > 0 && 0%{?rhel} <= 7)
%if %{with python2}
%py_byte_compile %{__python} %{buildroot}%{python2_sitelib}/louis/
%endif # with python2
install -d %{buildroot}%{python3_sitelib}/louis
install -pm 0644 __init__.py %{buildroot}%{python3_sitelib}/louis/
%py_byte_compile %{__python3} %{buildroot}%{python3_sitelib}/louis/
%endif
# Remove Rpaths from the executables. We must do that in the %%install section
# because, otherwise, the test suite wouldn't build.
for f in `find %{buildroot}%{_bindir} -exec file {} \; | grep 'ELF.*executable' | cut -d: -f1`; do
for f in %{buildroot}%{_bindir}/lou_* ; do
chrpath --delete $f
done
%post
/sbin/ldconfig
/sbin/install-info %{_infodir}/%{name}.info %{_infodir}/dir || :
%postun -p /sbin/ldconfig
%preun
if [ $1 = 0 ] ; then
/sbin/install-info --delete %{_infodir}/%{name}.info %{_infodir}/dir || :
fi
%ldconfig_scriptlets
%files
%doc README COPYING.LESSER AUTHORS NEWS ChangeLog TODO
%doc README AUTHORS NEWS ChangeLog TODO
%license COPYING.LESSER
%{_libdir}/%{name}.so.*
%{_datadir}/%{name}/
%{_infodir}/%{name}.info*
@ -216,52 +137,109 @@ fi
%{_libdir}/%{name}.so
%files utils
%doc COPYING
%license COPYING
%{_bindir}/lou_*
%{_mandir}/man1/lou_*.1*
%if %{with python2}
%files -n python2-louis
%doc python/README
%{python2_sitelib}/louis/
%endif # with python2
%if !( 0%{?rhel} > 0 && 0%{?rhel} <= 7)
%files -n python3-louis
%{python3_sitelib}/louis/
%endif
%files doc
%doc doc/%{name}.{html,txt,pdf}
%changelog
* Tue Jun 20 2023 Tomas Popela <tpopela@redhat.com> - 2.6.2-23
- Resolves: RHEL-593 Bump the release to fix the upgrade path
* Mon Apr 03 2023 David King <amigadave@amigadave.com> - 3.16.1-5
- Fix CVE-2023-26767 (#2181147)
- Fix CVE-2023-26768 (#2181151)
- Fix CVE-2023-26769 (#2181149)
* Sat May 16 2020 David King <dking@redhat.com> - 2.6.2-22
- Fix CVE-2018-11683 (#1588626)
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 3.16.1-4
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Mon Mar 02 2020 David King <dking@redhat.com> - 2.6.2-21
- A further Coverity fix (#1602585)
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 3.16.1-3
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Thu Dec 19 2019 David King <dking@redhat.com> - 2.6.2-20
- Fix buffer overruns found by Coverity (#1602585)
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.16.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Thu Dec 05 2019 David King <dking@redhat.com> - 2.6.2-19
- Fix two issues found by Coverity (#1602585)
* Wed Dec 02 2020 Martin Gieseking <martin.gieseking@uos.de> - 3.16.1-1
- Update to 3.16.1
* Wed Dec 04 2019 David King <dking@redhat.com> - 2.6.2-18
- Apply patch for CVE-2018-12085 (#1589942)
* Tue Dec 01 2020 Martin Gieseking <martin.gieseking@uos.de> - 3.16.0-1
- Update to 3.16.0
* Wed Dec 04 2019 David King <dking@redhat.com> - 2.6.2-17
- Fix CVE-2018-11577 (#1585906)
- Fix CVE-2018-11684 (#1588632)
- Fix CVE-2018-11685 (#1588637)
- Fix CVE-2018-12085 (#1589942)
* Mon Sep 07 2020 Martin Gieseking <martin.gieseking@uos.de> - 3.15.0-2
- Use make_install macro.
* Thu Jun 07 2018 Charalampos Stratakis <cstratak@redhat.com> - 2.6.2-16
- Conditionalize the python2 subpackage
* Tue Sep 01 2020 Martin Gieseking <martin.gieseking@uos.de> - 3.15.0-1
- Updated to 3.15.0
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.0-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue May 26 2020 Miro Hrončok <mhroncok@redhat.com> - 3.12.0-3
- Rebuilt for Python 3.9
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Mon Jan 20 2020 Martin Gieseking <martin.gieseking@uos.de> - 3.12.0-1
- Updated to 3.12.0.
- Dropped date from Provides(gnulib).
* Thu Oct 03 2019 Miro Hrončok <mhroncok@redhat.com> - 3.10.0-4
- Rebuilt for Python 3.8.0rc1 (#1748018)
* Mon Aug 19 2019 Miro Hrončok <mhroncok@redhat.com> - 3.10.0-3
- Rebuilt for Python 3.8
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Mon Jun 03 2019 Martin Gieseking <martin.gieseking@uos.de> - 3.10.0-1
- Updated to 3.10.0.
- Use %%license tag to add the file containing the license text.
* Mon Mar 04 2019 Martin Gieseking <martin.gieseking@uos.de> - 3.9.0-1
- Updated to 3.9.0.
- Dropped GCC 9 related patch since changes have been applied upstream.
* Fri Feb 08 2019 Martin Gieseking <martin.gieseking@uos.de> - 3.8.0-3
- Fixed memory issue introduced with GCC 9 (changed semantics of block scope compound literals).
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.8.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Mon Dec 10 2018 Martin Gieseking <martin.gieseking@uos.de> - 3.8.0-1
- Updated to 3.8.0
* Sat Oct 13 2018 Martin Gieseking <martin.gieseking@uos.de> - 3.7.0-2
- Dropped Python 2 language bindings according to
https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal
- Dropped Python dependency from utils package because it doesn't contain Python scripts any longer
- Added BR:libyaml-devel to enable YAML support
* Wed Sep 26 2018 Martin Gieseking <martin.gieseking@uos.de> - 3.7.0-1
- Updated to 3.7.0, fixes CVE-2018-17294 (BZ #1632834).
* Tue Jul 31 2018 Florian Weimer <fweimer@redhat.com> - 3.6.0-4
- Rebuild with fixed binutils
* Sat Jul 28 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 3.6.0-3
- Replace obsolete scriptlets
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Mon Jul 09 2018 Martin Gieseking <martin.gieseking@uos.de> - 3.6.0-1
- Updated to 3.6.0.
- Added patch to fix CVE-2018-12085.
- Create liblouis.pdf with XeTeX rather than texi2pdf to prevent build errors.
* Tue Jun 19 2018 Miro Hrončok <mhroncok@redhat.com> - 2.6.2-16
- Rebuilt for Python 3.7
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.2-15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

1
sources Normal file
View File

@ -0,0 +1 @@
SHA512 (liblouis-3.16.1.tar.gz) = 8ac3723d8240be7c84854bc2b6efeefd5c4fd405c3a368de151c2b7612acc809b91c4227bc15d31040d65b6872dd9b05fbb99ecc4325a87cc6a570972a8ca4a7