.gitignore

@@ -1,11 +1 @@
-/orc-0.4.23.tar.xz
-/orc-0.4.24.tar.xz
-/orc-0.4.25.tar.xz
-/orc-0.4.26.tar.xz
-/orc-0.4.27.tar.xz
-/orc-0.4.28.tar.xz
-/orc-0.4.29.tar.xz
-/orc-0.4.30.tar.xz
-/orc-0.4.31.tar.xz
-/orc-0.4.33.tar.xz
-/orc-0.4.39.tar.xz
+SOURCES/orc-0.4.28.tar.xz

.orc.metadata

@@ -0,0 +1 @@
+8444720a197a15a3da05292ce86a33df7226e3c9 SOURCES/orc-0.4.28.tar.xz

0001-powerpc-fix-div255w-which-still-used-the-inexact-sub.patch

@@ -1,66 +0,0 @@
-From 508280f7ac31c7d0ab2eaed33b26e6df59bb4dd9 Mon Sep 17 00:00:00 2001
-From: "L. E. Segovia" <amy@centricular.com>
-Date: Fri, 19 Jul 2024 22:25:20 -0300
-Subject: [PATCH 1/2] powerpc: fix div255w which still used the inexact
- substitution
-
-The code for this architecture used the substitution suggested in the
-original bug report. That one had subtle failures on armv7a and aarch64,
-but I was not able to verify if they affected PowerPC too.
-
-This commit fixes it by reusing the mulhuw instruction implementation --
-sse2 can be ported directly that way.
-
-Fixes #71
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/orc/-/merge_requests/195>
----
- orc/orcrules-altivec.c | 31 +++++++++++++++----------------
- 1 file changed, 15 insertions(+), 16 deletions(-)
-
-diff --git a/orc/orcrules-altivec.c b/orc/orcrules-altivec.c
-index 23409a8..a13fb5b 100644
---- a/orc/orcrules-altivec.c
-+++ b/orc/orcrules-altivec.c
-@@ -1513,23 +1513,22 @@ powerpc_rule_convlf (OrcCompiler *p, void *user, OrcInstruction *insn)
- static void
- powerpc_rule_div255w (OrcCompiler *p, void *user, OrcInstruction *insn)
- {
--  int src1 = ORC_SRC_ARG (p, insn, 0);
--  int dest = ORC_DEST_ARG (p, insn, 0);
--  int tmp = orc_compiler_get_temp_reg (p);
--  int tmp2 = orc_compiler_get_temp_reg (p);
--  int tmpc;
--
--  tmpc = powerpc_get_constant (p, ORC_CONST_SPLAT_W, 0x0001);
--
--  ORC_ASM_CODE(p,"  vspltish %s, 8\n", powerpc_get_regname(tmp2));
--  powerpc_emit_VX(p, 0x1000034c, powerpc_regnum(tmp2), 8, 0);
--
--  powerpc_emit_VX_2 (p, "vadduhm", 0x10000040, dest, src1, tmpc);
--
--  powerpc_emit_VX_2 (p, "vsrh", 0x10000244, tmp, src1, tmp2);
--  powerpc_emit_VX_2 (p, "vadduhm", 0x10000040, dest, dest, tmp);
-+  const int src1 = ORC_SRC_ARG (p, insn, 0);
-+  const int dest = ORC_DEST_ARG(p, insn, 0);
-+  const int tmp = powerpc_get_constant (p, ORC_CONST_SPLAT_W, 7);
-+  const int tmpc = powerpc_get_constant (p, ORC_CONST_SPLAT_W, 0x8081);
-+
-+  {
-+    // mulhuw
-+    const int perm = powerpc_get_constant_full(p, 0x10110001, 0x14150405,
-+        0x18190809, 0x1c1d0c0d);
-+
-+    powerpc_emit_vmuleuh (p, p->tmpreg, src1, tmpc);
-+    powerpc_emit_vmulouh (p, dest, src1, tmpc);
-+    powerpc_emit_vperm (p, dest, dest, p->tmpreg, perm);
-+  }
- 
--  powerpc_emit_VX_2 (p, "vsrh", 0x10000244, dest, dest, tmp2);
-+  powerpc_emit_VX_2 (p, "vsrh", 0x10000244, dest, dest, tmp);
- }
- 
- static void
--- 
-2.45.2
-

SOURCES/0001-Use-vasprintf-if-available-for-error-messages-and-ot.patch

@@ -0,0 +1,115 @@
+From 4077146f8a49eeb0fc0c01ef45398aaca53bc958 Mon Sep 17 00:00:00 2001
+From: Wim Taymans <wtaymans@redhat.com>
+Date: Wed, 31 Jul 2024 11:12:48 +0200
+Subject: [PATCH] Use vasprintf() if available for error messages and otherwise
+ vsnprintf()
+
+vasprintf() is a GNU/BSD extension and would allocate as much memory as required
+on the heap, similar to g_strdup_printf(). It's ridiculous that such a function
+is still not provided as part of standard C.
+
+If it's not available, use vsnprintf() to at least avoid stack/heap buffer
+overflows, which can lead to arbitrary code execution.
+
+Thanks to Noriko Totsuka for reporting.
+
+Fixes JVN#02030803 / JPCERT#92912620 / CVE-2024-40897
+Fixes #69
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/orc/-/merge_requests/191>
+---
+ configure.ac      |  1 +
+ meson.build       |  1 +
+ orc/orccompiler.c |  6 +++++-
+ orc/orcparse.c    | 18 +++++++++++++++---
+ 4 files changed, 22 insertions(+), 4 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index bdf89a6..0dd7d7a 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -64,6 +64,7 @@ AC_CHECK_HEADERS([inttypes.h])
+ AC_CHECK_HEADERS([sys/time.h])
+ AC_CHECK_HEADERS([unistd.h])
+ 
++AC_CHECK_FUNCS([vasprintf])
+ AC_CHECK_FUNCS([gettimeofday])
+ AC_CHECK_FUNCS([sigaction])
+ AC_CHECK_FUNCS([sigsetjmp])
+diff --git a/meson.build b/meson.build
+index 32f6492..ec085f0 100644
+--- a/meson.build
++++ b/meson.build
+@@ -97,6 +97,7 @@ int main() {
+ '''
+ cdata.set('HAVE_MONOTONIC_CLOCK', cc.compiles(monotonic_test))
+ cdata.set('HAVE_GETTIMEOFDAY', cc.has_function('gettimeofday'))
++cdata.set('HAVE_VASPRINTF', cc.has_function('vasprintf'))
+ cdata.set('HAVE_POSIX_MEMALIGN', cc.has_function('posix_memalign'))
+ cdata.set('HAVE_MMAP', cc.has_function('mmap'))
+ 
+diff --git a/orc/orccompiler.c b/orc/orccompiler.c
+index 57c3ea4..6c16816 100644
+--- a/orc/orccompiler.c
++++ b/orc/orccompiler.c
+@@ -1207,8 +1207,12 @@ orc_compiler_error_valist (OrcCompiler *compiler, const char *fmt,
+ 
+   if (compiler->error_msg) return;
+ 
++#ifdef HAVE_VASPRINTF
++  vasprintf (&s, fmt, args);
++#else
+   s = malloc (ORC_COMPILER_ERROR_BUFFER_SIZE);
+-  vsprintf (s, fmt, args);
++  vsnprintf (s, ORC_COMPILER_ERROR_BUFFER_SIZE, fmt, args);
++#endif
+   compiler->error_msg = s;
+   compiler->error = TRUE;
+   compiler->result = ORC_COMPILE_RESULT_UNKNOWN_COMPILE;
+diff --git a/orc/orcparse.c b/orc/orcparse.c
+index f46b0be..56a9c3a 100644
+--- a/orc/orcparse.c
++++ b/orc/orcparse.c
+@@ -401,9 +401,13 @@ opcode_arg_size (OrcStaticOpcode *opcode, int arg)
+ static void
+ orc_parse_log_valist (OrcParser *parser, const char *format, va_list args)
+ {
+-  char s[100];
++#ifdef HAVE_VASPRINTF
++  char *s;
++#else
++  char s[100] = { '\0' };
++#endif
+   int len;
+-  
++
+   if (parser->error_program != parser->program) {
+     sprintf(s, "In function %s:\n", parser->program->name);
+     len = strlen(s);
+@@ -418,7 +422,11 @@ orc_parse_log_valist (OrcParser *parser, const char *format, va_list args)
+     parser->error_program = parser->program;
+   }
+ 
+-  vsprintf(s, format, args);
++#ifdef HAVE_VASPRINTF
++  vasprintf (&s, format, args);
++#else
++  vsnprintf (s, sizeof (s), format, args);
++#endif
+   len = strlen(s);
+ 
+   if (parser->log_size + len + 1 >= parser->log_alloc) {
+@@ -428,6 +436,10 @@ orc_parse_log_valist (OrcParser *parser, const char *format, va_list args)
+ 
+   strcpy (parser->log + parser->log_size, s);
+   parser->log_size += len;
++
++#ifdef HAVE_VASPRINTF
++  free (s);
++#endif
+ }
+ 
+ static void
+-- 
+2.45.2
+

SOURCES/0001-x86-add-endbr32-and-endbr64-instructions.patch

@@ -0,0 +1,66 @@
+From eac51dc1b6eb89e00ed2294e39949ad056287d1e Mon Sep 17 00:00:00 2001
+From: Wim Taymans <wtaymans@redhat.com>
+Date: Fri, 19 Jul 2019 16:18:04 +0200
+Subject: [PATCH] x86: add endbr32 and endbr64 instructions
+
+Issue endbr instructions at the start of generated functions to
+make IBT (indirect branch tracking) work.
+
+Resolves #17
+---
+ orc/orcx86.c     | 4 ++++
+ orc/orcx86insn.c | 2 ++
+ orc/orcx86insn.h | 2 ++
+ 3 files changed, 8 insertions(+)
+
+diff --git a/orc/orcx86.c b/orc/orcx86.c
+index 02e6b34..d4cc086 100644
+--- a/orc/orcx86.c
++++ b/orc/orcx86.c
+@@ -452,6 +452,9 @@ orc_x86_emit_prologue (OrcCompiler *compiler)
+   orc_compiler_append_code(compiler,"%s:\n", compiler->program->name);
+   if (compiler->is_64bit) {
+     int i;
++
++    orc_x86_emit_cpuinsn_none (compiler, ORC_X86_endbr64);
++
+     for(i=0;i<16;i++){
+       if (compiler->used_regs[ORC_GP_REG_BASE+i] &&
+           compiler->save_regs[ORC_GP_REG_BASE+i]) {
+@@ -459,6 +462,7 @@ orc_x86_emit_prologue (OrcCompiler *compiler)
+       }
+     }
+   } else {
++    orc_x86_emit_cpuinsn_none (compiler, ORC_X86_endbr32);
+     orc_x86_emit_push (compiler, 4, X86_EBP);
+     if (compiler->use_frame_pointer) {
+       orc_x86_emit_mov_reg_reg (compiler, 4, X86_ESP, X86_EBP);
+diff --git a/orc/orcx86insn.c b/orc/orcx86insn.c
+index 9d93197..a9bdd9f 100644
+--- a/orc/orcx86insn.c
++++ b/orc/orcx86insn.c
+@@ -254,6 +254,8 @@ static const OrcSysOpcode orc_x86_opcodes[] = {
+   { "pshufw", ORC_X86_INSN_TYPE_IMM8_MMXM_MMX, 0, 0x00, 0x0f70 },
+   { "movq", ORC_X86_INSN_TYPE_MMXM_MMX, 0, 0x00, 0x0f6f },
+   { "movq", ORC_X86_INSN_TYPE_MMXM_MMX_REV, 0, 0x00, 0x0f7f },
++  { "endbr32", ORC_X86_INSN_TYPE_NONE, 0, 0xf3, 0x0f1efb },
++  { "endbr64", ORC_X86_INSN_TYPE_NONE, 0, 0xf3, 0x0f1efa },
+ };
+ 
+ static void
+diff --git a/orc/orcx86insn.h b/orc/orcx86insn.h
+index d109c95..864e5d6 100644
+--- a/orc/orcx86insn.h
++++ b/orc/orcx86insn.h
+@@ -277,6 +277,8 @@ typedef enum {
+   ORC_X86_pshufw,
+   ORC_X86_movq_mmx_load,
+   ORC_X86_movq_mmx_store,
++  ORC_X86_endbr32,
++  ORC_X86_endbr64,
+ } OrcX86Opcode;
+ 
+ enum {
+-- 
+2.21.0
+

SPECS/orc.spec

@@ -1,17 +1,18 @@
 Name:		orc
-Version:	0.4.39
-Release:	2%{?dist}
+Version:	0.4.28
+Release:	4%{?dist}
 Summary:	The Oil Run-time Compiler
 
-License:	BSD-2-Clause AND BSD-3-Clause
+Group:		System Environment/Libraries
+License:	BSD
 URL:		http://cgit.freedesktop.org/gstreamer/orc/
 Source0:	http://gstreamer.freedesktop.org/src/orc/%{name}-%{version}.tar.xz
 
-Patch0001:	0001-powerpc-fix-div255w-which-still-used-the-inexact-sub.patch
+# upstream patches
+Patch0:		0001-x86-add-endbr32-and-endbr64-instructions.patch
+Patch1:         0001-Use-vasprintf-if-available-for-error-messages-and-ot.patch
 
-BuildRequires:	meson >= 0.47.0
-BuildRequires:  gcc
-BuildRequires:	gtk-doc
+BuildRequires:	gtk-doc, libtool
 
 %description
 Orc is a library and set of tools for compiling and executing
@@ -22,6 +23,7 @@ subtraction, and many arithmetic operations.
 
 %package doc
 Summary:	Documentation for Orc
+Group:		Development/Languages
 Requires:	%{name} = %{version}-%{release}
 BuildArch:	noarch
 
@@ -30,6 +32,7 @@ Documentation for Orc.
 
 %package devel
 Summary:	Development files and libraries for Orc
+Group:		Development/Libraries
 Requires:	%{name} = %{version}-%{release}
 Requires:	%{name}-compiler
 Requires:	pkgconfig
@@ -40,6 +43,7 @@ on orc.
 
 %package compiler
 Summary:	Orc compiler
+Group:		Development/Libraries
 Requires:	%{name} = %{version}-%{release}
 Requires:	pkgconfig
 
@@ -48,30 +52,44 @@ The Orc compiler, to produce optimized code.
 
 
 %prep
-%autosetup -p1
+%setup -q
+%patch0 -p1
+%patch1 -p1
+gtkdocize --copy
+NOCONFIGURE=1 autoreconf -vif
+
 
 %build
-%meson -D default_library=shared
-%meson_build
+%configure --disable-static --enable-gtk-doc --enable-user-codemem --disable-gtk-doc-html
+
+make %{?_smp_mflags} V=1
+
 
 %install
-%meson_install
+make install DESTDIR=%{buildroot} INSTALL="install -p"
 
 # Remove unneeded files.
-find %{buildroot}/%{_libdir} -name \*.a -delete
+find %{buildroot}/%{_libdir} -name \*.a -or -name \*.la -delete
 rm -rf %{buildroot}/%{_libdir}/orc
 
-%check
-%meson_test
+touch -r stamp-h1 %{buildroot}%{_includedir}/%{name}-0.4/orc/orc-stdint.h   
 
-%ldconfig_scriptlets
+
+%check
+%ifnarch s390 s390x ppc %{power64} %{arm} i686 aarch64
+make check
+%endif
+
+
+%post -p /sbin/ldconfig
+
+
+%postun -p /sbin/ldconfig
 
 
 %files
-%license COPYING
-%doc README
-%{_libdir}/liborc-0.4.so.0*
-%{_libdir}/liborc-test-0.4.so*
+%doc COPYING README
+%{_libdir}/liborc-*.so.*
 %{_bindir}/orc-bugreport
 
 %files doc
@@ -80,94 +98,22 @@ rm -rf %{buildroot}/%{_libdir}/orc
 %files devel
 %doc examples/*.c
 %{_includedir}/%{name}-0.4/
-%{_libdir}/liborc-0.4.so
+%{_libdir}/liborc-*.so
 %{_libdir}/pkgconfig/orc-0.4.pc
-%{_libdir}/pkgconfig/orc-test-0.4.pc
+%{_datadir}/aclocal/orc.m4
 
 %files compiler
 %{_bindir}/orcc
 
 
 %changelog
-* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 0.4.39-2
-- Bump release for October 2024 mass rebuild:
-  Resolves: RHEL-64018
+* Wed Jul 31 2024 Wim Taymans <wtaymans@redhat.com> 0.4.28-4
+- Add patch for CVE-2024-40897
+- Resolves: RHEL-50710
 
-* Tue Jul 30 2024 Wim Taymans <wtaymans@redhat.com> 0.4.39-1
-- Update to 0.4.39
-- Add patch for div255w fix on ppc64le
-- Resolves: RHEL-50713
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.38-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Wed Mar 06 2024 Peter Robinson <pbrobinson@fedoraproject.org> - 0.4.38-2
-- Move orc-test to main package
-
-* Tue Mar 05 2024 Peter Robinson <pbrobinson@fedoraproject.org> - 0.4.38-1
-- Update to 0.4.38
-- Version the library to catch bumps
-- Cleanup spec, use license var
-
-* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.33-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.33-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.33-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.33-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Fri Nov 04 2022 Wim Taymans <wtaymans@redhat.com> 0.4.33-1
-- Update to 0.4.33
-
-* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.31-8
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.31-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Wed Aug 18 2021 Vít Ondruch <vondruch@redhat.com> - 0.4.31-6
-- Fix ppc64le segfault when used via libvips.
-  Resolves: rhbz#1917540
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.31-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.31-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.31-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.31-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Tue Nov 12 2019 Wim Taymans <wtaymans@redhat.com> 0.4.31-1
-- Update to 0.4.31
-
-* Tue Sep 24 2019 Wim Taymans <wtaymans@redhat.com> 0.4.30-1
-- Update to 0.4.30
-- Use meson as autogen was removed, add meson buildrequires
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.29-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Fri May 10 2019 Dan Horák <dan[at]danny.cz> 0.4.29-2
-- revert commits changing ppc64/ppc64le support
-
-* Tue Apr 23 2019 Wim Taymans <wtaymans@redhat.com> 0.4.29-1
-- Update to 0.4.29
-- Add orc-test pkgconfig file
-
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.28-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.28-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+* Thu Sep 12 2019 Wim Taymans <wtaymans@redhat.com> 0.4.28-3
+- x86: add endbr32 and endbr64 instructions
+- Resolves: rhbz#1693292
 
 * Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.28-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
@@ -302,7 +248,7 @@ rm -rf %{buildroot}/%{_libdir}/orc
 * Thu Aug 19 2010 Fabian Deutsch <fabiand@fedoraproject.org> - 0.4.7-1
 - Updated to 0.4.7.
 
-* Thu Jul 22 2010 Fabian Deutsch <fabiand@fedoraproject.org> - 0.4.6-1
+* Tue Jul 22 2010 Fabian Deutsch <fabiand@fedoraproject.org> - 0.4.6-1
 - Updated to 0.4.6.
 - New orc-bugreport added.
 

gating.yaml

@@ -1,6 +0,0 @@
---- !Policy
-product_versions:
-  - rhel-10
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: desktop-qe.desktop-ci.tier1-gating.functional}

sources

@@ -1 +0,0 @@
-SHA512 (orc-0.4.39.tar.xz) = 5b2167c9bb5ef4fdd5b1a683e5e7fc94bafa0afe62cb5f30e6fd2de9e80b4727b533029688e2807fc64b60af45f9263a421074bf330fb2f208b48620b0f95fd6