From 353417be949dbb784f3795a14aa254435600c54a Mon Sep 17 00:00:00 2001 From: James Antill Date: Thu, 26 May 2022 14:05:14 -0400 Subject: [PATCH] Auto sync2gitlab import of raptor2-2.0.15-16.el8.src.rpm --- .gitignore | 1 + ...aptor2-malformed-input-file-can-lead.patch | 33 +++ ...pace-declarations-correctly-for-XML-.patch | 43 ++++ EMPTY | 1 - raptor2.spec | 213 ++++++++++++++++++ sources | 1 + 6 files changed, 291 insertions(+), 1 deletion(-) create mode 100644 .gitignore create mode 100644 0001-CVE-2020-25713-raptor2-malformed-input-file-can-lead.patch create mode 100644 0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch delete mode 100644 EMPTY create mode 100644 raptor2.spec create mode 100644 sources diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..75852ab --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +/raptor2-2.0.15.tar.gz diff --git a/0001-CVE-2020-25713-raptor2-malformed-input-file-can-lead.patch b/0001-CVE-2020-25713-raptor2-malformed-input-file-can-lead.patch new file mode 100644 index 0000000..1fb279d --- /dev/null +++ b/0001-CVE-2020-25713-raptor2-malformed-input-file-can-lead.patch @@ -0,0 +1,33 @@ +From a549457461874157c8c8e8e8a6e0eec06da4fbd0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= +Date: Tue, 24 Nov 2020 10:30:20 +0000 +Subject: [PATCH] CVE-2020-25713 raptor2: malformed input file can lead to a + segfault + +due to an out of bounds array access in +raptor_xml_writer_start_element_common + +See: +https://bugs.mageia.org/show_bug.cgi?id=27605 +https://www.openwall.com/lists/oss-security/2020/11/13/1 +https://gerrit.libreoffice.org/c/core/+/106249 +--- + src/raptor_xml_writer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/raptor_xml_writer.c b/src/raptor_xml_writer.c +index 56993dc3..4426d38c 100644 +--- a/src/raptor_xml_writer.c ++++ b/src/raptor_xml_writer.c +@@ -227,7 +227,7 @@ raptor_xml_writer_start_element_common(raptor_xml_writer* xml_writer, + + /* check it wasn't an earlier declaration too */ + for(j = 0; j < nspace_declarations_count; j++) +- if(nspace_declarations[j].nspace == element->attributes[j]->nspace) { ++ if(nspace_declarations[j].nspace == element->attributes[i]->nspace) { + declare_me = 0; + break; + } +-- +2.28.0 + diff --git a/0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch b/0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch new file mode 100644 index 0000000..6fa726c --- /dev/null +++ b/0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch @@ -0,0 +1,43 @@ +From 590681e546cd9aa18d57dc2ea1858cb734a3863f Mon Sep 17 00:00:00 2001 +From: Dave Beckett +Date: Sun, 16 Apr 2017 23:15:12 +0100 +Subject: [PATCH] Calcualte max nspace declarations correctly for XML writer + +(raptor_xml_writer_start_element_common): Calculate max including for +each attribute a potential name and value. + +Fixes Issues #0000617 http://bugs.librdf.org/mantis/view.php?id=617 +and #0000618 http://bugs.librdf.org/mantis/view.php?id=618 +--- + src/raptor_xml_writer.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/src/raptor_xml_writer.c b/src/raptor_xml_writer.c +index 693b946..0d3a36a 100644 +--- a/src/raptor_xml_writer.c ++++ b/src/raptor_xml_writer.c +@@ -181,9 +181,10 @@ raptor_xml_writer_start_element_common(raptor_xml_writer* xml_writer, + size_t nspace_declarations_count = 0; + unsigned int i; + +- /* max is 1 per element and 1 for each attribute + size of declared */ + if(nstack) { +- int nspace_max_count = element->attribute_count+1; ++ int nspace_max_count = element->attribute_count * 2; /* attr and value */ ++ if(element->name->nspace) ++ nspace_max_count++; + if(element->declared_nspaces) + nspace_max_count += raptor_sequence_size(element->declared_nspaces); + if(element->xml_language) +@@ -237,7 +238,7 @@ raptor_xml_writer_start_element_common(raptor_xml_writer* xml_writer, + } + } + +- /* Add the attribute + value */ ++ /* Add the attribute's value */ + nspace_declarations[nspace_declarations_count].declaration= + raptor_qname_format_as_xml(element->attributes[i], + &nspace_declarations[nspace_declarations_count].length); +-- +2.9.3 + diff --git a/EMPTY b/EMPTY deleted file mode 100644 index 0519ecb..0000000 --- a/EMPTY +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/raptor2.spec b/raptor2.spec new file mode 100644 index 0000000..e0cbf0f --- /dev/null +++ b/raptor2.spec @@ -0,0 +1,213 @@ + +Summary: RDF Parser Toolkit for Redland +Name: raptor2 +Version: 2.0.15 +Release: 16%{?dist} + +License: GPLv2+ or LGPLv2+ or ASL 2.0 +Source: http://download.librdf.org/source/raptor2-%{version}.tar.gz +URL: http://librdf.org/raptor/ + +## upstream patches +# https://github.com/dajobe/raptor/commit/590681e546cd9aa18d57dc2ea1858cb734a3863f +Patch1: 0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch +# https://bugs.librdf.org/mantis/view.php?id=650 +Patch2: 0001-CVE-2020-25713-raptor2-malformed-input-file-can-lead.patch + +BuildRequires: curl-devel +%if ! 0%{?flatpak} +BuildRequires: gtk-doc +%endif +BuildRequires: libicu-devel +BuildRequires: pkgconfig(libxslt) + +# when /usr/bin/rappor moved here -- rex +Conflicts: raptor < 1.4.21-10 + +%description +Raptor is the RDF Parser Toolkit for Redland that provides +a set of standalone RDF parsers, generating triples from RDF/XML +or N-Triples. + +%package devel +Summary: Development files for %{name} +Requires: %{name}%{?_isa} = %{version}-%{release} +%description devel +%{summary}. + + +%prep +%autosetup -p1 + +# hack to nuke rpaths +%if "%{_libdir}" != "/usr/lib" +sed -i -e 's|"/lib /usr/lib|"/%{_lib} %{_libdir}|' configure +%endif + + +%build +%configure \ + --disable-static --enable-release \ + --with-icu-config=/usr/bin/icu-config \ +%if 0%{?flatpak} + --disable-gtk-doc \ +%endif + --with-yajl=no + +make %{?_smp_mflags} + + +%install +rm -rf %{buildroot} + +make DESTDIR=%{buildroot} install + +## unpackaged files +rm -fv %{buildroot}%{_libdir}/lib*.la + + +%check +export PKG_CONFIG_PATH=%{buildroot}%{_datadir}/pkgconfig:%{buildroot}%{_libdir}/pkgconfig +test "$(pkg-config --modversion raptor2)" = "%{version}" +make check + + +%clean +rm -rf %{buildroot} + + +%post -p /sbin/ldconfig +%postun -p /sbin/ldconfig + +%files +%doc AUTHORS ChangeLog NEWS README +%doc COPYING* LICENSE.txt LICENSE-2.0.txt +%{_libdir}/libraptor2.so.0* +%{_bindir}/rapper +%{_mandir}/man1/rapper* + +%files devel +%doc UPGRADING.html +%{_includedir}/raptor2/ +%{_libdir}/libraptor2.so +%{_libdir}/pkgconfig/raptor2.pc +%{_mandir}/man3/libraptor2* +%dir %{_datadir}/gtk-doc +%dir %{_datadir}/gtk-doc/html/ +%{_datadir}/gtk-doc/html/raptor2/ + + +%changelog +* Tue Nov 24 2020 Caolán McNamara - 2.0.15-16 +- Resolves: rhbz#1900904 CVE-2020-25713 raptor2: malformed input file can lead to a segfault + +* Tue Nov 17 2020 Caolán McNamara - 2.0.15-15 +- Resolves: rhbz#1896534 CVE-2017-18926 raptor: heap-based buffer overflow + +* Mon Nov 16 2020 Caolán McNamara - 2.0.15-14 +- Resolves: rhbz#1896340 Suppress documentation in Flatpak builds + +* Tue Aug 21 2018 Caolán McNamara - 2.0.15-13 +- Resolves: rhbz#1560206 drop requirement on yajl + +* Fri Feb 09 2018 Fedora Release Engineering - 2.0.15-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Thu Nov 30 2017 Pete Walter - 2.0.15-11 +- Rebuild for ICU 60.1 + +* Thu Aug 03 2017 Fedora Release Engineering - 2.0.15-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Thu Jul 27 2017 Fedora Release Engineering - 2.0.15-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Sat Feb 11 2017 Fedora Release Engineering - 2.0.15-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Fri Apr 15 2016 David Tardon - 2.0.15-7 +- rebuild for ICU 57.1 + +* Thu Feb 04 2016 Fedora Release Engineering - 2.0.15-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Wed Oct 28 2015 David Tardon - 2.0.15-5 +- rebuild for ICU 56.1 + +* Thu Jun 18 2015 Fedora Release Engineering - 2.0.15-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Wed Feb 18 2015 Rex Dieter 2.0.15-3 +- rebuild (gcc5) + +* Mon Jan 26 2015 David Tardon - 2.0.15-2 +- rebuild for ICU 54.1 + +* Mon Nov 03 2014 Rex Dieter 2.0.15-1 +- 2.0.15 (#1159636) + +* Tue Aug 26 2014 David Tardon - 2.0.14-4 +- rebuild for ICU 53.1 + +* Sun Aug 17 2014 Fedora Release Engineering - 2.0.14-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Sun Jun 08 2014 Fedora Release Engineering - 2.0.14-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Tue May 06 2014 Rex Dieter 2.0.14-1 +- 2.0.14 (#1094721) + +* Tue Mar 04 2014 Rex Dieter 2.0.13-1 +- 2.0.13 + +* Wed Feb 12 2014 Rex Dieter 2.0.9-3 +- rebuild (libicu) + +* Sun Aug 04 2013 Fedora Release Engineering - 2.0.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Tue Mar 26 2013 Rex Dieter 2.0.9-1 +- 2.0.9 +- BR: libicu-devel + +* Tue Feb 19 2013 Rex Dieter 2.0.8-1 +- 2.0.8 + +* Thu Feb 14 2013 Fedora Release Engineering - 2.0.7-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Sat Jul 21 2012 Fedora Release Engineering - 2.0.7-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Fri Mar 23 2012 Rex Dieter 2.0.7-1 +- 2.0.7 + +* Mon Mar 05 2012 Rex Dieter 2.0.6-1 +- 2.0.6 + +* Sat Jan 14 2012 Fedora Release Engineering - 2.0.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Thu Nov 10 2011 Rex Dieter 2.0.4-3 +- rebuild (yajl) +- pkgconfig-style deps + +* Sun Jul 31 2011 Rex Dieter 2.0.4-2 +- include rapper here + +* Fri Jul 29 2011 Rex Dieter 2.0.4-1 +- 2.0.4 + +* Fri Jul 29 2011 Rex Dieter 2.0.3-3 +- upstream patch to fix build against newer libcurl + +* Tue Jul 26 2011 Rex Dieter 2.0.3-2 +- -devel: drop Group: tag +- add lot's of %%doc's +- License: GPLv2+ or LGPLv2+ or ASL 2.0 (or newer) + +* Sat Jul 23 2011 Rex Dieter 2.0.3-1 +- first try + + diff --git a/sources b/sources new file mode 100644 index 0000000..2691a01 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (raptor2-2.0.15.tar.gz) = 563dd01869eb4df8524ec12e2c0a541653874dcd834bd1eb265bc2943bb616968f624121d4688579cdce11b4f00a8ab53b7099f1a0850e256bb0a2c16ba048ee