This commit is contained in:
Petr Písař 2019-09-13 16:17:13 +02:00
parent 306d21033c
commit 62fc0a34ed
5 changed files with 7 additions and 107 deletions

1
.gitignore vendored
View File

@ -4,3 +4,4 @@ recode-3.6.tar.gz
/recode-3.7.3.tar.gz
/recode-3.7.4.tar.gz
/recode-3.7.5.tar.gz
/recode-3.7.6.tar.gz

View File

@ -1,43 +0,0 @@
From 3e566ca4b17814de8bc100e3edadbed6e539874f Mon Sep 17 00:00:00 2001
From: Reuben Thomas <rrt@sc3d.org>
Date: Wed, 11 Sep 2019 19:46:53 +0100
Subject: [PATCH] Fix a couple of potential buffer overflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Petr Písař <ppisar@redhat.com>
---
src/java.c | 2 +-
src/testdump.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/java.c b/src/java.c
index 05367f1..4bb8bc9 100644
--- a/src/java.c
+++ b/src/java.c
@@ -88,7 +88,7 @@ transform_utf16_java (RECODE_SUBTASK subtask)
put_byte (value, subtask);
else
{
- char buffer[7];
+ char buffer[11];
char *cursor;
sprintf (buffer, "\\u%04x", value);
diff --git a/src/testdump.c b/src/testdump.c
index ff2ee9d..bd45837 100644
--- a/src/testdump.c
+++ b/src/testdump.c
@@ -254,7 +254,7 @@ produce_count (RECODE_SUBTASK subtask)
delayed--;
}
- sprintf (buffer, "%*u %.4X", (int)count_width, (*cursor)->count, character);
+ snprintf (buffer, sizeof(buffer), "%*u %.4X", (int)count_width, (*cursor)->count, character);
put_string (buffer, subtask);
if (mnemonic)
{
--
2.21.0

View File

@ -1,42 +0,0 @@
From d007389422007adf9cee50830b8dae9884802d77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Thu, 12 Sep 2019 12:43:56 +0200
Subject: [PATCH] test: Fix signedness mismatch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
GCC 9.2.1 warns:
Recode.c: In function __pyx_pf_6Recode_7Request_8pair_sequence:
Recode.c:3096:45: warning: comparison of integer expressions of different signedness: unsigned int and short int [-Wsign-compare]
3096 | for (__pyx_v_counter = 0; __pyx_v_counter < __pyx_t_2; __pyx_v_counter++) {
| ^
A comparison between differently signed variable is dangerous because the
signed value is converted to an unsigned value of the same width and that
mangles the value and leads to comparing unintended values.
This patch fixes it.
Signed-off-by: Petr Písař <ppisar@redhat.com>
---
tests/Recode.pyx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tests/Recode.pyx b/tests/Recode.pyx
index a7982a2..545c1a1 100644
--- a/tests/Recode.pyx
+++ b/tests/Recode.pyx
@@ -604,7 +604,7 @@ cdef class Request:
def pair_sequence(self):
list = []
cdef recode_step step
- cdef unsigned counter
+ cdef short counter
for counter from 0 <= counter < self.request.sequence_length:
step = self.request.sequence_array[counter]
list.append((step.before.name, step.after.name))
--
2.21.0

View File

@ -1,8 +1,5 @@
# Use valgrind in tests. Very slow. Some leaks in Python.
%bcond_with recode_enables_valgrind_test
Name: recode
Version: 3.7.5
Version: 3.7.6
Release: 1%{?dist}
Summary: Conversion between character sets and surfaces
# COPYING: GPLv3 text
@ -58,11 +55,6 @@ URL: https://github.com/rrthomas/recode
Source: %{url}/releases/download/v%{version}/recode-%{version}.tar.gz
# Make internal hash function identifiers unique
Patch0: recode-3.7.1-Rename-coliding-hash-functions.patch
# Fix a possible buffer overflow in transform_utf16_java(),
# in upstream after 3.7.5
Patch1: recode-3.7.5-Fix-a-couple-of-potential-buffer-overflows.patch
# Fix a type mismatch in tests, <https://github.com/rrthomas/recode/pull/23>
Patch2: recode-3.7.5-test-Fix-signedness-mismatch.patch
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: coreutils
@ -77,10 +69,6 @@ BuildRequires: texinfo
# Tests:
BuildRequires: python3-Cython
BuildRequires: python3-devel >= 3.7.5
%if %{with recode_enables_valgrind_test}
# Optional tests:
BuildRequires: valgrind
%endif
%description
The recode tool and library convert files between character sets and usages.
@ -101,8 +89,6 @@ This package provides deader files for recode library.
%prep
%setup -q
%patch0 -p1
%patch1 -p1
%patch2 -p1
autoreconf -fi
%build
@ -114,12 +100,7 @@ export PYTHON=%{__python3}
--enable-nls \
--disable-rpath \
--enable-shared \
--disable-static \
%if %{with recode_enables_valgrind_test}
--enable-valgrind-tests
%else
--disable-valgrind-tests
%endif
--disable-static
%{make_build}
%check
@ -150,6 +131,9 @@ rm $RPM_BUILD_ROOT%{_libdir}/*.la
%{_includedir}/*
%changelog
* Fri Sep 13 2019 Petr Pisar <ppisar@redhat.com> - 3.7.6-1
- 3.7.6
* Thu Sep 12 2019 Petr Pisar <ppisar@redhat.com> - 3.7.5-1
- 3.7.5 bump
- Fix a possible buffer overflow in transform_utf16_java()

View File

@ -1 +1 @@
SHA512 (recode-3.7.5.tar.gz) = bb18b5acbf1bb00f5dd829dd18ccbabeb8224bd85479759d1745bb259e91b0cef01af0ada8471e89de6aedf3ffa8799cc9caa068030b1b25995ec806094f4450
SHA512 (recode-3.7.6.tar.gz) = ababefc445fcc47b6bf9ed640b767aed374bb8ce93cdccb641dd1ba5d298360583dd79070a0bb458f1190a8d6f1ddeb3b04eec34a61305b69def0963cec5843f