From: "Andreas Sturmlechner" <asturm@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] repo/gentoo:master commit in: dev-libs/libzip/, dev-libs/libzip/files/
Date: Mon, 23 Oct 2017 23:33:32 +0000 (UTC) [thread overview]
Message-ID: <1508801122.b4a9cb3e5493b414c2d671e6e5c1e8bcf084915c.asturm@gentoo> (raw)
commit: b4a9cb3e5493b414c2d671e6e5c1e8bcf084915c
Author: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org>
AuthorDate: Mon Oct 23 23:25:22 2017 +0000
Commit: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org>
CommitDate: Mon Oct 23 23:25:22 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b4a9cb3e
dev-libs/libzip: Security cleanup, bug #629574
Package-Manager: Portage-2.3.12, Repoman-2.3.3
dev-libs/libzip/Manifest | 1 -
.../libzip/files/libzip-1.2.0-CVE-2017-12858.patch | 37 -------------------
.../libzip/files/libzip-1.2.0-CVE-2017-14107.patch | 27 --------------
dev-libs/libzip/libzip-1.2.0-r1.ebuild | 40 ---------------------
dev-libs/libzip/libzip-1.2.0-r2.ebuild | 41 ----------------------
dev-libs/libzip/libzip-1.2.0.ebuild | 39 --------------------
6 files changed, 185 deletions(-)
diff --git a/dev-libs/libzip/Manifest b/dev-libs/libzip/Manifest
index 4fd8d312a19..9206b63f7b6 100644
--- a/dev-libs/libzip/Manifest
+++ b/dev-libs/libzip/Manifest
@@ -1,2 +1 @@
-DIST libzip-1.2.0.tar.xz 938284 SHA256 ffc0764395fba3d45dc5a6e32282788854618b9e9838337f8218b596007f1376 SHA512 1ba8626d72e6b47f735568afaf007d1e18beb3ebedf6b69a6b575f9e04d3b84550371191a89be153f8fcedb4a8eac2f996e141da95cdbb52380b6283cc99cf8b WHIRLPOOL 794a462fc4d1529008fccbe6df41c5616b34712ef34721e0cbe555aa12ada7928d22f6e9421de210efdf7b460188a4d6a9a6e53fc0266bcf52d47d6a7e30a5f6
DIST libzip-1.3.0.tar.xz 955876 SHA256 aa936efe34911be7acac2ab07fb5c8efa53ed9bb4d44ad1fe8bff19630e0d373 SHA512 8e12a23fe62b993ff4592e1b9da152533a363b0603fc1f65e6cbb6121d4260c45f98171effbccb76dec4030b0fcdcd273919755a2496ab462431646ac83bb900 WHIRLPOOL eca44e4c7e3a09d90f7a9c694de01c97fdc97ce7989bd8ccf9acb8e33e10145f6860c4dd5bb282d2ab0a708d9ddb6b7ecde88bf5276365179057c02f534e182d
diff --git a/dev-libs/libzip/files/libzip-1.2.0-CVE-2017-12858.patch b/dev-libs/libzip/files/libzip-1.2.0-CVE-2017-12858.patch
deleted file mode 100644
index 26236510fee..00000000000
--- a/dev-libs/libzip/files/libzip-1.2.0-CVE-2017-12858.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 2217022b7d1142738656d891e00b3d2d9179b796 Mon Sep 17 00:00:00 2001
-From: Thomas Klausner <tk@giga.or.at>
-Date: Mon, 14 Aug 2017 10:55:44 +0200
-Subject: [PATCH] Fix double free().
-
-Found by Brian 'geeknik' Carpenter using AFL.
----
- THANKS | 1 +
- lib/zip_dirent.c | 3 ---
- 2 files changed, 1 insertion(+), 3 deletions(-)
-
-diff --git a/THANKS b/THANKS
-index be0cca9..a80ee1d 100644
---- a/THANKS
-+++ b/THANKS
-@@ -12,6 +12,7 @@ BALATON Zoltan <balaton@eik.bme.hu>
- Benjamin Gilbert <bgilbert@backtick.net>
- Boaz Stolk <bstolk@aweta.nl>
- Bogdan <bogiebog@gmail.com>
-+Brian 'geeknik' Carpenter <geeknik@protonmail.ch>
- Chris Nehren <cnehren+libzip@pobox.com>
- Coverity <info@coverity.com>
- Dane Springmeyer <dane.springmeyer@gmail.com>
-diff --git a/lib/zip_dirent.c b/lib/zip_dirent.c
-index a369900..e5a7cc9 100644
---- a/lib/zip_dirent.c
-+++ b/lib/zip_dirent.c
-@@ -579,9 +579,6 @@ _zip_dirent_read(zip_dirent_t *zde, zip_source_t *src, zip_buffer_t *buffer, boo
- }
-
- if (!_zip_dirent_process_winzip_aes(zde, error)) {
-- if (!from_buffer) {
-- _zip_buffer_free(buffer);
-- }
- return -1;
- }
-
diff --git a/dev-libs/libzip/files/libzip-1.2.0-CVE-2017-14107.patch b/dev-libs/libzip/files/libzip-1.2.0-CVE-2017-14107.patch
deleted file mode 100644
index 3d1f9a0aabc..00000000000
--- a/dev-libs/libzip/files/libzip-1.2.0-CVE-2017-14107.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 9b46957ec98d85a572e9ef98301247f39338a3b5 Mon Sep 17 00:00:00 2001
-From: Thomas Klausner <tk@giga.or.at>
-Date: Tue, 29 Aug 2017 10:25:03 +0200
-Subject: [PATCH] Make eocd checks more consistent between zip and zip64 cases.
-
----
- lib/zip_open.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/lib/zip_open.c b/lib/zip_open.c
-index 3bd593b..9d3a4cb 100644
---- a/lib/zip_open.c
-+++ b/lib/zip_open.c
-@@ -847,7 +847,12 @@ _zip_read_eocd64(zip_source_t *src, zip_buffer_t *buffer, zip_uint64_t buf_offse
- zip_error_set(error, ZIP_ER_SEEK, EFBIG);
- return NULL;
- }
-- if ((flags & ZIP_CHECKCONS) && offset+size != eocd_offset) {
-+ if (offset+size > buf_offset + eocd_offset) {
-+ /* cdir spans past EOCD record */
-+ zip_error_set(error, ZIP_ER_INCONS, 0);
-+ return NULL;
-+ }
-+ if ((flags & ZIP_CHECKCONS) && offset+size != buf_offset + eocd_offset) {
- zip_error_set(error, ZIP_ER_INCONS, 0);
- return NULL;
- }
diff --git a/dev-libs/libzip/libzip-1.2.0-r1.ebuild b/dev-libs/libzip/libzip-1.2.0-r1.ebuild
deleted file mode 100644
index 61f933dcd36..00000000000
--- a/dev-libs/libzip/libzip-1.2.0-r1.ebuild
+++ /dev/null
@@ -1,40 +0,0 @@
-# Copyright 1999-2017 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit autotools
-
-DESCRIPTION="Library for manipulating zip archives"
-HOMEPAGE="http://www.nih.at/libzip/"
-SRC_URI="http://www.nih.at/libzip/${P}.tar.xz"
-
-LICENSE="BSD"
-SLOT="0/5"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~x86-macos"
-IUSE="static-libs"
-
-RDEPEND="
- sys-libs/zlib
- elibc_musl? ( sys-libs/fts-standalone )
-"
-DEPEND="${RDEPEND}"
-
-DOCS=( AUTHORS NEWS.md API-CHANGES THANKS )
-
-PATCHES=(
- "${FILESDIR}/${P}-headers.patch"
- "${FILESDIR}/${P}-fts.patch"
- "${FILESDIR}/${P}-CVE-2017-12858.patch"
-)
-
-src_prepare() {
- default
- eautoreconf
-}
-
-src_install() {
- default
- use static-libs || rm "${ED%/}"/usr/$(get_libdir)/libzip.a || die
- find "${D}" -name '*.la' -delete || die
-}
diff --git a/dev-libs/libzip/libzip-1.2.0-r2.ebuild b/dev-libs/libzip/libzip-1.2.0-r2.ebuild
deleted file mode 100644
index 524782f42c3..00000000000
--- a/dev-libs/libzip/libzip-1.2.0-r2.ebuild
+++ /dev/null
@@ -1,41 +0,0 @@
-# Copyright 1999-2017 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit autotools
-
-DESCRIPTION="Library for manipulating zip archives"
-HOMEPAGE="https://nih.at/libzip/"
-SRC_URI="https://www.nih.at/libzip/${P}.tar.xz"
-
-LICENSE="BSD"
-SLOT="0/5"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~x86-macos"
-IUSE="static-libs"
-
-RDEPEND="
- sys-libs/zlib
- elibc_musl? ( sys-libs/fts-standalone )
-"
-DEPEND="${RDEPEND}"
-
-DOCS=( AUTHORS NEWS.md API-CHANGES THANKS )
-
-PATCHES=(
- "${FILESDIR}/${P}-headers.patch"
- "${FILESDIR}/${P}-fts.patch"
- "${FILESDIR}/${P}-CVE-2017-12858.patch"
- "${FILESDIR}/${P}-CVE-2017-14107.patch"
-)
-
-src_prepare() {
- default
- eautoreconf
-}
-
-src_install() {
- default
- use static-libs || rm "${ED%/}"/usr/$(get_libdir)/libzip.a || die
- find "${D}" -name '*.la' -delete || die
-}
diff --git a/dev-libs/libzip/libzip-1.2.0.ebuild b/dev-libs/libzip/libzip-1.2.0.ebuild
deleted file mode 100644
index d51ce765081..00000000000
--- a/dev-libs/libzip/libzip-1.2.0.ebuild
+++ /dev/null
@@ -1,39 +0,0 @@
-# Copyright 1999-2017 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit autotools
-
-DESCRIPTION="Library for manipulating zip archives"
-HOMEPAGE="http://www.nih.at/libzip/"
-SRC_URI="http://www.nih.at/libzip/${P}.tar.xz"
-
-LICENSE="BSD"
-SLOT="0/5"
-KEYWORDS="alpha amd64 ~arm ~arm64 ~hppa ia64 ~mips ppc ppc64 sparc x86 ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~x86-macos"
-IUSE="static-libs"
-
-RDEPEND="
- sys-libs/zlib
- elibc_musl? ( sys-libs/fts-standalone )
-"
-DEPEND="${RDEPEND}"
-
-DOCS=( AUTHORS NEWS.md API-CHANGES THANKS )
-
-PATCHES=(
- "${FILESDIR}/${P}-headers.patch"
- "${FILESDIR}/${P}-fts.patch"
-)
-
-src_prepare() {
- default
- eautoreconf
-}
-
-src_install() {
- default
- use static-libs || rm "${ED%/}"/usr/$(get_libdir)/libzip.a || die
- find "${D}" -name '*.la' -delete || die
-}
next reply other threads:[~2017-10-23 23:33 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-23 23:33 Andreas Sturmlechner [this message]
-- strict thread matches above, loose matches on Subject: below --
2025-03-04 22:32 [gentoo-commits] repo/gentoo:master commit in: dev-libs/libzip/, dev-libs/libzip/files/ Andreas Sturmlechner
2024-11-23 14:51 Sam James
2021-09-08 6:23 Andreas Sturmlechner
2020-04-09 23:51 Andreas Sturmlechner
2020-01-26 13:04 Andreas Sturmlechner
2019-04-04 0:09 Andreas Sturmlechner
2019-02-09 20:58 Andreas Sturmlechner
2017-08-04 18:14 Andreas Sturmlechner
2017-07-30 20:46 Andreas Sturmlechner
2017-03-17 18:47 Andreas Sturmlechner
2017-03-17 18:47 Andreas Sturmlechner
2016-05-31 21:00 Chris Reffett
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1508801122.b4a9cb3e5493b414c2d671e6e5c1e8bcf084915c.asturm@gentoo \
--to=asturm@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox