From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id E6B5D1396D9 for ; Mon, 23 Oct 2017 23:33:35 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 1DCA62BC011; Mon, 23 Oct 2017 23:33:35 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id E73B52BC011 for ; Mon, 23 Oct 2017 23:33:34 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id AA5C233BF51 for ; Mon, 23 Oct 2017 23:33:33 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 1CF0E316 for ; Mon, 23 Oct 2017 23:33:32 +0000 (UTC) From: "Andreas Sturmlechner" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Andreas Sturmlechner" Message-ID: <1508801122.b4a9cb3e5493b414c2d671e6e5c1e8bcf084915c.asturm@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: dev-libs/libzip/, dev-libs/libzip/files/ X-VCS-Repository: repo/gentoo X-VCS-Files: dev-libs/libzip/Manifest dev-libs/libzip/files/libzip-1.2.0-CVE-2017-12858.patch dev-libs/libzip/files/libzip-1.2.0-CVE-2017-14107.patch dev-libs/libzip/libzip-1.2.0-r1.ebuild dev-libs/libzip/libzip-1.2.0-r2.ebuild dev-libs/libzip/libzip-1.2.0.ebuild X-VCS-Directories: dev-libs/libzip/ dev-libs/libzip/files/ X-VCS-Committer: asturm X-VCS-Committer-Name: Andreas Sturmlechner X-VCS-Revision: b4a9cb3e5493b414c2d671e6e5c1e8bcf084915c X-VCS-Branch: master Date: Mon, 23 Oct 2017 23:33:32 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 95d94935-b59f-4bca-934e-e7524ca184fa X-Archives-Hash: 4b9df103f25b0939311b4981fc8cc829 commit: b4a9cb3e5493b414c2d671e6e5c1e8bcf084915c Author: Andreas Sturmlechner gentoo org> AuthorDate: Mon Oct 23 23:25:22 2017 +0000 Commit: Andreas Sturmlechner gentoo org> CommitDate: Mon Oct 23 23:25:22 2017 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b4a9cb3e dev-libs/libzip: Security cleanup, bug #629574 Package-Manager: Portage-2.3.12, Repoman-2.3.3 dev-libs/libzip/Manifest | 1 - .../libzip/files/libzip-1.2.0-CVE-2017-12858.patch | 37 ------------------- .../libzip/files/libzip-1.2.0-CVE-2017-14107.patch | 27 -------------- dev-libs/libzip/libzip-1.2.0-r1.ebuild | 40 --------------------- dev-libs/libzip/libzip-1.2.0-r2.ebuild | 41 ---------------------- dev-libs/libzip/libzip-1.2.0.ebuild | 39 -------------------- 6 files changed, 185 deletions(-) diff --git a/dev-libs/libzip/Manifest b/dev-libs/libzip/Manifest index 4fd8d312a19..9206b63f7b6 100644 --- a/dev-libs/libzip/Manifest +++ b/dev-libs/libzip/Manifest @@ -1,2 +1 @@ -DIST libzip-1.2.0.tar.xz 938284 SHA256 ffc0764395fba3d45dc5a6e32282788854618b9e9838337f8218b596007f1376 SHA512 1ba8626d72e6b47f735568afaf007d1e18beb3ebedf6b69a6b575f9e04d3b84550371191a89be153f8fcedb4a8eac2f996e141da95cdbb52380b6283cc99cf8b WHIRLPOOL 794a462fc4d1529008fccbe6df41c5616b34712ef34721e0cbe555aa12ada7928d22f6e9421de210efdf7b460188a4d6a9a6e53fc0266bcf52d47d6a7e30a5f6 DIST libzip-1.3.0.tar.xz 955876 SHA256 aa936efe34911be7acac2ab07fb5c8efa53ed9bb4d44ad1fe8bff19630e0d373 SHA512 8e12a23fe62b993ff4592e1b9da152533a363b0603fc1f65e6cbb6121d4260c45f98171effbccb76dec4030b0fcdcd273919755a2496ab462431646ac83bb900 WHIRLPOOL eca44e4c7e3a09d90f7a9c694de01c97fdc97ce7989bd8ccf9acb8e33e10145f6860c4dd5bb282d2ab0a708d9ddb6b7ecde88bf5276365179057c02f534e182d diff --git a/dev-libs/libzip/files/libzip-1.2.0-CVE-2017-12858.patch b/dev-libs/libzip/files/libzip-1.2.0-CVE-2017-12858.patch deleted file mode 100644 index 26236510fee..00000000000 --- a/dev-libs/libzip/files/libzip-1.2.0-CVE-2017-12858.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 2217022b7d1142738656d891e00b3d2d9179b796 Mon Sep 17 00:00:00 2001 -From: Thomas Klausner -Date: Mon, 14 Aug 2017 10:55:44 +0200 -Subject: [PATCH] Fix double free(). - -Found by Brian 'geeknik' Carpenter using AFL. ---- - THANKS | 1 + - lib/zip_dirent.c | 3 --- - 2 files changed, 1 insertion(+), 3 deletions(-) - -diff --git a/THANKS b/THANKS -index be0cca9..a80ee1d 100644 ---- a/THANKS -+++ b/THANKS -@@ -12,6 +12,7 @@ BALATON Zoltan - Benjamin Gilbert - Boaz Stolk - Bogdan -+Brian 'geeknik' Carpenter - Chris Nehren - Coverity - Dane Springmeyer -diff --git a/lib/zip_dirent.c b/lib/zip_dirent.c -index a369900..e5a7cc9 100644 ---- a/lib/zip_dirent.c -+++ b/lib/zip_dirent.c -@@ -579,9 +579,6 @@ _zip_dirent_read(zip_dirent_t *zde, zip_source_t *src, zip_buffer_t *buffer, boo - } - - if (!_zip_dirent_process_winzip_aes(zde, error)) { -- if (!from_buffer) { -- _zip_buffer_free(buffer); -- } - return -1; - } - diff --git a/dev-libs/libzip/files/libzip-1.2.0-CVE-2017-14107.patch b/dev-libs/libzip/files/libzip-1.2.0-CVE-2017-14107.patch deleted file mode 100644 index 3d1f9a0aabc..00000000000 --- a/dev-libs/libzip/files/libzip-1.2.0-CVE-2017-14107.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 9b46957ec98d85a572e9ef98301247f39338a3b5 Mon Sep 17 00:00:00 2001 -From: Thomas Klausner -Date: Tue, 29 Aug 2017 10:25:03 +0200 -Subject: [PATCH] Make eocd checks more consistent between zip and zip64 cases. - ---- - lib/zip_open.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/lib/zip_open.c b/lib/zip_open.c -index 3bd593b..9d3a4cb 100644 ---- a/lib/zip_open.c -+++ b/lib/zip_open.c -@@ -847,7 +847,12 @@ _zip_read_eocd64(zip_source_t *src, zip_buffer_t *buffer, zip_uint64_t buf_offse - zip_error_set(error, ZIP_ER_SEEK, EFBIG); - return NULL; - } -- if ((flags & ZIP_CHECKCONS) && offset+size != eocd_offset) { -+ if (offset+size > buf_offset + eocd_offset) { -+ /* cdir spans past EOCD record */ -+ zip_error_set(error, ZIP_ER_INCONS, 0); -+ return NULL; -+ } -+ if ((flags & ZIP_CHECKCONS) && offset+size != buf_offset + eocd_offset) { - zip_error_set(error, ZIP_ER_INCONS, 0); - return NULL; - } diff --git a/dev-libs/libzip/libzip-1.2.0-r1.ebuild b/dev-libs/libzip/libzip-1.2.0-r1.ebuild deleted file mode 100644 index 61f933dcd36..00000000000 --- a/dev-libs/libzip/libzip-1.2.0-r1.ebuild +++ /dev/null @@ -1,40 +0,0 @@ -# Copyright 1999-2017 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -EAPI=6 - -inherit autotools - -DESCRIPTION="Library for manipulating zip archives" -HOMEPAGE="http://www.nih.at/libzip/" -SRC_URI="http://www.nih.at/libzip/${P}.tar.xz" - -LICENSE="BSD" -SLOT="0/5" -KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~x86-macos" -IUSE="static-libs" - -RDEPEND=" - sys-libs/zlib - elibc_musl? ( sys-libs/fts-standalone ) -" -DEPEND="${RDEPEND}" - -DOCS=( AUTHORS NEWS.md API-CHANGES THANKS ) - -PATCHES=( - "${FILESDIR}/${P}-headers.patch" - "${FILESDIR}/${P}-fts.patch" - "${FILESDIR}/${P}-CVE-2017-12858.patch" -) - -src_prepare() { - default - eautoreconf -} - -src_install() { - default - use static-libs || rm "${ED%/}"/usr/$(get_libdir)/libzip.a || die - find "${D}" -name '*.la' -delete || die -} diff --git a/dev-libs/libzip/libzip-1.2.0-r2.ebuild b/dev-libs/libzip/libzip-1.2.0-r2.ebuild deleted file mode 100644 index 524782f42c3..00000000000 --- a/dev-libs/libzip/libzip-1.2.0-r2.ebuild +++ /dev/null @@ -1,41 +0,0 @@ -# Copyright 1999-2017 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -EAPI=6 - -inherit autotools - -DESCRIPTION="Library for manipulating zip archives" -HOMEPAGE="https://nih.at/libzip/" -SRC_URI="https://www.nih.at/libzip/${P}.tar.xz" - -LICENSE="BSD" -SLOT="0/5" -KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~x86-macos" -IUSE="static-libs" - -RDEPEND=" - sys-libs/zlib - elibc_musl? ( sys-libs/fts-standalone ) -" -DEPEND="${RDEPEND}" - -DOCS=( AUTHORS NEWS.md API-CHANGES THANKS ) - -PATCHES=( - "${FILESDIR}/${P}-headers.patch" - "${FILESDIR}/${P}-fts.patch" - "${FILESDIR}/${P}-CVE-2017-12858.patch" - "${FILESDIR}/${P}-CVE-2017-14107.patch" -) - -src_prepare() { - default - eautoreconf -} - -src_install() { - default - use static-libs || rm "${ED%/}"/usr/$(get_libdir)/libzip.a || die - find "${D}" -name '*.la' -delete || die -} diff --git a/dev-libs/libzip/libzip-1.2.0.ebuild b/dev-libs/libzip/libzip-1.2.0.ebuild deleted file mode 100644 index d51ce765081..00000000000 --- a/dev-libs/libzip/libzip-1.2.0.ebuild +++ /dev/null @@ -1,39 +0,0 @@ -# Copyright 1999-2017 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -EAPI=6 - -inherit autotools - -DESCRIPTION="Library for manipulating zip archives" -HOMEPAGE="http://www.nih.at/libzip/" -SRC_URI="http://www.nih.at/libzip/${P}.tar.xz" - -LICENSE="BSD" -SLOT="0/5" -KEYWORDS="alpha amd64 ~arm ~arm64 ~hppa ia64 ~mips ppc ppc64 sparc x86 ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~x86-macos" -IUSE="static-libs" - -RDEPEND=" - sys-libs/zlib - elibc_musl? ( sys-libs/fts-standalone ) -" -DEPEND="${RDEPEND}" - -DOCS=( AUTHORS NEWS.md API-CHANGES THANKS ) - -PATCHES=( - "${FILESDIR}/${P}-headers.patch" - "${FILESDIR}/${P}-fts.patch" -) - -src_prepare() { - default - eautoreconf -} - -src_install() { - default - use static-libs || rm "${ED%/}"/usr/$(get_libdir)/libzip.a || die - find "${D}" -name '*.la' -delete || die -}