From c3499ad6b8cfdf1c6b09aa51f9f681a5be6c8962 Mon Sep 17 00:00:00 2001 From: Mark H Weaver Date: Thu, 10 Mar 2016 02:57:05 -0500 Subject: gnu: icecat: Add several security fixes. * gnu/packages/patches/icecat-CVE-2015-4477.patch, gnu/packages/patches/icecat-CVE-2015-7207.patch, gnu/packages/patches/icecat-CVE-2016-1952-pt01.patch, gnu/packages/patches/icecat-CVE-2016-1952-pt02.patch, gnu/packages/patches/icecat-CVE-2016-1952-pt03.patch, gnu/packages/patches/icecat-CVE-2016-1952-pt04.patch, gnu/packages/patches/icecat-CVE-2016-1952-pt05.patch, gnu/packages/patches/icecat-CVE-2016-1952-pt06.patch, gnu/packages/patches/icecat-CVE-2016-1954.patch, gnu/packages/patches/icecat-CVE-2016-1960.patch, gnu/packages/patches/icecat-CVE-2016-1961.patch, gnu/packages/patches/icecat-CVE-2016-1962.patch, gnu/packages/patches/icecat-CVE-2016-1964.patch, gnu/packages/patches/icecat-CVE-2016-1965.patch, gnu/packages/patches/icecat-CVE-2016-1966.patch, gnu/packages/patches/icecat-CVE-2016-1974.patch, gnu/packages/patches/icecat-bug-1248851.patch: New files. * gnu-system.am (dist_patch_DATA): Add them. * gnu/packages/gnuzilla.scm (icecat)[source]: Add patches. --- gnu-system.am | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 4566ecac7..2ca703c58 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -528,6 +528,23 @@ dist_patch_DATA = \ gnu/packages/patches/icecat-update-graphite2.patch \ gnu/packages/patches/icecat-update-graphite2-pt2.patch \ gnu/packages/patches/icecat-re-enable-DHE-cipher-suites.patch \ + gnu/packages/patches/icecat-CVE-2015-4477.patch \ + gnu/packages/patches/icecat-CVE-2015-7207.patch \ + gnu/packages/patches/icecat-CVE-2016-1952-pt01.patch \ + gnu/packages/patches/icecat-CVE-2016-1952-pt02.patch \ + gnu/packages/patches/icecat-CVE-2016-1952-pt03.patch \ + gnu/packages/patches/icecat-CVE-2016-1952-pt04.patch \ + gnu/packages/patches/icecat-CVE-2016-1952-pt05.patch \ + gnu/packages/patches/icecat-CVE-2016-1952-pt06.patch \ + gnu/packages/patches/icecat-CVE-2016-1954.patch \ + gnu/packages/patches/icecat-CVE-2016-1960.patch \ + gnu/packages/patches/icecat-CVE-2016-1961.patch \ + gnu/packages/patches/icecat-CVE-2016-1962.patch \ + gnu/packages/patches/icecat-CVE-2016-1964.patch \ + gnu/packages/patches/icecat-CVE-2016-1965.patch \ + gnu/packages/patches/icecat-CVE-2016-1966.patch \ + gnu/packages/patches/icecat-CVE-2016-1974.patch \ + gnu/packages/patches/icecat-bug-1248851.patch \ gnu/packages/patches/icu4c-CVE-2014-6585.patch \ gnu/packages/patches/icu4c-CVE-2015-1270.patch \ gnu/packages/patches/icu4c-CVE-2015-4760.patch \ -- cgit v1.3 From ef0f0d5f971bf9c7a755b6b5c4bda34fc50e1987 Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Fri, 11 Mar 2016 15:52:45 +0100 Subject: gnu: vorbis-tools: Patch buffer overflow [fixes CVE-2015-6749]. * gnu/packages/patches/vorbis-tools-CVE-2015-6749.patch: New file. * gnu-system.am (dist_patch_DATA): Add it. * gnu/packages/xiph.scm (vorbis-tools)[source]: Use it. --- gnu-system.am | 1 + .../patches/vorbis-tools-CVE-2015-6749.patch | 44 ++++++++++++++++++++++ gnu/packages/xiph.scm | 3 +- 3 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/vorbis-tools-CVE-2015-6749.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 2ca703c58..38c1f5a2d 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -770,6 +770,7 @@ dist_patch_DATA = \ gnu/packages/patches/util-linux-tests.patch \ gnu/packages/patches/upower-builddir.patch \ gnu/packages/patches/valgrind-enable-arm.patch \ + gnu/packages/patches/vorbis-tools-CVE-2015-6749.patch \ gnu/packages/patches/vpnc-script.patch \ gnu/packages/patches/vtk-mesa-10.patch \ gnu/packages/patches/w3m-libgc.patch \ diff --git a/gnu/packages/patches/vorbis-tools-CVE-2015-6749.patch b/gnu/packages/patches/vorbis-tools-CVE-2015-6749.patch new file mode 100644 index 000000000..bcddcbfd7 --- /dev/null +++ b/gnu/packages/patches/vorbis-tools-CVE-2015-6749.patch @@ -0,0 +1,44 @@ +Upstream fix for CVE-2015-6749. +https://trac.xiph.org/ticket/2212 + +From 04815d3e1bfae3a6cdfb2c25358a5a72b61299f7 Mon Sep 17 00:00:00 2001 +From: Mark Harris +Date: Sun, 30 Aug 2015 05:54:46 -0700 +Subject: [PATCH] oggenc: Fix large alloca on bad AIFF input + +Fixes #2212 +--- + oggenc/audio.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/oggenc/audio.c b/oggenc/audio.c +index 477da8c..4921fb9 100644 +--- a/oggenc/audio.c ++++ b/oggenc/audio.c +@@ -245,8 +245,8 @@ static int aiff_permute_matrix[6][6] = + int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen) + { + int aifc; /* AIFC or AIFF? */ +- unsigned int len; +- unsigned char *buffer; ++ unsigned int len, readlen; ++ unsigned char buffer[22]; + unsigned char buf2[8]; + aiff_fmt format; + aifffile *aiff = malloc(sizeof(aifffile)); +@@ -269,9 +269,9 @@ int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen) + return 0; /* Weird common chunk */ + } + +- buffer = alloca(len); +- +- if(fread(buffer,1,len,in) < len) ++ readlen = len < sizeof(buffer) ? len : sizeof(buffer); ++ if(fread(buffer,1,readlen,in) < readlen || ++ (len > readlen && !seek_forward(in, len-readlen))) + { + fprintf(stderr, _("Warning: Unexpected EOF in reading AIFF header\n")); + return 0; +-- +2.5.0 + diff --git a/gnu/packages/xiph.scm b/gnu/packages/xiph.scm index a602a3464..04dfd70c5 100644 --- a/gnu/packages/xiph.scm +++ b/gnu/packages/xiph.scm @@ -266,7 +266,8 @@ Kate stream.") "vorbis-tools-" version ".tar.gz")) (sha256 (base32 - "1g12bnh5ah08v529y72kfdz5lhvy75iaz7f9jskyby23m9dkk2d3")))) + "1g12bnh5ah08v529y72kfdz5lhvy75iaz7f9jskyby23m9dkk2d3")) + (patches (list (search-patch "vorbis-tools-CVE-2015-6749.patch"))))) (build-system gnu-build-system) (inputs `(("ao" ,ao) ("curl" ,curl) -- cgit v1.3 From 8e755b1bcd377a4c475ae4cad586e6e192f20320 Mon Sep 17 00:00:00 2001 From: Andreas Enge Date: Sat, 12 Mar 2016 09:56:27 +0100 Subject: gnu: mupdf: Simplify package. * gnu/packages/pdf.scm (mupdf)[source]: Drop patch and part of snippet modifying permissions of files added by the patch. [arguments]: Use #:make-flags instead of modified build and install phases. Drop superfluous module inclusion. Use modify-phases syntax. * gnu/packages/patches/mupdf-buildsystem-fix.patch: Remove patch. * gnu-system.am (dist_patch_DATA): Unregister patch. --- gnu-system.am | 1 - gnu/packages/patches/mupdf-buildsystem-fix.patch | 69 ------------------------ gnu/packages/pdf.scm | 34 +++--------- 3 files changed, 8 insertions(+), 96 deletions(-) delete mode 100644 gnu/packages/patches/mupdf-buildsystem-fix.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 38c1f5a2d..e198793a8 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -636,7 +636,6 @@ dist_patch_DATA = \ gnu/packages/patches/module-init-tools-moduledir.patch \ gnu/packages/patches/mumps-build-parallelism.patch \ gnu/packages/patches/mupen64plus-ui-console-notice.patch \ - gnu/packages/patches/mupdf-buildsystem-fix.patch \ gnu/packages/patches/mutt-store-references.patch \ gnu/packages/patches/net-tools-bitrot.patch \ gnu/packages/patches/ngircd-handle-zombies.patch \ diff --git a/gnu/packages/patches/mupdf-buildsystem-fix.patch b/gnu/packages/patches/mupdf-buildsystem-fix.patch deleted file mode 100644 index 0b17dda91..000000000 --- a/gnu/packages/patches/mupdf-buildsystem-fix.patch +++ /dev/null @@ -1,69 +0,0 @@ -Since openjpeg doesn't seem to ship with a .pc file, provide an alternative. - ---- a/ojp2_cppflags.sh 1970-01-01 01:00:00.000000000 +0100 -+++ b/ojp2_cppflags.sh 2014-09-13 22:56:38.842418777 +0200 -@@ -0,0 +1,7 @@ -+#!/bin/sh -+ -+# Return the preprocessor flags to link against openjpeg. -+ -+cpppath=$(echo ${NIX_STORE}/*-openjpeg-*/include/openjpeg-*) -+ -+echo -I$cpppath - ---- a/ojp2_ldflags.sh 1970-01-01 01:00:00.000000000 +0100 -+++ b/ojp2_ldflags.sh 2014-09-13 22:56:38.842418777 +0200 -@@ -0,0 +1,7 @@ -+#!/bin/sh -+ -+# Return the linker flags to link against openjpeg. -+ -+ldpath=$(echo ${NIX_STORE}/*-openjpeg-*/lib) -+ -+echo -L$ldpath -lopenjp2 - -Make use of the above alternatives, compile with gcc. - ---- a/Makerules 2014-09-14 09:13:40.729149860 +0200 -+++ b/Makerules 2014-09-14 09:17:06.425156595 +0200 -@@ -75,12 +75,14 @@ - - SYS_FREETYPE_CFLAGS = $(shell pkg-config --cflags freetype2) - SYS_FREETYPE_LIBS = $(shell pkg-config --libs freetype2) --SYS_OPENJPEG_CFLAGS = $(shell pkg-config --cflags libopenjp2) --SYS_OPENJPEG_LIBS = $(shell pkg-config --libs libopenjp2) -+SYS_OPENJPEG_CFLAGS = $(shell ./ojp2_cppflags.sh) -+SYS_OPENJPEG_LIBS = $(shell ./ojp2_ldflags.sh) - SYS_JBIG2DEC_LIBS = -ljbig2dec - SYS_JPEG_LIBS = -ljpeg - SYS_ZLIB_LIBS = -lz - -+CC = gcc -+ - endif - - # The following section is an example of how to simply do cross-compilation - -Remove the -x11 from the built binaries, since X11 is implied on GNU. (This -might change when Wayland gets more popular) - ---- a/Makefile 2014-06-10 17:09:28.000000000 +0200 -+++ b/Makefile 2014-09-14 09:57:10.381235299 +0200 -@@ -255,7 +255,7 @@ - $(LINK_CMD) - - ifeq "$(HAVE_X11)" "yes" --MUVIEW_X11 := $(OUT)/mupdf-x11 -+MUVIEW_X11 := $(OUT)/mupdf - MUVIEW_X11_OBJ := $(addprefix $(OUT)/platform/x11/, x11_main.o x11_image.o pdfapp.o) - $(MUVIEW_X11_OBJ) : $(FITZ_HDR) $(PDF_HDR) - $(MUVIEW_X11) : $(MUPDF_LIB) $(THIRD_LIBS) -@@ -263,7 +263,7 @@ - $(LINK_CMD) $(X11_LIBS) - - ifeq "$(HAVE_CURL)" "yes" --MUVIEW_X11_CURL := $(OUT)/mupdf-x11-curl -+MUVIEW_X11_CURL := $(OUT)/mupdf-curl - MUVIEW_X11_CURL_OBJ := $(addprefix $(OUT)/platform/x11/curl/, x11_main.o x11_image.o pdfapp.o curl_stream.o) - $(MUVIEW_X11_CURL_OBJ) : $(FITZ_HDR) $(PDF_HDR) - $(MUVIEW_X11_CURL) : $(MUPDF_LIB) $(THIRD_LIBS) $(CURL_LIB) diff --git a/gnu/packages/pdf.scm b/gnu/packages/pdf.scm index a99fdd70a..67e9beaa3 100644 --- a/gnu/packages/pdf.scm +++ b/gnu/packages/pdf.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright © 2013, 2015 Andreas Enge +;;; Copyright © 2013, 2015, 2016 Andreas Enge ;;; Copyright © 2014 Mark H Weaver ;;; Copyright © 2014, 2015 Ricardo Wurmus ;;; Copyright © 2015 Paul van der Walt @@ -418,18 +418,10 @@ extracting content or merging files.") name "-" version "-source.tar.gz")) (sha256 (base32 "0qx51rj6alzcagcixm59rvdpm54w6syrwr4184v439jh14ryw4wq")) - (patches - (list (search-patch "mupdf-buildsystem-fix.patch"))) (modules '((guix build utils))) (snippet - '(begin ;; Don't build the bundled-in third party libraries. - (delete-file-recursively "thirdparty") - - ;; Make the scripts for finding openjpeg build details executable. - (chmod "ojp2_cppflags.sh" #o0755) - (chmod "ojp2_ldflags.sh" #o0755))))) - + '(delete-file-recursively "thirdparty")))) (build-system gnu-build-system) (inputs `(("curl" ,curl) @@ -444,22 +436,12 @@ extracting content or merging files.") (native-inputs `(("pkg-config" ,pkg-config))) (arguments - ;; Trying to run `$ make check' results in a no rule fault. - '(#:tests? #f - - #:modules ((guix build gnu-build-system) - (guix build utils) - (srfi srfi-1)) - #:phases (alist-replace - 'build - (lambda _ (zero? (system* "make" "XCFLAGS=-fpic"))) - (alist-replace - 'install - (lambda* (#:key outputs #:allow-other-keys) - (let ((out (assoc-ref outputs "out"))) - (zero? (system* "make" (string-append "prefix=" out) - "install")))) - (alist-delete 'configure %standard-phases))))) + '(#:tests? #f ; no check target + #:make-flags (list "CC=gcc" + "XCFLAGS=-fpic" + (string-append "prefix=" (assoc-ref %outputs "out"))) + #:phases (modify-phases %standard-phases + (delete 'configure)))) (home-page "http://mupdf.com") (synopsis "Lightweight PDF viewer and toolkit") (description -- cgit v1.3