Fix potentially exploitable memory corruption (bug #542264, thanks to Agostino Sarubb...

Package-Manager: portage-2.2.18/cvs/Linux x86_64
Manifest-Sign-Key: 0x18E5B6F2D8D5EC8D

diff --git a/net-libs/rest/ChangeLog b/net-libs/rest/ChangeLog
index e27b832b9a54ef863dbdba711f55d70f18bc9002..2851740e49d4b259a7741e5fb73ffef3db189207 100644 (file)
--- a/net-libs/rest/ChangeLog
+++ b/net-libs/rest/ChangeLog
@@ -1,6 +1,15 @@
 # ChangeLog for net-libs/rest
 # Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-libs/rest/ChangeLog,v 1.32 2015/01/19 10:41:51 jer Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-libs/rest/ChangeLog,v 1.33 2015/03/05 18:20:52 tetromino Exp $
+
+*rest-0.7.92-r2 (05 Mar 2015)
+
+  05 Mar 2015; Alexandre Rostovtsev <tetromino@gentoo.org> -rest-0.7.91.ebuild,
+  +rest-0.7.92-r2.ebuild, +files/rest-0.7.92-oauth-missing-include.patch,
+  +files/rest-0.7.92-tests-GError-pointers.patch,
+  +files/rest-0.7.92-xml-parser-missing-break.patch:
+  Fix potentially exploitable memory corruption (bug #542264, thanks to
+  Agostino Sarubbo). Punt old.
 
   19 Jan 2015; Jeroen Roovers <jer@gentoo.org> rest-0.7.92-r1.ebuild:
   Stable for HPPA (bug #536694).

diff --git a/net-libs/rest/Manifest b/net-libs/rest/Manifest
index 34275ae0a7d294812684f50e7da5860a11a5173d..140a5824681a9bd630b0b68786cc1bf0b4ed3eb9 100644 (file)
--- a/net-libs/rest/Manifest
+++ b/net-libs/rest/Manifest
@@ -1,17 +1,31 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
-DIST rest-0.7.91.tar.xz 321120 SHA256 838814d935143f2dc99eb79f1ac69c615e7b547339f6cd226dd0ed4d7c16b67a SHA512 3fa63ca2c2b0d2a0bcccdc5cdd2a7b0d55a7e2600c564fe84e638bac4ac3b24d50199c7e65cb0e15946d9f80965165e5f01bc3521e7d797a66ca90e04a31d659 WHIRLPOOL cbc01285445a9785d36a0231230abde336927e4104cffcd994ac6ba01b4b38f560253c244c6eef4af3de4ac3188f49dc46f893bd451d9319c0e178ae3a615911
+AUX rest-0.7.92-oauth-missing-include.patch 745 SHA256 46da0228295c0c7095d45350411183833d2beb3660f6afbb56a8f9dafa83f3a0 SHA512 7b850de4c568638dd0d7cdf796b43a8cf94dd70854c1ba3fb40d6e8105371254132af362b0849e3a7bf974c2732b76869c1067c47a7666eaec03e83d849e383a WHIRLPOOL 860e3ddac6f11bd9c6da6349678b160543eb8fccc3f2f3bebe6657ca3a765134862ca8b3f01ee47312c2371157e776755fd9a67592570ff1ee6d010ab6014d99
+AUX rest-0.7.92-tests-GError-pointers.patch 1082 SHA256 435e8ec3a9e18889a5a20c63ab1926dae730e59241d1ec5aff193dc4687b96c5 SHA512 844aaa3d00a12689ed642330a9454fe744082c477778c5ffa4a9a7bff0f7f68713439f332f0e9558eebbb30bb96948dcbb923d82c25efe82ca5f2a53fd5bb017 WHIRLPOOL 865b9fbe5aea61e3583a43673aefbe20636602ee6a7ccd39d79d172fb4faa5e563c3da026a63f43d14f0bf3ccda037ea062fb6ac43fcf32e931deea41813afab
+AUX rest-0.7.92-xml-parser-missing-break.patch 939 SHA256 b1842826d440faca991d5263c347117a629e29f8d9a8e90661a0a029853e3e3c SHA512 3e4838c0f86250fd5d25723379c93e5b05b013884daef989a4626e4bc6153c149aa8c5f7d71f274115c23a32423865ed9108fcd6b192f5db45324235d3c135fb WHIRLPOOL a8aa1db085cec4b9d0e7c7384ec58405cd705c897073056b41c29d03e700cf9612bff72c1f1ed2afaa8e8be6d468110d5d8d9072ab2f3472f675cf7729c275f6
 DIST rest-0.7.92.tar.xz 321580 SHA256 07548c8785a3e743daf54a82b952ff5f32af94fee68997df4c83b00d52f9c0ec SHA512 9e30e185b0c2bdbbc507cef35f7c2e286917d2a9a0c97b075b8dea3eb9312e1a0a757185679109ca569de5dda7fee7fd2e6e19a24d7ca66aa9fcf5166dd5de86 WHIRLPOOL 1ade25a20d81e08a937c37f36c051c07eaef1792be1be118e4baf26d283e4ee1ce351b34d698b69bda591641af5644c406e8be8c11a0f8b94c8aedf252ea0d68
-EBUILD rest-0.7.91.ebuild 1141 SHA256 69e67212897ec23e376cabb604c738773394231a7fe9fa401644532031512b90 SHA512 324177558be94f938ad7af5e2ab26a6e6e9a39ac1ab12acd6723331a4ce38317e1bd81984bc8a96ecc5d224c0a2935654fdaaf551e1f8aa1b823d407f6492d92 WHIRLPOOL 09cc69d574583e801a147acfbc259ad6da1c9282d97dca3f767b8a185900d547b12cdf0e819dd7d605f36910a5a9191f6bda494a8f639d660819576b0dd9ad1d
 EBUILD rest-0.7.92-r1.ebuild 1548 SHA256 6ec1a1bfb50e29487dbefb2e474fc3984e4367f7f3e986dce65d4819a7c4bb79 SHA512 e9e7fe321f1c085aaddbfe4a59506a54f1ee93713a4ef0a016b526c44aa8ea321fa44bdd84a2a20ef08ec06bab9e705f35f89837057085478b8da776200c05dc WHIRLPOOL 129cfa1949d8cb84dc7737b41c783090518e5de7980bb11abc6d446980ce12b531b7316ac8130e929c23779bbedeaea87e1efad774794fdfb3edf5ea157285ab
+EBUILD rest-0.7.92-r2.ebuild 1843 SHA256 a815007568c159b2bf145b4f88084bd0831b79e35f327837ce9840e4436125bb SHA512 db1fac7c5674e0e75ee4944984de40b1696329921081b62f21b40e8f4a474799907285213d3f56cea82598cfa6916a912e22797deff914c5147c550af6ec3f94 WHIRLPOOL f38af82daf9194ff7f3e8815ea31f8db3662a4adb1c974b4ead55aa50bb7a676c2bd9194935353cdffaa2ddcbcf8254f882dd99d629dca11087c91fac8769780
 EBUILD rest-0.7.92.ebuild 1148 SHA256 7f7d0faee8bf7115430b620754518a4fb075faaac286505508116598b261c8be SHA512 291175028944bbdb94c73c7f23ef9855cb374f6eb9ac564d59dd4632f7c1b2172c5a8cd1fc1c8034366f023afad6731d7f9cf9f6e46835041920259d9b042cb0 WHIRLPOOL 031d745a617b6736321d91a999cd2084bd23298e8548a97836b6810197658701d72e2595ba7986e194c9895f41bd820f89b3051f5f79e51a2e3379c5aacb8608
-MISC ChangeLog 4117 SHA256 f508333c4b5b651dd769c5647aabb6d803d68ac2a8d269fdcb2371ed28c9ca4e SHA512 98e310e1957556ea63ad846fcdda89ac8115bbf5bfff4967ae2038012ffd3935c5aa0f387fabc5f2876abc86a0c6665c3e2764ad5ef1e8201a4069e2ef1f34d9 WHIRLPOOL 331eacea1e259f59bc27130e379c7681bd071542c61b92d085a35890f7750a708d9eab55ee3eb29c6faf7ad1bafbcef43ba1e172bf4bc27e224c1e74d9f7d827
+MISC ChangeLog 4515 SHA256 56626c0ca723fbe93b030b1d399de0027563ffd856e6ff4a5c485a66244771a5 SHA512 038ed078d5e4422560555557ce284687837e92eeefe703b28bfa4b7f56006cb980d98c8bef0b1266be739f33c226f9e0499a53c1309c4f2123f2d02fb2e879ff WHIRLPOOL f10aa00a25b6e7a1fade2033828b9dfe97aee15113847784487d182d90d3f768bad60842977ff6b6de7c295aee35e065ee83704dd71aae82b8bebd4fe6753c2b
 MISC metadata.xml 279 SHA256 688824d65296493f7c53e26eef986d647df2c137a419bc2e55b31eb77c7bd5a0 SHA512 449d5f4daa7de31f2aae7228e492f826fea80c3243255f5be61ef401bf8fc45880528e4e922e9ecd1060f0039c7f0ef37ec0f825f295f9594ae4ed8d9af8fa1c WHIRLPOOL 1aca9c991f4f47907eb08bf9dc75e5d7c7197822948519cb4bc44c6dca3514bd94068b774555ed6d1a527be1c72671c517efe0c40532db12ecf95a99a8e09447
 -----BEGIN PGP SIGNATURE-----
-Version: GnuPG v2
+Version: GnuPG v2.0
 
-iEYEAREIAAYFAlS833EACgkQVWmRsqeSphO8vgCdFxDFAfzRqF8KqJpP7mViOYLi
-GqcAn1elulDkrE2sh3DLJVx3drevvQHd
-=3cZ3
+iQJ8BAEBCABmBQJU+J6FXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
+ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ1RTNCRkUzRDRBNkI2MEEwQkYwQzMyOEEx
+OEU1QjZGMkQ4RDVFQzhEAAoJEBjltvLY1eyNJs0QANpzpFZHLovtEfkx1z/+RT2t
+ywJKyvLsl9L46UiYdK95wHS0rI7s4taD4SrVf9qOH+4auD8xBPrjr5fbnLP58XNc
+opaKR2/CFnXRAG3PyPZDf7yMI/ZaAEsyIdgQUr6GoAcph2TjApHFDznzxbbl0Yg8
+E2pKBOzAcr10WVHvS1CbriRtPBi6JtJ0kjv9syyqxWiHmgDIHcJrPa8O0g51Hmzx
+yXpVCPoZbPHAkUA3EvYGu6KSgN9ef1HIhDYc67IiRI8tPfVOqw9CZ9rbslWPla77
+VF14HS54D90a39IZ0rBEks/lUtqLzhLXqBo1KN9zFT20U0NvSUGXdP4BMRXYFEY6
+gl8P+a2CMbbFuhtGul4JUIieo4wv4HXp6eHGu8nj+s/iR2YDYce+GfK3y5Ez/OYv
+LKDyjd6hWnfprvYSUR4/9qEiZ3BcoIR5mFrh1myora1yVI2Ngxj732HDw5LQtSkk
+5Gz5Mz2ofAKYQh8tLooKi/4nko9avm4kFA7W78AwDFpnjPwOoIGweBA63D16MRsr
+q6E1N8+e4HJMrK1ZaMwsfrTcDhparZEDcdCPs5gajN30Yy7gRhKkoK4kfx1t5JYO
+2bgz5wTa5hZWuXLkrjN67j37GJKKZVWq01XCIo8jnxn4wsdplt+SQ05ZecfDiXJk
+zZ2QHhy5ELwvcq1VmkDe
+=uO0F
 -----END PGP SIGNATURE-----

diff --git a/net-libs/rest/files/rest-0.7.92-oauth-missing-include.patch b/net-libs/rest/files/rest-0.7.92-oauth-missing-include.patch
new file mode 100644 (file)
index 0000000..2fafa2c
--- /dev/null
+++ b/net-libs/rest/files/rest-0.7.92-oauth-missing-include.patch
@@ -0,0 +1,25 @@
+From b50ace7738ea03817acdad87fb2b338a86018329 Mon Sep 17 00:00:00 2001
+From: Christophe Fergeau <cfergeau@redhat.com>
+Date: Wed, 3 Sep 2014 11:31:49 +0200
+Subject: [PATCH 2/3] oauth: Add missing include
+
+This fixes a compilation warning about a missing prototype.
+---
+ rest/oauth-proxy-call.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/rest/oauth-proxy-call.c b/rest/oauth-proxy-call.c
+index dce2c66..ab77b1a 100644
+--- a/rest/oauth-proxy-call.c
++++ b/rest/oauth-proxy-call.c
+@@ -25,6 +25,7 @@
+ #include <rest/rest-proxy-call.h>
+ #include "oauth-proxy-call.h"
+ #include "oauth-proxy-private.h"
++#include "rest-proxy-call-private.h"
+ #include "sha1.h"
+ 
+ G_DEFINE_TYPE (OAuthProxyCall, oauth_proxy_call, REST_TYPE_PROXY_CALL)
+-- 
+2.3.1
+

diff --git a/net-libs/rest/files/rest-0.7.92-tests-GError-pointers.patch b/net-libs/rest/files/rest-0.7.92-tests-GError-pointers.patch
new file mode 100644 (file)
index 0000000..edc8b70
--- /dev/null
+++ b/net-libs/rest/files/rest-0.7.92-tests-GError-pointers.patch
@@ -0,0 +1,40 @@
+From 1bd0dc67914b7398acf60aaa42aa03bb4d36b839 Mon Sep 17 00:00:00 2001
+From: Alexandre Rostovtsev <tetromino@gentoo.org>
+Date: Thu, 5 Mar 2015 13:05:21 -0500
+Subject: [PATCH] tests: GError pointers must be initialized
+
+https://bugzilla.gnome.org/show_bug.cgi?id=745694
+---
+ tests/custom-serialize.c | 2 +-
+ tests/proxy-continuous.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tests/custom-serialize.c b/tests/custom-serialize.c
+index b50405d..f683941 100644
+--- a/tests/custom-serialize.c
++++ b/tests/custom-serialize.c
+@@ -115,7 +115,7 @@ main (int argc, char **argv)
+   RestProxy *proxy;
+   RestProxyCall *call;
+   char *url;
+-  GError *error;
++  GError *error = NULL;
+ 
+ #if !GLIB_CHECK_VERSION (2, 36, 0)
+   g_type_init ();
+diff --git a/tests/proxy-continuous.c b/tests/proxy-continuous.c
+index 9395cd2..22ad0f7 100644
+--- a/tests/proxy-continuous.c
++++ b/tests/proxy-continuous.c
+@@ -139,7 +139,7 @@ static void
+ stream_test (RestProxy *proxy)
+ {
+   RestProxyCall *call;
+-  GError *error;
++  GError *error = NULL;
+ 
+   client_count = 1;
+ 
+-- 
+2.3.1
+

diff --git a/net-libs/rest/files/rest-0.7.92-xml-parser-missing-break.patch b/net-libs/rest/files/rest-0.7.92-xml-parser-missing-break.patch
new file mode 100644 (file)
index 0000000..7f2b5c4
--- /dev/null
+++ b/net-libs/rest/files/rest-0.7.92-xml-parser-missing-break.patch
@@ -0,0 +1,26 @@
+From 272db68e131a20652c98453b75b9c743cda2b327 Mon Sep 17 00:00:00 2001
+From: Rob Bradford <rob@linux.intel.com>
+Date: Fri, 19 Sep 2014 17:06:00 +0100
+Subject: [PATCH 3/3] xml-parser: Add missing break in switch statement
+
+This would result in an inappropriate debug message appearing on valid
+text data.
+---
+ rest/rest-xml-parser.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/rest/rest-xml-parser.c b/rest/rest-xml-parser.c
+index 49b49b4..4447a1a 100644
+--- a/rest/rest-xml-parser.c
++++ b/rest/rest-xml-parser.c
+@@ -197,6 +197,7 @@ rest_xml_parser_parse_from_data (RestXmlParser *parser,
+         cur_node->content = g_strdup (G(xmlTextReaderConstValue (reader)));
+         REST_DEBUG (XML_PARSER, "Text content found: %s",
+                  cur_node->content);
++        break;
+       default:
+         REST_DEBUG (XML_PARSER, "Found unknown content with type: 0x%x", 
+                  xmlTextReaderNodeType (reader));
+-- 
+2.3.1
+

diff --git a/net-libs/rest/rest-0.7.91.ebuild b/net-libs/rest/rest-0.7.91.ebuild
deleted file mode 100644 (file)
index 3f8ebc9..0000000
--- a/net-libs/rest/rest-0.7.91.ebuild
+++ /dev/null
@@ -1,46 +0,0 @@
-# Copyright 1999-2014 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-libs/rest/rest-0.7.91.ebuild,v 1.5 2014/08/07 18:25:58 jer Exp $
-
-EAPI="5"
-GCONF_DEBUG="no"
-GNOME2_LA_PUNT="yes"
-
-inherit gnome2 virtualx
-
-DESCRIPTION="Helper library for RESTful services"
-HOMEPAGE="http://live.gnome.org/Librest"
-
-LICENSE="LGPL-2.1"
-SLOT="0.7"
-IUSE="+gnome +introspection test"
-KEYWORDS="~alpha amd64 ~arm hppa ~ia64 ~ppc ~ppc64 ~sparc x86"
-
-# Coverage testing should not be enabled
-RDEPEND="app-misc/ca-certificates
-       >=dev-libs/glib-2.24:2
-       dev-libs/libxml2:2
-       net-libs/libsoup:2.4
-       gnome? ( >=net-libs/libsoup-gnome-2.25.1:2.4 )
-       introspection? ( >=dev-libs/gobject-introspection-0.6.7 )
-"
-DEPEND="${RDEPEND}
-       >=dev-util/gtk-doc-am-1.13
-       >=dev-util/intltool-0.40
-       virtual/pkgconfig
-       test? ( sys-apps/dbus )
-"
-
-src_configure() {
-       gnome2_src_configure \
-               --disable-static \
-               --disable-gcov \
-               --with-ca-certificates="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt \
-               $(use_with gnome) \
-               $(use_enable introspection)
-}
-
-src_test() {
-       # Tests need dbus
-       Xemake check || die
-}

diff --git a/net-libs/rest/rest-0.7.92-r2.ebuild b/net-libs/rest/rest-0.7.92-r2.ebuild
new file mode 100644 (file)
index 0000000..8e726f2
--- /dev/null
+++ b/net-libs/rest/rest-0.7.92-r2.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-libs/rest/rest-0.7.92-r2.ebuild,v 1.1 2015/03/05 18:20:52 tetromino Exp $
+
+EAPI="5"
+GCONF_DEBUG="no"
+GNOME2_LA_PUNT="yes"
+
+inherit gnome2 multilib-minimal virtualx
+
+DESCRIPTION="Helper library for RESTful services"
+HOMEPAGE="https://wiki.gnome.org/Projects/Librest"
+
+LICENSE="LGPL-2.1"
+SLOT="0.7"
+IUSE="+gnome +introspection test"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+
+# Coverage testing should not be enabled
+RDEPEND="
+       app-misc/ca-certificates
+       >=dev-libs/glib-2.24:2[${MULTILIB_USEDEP}]
+       dev-libs/libxml2:2[${MULTILIB_USEDEP}]
+       net-libs/libsoup:2.4[${MULTILIB_USEDEP}]
+       gnome? ( >=net-libs/libsoup-gnome-2.25.1:2.4[${MULTILIB_USEDEP}] )
+       introspection? ( >=dev-libs/gobject-introspection-0.6.7 )
+"
+DEPEND="${RDEPEND}
+       >=dev-util/gtk-doc-am-1.13
+       >=dev-util/intltool-0.40
+       virtual/pkgconfig[${MULTILIB_USEDEP}]
+       test? ( sys-apps/dbus[${MULTILIB_USEDEP}] )
+"
+
+src_prepare() {
+       # fixed in 0.7.93
+       epatch "${FILESDIR}/${P}-oauth-missing-include.patch" #542264
+       epatch "${FILESDIR}/${P}-xml-parser-missing-break.patch"
+       # https://bugzilla.gnome.org/show_bug.cgi?id=745694
+       epatch "${FILESDIR}/${P}-tests-GError-pointers.patch"
+
+       gnome2_src_prepare
+}
+
+multilib_src_configure() {
+       ECONF_SOURCE=${S} \
+       gnome2_src_configure \
+               --disable-static \
+               --disable-gcov \
+               --with-ca-certificates="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt \
+               $(use_with gnome) \
+               $(multilib_native_use_enable introspection)
+
+       if multilib_is_native_abi; then
+               ln -s "${S}"/docs/reference/rest/html docs/reference/rest/html || die
+       fi
+}
+
+multilib_src_test() {
+       # Tests need dbus
+       Xemake check
+}
+
+multilib_src_compile() { gnome2_src_compile; }
+multilib_src_install() { gnome2_src_install; }