Fixed CVE-2018-10196
This commit is contained in:
parent
6fa2e1fe45
commit
619fbb253b
16
graphviz-2.40.1-CVE-2018-10196.patch
Normal file
16
graphviz-2.40.1-CVE-2018-10196.patch
Normal file
@ -0,0 +1,16 @@
|
||||
diff --git a/lib/dotgen/conc.c b/lib/dotgen/conc.c
|
||||
--- a/lib/dotgen/conc.c
|
||||
+++ b/lib/dotgen/conc.c
|
||||
@@ -159,7 +159,11 @@ static void rebuild_vlists(graph_t * g)
|
||||
|
||||
for (r = GD_minrank(g); r <= GD_maxrank(g); r++) {
|
||||
lead = GD_rankleader(g)[r];
|
||||
- if (GD_rank(dot_root(g))[r].v[ND_order(lead)] != lead) {
|
||||
+ if (lead == NULL) {
|
||||
+ agerr(AGERR, "rebuiltd_vlists: lead is null for rank %d\n", r);
|
||||
+ longjmp(jbuf, 1);
|
||||
+ }
|
||||
+ else if (GD_rank(dot_root(g))[r].v[ND_order(lead)] != lead) {
|
||||
agerr(AGERR, "rebuiltd_vlists: rank lead %s not in order %d of rank %d\n",
|
||||
agnameof(lead), ND_order(lead), r);
|
||||
longjmp(jbuf, 1);
|
@ -49,12 +49,13 @@
|
||||
Name: graphviz
|
||||
Summary: Graph Visualization Tools
|
||||
Version: 2.40.1
|
||||
Release: 20%{?dist}
|
||||
Release: 21%{?dist}
|
||||
Group: Applications/Multimedia
|
||||
License: EPL
|
||||
URL: http://www.graphviz.org/
|
||||
Source0: http://www.graphviz.org/pub/graphviz/ARCHIVE/%{name}-%{version}.tar.gz
|
||||
Patch0: graphviz-2.40.1-visio.patch
|
||||
Patch1: graphviz-2.40.1-CVE-2018-10196.patch
|
||||
BuildRequires: zlib-devel, libpng-devel, libjpeg-devel, expat-devel, freetype-devel >= 2
|
||||
BuildRequires: ksh, bison, m4, flex, tk-devel, tcl-devel >= 8.3, swig
|
||||
BuildRequires: fontconfig-devel, libtool-ltdl-devel, ruby-devel, ruby, guile-devel, python2-devel
|
||||
@ -263,6 +264,7 @@ Various tcl packages (extensions) for the graphviz tools.
|
||||
%prep
|
||||
%setup -q
|
||||
%patch0 -p1 -b .visio
|
||||
%patch1 -p1 -b .CVE-2018-10196
|
||||
|
||||
# Attempt to fix rpmlint warnings about executable sources
|
||||
find -type f -regex '.*\.\(c\|h\)$' -exec chmod a-x {} ';'
|
||||
@ -555,6 +557,9 @@ php --no-php-ini \
|
||||
%{_mandir}/man3/*.3tcl*
|
||||
|
||||
%changelog
|
||||
* Thu May 17 2018 Jaroslav Škarvada <jskarvad@redhat.com> - 2.40.1-21
|
||||
- Fixed CVE-2018-10196
|
||||
|
||||
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.40.1-20
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user