Compare commits
10 Commits
Author | SHA1 | Date | |
---|---|---|---|
|
d4689ff480 | ||
|
da9ec35313 | ||
|
ba78633489 | ||
|
e860ef1e41 | ||
|
254b57538a | ||
|
dc39ef7dbd | ||
|
2d639ad566 | ||
|
dd879d0384 | ||
|
322c372f22 | ||
|
01612c6409 |
41
graphviz-2.30.1-CVE-2014-0978-CVE-2014-1235.patch
Normal file
41
graphviz-2.30.1-CVE-2014-0978-CVE-2014-1235.patch
Normal file
@ -0,0 +1,41 @@
|
|||||||
|
diff --git a/lib/cgraph/scan.l b/lib/cgraph/scan.l
|
||||||
|
index e2215d1..67eca47 100644
|
||||||
|
--- a/lib/cgraph/scan.l
|
||||||
|
+++ b/lib/cgraph/scan.l
|
||||||
|
@@ -16,6 +16,7 @@
|
||||||
|
%{
|
||||||
|
#include <grammar.h>
|
||||||
|
#include <cghdr.h>
|
||||||
|
+#include <agxbuf.h>
|
||||||
|
#include <ctype.h>
|
||||||
|
#define GRAPH_EOF_TOKEN '@' /* lex class must be defined below */
|
||||||
|
/* this is a workaround for linux flex */
|
||||||
|
@@ -192,13 +193,22 @@ ID ({NAME}|{NUMBER})
|
||||||
|
%%
|
||||||
|
void yyerror(char *str)
|
||||||
|
{
|
||||||
|
+ unsigned char xbuf[BUFSIZ];
|
||||||
|
char buf[BUFSIZ];
|
||||||
|
- if (InputFile)
|
||||||
|
- sprintf(buf,"%s:%d: %s in line %d near '%s'\n",InputFile, line_num,
|
||||||
|
- str,line_num,yytext);
|
||||||
|
- else
|
||||||
|
- sprintf(buf," %s in line %d near '%s'\n", str,line_num,yytext);
|
||||||
|
- agerr(AGWARN,buf);
|
||||||
|
+ agxbuf xb;
|
||||||
|
+
|
||||||
|
+ agxbinit(&xb, BUFSIZ, xbuf);
|
||||||
|
+ if (InputFile) {
|
||||||
|
+ agxbput (&xb, InputFile);
|
||||||
|
+ agxbput (&xb, ": ");
|
||||||
|
+ }
|
||||||
|
+ agxbput (&xb, str);
|
||||||
|
+ sprintf(buf," in line %d near '", line_num);
|
||||||
|
+ agxbput (&xb, buf);
|
||||||
|
+ agxbput (&xb, yytext);
|
||||||
|
+ agxbput (&xb,"'\n");
|
||||||
|
+ agerr(AGWARN,agxbuse(&xb));
|
||||||
|
+ agxbfree(&xb);
|
||||||
|
}
|
||||||
|
/* must be here to see flex's macro defns */
|
||||||
|
void aglexeof() { unput(GRAPH_EOF_TOKEN); }
|
58
graphviz-2.30.1-CVE-2014-1236.patch
Normal file
58
graphviz-2.30.1-CVE-2014-1236.patch
Normal file
@ -0,0 +1,58 @@
|
|||||||
|
From 1d1bdec6318746f6f19f245db589eddc887ae8ff Mon Sep 17 00:00:00 2001
|
||||||
|
From: "Emden R. Gansner" <erg@alum.mit.edu>
|
||||||
|
Date: Wed, 8 Jan 2014 11:31:04 -0500
|
||||||
|
Subject: [PATCH] Fix possible buffer overflow problem in chkNum of scanner.
|
||||||
|
|
||||||
|
---
|
||||||
|
lib/cgraph/scan.l | 35 ++++++++++++++++++++++++++---------
|
||||||
|
1 file changed, 26 insertions(+), 9 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/cgraph/scan.l b/lib/cgraph/scan.l
|
||||||
|
index 212967c..d065b61 100644
|
||||||
|
--- a/lib/cgraph/scan.l
|
||||||
|
+++ b/lib/cgraph/scan.l
|
||||||
|
@@ -129,15 +129,32 @@ static void ppDirective (void)
|
||||||
|
* and report this to the user.
|
||||||
|
*/
|
||||||
|
static int chkNum(void) {
|
||||||
|
- unsigned char c = (unsigned char)yytext[yyleng-1]; /* last character */
|
||||||
|
- if (!isdigit(c) && (c != '.')) { /* c is letter */
|
||||||
|
- char buf[BUFSIZ];
|
||||||
|
- sprintf(buf,"syntax error - badly formed number '%s' in line %d of %s\n",yytext,line_num, InputFile);
|
||||||
|
- strcat (buf, "splits into two name tokens\n");
|
||||||
|
- agerr(AGWARN,buf);
|
||||||
|
- return 1;
|
||||||
|
- }
|
||||||
|
- else return 0;
|
||||||
|
+ unsigned char c = (unsigned char)yytext[yyleng-1]; /* last character */
|
||||||
|
+ if (!isdigit(c) && (c != '.')) { /* c is letter */
|
||||||
|
+ unsigned char xbuf[BUFSIZ];
|
||||||
|
+ char buf[BUFSIZ];
|
||||||
|
+ agxbuf xb;
|
||||||
|
+ char* fname;
|
||||||
|
+
|
||||||
|
+ if (InputFile)
|
||||||
|
+ fname = InputFile;
|
||||||
|
+ else
|
||||||
|
+ fname = "input";
|
||||||
|
+
|
||||||
|
+ agxbinit(&xb, BUFSIZ, xbuf);
|
||||||
|
+
|
||||||
|
+ agxbput(&xb,"syntax ambiguity - badly delimited number '");
|
||||||
|
+ agxbput(&xb,yytext);
|
||||||
|
+ sprintf(buf,"' in line %d of ", line_num);
|
||||||
|
+ agxbput(&xb,buf);
|
||||||
|
+ agxbput(&xb,fname);
|
||||||
|
+ agxbput(&xb, " splits into two tokens\n");
|
||||||
|
+ agerr(AGWARN,agxbuse(&xb));
|
||||||
|
+
|
||||||
|
+ agxbfree(&xb);
|
||||||
|
+ return 1;
|
||||||
|
+ }
|
||||||
|
+ else return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* The LETTER class below consists of ascii letters, underscore, all non-ascii
|
||||||
|
--
|
||||||
|
1.8.5.1
|
||||||
|
|
13
graphviz-2.30.1-format-string.patch
Normal file
13
graphviz-2.30.1-format-string.patch
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
diff --git a/lib/cgraph/scan.l b/lib/cgraph/scan.l
|
||||||
|
index 94e4c17..2255b59 100644
|
||||||
|
--- a/lib/cgraph/scan.l
|
||||||
|
+++ b/lib/cgraph/scan.l
|
||||||
|
@@ -224,7 +224,7 @@ void yyerror(char *str)
|
||||||
|
agxbput (&xb, buf);
|
||||||
|
agxbput (&xb, yytext);
|
||||||
|
agxbput (&xb,"'\n");
|
||||||
|
- agerr(AGWARN,agxbuse(&xb));
|
||||||
|
+ agerr(AGWARN, "%s", agxbuse(&xb));
|
||||||
|
agxbfree(&xb);
|
||||||
|
}
|
||||||
|
/* must be here to see flex's macro defns */
|
@ -51,7 +51,7 @@
|
|||||||
Name: graphviz
|
Name: graphviz
|
||||||
Summary: Graph Visualization Tools
|
Summary: Graph Visualization Tools
|
||||||
Version: 2.30.1
|
Version: 2.30.1
|
||||||
Release: 10%{?dist}
|
Release: 13%{?dist}
|
||||||
Group: Applications/Multimedia
|
Group: Applications/Multimedia
|
||||||
License: EPL
|
License: EPL
|
||||||
URL: http://www.graphviz.org/
|
URL: http://www.graphviz.org/
|
||||||
@ -75,6 +75,12 @@ Patch9: graphviz-2.30.1-lefty-help.patch
|
|||||||
Patch10: graphviz-2.30.1-prune-help.patch
|
Patch10: graphviz-2.30.1-prune-help.patch
|
||||||
# Sent upstream, ticket #2307
|
# Sent upstream, ticket #2307
|
||||||
Patch11: graphviz-2.30.1-man-fix.patch
|
Patch11: graphviz-2.30.1-man-fix.patch
|
||||||
|
# Fix yyerror overflow (CVE-2014-0978, CVE-2014-1235)
|
||||||
|
Patch12: graphviz-2.30.1-CVE-2014-0978-CVE-2014-1235.patch
|
||||||
|
# Fix chknum overflow (CVE-2014-1236)
|
||||||
|
Patch13: graphviz-2.30.1-CVE-2014-1236.patch
|
||||||
|
# Backported from upstream
|
||||||
|
Patch14: graphviz-2.30.1-format-string.patch
|
||||||
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
||||||
BuildRequires: zlib-devel, libpng-devel, libjpeg-devel, expat-devel, freetype-devel >= 2
|
BuildRequires: zlib-devel, libpng-devel, libjpeg-devel, expat-devel, freetype-devel >= 2
|
||||||
BuildRequires: ksh, bison, m4, flex, tk-devel, tcl-devel >= 8.3, swig
|
BuildRequires: ksh, bison, m4, flex, tk-devel, tcl-devel >= 8.3, swig
|
||||||
@ -282,6 +288,9 @@ Various tcl packages (extensions) for the graphviz tools.
|
|||||||
%patch9 -p1 -b .lefty-help
|
%patch9 -p1 -b .lefty-help
|
||||||
%patch10 -p1 -b .prune-help
|
%patch10 -p1 -b .prune-help
|
||||||
%patch11 -p1 -b .man-fix
|
%patch11 -p1 -b .man-fix
|
||||||
|
%patch12 -p1 -b .CVE-2014-0978-CVE-2014-1235
|
||||||
|
%patch13 -p1 -b .CVE-2014-1236
|
||||||
|
%patch14 -p1 -b .format-string
|
||||||
|
|
||||||
# Attempt to fix rpmlint warnings about executable sources
|
# Attempt to fix rpmlint warnings about executable sources
|
||||||
find -type f -regex '.*\.\(c\|h\)$' -exec chmod a-x {} ';'
|
find -type f -regex '.*\.\(c\|h\)$' -exec chmod a-x {} ';'
|
||||||
@ -558,6 +567,20 @@ rm -rf %{buildroot}
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Tue Nov 25 2014 Jaroslav Škarvada <jskarvad@redhat.com> - 2.30.1-13
|
||||||
|
- Fixed format string vulnerability
|
||||||
|
Resolves: rhbz#1167868
|
||||||
|
|
||||||
|
* Fri Jan 10 2014 Jaroslav Škarvada <jskarvad@redhat.com> - 2.30.1-12
|
||||||
|
- Prevent possible buffer overflow in yyerror()
|
||||||
|
Resolves: CVE-2014-1235
|
||||||
|
- Fix possible buffer overflow problem in chkNum of scanner
|
||||||
|
Resolves: CVE-2014-1236
|
||||||
|
|
||||||
|
* Tue Jan 7 2014 Jaroslav Škarvada <jskarvad@redhat.com> - 2.30.1-11
|
||||||
|
- Fixed overflow in yyerror
|
||||||
|
Resolves: CVE-2014-0978
|
||||||
|
|
||||||
* Fri Jul 12 2013 Jaroslav Škarvada <jskarvad@redhat.com> - 2.30.1-10
|
* Fri Jul 12 2013 Jaroslav Škarvada <jskarvad@redhat.com> - 2.30.1-10
|
||||||
- Various man and built-in help fixes
|
- Various man and built-in help fixes
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user