Fixed menu in dotty

Resolves: rhbz#1505230

graphviz-2.40.1-CVE-2018-10196.patch

@@ -0,0 +1,16 @@
+diff --git a/lib/dotgen/conc.c b/lib/dotgen/conc.c
+--- a/lib/dotgen/conc.c
++++ b/lib/dotgen/conc.c
+@@ -159,7 +159,11 @@ static void rebuild_vlists(graph_t * g)
+ 
+     for (r = GD_minrank(g); r <= GD_maxrank(g); r++) {
+ 	lead = GD_rankleader(g)[r];
+-	if (GD_rank(dot_root(g))[r].v[ND_order(lead)] != lead) {
++	if (lead == NULL) {
++		agerr(AGERR, "rebuiltd_vlists: lead is null for rank %d\n", r);
++		longjmp(jbuf, 1);
++	}
++	else if (GD_rank(dot_root(g))[r].v[ND_order(lead)] != lead) {
+ 	    agerr(AGERR, "rebuiltd_vlists: rank lead %s not in order %d of rank %d\n", 
+ 		agnameof(lead), ND_order(lead), r);
+ 	    longjmp(jbuf, 1);

graphviz-2.40.1-dotty-menu-fix.patch

@@ -0,0 +1,22 @@
+diff --git a/cmd/dotty/dotty_ui.lefty b/cmd/dotty/dotty_ui.lefty
+index a8c9116..a708c61 100644
+--- a/cmd/dotty/dotty_ui.lefty
++++ b/cmd/dotty/dotty_ui.lefty
+@@ -342,7 +342,7 @@ dotty.protovt.normal.uifuncs = [
+         else
+             gt.insertedge (gt, data.pobj, null, data.obj, null, null, 1);
+     };
+-    'rightdown' = function (data) {
++    'rightup' = function (data) {
+         local vt, gt, menu, i;
+ 
+         vt = dotty.views[data.widget];
+@@ -447,7 +447,7 @@ dotty.protovt.birdseye.uifuncs = [
+     'middledown' = dotty.protovt.normal.uifuncs.middledown;
+     'middlemove' = dotty.protovt.normal.uifuncs.middlemove;
+     'middleup' = dotty.protovt.normal.uifuncs.middleup;
+-    'rightdown' = dotty.protovt.normal.uifuncs.rightdown;
++    'rightup' = dotty.protovt.normal.uifuncs.rightup;
+     'keyup' = dotty.protovt.normal.uifuncs.keyup;
+     'redraw' = dotty.protovt.normal.uifuncs.redraw;
+     'closeview' = dotty.protovt.normal.uifuncs.closeview;

graphviz.spec

@@ -49,12 +49,14 @@
 Name:			graphviz
 Summary:		Graph Visualization Tools
 Version:		2.40.1
-Release:		20%{?dist}
+Release:		23%{?dist}
 Group:			Applications/Multimedia
 License:		EPL
 URL:			http://www.graphviz.org/
 Source0:		http://www.graphviz.org/pub/graphviz/ARCHIVE/%{name}-%{version}.tar.gz
 Patch0:			graphviz-2.40.1-visio.patch
+Patch1:			graphviz-2.40.1-CVE-2018-10196.patch
+Patch2:			graphviz-2.40.1-dotty-menu-fix.patch
 BuildRequires:		zlib-devel, libpng-devel, libjpeg-devel, expat-devel, freetype-devel >= 2
 BuildRequires:		ksh, bison, m4, flex, tk-devel, tcl-devel >= 8.3, swig
 BuildRequires:		fontconfig-devel, libtool-ltdl-devel, ruby-devel, ruby, guile-devel, python2-devel
@@ -204,24 +206,27 @@ Perl extension for graphviz.
 Group:			Applications/Multimedia
 Summary:		PHP extension for graphviz
 Requires:		%{name} = %{version}-%{release}
-Requires:	php(zend-abi) = %{php_zend_api}
-Requires:	php(api) = %{php_core_api}
+Requires:	php(zend-abi) = %{?php_zend_api}%{?!php_zend_api:UNDEFINED}
+Requires:	php(api) = %{?php_core_api}%{?!php_core_api:UNDEFINED}
 
 %description php
 PHP extension for graphviz.
 %endif
 
-%package -n python2-graphviz
-%{?python_provide:%python_provide python2-graphviz}
+%package python2
+Group:			Applications/Multimedia
+Summary:		Python extension for graphviz
+Requires:		%{name} = %{version}-%{release}
+# Manually add provides that would be generated automatically if .egg-info was present
+Provides: python2dist(gv) = %{version}
+Provides: python%{python2_version}dist(gv) = %{version}
 # Remove before F30
 Provides: %{name}-python = %{version}-%{release}
 Provides: %{name}-python%{?_isa} = %{version}-%{release}
-Obsoletes: %{name}-python < %{version}-%{release}
-Group:			Applications/Multimedia
-Summary:		Python extension for graphviz
-Requires:		%{name} = %{version}-%{release}, python2
+Obsoletes: %{name}-python < 2.40.1-22
+Obsoletes: python2-%{name} < 2.40.1-22
 
-%description -n python2-graphviz
+%description python2
 Python extension for graphviz.
 
 %if %{ARRRR}
@@ -263,6 +268,8 @@ Various tcl packages (extensions) for the graphviz tools.
 %prep
 %setup -q
 %patch0 -p1 -b .visio
+%patch1 -p1 -b .CVE-2018-10196
+%patch2 -p1 -b .dotty-menu-fix
 
 # Attempt to fix rpmlint warnings about executable sources
 find -type f -regex '.*\.\(c\|h\)$' -exec chmod a-x {} ';'
@@ -520,7 +527,7 @@ php --no-php-ini \
 %{_mandir}/man3/gv.3php*
 %endif
 
-%files -n python2-graphviz
+%files python2
 %defattr(-,root,root,-)
 %{_libdir}/graphviz/python/
 %{_libdir}/python*/*
@@ -555,6 +562,18 @@ php --no-php-ini \
 %{_mandir}/man3/*.3tcl*
 
 %changelog
+* Tue Jul 17 2018 Jaroslav Škarvada <jskarvad@redhat.com> - 2.40.1-23
+- Fixed menu in dotty
+  Resolves: rhbz#1505230
+
+* Fri May 18 2018 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.40.1-22
+- Rename python2 subpackage to graphviz-python2, because
+  there is intent to package python-graphviz, which is a separate project
+  from graphviz.
+
+* Thu May 17 2018 Jaroslav Škarvada <jskarvad@redhat.com> - 2.40.1-21
+- Fixed CVE-2018-10196
+
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.40.1-20
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild