Fixed format string vulnerability

Resolves: rhbz#1167868

.gitignore

@@ -1 +1 @@
-/graphviz-*.tar.bz2
+graphviz-*.tar.gz

graphviz-2.32.0-rtest-errout-fix.patch

@@ -0,0 +1,24 @@
+diff --git a/rtest/rtest.sh b/rtest/rtest.sh
+index ad6e14b..94bc044 100755
+--- a/rtest/rtest.sh
++++ b/rtest/rtest.sh
+@@ -280,14 +280,16 @@ function doTest
+     $testcmd 2> errout
+     RVAL=$?
+ 
++    if [[ -s errout ]]
++    then
++      cat errout
++    fi
++    
+     if [[ $RVAL != 0 || ! -s $OUTPATH ]]
+     then
+       (( CRASH_CNT+=1 ))
+       print -u 2 "Test $TESTNAME:$i : == Layout failed =="
+       print -u 2 "  $testcmd"
+-    elif [[ -s errout ]]
+-    then
+-      cat errout
+     elif [[ $GENERATE == 1 ]]
+     then
+       continue

graphviz-2.32.0-testsuite-sigsegv-fix.patch

@@ -0,0 +1,28 @@
+diff --git a/lib/gvc/gvconfig.c b/lib/gvc/gvconfig.c
+index dc3d578..0562ae8 100644
+--- a/lib/gvc/gvconfig.c
++++ b/lib/gvc/gvconfig.c
+@@ -507,6 +507,7 @@ void gvconfig(GVC_t * gvc, boolean rescan)
+         libdir = gvconfig_libdir(gvc);
+         rc = stat(libdir, &libdir_st);
+         if (rc == -1) {
++            gvtextlayout_select(gvc);   /* choose best available textlayout plugin immediately */
+     	    /* if we fail to stat it then it probably doesn't exist so just fail silently */
+ 	    return;
+         }
+@@ -521,6 +522,7 @@ void gvconfig(GVC_t * gvc, boolean rescan)
+         if (rescan) {
+     	    config_rescan(gvc, gvc->config_path);
+     	    gvc->config_found = TRUE;
++            gvtextlayout_select(gvc);   /* choose best available textlayout plugin immediately */
+     	    return;
+         }
+     
+@@ -528,6 +530,7 @@ void gvconfig(GVC_t * gvc, boolean rescan)
+     
+         rc = stat(gvc->config_path, &config_st);
+         if (rc == -1) {
++            gvtextlayout_select(gvc);   /* choose best available textlayout plugin immediately */
+     	    /* silently return without setting gvc->config_found = TRUE */
+     	    return;
+         }

graphviz-2.34.0-CVE-2014-0978-CVE-2014-1235.patch

@@ -0,0 +1,40 @@
+diff --git a/lib/cgraph/scan.l b/lib/cgraph/scan.l
+--- a/lib/cgraph/scan.l
++++ b/lib/cgraph/scan.l
+@@ -16,6 +16,7 @@
+ %{
+ #include <grammar.h>
+ #include <cghdr.h>
++#include <agxbuf.h>
+ #include <ctype.h>
+ #define GRAPH_EOF_TOKEN		'@'		/* lex class must be defined below */
+ 	/* this is a workaround for linux flex */
+@@ -191,13 +192,22 @@ ID		({NAME}|{NUMBER})
+ %%
+ void yyerror(char *str)
+ {
++	unsigned char	xbuf[BUFSIZ];
+ 	char	buf[BUFSIZ];
+-	if (InputFile)
+-		sprintf(buf,"%s:%d: %s in line %d near '%s'\n",InputFile, line_num,
+-			str,line_num,yytext);
+-	else
+-		sprintf(buf," %s in line %d near '%s'\n", str,line_num,yytext);
+-	agerr(AGWARN,buf);
++	agxbuf  xb;
++
++	agxbinit(&xb, BUFSIZ, xbuf);
++	if (InputFile) {
++		agxbput (&xb, InputFile);
++		agxbput (&xb, ": ");
++	}
++	agxbput (&xb, str);
++	sprintf(buf," in line %d near '", line_num);
++	agxbput (&xb, buf);
++	agxbput (&xb, yytext);
++	agxbput (&xb,"'\n");
++	agerr(AGWARN,agxbuse(&xb));
++	agxbfree(&xb);
+ }
+ /* must be here to see flex's macro defns */
+ void aglexeof() { unput(GRAPH_EOF_TOKEN); }

graphviz-2.34.0-CVE-2014-1236.patch

@@ -0,0 +1,58 @@
+From 1d1bdec6318746f6f19f245db589eddc887ae8ff Mon Sep 17 00:00:00 2001
+From: "Emden R. Gansner" <erg@alum.mit.edu>
+Date: Wed, 8 Jan 2014 11:31:04 -0500
+Subject: [PATCH] Fix possible buffer overflow problem in chkNum of scanner.
+
+---
+ lib/cgraph/scan.l | 35 ++++++++++++++++++++++++++---------
+ 1 file changed, 26 insertions(+), 9 deletions(-)
+
+diff --git a/lib/cgraph/scan.l b/lib/cgraph/scan.l
+index 212967c..d065b61 100644
+--- a/lib/cgraph/scan.l
++++ b/lib/cgraph/scan.l
+@@ -129,15 +129,32 @@ static void ppDirective (void)
+  * and report this to the user.
+  */
+ static int chkNum(void) {
+-  unsigned char	c = (unsigned char)yytext[yyleng-1];   /* last character */
+-  if (!isdigit(c) && (c != '.')) {  /* c is letter */
+-	char	buf[BUFSIZ];
+-	sprintf(buf,"syntax error - badly formed number '%s' in line %d of %s\n",yytext,line_num, InputFile);
+-    strcat (buf, "splits into two name tokens\n");
+-	agerr(AGWARN,buf);
+-    return 1;
+-  }
+-  else return 0;
++    unsigned char c = (unsigned char)yytext[yyleng-1];   /* last character */
++    if (!isdigit(c) && (c != '.')) {  /* c is letter */
++	unsigned char xbuf[BUFSIZ];
++	char buf[BUFSIZ];
++	agxbuf  xb;
++	char* fname;
++
++	if (InputFile)
++	    fname = InputFile;
++	else
++	    fname = "input";
++
++	agxbinit(&xb, BUFSIZ, xbuf);
++
++	agxbput(&xb,"syntax ambiguity - badly delimited number '");
++	agxbput(&xb,yytext);
++	sprintf(buf,"' in line %d of ", line_num);
++	agxbput(&xb,buf);
++	agxbput(&xb,fname);
++	agxbput(&xb, " splits into two tokens\n");
++	agerr(AGWARN,agxbuse(&xb));
++
++	agxbfree(&xb);
++	return 1;
++    }
++    else return 0;
+ }
+ 
+ /* The LETTER class below consists of ascii letters, underscore, all non-ascii
+-- 
+1.8.5.1
+

graphviz-2.34.0-format-string.patch

@@ -0,0 +1,13 @@
+diff --git a/lib/cgraph/scan.l b/lib/cgraph/scan.l
+index f01785a..e54a302 100644
+--- a/lib/cgraph/scan.l
++++ b/lib/cgraph/scan.l
+@@ -223,7 +223,7 @@ void yyerror(char *str)
+ 	agxbput (&xb, buf);
+ 	agxbput (&xb, yytext);
+ 	agxbput (&xb,"'\n");
+-	agerr(AGWARN,agxbuse(&xb));
++	agerr(AGWARN, "%s", agxbuse(&xb));
+ 	agxbfree(&xb);
+ }
+ /* must be here to see flex's macro defns */

graphviz-2.34.0-lefty-getaddrinfo.patch

@@ -0,0 +1,45 @@
+diff -up graphviz-2.34.0/cmd/lefty/os/unix/io.c.orig graphviz-2.34.0/cmd/lefty/os/unix/io.c
+--- graphviz-2.34.0/cmd/lefty/os/unix/io.c.orig	2013-09-07 03:07:52.000000000 +0200
++++ graphviz-2.34.0/cmd/lefty/os/unix/io.c	2013-10-30 17:38:59.746296595 +0100
+@@ -285,9 +285,8 @@ int IOwriteline (int ioi, char *bufp) {
+ 
+ static FILE *serverconnect (char *name) {
+     char *host, *portp, buf[1024];
+-    int port;
+-    struct hostent *hp;
+-    struct sockaddr_in sin;
++    struct addrinfo *ai;
++    struct addrinfo hints;
+     int cfd;
+ 
+     strcpy (buf, name);
+@@ -295,17 +294,18 @@ static FILE *serverconnect (char *name)
+     portp = strchr (host, '/');
+     if (*host == 0 || !portp)
+         return NULL;
+-    *portp++ = 0, port = atoi (portp);
+-    if (!(hp = gethostbyname (host)))
+-        return NULL;
+-    memset ((char *) &sin, 1, sizeof (sin));
+-    memcpy ((char *) &sin.sin_addr, hp->h_addr, hp->h_length);
+-    sin.sin_family = hp->h_addrtype;
+-    sin.sin_port = htons (port);
+-    if ((cfd = socket (hp->h_addrtype, SOCK_STREAM, 0)) < 0)
+-        return NULL;
+-    if (connect (cfd, (struct sockaddr *) &sin, sizeof (sin)) < 0)
+-        return NULL;
++    *portp++ = 0;
++    memset (&hints, 0, sizeof (hints));
++    hints.ai_family = AF_UNSPEC;
++    hints.ai_flags = AI_ADDRCONFIG | AI_NUMERICSERV;
++    hints.ai_socktype = SOCK_STREAM;
++    if (getaddrinfo (host, portp, &hints, &ai))
++        return freeaddrinfo(ai), NULL;
++    if ((cfd = socket (ai->ai_family, ai->ai_socktype, ai->ai_protocol)) < 0)
++        return freeaddrinfo(ai), NULL;
++    if (connect (cfd, ai->ai_addr, ai->ai_addrlen) < 0)
++        return freeaddrinfo(ai), NULL;
++    freeaddrinfo(ai);
+     return fdopen (cfd, "w+");
+ }
+ 

graphviz-2.34.0-lefty-xdot12.patch

@@ -0,0 +1,25 @@
+@@ -, +, @@ 
+---
+ cmd/dotty/dotty_layout.lefty | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+--- a/cmd/dotty/dotty_layout.lefty	
++++ a/cmd/dotty/dotty_layout.lefty	
+@@ -5,7 +5,7 @@ dotty.grablserver = function (lserver) {
+     local fd;
+ 
+     if (~dotty.lservers[lserver] | tablesize (dotty.lservers[lserver]) == 0) {
+-        if (~((fd = openio ('pipe', lserver, 'r+', '%e -Txdot')) >= 0)) {
++        if (~((fd = openio ('pipe', lserver, 'r+', '%e -Txdot1.2')) >= 0)) {
+             dotty.message (0, concat ('cannot start ', lserver));
+             return null;
+         }
+@@ -438,6 +438,8 @@ dotty.protogt.unpackdraw = function (gt, attr) {
+             }
+         } else if (t[i] == 'I') {
+             i = i + 7;
++        } else if (t[i] == 't') {
++            i = i + 2;
+         } else {
+             dotty.message (0, concat ('draw language parser error: ', t[i]));
+             return null;
+-- 

graphviz-4.0.0-gvpack-neato-static.patch

@@ -1,15 +0,0 @@
-diff --git a/cmd/tools/Makefile.am b/cmd/tools/Makefile.am
-index 4978fea..9fbe2e2 100644
---- a/cmd/tools/Makefile.am
-+++ b/cmd/tools/Makefile.am
-@@ -249,7 +249,9 @@ gvpack_LDADD = \
- 	$(top_builddir)/lib/ingraphs/libingraphs_C.la \
- 	$(top_builddir)/lib/cgraph/libcgraph.la \
- 	$(top_builddir)/lib/cdt/libcdt.la \
--	$(top_builddir)/plugin/neato_layout/libgvplugin_neato_layout.la
-+	$(top_builddir)/plugin/neato_layout/libgvplugin_neato_layout_C.la \
-+	$(top_builddir)/lib/pathplan/libpathplan_C.la \
-+		$(EXPAT_LIBS) $(Z_LIBS) $(GTS_LIBS) $(SOCKET_LIBS) $(IPSEPCOLA_LIBS) $(MATH_LIBS)
- 
- if ENABLE_STATIC
- gvpack_static_SOURCES = gvpack.cpp

graphviz-7.0.6-fix-python-3.12.patch

@@ -1,13 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index 49e027f..542c23a 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1141,7 +1141,7 @@ else
- 	           use_python3="No (python-$PYTHON3_VERSION.pc not found)"
-           fi
-         fi
--        PYTHON3_INSTALL_DIR="`$PYTHON3 -c 'from distutils import sysconfig; print(sysconfig.get_python_lib(1,0))'`"
-+        PYTHON3_INSTALL_DIR="`$PYTHON3 -c 'import sysconfig; print(sysconfig.get_path("platlib"))'`"
-         save_CPPFLAGS=$CPPFLAGS
-         CPPFLAGS="$CPPFLAGS $PYTHON3_INCLUDES"
-         AC_CHECK_HEADER(Python.h,,[

sources

@@ -1 +1 @@
-SHA512 (graphviz-7.1.0.tar.bz2) = 28b3217153cbe96270b25862aa030269128653b011cf9eb6607fe9d061aa9db85f9b2454d9fde70be5af4f98474f8cac61040584ce164723df6ceb372cfb29ad
+a8a54f8abac5bcdafd9a568e85a086d6  graphviz-2.34.0.tar.gz