Fixed buffer overflow in lib/common/shapes.c

Resolves: CVE-2020-18032
  Resolves: rhbz#1963395

.gitignore

@@ -1 +1,3 @@
-/graphviz-*.tar.bz2
+graphviz-*.tar.gz
+/graphviz-2.42.4.tar.bz2
+/graphviz-2.44.0.tar.bz2

graphviz-2.42.2-coverity-scan-fixes.patch

@@ -0,0 +1,26 @@
+diff --git a/cmd/lefty/dot2l/dotlex.c b/cmd/lefty/dot2l/dotlex.c
+index cf738c0..65e17e2 100644
+--- a/cmd/lefty/dot2l/dotlex.c
++++ b/cmd/lefty/dot2l/dotlex.c
+@@ -252,7 +252,7 @@ static char *scan_token (char *p) {
+     char *q;
+ 
+     q = lexbuf;
+-    if (p == '\0')
++    if (!p || *p == '\0')
+         return NULL;
+     while (isalnum (*p) || (*p == '_') || (!isascii (*p)))
+         *q++ = *p++;
+diff --git a/cmd/tools/gvgen.c b/cmd/tools/gvgen.c
+index c2b166d..c9a51e9 100644
+--- a/cmd/tools/gvgen.c
++++ b/cmd/tools/gvgen.c
+@@ -453,6 +453,8 @@ closeOpen (void)
+ 	fprintf(opts.outfile, "}\ngraph {\n");
+ }
+ 
++extern void makeTetrix(int depth, edgefn ef);
++
+ int main(int argc, char *argv[])
+ {
+     GraphType graphType;

graphviz-2.42.2-dotty-menu-fix.patch

@@ -0,0 +1,22 @@
+diff --git a/cmd/dotty/dotty_ui.lefty b/cmd/dotty/dotty_ui.lefty
+index 6fdec8f..270c0c8 100644
+--- a/cmd/dotty/dotty_ui.lefty
++++ b/cmd/dotty/dotty_ui.lefty
+@@ -351,7 +351,7 @@ dotty.protovt.normal.uifuncs = [
+         else
+             gt.insertedge (gt, data.pobj, null, data.obj, null, null, 1);
+     };
+-    'rightdown' = function (data) {
++    'rightup' = function (data) {
+         local vt, gt, menu, i;
+ 
+         vt = dotty.views[data.widget];
+@@ -456,7 +456,7 @@ dotty.protovt.birdseye.uifuncs = [
+     'middledown' = dotty.protovt.normal.uifuncs.middledown;
+     'middlemove' = dotty.protovt.normal.uifuncs.middlemove;
+     'middleup' = dotty.protovt.normal.uifuncs.middleup;
+-    'rightdown' = dotty.protovt.normal.uifuncs.rightdown;
++    'rightup' = dotty.protovt.normal.uifuncs.rightup;
+     'keyup' = dotty.protovt.normal.uifuncs.keyup;
+     'redraw' = dotty.protovt.normal.uifuncs.redraw;
+     'closeview' = dotty.protovt.normal.uifuncs.closeview;

graphviz-2.44.0-CVE-2020-18032.patch

@@ -0,0 +1,40 @@
+From 784411ca3655c80da0f6025ab20634b2a6ff696b Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Sat, 25 Jul 2020 19:31:01 -0700
+Subject: [PATCH] fix: out-of-bounds write on invalid label
+
+When the label for a node cannot be parsed (due to it being malformed), it falls
+back on the symbol name of the node itself. I.e. the default label the node
+would have had if it had no label attribute at all. However, this is applied by
+dynamically altering the node's label to "\N", a shortcut for the symbol name of
+the node. All of this is fine, however if the hand written label itself is
+shorter than the literal string "\N", not enough memory would have been
+allocated to write "\N" into the label text.
+
+Here we account for the possibility of error during label parsing, and assume
+that the label text may need to be overwritten with "\N" after the fact. Fixes
+issue #1700.
+---
+ lib/common/shapes.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/lib/common/shapes.c b/lib/common/shapes.c
+index 0a0635fc3..9dca9ba6e 100644
+--- a/lib/common/shapes.c
++++ b/lib/common/shapes.c
+@@ -3546,9 +3546,10 @@ static void record_init(node_t * n)
+     reclblp = ND_label(n)->text;
+     len = strlen(reclblp);
+     /* For some forgotten reason, an empty label is parsed into a space, so
+-     * we need at least two bytes in textbuf.
++     * we need at least two bytes in textbuf, as well as accounting for the
++     * error path involving "\\N" below.
+      */
+-    len = MAX(len, 1);
++    len = MAX(MAX(len, 1), (int)strlen("\\N"));
+     textbuf = N_NEW(len + 1, char);
+     if (!(info = parse_reclbl(n, flip, TRUE, textbuf))) {
+ 	agerr(AGERR, "bad label format %s\n", ND_label(n)->text);
+-- 
+GitLab
+

graphviz-2.44.0-man-fix.patch

@@ -0,0 +1,127 @@
+diff --git a/cmd/dot/dot.1 b/cmd/dot/dot.1
+index 986b262..e9c56f2 100644
+--- a/cmd/dot/dot.1
++++ b/cmd/dot/dot.1
+@@ -352,7 +352,7 @@ in the layout.
+ layout the graph.
+ .PP
+ \fBstart=\fIval\fR. Adjusts the random initial placement of nodes
+-with no specified position.  If \fIval\fP is is an integer,
++with no specified position.  If \fIval\fP is an integer,
+ it is used as the seed for the random number generator.
+ If \fIval\fP is not an integer, a random system\(hygenerated integer,
+ such as the process ID or current time, is used as the seed.
+@@ -635,6 +635,22 @@ As usual, edge layout is guided by the \fBsplines\fR attribute.
+ .PP
+ \fB\-y\fR invert y coordinate in output.
+ .PP
++\fB\-o\fIfile\fR write output to \fIfile\fP.
++.PP
++\fB\-x\fP reduce graph.
++.PP
++\fB\-Lg\fP don't use grid.
++.PP
++\fB\-LO\fP use old attractive force.
++.PP
++\fB\-Ln\fIi\fR set number of iterations to \fIi\fP.
++.PP
++\fB\-LU\fIi\fR set unscaled factor to \fIi\fP.
++.PP
++\fB\-LC\fIv\fR set overlap expansion factor to \fIv\fP.
++.PP
++\fB\-LT\fR[*]\fIv\fR set temperature (temperature factor) to \fIv\fP.
++.PP
+ \fB\-V\fP (version) prints version information and exits.
+ .PP
+ \fB\-?\fP prints the usage and exits.
+diff --git a/cmd/dot/osage.1 b/cmd/dot/osage.1
+index 0efbf90..5eded8b 100644
+--- a/cmd/dot/osage.1
++++ b/cmd/dot/osage.1
+@@ -404,6 +404,22 @@ If \fB\-l\fP is given by itself, the standard library is omitted.
+ .PP
+ \fB\-O\fP automatically generate output filenames based on the input filename and the \-T format.
+ .PP
++\fB\-o\fIfile\fR write output to \fIfile\fP.
++.PP
++\fB\-x\fP reduce graph.
++.PP
++\fB\-Lg\fP don't use grid.
++.PP
++\fB\-LO\fP use old attractive force.
++.PP
++\fB\-Ln\fIi\fR set number of iterations to \fIi\fP.
++.PP
++\fB\-LU\fIi\fR set unscaled factor to \fIi\fP.
++.PP
++\fB\-LC\fIv\fR set overlap expansion factor to \fIv\fP.
++.PP
++\fB\-LT\fR[*]\fIv\fR set temperature (temperature factor) to \fIv\fP.
++.PP
+ \fB\-v\fP (verbose) prints various information useful for debugging.
+ .PP
+ \fB\-V\fP (version) prints version information and exits.
+diff --git a/cmd/dot/patchwork.1 b/cmd/dot/patchwork.1
+index 7fe68fb..852f516 100644
+--- a/cmd/dot/patchwork.1
++++ b/cmd/dot/patchwork.1
+@@ -398,6 +398,22 @@ If \fB\-l\fP is given by itself, the standard library is omitted.
+ .PP
+ \fB\-O\fP automatically generate output filenames based on the input filename and the \-T format.
+ .PP
++\fB\-o\fIfile\fR write output to \fIfile\fP.
++.PP
++\fB\-x\fP reduce graph.
++.PP
++\fB\-Lg\fP don't use grid.
++.PP
++\fB\-LO\fP use old attractive force.
++.PP
++\fB\-Ln\fIi\fR set number of iterations to \fIi\fP.
++.PP
++\fB\-LU\fIi\fR set unscaled factor to \fIi\fP.
++.PP
++\fB\-LC\fIv\fR set overlap expansion factor to \fIv\fP.
++.PP
++\fB\-LT\fR[*]\fIv\fR set temperature (temperature factor) to \fIv\fP.
++.PP
+ \fB\-v\fP (verbose) prints various information useful for debugging.
+ .PP
+ \fB\-V\fP (version) prints version information and exits.
+diff --git a/cmd/gvmap/cluster.1 b/cmd/gvmap/cluster.1
+index 15b0332..188dcd6 100644
+--- a/cmd/gvmap/cluster.1
++++ b/cmd/gvmap/cluster.1
+@@ -51,6 +51,9 @@ Specifies that output should go into the file \fIoutfile\fP. By default,
+ .TP
+ .BI \-v 
+ Verbose mode.
++.TP
++.BI \-?
++Prints the usage and exits.
+ .SH EXAMPLES
+ .PP
+ Applying 
+diff --git a/cmd/tools/unflatten.1 b/cmd/tools/unflatten.1
+index 7857cf0..089496f 100644
+--- a/cmd/tools/unflatten.1
++++ b/cmd/tools/unflatten.1
+@@ -3,7 +3,7 @@
+ unflatten \- adjust directed graphs to improve layout aspect ratio
+ .SH SYNOPSIS
+ .B unflatten
+-[\fB\-f\fR]
++[\fB\-f?\fR]
+ [\fB\-l\fIlen\fR]
+ [\fB\-c\fIlen\fR
+ ] [
+@@ -41,6 +41,9 @@ Form disconnected nodes into chains of up to \fIlen\fP nodes.
+ .BI \-o " outfile"
+ causes the output to be written to the specified file; by default,
+ output is written to \fBstdout\fP.
++.TP
++.BI \-?
++Prints the usage and exits.
+ .SH OPERANDS
+ The following operand is supported:
+ .TP 8

graphviz-4.0.0-gvpack-neato-static.patch

@@ -1,15 +0,0 @@
-diff --git a/cmd/tools/Makefile.am b/cmd/tools/Makefile.am
-index 4978fea..9fbe2e2 100644
---- a/cmd/tools/Makefile.am
-+++ b/cmd/tools/Makefile.am
-@@ -249,7 +249,9 @@ gvpack_LDADD = \
- 	$(top_builddir)/lib/ingraphs/libingraphs_C.la \
- 	$(top_builddir)/lib/cgraph/libcgraph.la \
- 	$(top_builddir)/lib/cdt/libcdt.la \
--	$(top_builddir)/plugin/neato_layout/libgvplugin_neato_layout.la
-+	$(top_builddir)/plugin/neato_layout/libgvplugin_neato_layout_C.la \
-+	$(top_builddir)/lib/pathplan/libpathplan_C.la \
-+		$(EXPAT_LIBS) $(Z_LIBS) $(GTS_LIBS) $(SOCKET_LIBS) $(IPSEPCOLA_LIBS) $(MATH_LIBS)
- 
- if ENABLE_STATIC
- gvpack_static_SOURCES = gvpack.cpp

graphviz-7.0.6-fix-python-3.12.patch

@@ -1,13 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index 49e027f..542c23a 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1141,7 +1141,7 @@ else
- 	           use_python3="No (python-$PYTHON3_VERSION.pc not found)"
-           fi
-         fi
--        PYTHON3_INSTALL_DIR="`$PYTHON3 -c 'from distutils import sysconfig; print(sysconfig.get_python_lib(1,0))'`"
-+        PYTHON3_INSTALL_DIR="`$PYTHON3 -c 'import sysconfig; print(sysconfig.get_path("platlib"))'`"
-         save_CPPFLAGS=$CPPFLAGS
-         CPPFLAGS="$CPPFLAGS $PYTHON3_INCLUDES"
-         AC_CHECK_HEADER(Python.h,,[

graphviz.spec

@@ -1,24 +1,13 @@
-%undefine _package_note_flags
-%if 0%{?rhel} >= 8
-%bcond_with php
-%bcond_with guile
-%else
-# temporal drop of PHP support due to https://gitlab.com/graphviz/graphviz/-/issues/2277
-%bcond_with php
-%bcond_without guile
-%endif
+%if 0%{?rhel} == 8
 %bcond_with python2
-
-# Macro for creating an option which enables bootstraping build without dependencies,
-# which cause problems during rebuilds. Currently it is circular dependency of graphviz and
-# doxygen - in case a dependency of graphviz/doxygen bumps SONAME and graphviz/doxygen
-# has to be rebuilt, we can break the circular dependency by building with --with bootstrap.
-%bcond_with bootstrap
-
-%if 0%{?rhel} >= 10
-%bcond_with gtk2
+%bcond_with php
 %else
-%bcond_without gtk2
+%if 0%{?fedora} > 31
+%bcond_with python2
+%else
+%bcond_without python2
+%endif
+%bcond_without php
 %endif
 
 # Necessary conditionals
@@ -43,12 +32,6 @@
 # Not in Fedora yet.
 %global MING   0
 
-%ifarch %{java_arches}
-%global JAVA 1
-%else
-%global JAVA 0
-%endif
-
 %if 0%{?rhel}
 %global SHARP  0
 %global ARRRR  0
@@ -63,18 +46,6 @@
 %global PHP 0
 %endif
 
-%if %{with guile}
-%global GUILE 1
-%else
-%global GUILE 0
-%endif
-
-%ifarch %{golang_arches}
-%global GOLANG 1
-%else
-%global GOLANG 0
-%endif
-
 # Plugins version
 %global pluginsver 6
 
@@ -93,58 +64,26 @@
 
 Name:			graphviz
 Summary:		Graph Visualization Tools
-Version:		7.1.0
-Release:		2%{?dist}
+Version:		2.44.0
+Release:		14%{?dist}.2
 License:		EPL-1.0
 URL:			http://www.graphviz.org/
 Source0:		https://gitlab.com/%{name}/%{name}/-/archive/%{version}/%{name}-%{version}.tar.bz2
-BuildRequires:		gcc-g++
-BuildRequires:		zlib-devel
-BuildRequires:		libpng-devel
-BuildRequires:		libjpeg-devel
-BuildRequires:		expat-devel
-BuildRequires:		freetype-devel >= 2
-BuildRequires:		ksh
-BuildRequires:		bison
-BuildRequires:		m4
-BuildRequires:		flex
-BuildRequires:		tk-devel
-BuildRequires:		tcl-devel >= 8.3
-BuildRequires:		swig
-BuildRequires:		sed
-BuildRequires:		fontconfig-devel
-BuildRequires:		libtool-ltdl-devel
-BuildRequires:		ruby-devel
-BuildRequires:		ruby
-BuildRequires:		libXt-devel
-BuildRequires:		libXmu-devel
-%if %{GUILE}
-BuildRequires:		guile22-devel
-%endif
+# rhbz#1505230
+Patch0:			graphviz-2.42.2-dotty-menu-fix.patch
+Patch1:			graphviz-2.42.2-coverity-scan-fixes.patch
+# rhbz#1612692, https://gitlab.com/graphviz/graphviz/-/merge_requests/1367
+Patch2:			graphviz-2.44.0-man-fix.patch
+Patch3:			graphviz-2.44.0-CVE-2020-18032.patch
+BuildRequires:		zlib-devel, libpng-devel, libjpeg-devel, expat-devel, freetype-devel >= 2
+BuildRequires:		ksh, bison, m4, flex, tk-devel, tcl-devel >= 8.3, swig, sed
+BuildRequires:		fontconfig-devel, libtool-ltdl-devel, ruby-devel, ruby, guile-devel
 %if %{with python2}
 BuildRequires:		python2-devel
 %endif
-BuildRequires:		python3-devel
-BuildRequires:		libXaw-devel
-BuildRequires:		libSM-devel
-BuildRequires:		libXext-devel
-%if %{JAVA}
-BuildRequires:		java-devel
-%endif
-BuildRequires:		cairo-devel >= 1.1.10
-BuildRequires:		pango-devel
-BuildRequires:		gmp-devel
-BuildRequires:		lua-devel
-%if %{with gtk2}
-BuildRequires:		gtk2-devel
-%endif
-BuildRequires:		gd-devel
-BuildRequires:		perl-devel
-BuildRequires:		swig >= 1.3.33
-BuildRequires:		automake
-BuildRequires:		autoconf
-BuildRequires:		libtool
-BuildRequires:		qpdf
+BuildRequires:		python3-devel, libXaw-devel, libSM-devel, libXext-devel, java-devel
+BuildRequires:		cairo-devel >= 1.1.10, pango-devel, gmp-devel, lua-devel, gtk2-devel
+BuildRequires:		gd-devel, perl-devel, swig >= 1.3.33, automake, autoconf, libtool, qpdf
 # Temporary workaound for perl(Carp) not pulled
 BuildRequires:		perl-Carp
 %if %{PHP}
@@ -171,37 +110,14 @@ BuildRequires:		gts-devel
 %if %{LASI}
 BuildRequires:		lasi-devel
 %endif
-BuildRequires:		urw-base35-fonts
-BuildRequires:		perl-ExtUtils-Embed
-BuildRequires:		perl-generators
-BuildRequires:		librsvg2-devel
+BuildRequires:		urw-base35-fonts, perl-ExtUtils-Embed, perl-generators, librsvg2-devel
 # for ps2pdf
 BuildRequires:		ghostscript
 BuildRequires:		libgs-devel
-BuildRequires:		make
-BuildRequires:		poppler-glib-devel
-BuildRequires:		freeglut-devel
-BuildRequires:		libglade2-devel
-BuildRequires:		gtkglext-devel
-%if %{without bootstrap}
-BuildRequires:		doxygen
-%endif
-%if %{GOLANG}
-BuildRequires:		golang
-%endif
 # ISO8859-1 fonts are required by lefty
-Requires:		urw-base35-fonts
-Requires:		xorg-x11-fonts-ISO8859-1-100dpi
+Requires:		urw-base35-fonts, xorg-x11-fonts-ISO8859-1-100dpi
 Requires(post):		/sbin/ldconfig
 Requires(postun):	/sbin/ldconfig
-# rhbz#1838679
-Patch0:			graphviz-4.0.0-gvpack-neato-static.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=2155048
-Patch1:			graphviz-7.0.6-fix-python-3.12.patch
-
-%if ! %{JAVA}
-Obsoletes:              graphviz-java < %{version}-%{release}
-%endif
 
 %description
 A collection of tools for the manipulation and layout of graphs (as in nodes
@@ -234,14 +150,6 @@ Summary:		PDF and HTML documents for graphviz
 %description doc
 Provides some additional PDF and HTML documentation for graphviz.
 
-%if %{GTS}
-%package smyrna
-Summary:		Graphviz interactive graph viewer
-
-%description smyrna
-Smyrna is a viewer for graphs in the DOT format.
-%endif
-
 %package gd
 Summary:		Graphviz plugin for renderers based on gd
 Requires:		%{name} = %{version}-%{release}
@@ -253,40 +161,25 @@ Graphviz plugin for renderers based on gd.  (Unless you absolutely have to use
 GIF, you are recommended to use the PNG format instead because of the better
 quality anti-aliased lines provided by the cairo+pango based renderer.)
 
-%if %{with gtk2}
-%package gtk2
-Summary:		Graphviz plugin for renderers based on gtk2
-Requires:		%{name} = %{version}-%{release}
-Requires(post):		%{_bindir}/dot /sbin/ldconfig
-Requires(postun):	%{_bindir}/dot /sbin/ldconfig
-
-%description gtk2
-Graphviz plugin for renderers based on gtk2.
-%endif
-
 %package graphs
 Summary:		Demo graphs for graphviz
 
 %description graphs
 Some demo graphs for graphviz.
 
-%if %{GUILE}
 %package guile
 Summary:		Guile extension for graphviz
-Requires:		%{name} = %{version}-%{release}
+Requires:		%{name} = %{version}-%{release}, guile
 
 %description guile
 Guile extension for graphviz.
-%endif
 
-%if %{JAVA}
 %package java
 Summary:		Java extension for graphviz
 Requires:		%{name} = %{version}-%{release}
 
 %description java
 Java extension for graphviz.
-%endif
 
 %package lua
 Summary:		Lua extension for graphviz
@@ -316,6 +209,7 @@ Ocaml extension for graphviz.
 %package perl
 Summary:		Perl extension for graphviz
 Requires:		%{name} = %{version}-%{release}
+Requires:		perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
 
 %description perl
 Perl extension for graphviz.
@@ -390,28 +284,21 @@ Requires:		%{name} = %{version}-%{release}, tcl >= 8.3, tk
 %description tcl
 Various tcl packages (extensions) for the graphviz tools.
 
-%if %{GOLANG}
-%package go
-Summary:		Go extension for graphviz
-Requires:		%{name} = %{version}-%{release}, golang
-
-%description go
-Go extension for graphviz.
-%endif
-
 %prep
-%autosetup -p1
+%setup -q
+%patch0 -p1 -b .dotty-menu-fix
+%patch1 -p1 -b .coverity-scan-fixes
+%patch2 -p1 -b .man-fix
+%patch3 -p1 -b .CVE-2020-18032
 
 # Attempt to fix rpmlint warnings about executable sources
 find -type f -regex '.*\.\(c\|h\)$' -exec chmod a-x {} ';'
 
 %build
 ./autogen.sh
-%if %{JAVA}
 # Hack in the java includes we need
 sed -i '/JavaVM.framework/!s/JAVA_INCLUDES=/JAVA_INCLUDES=\"_MY_JAVA_INCLUDES_\"/g' configure
 sed -i 's|_MY_JAVA_INCLUDES_|-I%{java_home}/include/ -I%{java_home}/include/linux/|g' configure
-%endif
 # Rewrite config_ruby.rb to work with Ruby 2.2
 sed -i 's|expand(|expand(RbConfig::|' config/config_ruby.rb
 sed -i 's|sitearchdir|vendorarchdir|' config/config_ruby.rb
@@ -419,11 +306,8 @@ sed -i 's|sitearchdir|vendorarchdir|' config/config_ruby.rb
 # get the path to search for ruby/config.h to CPPFLAGS, so that configure can find it
 export CPPFLAGS=-I`ruby -e "puts File.join(RbConfig::CONFIG['includedir'], RbConfig::CONFIG['sitearch'])" || echo /dev/null`
 %configure --with-x --disable-static --disable-dependency-tracking \
-%if ! %{JAVA}
---enable-java=no \
-%endif
 	--without-mylibgd --with-ipsepcola --with-pangocairo \
-	--with-gdk-pixbuf --with-visio --disable-silent-rules --enable-lefty \
+	--with-gdk-pixbuf --with-visio --disable-silent-rules \
 %if ! %{LASI}
 	--without-lasi \
 %endif
@@ -446,34 +330,27 @@ export CPPFLAGS=-I`ruby -e "puts File.join(RbConfig::CONFIG['includedir'], RbCon
 	--without-devil \
 %endif
 %if ! %{QTAPPS}
-	--without-qt \
-%endif
-%if %{GUILE}
-	--enable-guile=yes \
-%else
-	--enable-guile=no \
-%endif
-%if %{GOLANG}
-	--enable-go=yes
-%else
-	--enable-go=no
+	--without-qt
 %endif
 
 # drop rpath
 sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
 sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
 
-%make_build CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing -fno-strict-overflow %{?FFSTORE}" \
+make %{?_smp_mflags} CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing -fno-strict-overflow %{?FFSTORE}" \
   CXXFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing -fno-strict-overflow %{?FFSTORE}"
 
-%if %{without bootstrap}
-make doxygen
-%endif
-
 %install
-%make_install docdir=%{_docdir}/%{name} \
-	pkgconfigdir=%{_libdir}/pkgconfig
+make DESTDIR=%{buildroot} \
+	docdir=%{buildroot}%{_docdir}/%{name} \
+	pkgconfigdir=%{_libdir}/pkgconfig \
+	install
 find %{buildroot} -type f -name "*.la" -exec rm -f {} ';'
+chmod -x %{buildroot}%{_datadir}/%{name}/lefty/*
+
+# Move docs to the right place
+mkdir -p %{buildroot}%{_docdir}/%{name}
+mv %{buildroot}%{_datadir}/%{name}/doc/* %{buildroot}%{_docdir}/%{name}
 
 # Install README
 install -m0644 README %{buildroot}%{_docdir}/%{name}
@@ -500,8 +377,8 @@ find %{buildroot}%{_docdir}/%{name}/demo -type f -name "*.py" -exec mv {} {}.dem
 rm -f %{buildroot}%{_bindir}/dot_builtins
 
 # Remove metadata from generated PDFs
-pushd %{buildroot}%{_docdir}/%{name}
-for f in prune gvgen.1 gc.1 dot.1 cluster.1
+pushd %{buildroot}%{_docdir}/%{name}/pdf
+for f in prune lneato.1 lefty.1 gvgen.1 gc.1 dotty.1 dot.1 cluster.1
 do
   if [ -f $f.pdf ]
   then
@@ -530,11 +407,6 @@ if [ "%{_prefix}" != "/usr" ]; then
   rm -rf %{buildroot}/usr/*
 fi
 
-# Explicitly create examples directory to always have it.
-# At the moment there are only examples dependant on smyrna. I.e. if smyrna is not
-# built this directory is empty.
-mkdir -p %{buildroot}%{_datadir}/%{name}/examples
-
 %check
 %if %{PHP}
 # Minimal load test of php extension
@@ -576,16 +448,6 @@ php --no-php-ini \
 %{_bindir}/dot -c 2>/dev/null || :
 %{?ldconfig}
 
-%if %{with gtk2}
-%post gtk2
-%{_bindir}/dot -c 2>/dev/null || :
-%{?ldconfig}
-
-%postun gtk2
-%{_bindir}/dot -c 2>/dev/null || :
-%{?ldconfig}
-%endif
-
 %if %{MING}
 # run "dot -c" to generate plugin config in %%{_libdir}/graphviz/config*
 %post ming
@@ -599,32 +461,26 @@ php --no-php-ini \
 
 %files
 %doc %{_docdir}/%{name}
-%if %{GTS}
-%exclude %{_bindir}/smyrna
-%exclude %{_mandir}/man1/smyrna.1*
-%endif
 %{_bindir}/*
 %dir %{_libdir}/graphviz
 %{_libdir}/*.so.*
 %{_libdir}/graphviz/*.so.*
 %{_mandir}/man1/*.1*
 %{_mandir}/man7/*.7*
-%dir %{_datadir}/%{name}
-%exclude %{_docdir}/%{name}/*.html
-%exclude %{_docdir}/%{name}/*.pdf
+%dir %{_datadir}/graphviz
+%exclude %{_docdir}/%{name}/html
+%exclude %{_docdir}/%{name}/pdf
 %exclude %{_docdir}/%{name}/demo
-%{_datadir}/%{name}/gvpr
-%{_datadir}/%{name}/examples
-%ghost %{_libdir}/%{name}/config%{pluginsver}
+%{_datadir}/graphviz/lefty
+%{_datadir}/graphviz/gvpr
+%ghost %{_libdir}/graphviz/config%{pluginsver}
 
 %if %{QTAPPS}
-%{_datadir}/%{name}/gvedit
+%{_datadir}/graphviz/gvedit
 %endif
 
 %exclude %{_libdir}/graphviz/*/*
 %exclude %{_libdir}/graphviz/libgvplugin_gd.*
-%exclude %{_libdir}/graphviz/libgvplugin_gtk.*
-%exclude %{_libdir}/graphviz/libgvplugin_gdk.*
 %if %{DEVIL}
 %exclude %{_libdir}/graphviz/libgvplugin_devil.*
 %endif
@@ -646,41 +502,24 @@ php --no-php-ini \
 %endif
 
 %files doc
-%doc %{_docdir}/%{name}/*.html
-%doc %{_docdir}/%{name}/*.pdf
+%doc %{_docdir}/%{name}/html
+%doc %{_docdir}/%{name}/pdf
 %doc %{_docdir}/%{name}/demo
 
-%if %{GTS}
-%files smyrna
-%{_bindir}/smyrna
-%{_datadir}/%{name}/smyrna
-%{_mandir}/man1/smyrna.1*
-%endif
-
 %files gd
 %{_libdir}/graphviz/libgvplugin_gd.so.*
 
-%if %{with gtk2}
-%files gtk2
-%{_libdir}/graphviz/libgvplugin_gtk.so.*
-%{_libdir}/graphviz/libgvplugin_gdk.so.*
-%endif
-
 %files graphs
 %dir %{_datadir}/graphviz
 %{_datadir}/graphviz/graphs
 
-%if %{GUILE}
 %files guile
 %{_libdir}/graphviz/guile/
 %{_mandir}/man3/gv.3guile*
-%endif
 
-%if %{JAVA}
 %files java
 %{_libdir}/graphviz/java/
 %{_mandir}/man3/gv.3java*
-%endif
 
 %files lua
 %{_libdir}/graphviz/lua/
@@ -747,273 +586,14 @@ php --no-php-ini \
 #  always includes tcldot.3tcl, gdtclft.3tcl
 %{_mandir}/man3/*.3tcl*
 
-%if %{GOLANG}
-%files go
-%{_libdir}/graphviz/go/
-%{_mandir}/man3/gv.3go.*
-%endif
-
 %changelog
-* Tue Jan 24 2023 Jaroslav Škarvada <jskarvad@redhat.com> - 7.1.0-2
-- Release bump to handle gs update
+* Wed May 26 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.44.0-14.2
+- Fixed buffer overflow in lib/common/shapes.c
+  Resolves: CVE-2020-18032
+  Resolves: rhbz#1963395
 
-* Tue Jan 24 2023 Jaroslav Škarvada <jskarvad@redhat.com> - 7.1.0-1
-- New version
-  Resolves: rhbz#2162906
-
-* Tue Jan 24 2023 Richard W.M. Jones <rjones@redhat.com> - 7.0.6-4
-- Rebuild OCaml packages for F38
-
-* Mon Jan 23 2023 Zdenek Dohnal <zdohnal@redhat.com> - 7.0.6-3
-- add %%bcond_with bootstrap to break circular dependency with doxygen if needed
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 7.0.6-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Thu Jan 12 2023 Jaroslav Škarvada <jskarvad@redhat.com> - 7.0.6-1
-- New version
-  Resovles: rhbz#2158703
-
-* Fri Jan 06 2023 Tomas Popela <tpopela@redhat.com> - 7.0.5-3
-- Don't build GTK 2 bits on ELN/RHEL 10 as GTK 2 won't be available there
-
-* Wed Jan 04 2023 Mamoru TASAKA <mtasaka@fedoraproject.org> - 7.0.5-2
-- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.2
-
-* Thu Dec 29 2022 Tom Callaway <spot@fedoraproject.org> - 7.0.5-1
-- update to 7.0.5
-- patch out distutils usage to build with Python 3.12
-
-* Thu Dec 15 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 7.0.4-1
-- New version
-  Resolves: rhbz#2150535
-
-* Thu Dec  1 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 7.0.3-1
-- New version
-  Resolves: rhbz#2148597
-
-* Mon Nov 21 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 7.0.2-1
-- New version
-  Resolves: rhbz#2144128
-
-* Mon Nov 14 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 7.0.1-1
-- New version
-  Resolves: rhbz#2141409
-
-* Tue Nov  1 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 7.0.0-2
-- Temporally drop PHP support due to graphviz issue #2277
-  Resolves: rhbz#2137832
-
-* Mon Oct 24 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 7.0.0-1
-- New version
-  Resolves: rhbz#2137071
-
-* Fri Oct 14 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 6.0.2-3
-- More fixes for conditional build of smyrna
-
-* Fri Oct 14 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 6.0.2-2
-- Made smyrna dependant on GTS
-
-* Thu Oct 13 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 6.0.2-1
-- New version
-  Resolves: rhbz#2133932
-
-* Wed Oct 05 2022 Remi Collet <remi@remirepo.net> - 6.0.1-2
-- rebuild for https://fedoraproject.org/wiki/Changes/php82
-
-* Thu Sep 22 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 6.0.1-1
-- New version
-  Resolves: rhbz#2125817
-
-* Tue Aug 23 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 5.0.1-1
-- New version
-  Resolves: rhbz#2119990
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5.0.0-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Tue Jul 19 2022 Maxwell G <gotmax@e.email> - 5.0.0-3
-- Only build go subpackage on %%golang_arches (i.e. the architectures where
-  golang is available).
-
-* Fri Jul 15 2022 Jiri Vanek <jvanek@redhat.com> - 5.0.0-2
-- adapted to removal of java on i686
-- finsihing merged https://src.fedoraproject.org/rpms/graphviz/pull-request/9#request_diff
-- ifed out on i686 recomanded rm -v...
-- set --enable-java=no for non java arches
-- added changelog entry, bumped release
-- https://bugzilla.redhat.com/show_bug.cgi?id=2104225
-
-* Tue Jul 12 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 5.0.0-1
-- New version
-  Resolves: rhbz#2105006
-
-* Sun Jul 10 2022 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 4.0.0-9
-- Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191,
-  CVE-2022-29526, CVE-2022-30629
-
-* Mon Jun 20 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 4.0.0-8
-- Rebuilt for ocaml
-  Resolves: rhbz#2098719
-
-* Sun Jun 19 2022 Python Maint <python-maint@redhat.com> - 4.0.0-7
-- Rebuilt for Python 3.11
-
-* Sun Jun 19 2022 Robert-André Mauchin <zebob.m@gmail.com> - 4.0.0-6
-- Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191,
-  CVE-2022-29526, CVE-2022-30629
-
-* Sat Jun 18 2022 Richard W.M. Jones <rjones@redhat.com> - 4.0.0-5
-- OCaml 4.14.0 rebuild
-
-* Sat Jun 18 2022 Robert-André Mauchin <zebob.m@gmail.com> - 4.0.0-4
-- Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191,
-  CVE-2022-29526, CVE-2022-30629
-
-* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 4.0.0-3
-- Rebuilt for Python 3.11
-
-* Thu Jun  9 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 4.0.0-2
-- Used lm fix patch from upstream
-
-* Mon Jun  6 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 4.0.0-1
-- New version
-  Resolves: rhbz#2091383
-
-* Wed Jun 01 2022 Jitka Plesnikova <jplesnik@redhat.com> - 3.0.0-2
-- Perl 5.36 rebuild
-
-* Wed Mar  2 2022 Jaroslav Škarvada <jskarvad@redhat.com> - 3.0.0-1
-- New version
-  Resolves: rhbz#2058892
-
-* Sat Feb 05 2022 Jiri Vanek <jvanek@redhat.com> - 2.50.0-6
-- Rebuilt for java-17-openjdk as system jdk
-
-* Fri Feb 04 2022 Richard W.M. Jones <rjones@redhat.com> - 2.50.0-5
-- OCaml 4.13.1 rebuild to remove package notes
-
-* Wed Jan 26 2022 Vít Ondruch <vondruch@redhat.com> - 2.50.0-4
-- Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_3.1
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.50.0-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Wed Dec 15 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.50.0-2
-- GTK2 stuff Split to the gtk2 subpackage
-  Resolves: rhbz#2032671
-
-* Mon Dec  6 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.50.0-1
-- New version
-  Resolves: rhbz#2029089
-
-* Tue Nov 23 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.49.3-3
-- Fixed gvpack to run
-  Resolves: rhbz#1838679
-
-* Thu Oct 28 2021 Remi Collet <remi@remirepo.net> - 2.49.3-2
-- rebuild for https://fedoraproject.org/wiki/Changes/php81
-
-* Mon Oct 25 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.49.3-1
-- New version
-  Resolves: rhbz#2016728
-
-* Mon Oct 18 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.49.2-1
-- New version
-  Resolves: rhbz#2014784
-
-* Wed Oct 06 2021 Richard W.M. Jones <rjones@redhat.com> - 2.49.1-2
-- Rebuild for OCaml 4.13.1
-
-* Tue Oct  5 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.49.1-1
-- New version
-  Resolves: rhbz#2007059
-
-* Mon Oct 04 2021 Richard W.M. Jones <rjones@redhat.com> - 2.49.0-3
-- OCaml 4.13.1 build
-
-* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.49.0-2
-- Rebuilt with OpenSSL 3.0.0
-
-* Mon Sep  6 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.49.0-1
-- New version
-  Resolves: rhbz#1998765
-
-* Fri Jul 23 2021 Aleksei Bavshin <alebastr@fedoraproject.org> - 2.48.0-3
-- Dropped unused runtime dependency from guile 2.0
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.48.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Mon Jul 19 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.48.0-1
-- New version
-  Resolves: rhbz#1983328
-
-* Tue Jun 22 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.47.3-1
-- New version
-  Resolves: rhbz#1973976
-
-* Tue Jun  8 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.47.2-3
-- Fixed possible races during docs build which could lead to empty pdf files
-
-* Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 2.47.2-2
-- Rebuilt for Python 3.10
-
-* Thu May 27 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.47.2-1
-- New version
-  Resolves: rhbz#1965146
-
-* Sun May 23 2021 Jitka Plesnikova <jplesnik@redhat.com> - 2.47.1-5
-- Perl 5.34 rebuild
-
-* Wed May 12 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.47.1-4
-- Dropped unneeded tmsize10.clo file
-
-* Fri May  7 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.47.1-3
-- Added build requirement for gcc-g++
-
-* Fri May  7 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.47.1-2
-- Conditionalized guile support
-- Updated RHEL macros
-
-* Mon Apr 19 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.47.1-1
-- New version
-  Resolves: rhbz#1950691
-
-* Tue Mar 23 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.47.0-2
-- Re-enabled PHP support
-  Resolves: rhbz#1934996
-
-* Tue Mar 16 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.47.0-1
-- New version
-  Resolves: rhbz#1939299
-
-* Mon Mar  8 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.46.1-3
-- Temporary disabled PHP support
-  Resolves: rhbz#1935859
-
-* Thu Mar  4 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.46.1-2
-- Built against guile22
-
-* Wed Mar  3 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.46.1-1
-- New version
-  Related: rhbz#1933722
-
-* Tue Mar  2 2021 Jaroslav Škarvada <jskarvad@redhat.com> - 2.46.0-1
-- New version
-  Resolves: rhbz#1933722
-
-* Mon Mar  1 13:11:59 GMT 2021 Richard W.M. Jones <rjones@redhat.com> - 2.44.0-18
-- OCaml 4.12.0 build
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.44.0-17
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Thu Jan 07 2021 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.44.0-16
-- F-34: rebuild against ruby 3.0
-
-* Wed Nov 25 2020 Miro Hrončok <mhroncok@redhat.com> - 2.44.0-15
-- Disable Python 2 in ELN
+* Wed Sep 02 2020 Richard W.M. Jones <rjones@redhat.com> - 2.44.0-14.1
+- Bump release and rebuild.
 
 * Tue Sep 01 2020 Richard W.M. Jones <rjones@redhat.com> - 2.44.0-14
 - OCaml 4.11.1 rebuild

sources

@@ -1 +1 @@
-SHA512 (graphviz-7.1.0.tar.bz2) = 28b3217153cbe96270b25862aa030269128653b011cf9eb6607fe9d061aa9db85f9b2454d9fde70be5af4f98474f8cac61040584ce164723df6ceb372cfb29ad
+SHA512 (graphviz-2.44.0.tar.bz2) = 2b6bfe66c92cade55ce394cf1fd22afe8bcc8681196059afdb0711173702862ea3154ef20e06ecc9f10fde1706534e44dd95e89960214eb8df9262fd7cad1fe0