On Thu, Sep 15, 2016 at 4:20 PM, Josh Boyer <jwboyer(a)fedoraproject.org> wrote:
On Thu, Sep 15, 2016 at 3:42 AM, Dan HorĂ¡k <dan(a)danny.cz>
wrote:
> On Wed, 14 Sep 2016 20:50:49 +0100
> Richard Hughes <hughsient(a)gmail.com> wrote:
>
>> Can we get somebody to revert
>>
https://bodhi.fedoraproject.org/updates/FEDORA-2016-7776983633 please.
>> The update was built to fix CVE-2015-5203 which fixes a double free
>> when opening corrupt JPEG-2000 files but in doing-so breaks quite a
>> few apps in the desktop spin causing them to exit with an assert deep
>> in libjasper.
>>
>> In the update the function jas_stream_memopen has been changed:
>>
>> -jas_stream_t *jas_stream_memopen(char *buf, int bufsize);
>> +jas_stream_t *jas_stream_memopen(char *buf, size_t bufsize);
>>
>> Unless I'm misunderstood things dramatically, size_t is basically
>> *unsigned* long integer, but this function offers a feature where if
>> the bufsize is -1 the buffer is realloc'd as needed. gdk-pixbuf2 uses
>> this feature for JPEG-2000 files. However, as size_t represents only
>> positive numbers, a conversion takes place to some very high number
>> and the allocation fails.
>
> one more case for enabling libabigail tests in bodhi ...
I agree. This would have been caught by libabigail/abicheck as far as I know.
Yes, see my previous comment for more detail.
Does anyone know what the blockers are for enabling it in production?
Right now abichecks already run in production on set of packages which are
listed in critpath[1] and can be viewed [2] or subscribed[3] to. For initial
phase, it has been kept as informational and no packages get blocked if
incompatible ABI changes found. There is already ticket [4] for
enabling abicheck
on all c/c++ package updates which I believe will be worked on soon.
[1]
https://admin.fedoraproject.org/pkgdb/api/critpath
[2]
https://taskotron.fedoraproject.org/resultsdb/results?testcase_name=dist....
[3]
https://apps.fedoraproject.org/notifications/
[4]
https://phab.qadevel.cloud.fedoraproject.org/T823