[graphviz] Fixed format string vulnerability
Jaroslav Škarvada
jskarvad at fedoraproject.org
Tue Nov 25 16:49:44 UTC 2014
commit 1fe8c8315847c87d4c45ef9890ddce045effd715
Author: Jaroslav Škarvada <jskarvad at redhat.com>
Date: Tue Nov 25 17:49:39 2014 +0100
Fixed format string vulnerability
Resolves: rhbz#1167868
graphviz-2.38.0-format-string.patch | 13 +++++++++++++
graphviz.spec | 11 +++++++++--
2 files changed, 22 insertions(+), 2 deletions(-)
---
diff --git a/graphviz-2.38.0-format-string.patch b/graphviz-2.38.0-format-string.patch
new file mode 100644
index 0000000..24a9b9c
--- /dev/null
+++ b/graphviz-2.38.0-format-string.patch
@@ -0,0 +1,13 @@
+diff --git a/lib/cgraph/scan.l b/lib/cgraph/scan.l
+index 87db5d4..4edda50 100644
+--- a/lib/cgraph/scan.l
++++ b/lib/cgraph/scan.l
+@@ -225,7 +225,7 @@ void yyerror(char *str)
+ agxbput (&xb, buf);
+ agxbput (&xb, yytext);
+ agxbput (&xb,"'\n");
+- agerr(AGERR,agxbuse(&xb));
++ agerr(AGERR, "%s", agxbuse(&xb));
+ agxbfree(&xb);
+ }
+ /* must be here to see flex's macro defns */
diff --git a/graphviz.spec b/graphviz.spec
index b0b36de..b17dd92 100644
--- a/graphviz.spec
+++ b/graphviz.spec
@@ -47,7 +47,7 @@
Name: graphviz
Summary: Graph Visualization Tools
Version: 2.38.0
-Release: 16%{?dist}
+Release: 17%{?dist}
Group: Applications/Multimedia
License: EPL
URL: http://www.graphviz.org/
@@ -56,7 +56,9 @@ Source0: http://www.graphviz.org/pub/graphviz/ARCHIVE/%{name}-%{version}.tar.gz
Patch0: graphviz-2.38.0-rtest-fix.patch
Patch1: graphviz-2.38.0-find-fix.patch
# Not upstream patch to fix build with OCaml > 4.02.0 (upstream) and Fedora.
-Patch2: graphviz-2.38.0-ocaml-fix-ints.patch
+Patch2: graphviz-2.38.0-ocaml-fix-ints.patch
+# Backported from upstream
+Patch3: graphviz-2.38.0-format-string.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildRequires: zlib-devel, libpng-devel, libjpeg-devel, expat-devel, freetype-devel >= 2
BuildRequires: ksh, bison, m4, flex, tk-devel, tcl-devel >= 8.3, swig
@@ -263,6 +265,7 @@ Various tcl packages (extensions) for the graphviz tools.
%patch0 -p1 -b .rtest-fix
%patch1 -p1 -b .find-fix
%patch2 -p1
+%patch3 -p1 -b .format-string
# Attempt to fix rpmlint warnings about executable sources
find -type f -regex '.*\.\(c\|h\)$' -exec chmod a-x {} ';'
@@ -552,6 +555,10 @@ rm -rf %{buildroot}
%changelog
+* Tue Nov 25 2014 Jaroslav Škarvada <jskarvad at redhat.com> - 2.38.0-17
+- Fixed format string vulnerability
+ Resolves: rhbz#1167868
+
* Tue Nov 11 2014 Jaroslav Škarvada <jskarvad at redhat.com> - 2.38.0-16
- Added ISO8859-1 fonts as requirement
Resolves: rhbz#1058323
More information about the scm-commits
mailing list