diff --git a/CVE-2019-3817-Fix-UAF-in-comps_objmrtree_unite-function.patch b/CVE-2019-3817-Fix-UAF-in-comps_objmrtree_unite-function.patch deleted file mode 100644 index 5c10c2eafddf6739e13b13a5640e76aaf453e1d9..0000000000000000000000000000000000000000 --- a/CVE-2019-3817-Fix-UAF-in-comps_objmrtree_unite-function.patch +++ /dev/null @@ -1,91 +0,0 @@ -From e3a5d056633677959ad924a51758876d415e7046 Mon Sep 17 00:00:00 2001 -From: Riccardo Schirone -Date: Mon, 21 Jan 2019 18:11:42 +0100 -Subject: [PATCH] Fix UAF in comps_objmrtree_unite function - -The added field is not used at all in many places and it is probably the -left-over of some copy-paste. - -Signed-off-by: root ---- - libcomps/src/comps_mradix.c | 2 -- - libcomps/src/comps_objmradix.c | 2 -- - libcomps/src/comps_objradix.c | 2 -- - libcomps/src/comps_radix.c | 1 - - 4 files changed, 7 deletions(-) - -diff --git a/libcomps/src/comps_mradix.c b/libcomps/src/comps_mradix.c -index 8ef9640..dfdee8e 100644 ---- a/libcomps/src/comps_mradix.c -+++ b/libcomps/src/comps_mradix.c -@@ -177,7 +177,6 @@ void comps_mrtree_unite(COMPS_MRTree *rt1, COMPS_MRTree *rt2) { - struct Pair { - COMPS_HSList * subnodes; - char * key; -- char added; - } *pair, *parent_pair; - - pair = malloc(sizeof(struct Pair)); -@@ -195,7 +194,6 @@ void comps_mrtree_unite(COMPS_MRTree *rt1, COMPS_MRTree *rt2) { - parent_pair = (struct Pair*) it->data; - free(it); - -- pair->added = 0; - for (it = tmp_subnodes->first; it != NULL; it=it->next) { - pair = malloc(sizeof(struct Pair)); - pair->subnodes = ((COMPS_MRTreeData*)it->data)->subnodes; -diff --git a/libcomps/src/comps_objmradix.c b/libcomps/src/comps_objmradix.c -index 9a2038b..22ad262 100644 ---- a/libcomps/src/comps_objmradix.c -+++ b/libcomps/src/comps_objmradix.c -@@ -285,7 +285,6 @@ void comps_objmrtree_unite(COMPS_ObjMRTree *rt1, COMPS_ObjMRTree *rt2) { - struct Pair { - COMPS_HSList * subnodes; - char * key; -- char added; - } *pair, *parent_pair; - - pair = malloc(sizeof(struct Pair)); -@@ -303,7 +302,6 @@ void comps_objmrtree_unite(COMPS_ObjMRTree *rt1, COMPS_ObjMRTree *rt2) { - parent_pair = (struct Pair*) it->data; - free(it); - -- pair->added = 0; - for (it = tmp_subnodes->first; it != NULL; it=it->next) { - pair = malloc(sizeof(struct Pair)); - pair->subnodes = ((COMPS_ObjMRTreeData*)it->data)->subnodes; -diff --git a/libcomps/src/comps_objradix.c b/libcomps/src/comps_objradix.c -index c657b75..840592a 100644 ---- a/libcomps/src/comps_objradix.c -+++ b/libcomps/src/comps_objradix.c -@@ -692,7 +692,6 @@ void comps_objrtree_unite(COMPS_ObjRTree *rt1, COMPS_ObjRTree *rt2) { - struct Pair { - COMPS_HSList * subnodes; - char * key; -- char added; - } *pair, *parent_pair; - - pair = malloc(sizeof(struct Pair)); -@@ -711,7 +711,6 @@ void comps_objrtree_unite(COMPS_ObjRTree *rt1, COMPS_ObjRTree *rt2) { - //printf("key-part:%s\n", parent_pair->key); - free(it); - -- //pair->added = 0; - for (it = tmp_subnodes->first; it != NULL; it=it->next) { - pair = malloc(sizeof(struct Pair)); - pair->subnodes = ((COMPS_ObjRTreeData*)it->data)->subnodes; -diff --git a/libcomps/src/comps_radix.c b/libcomps/src/comps_radix.c -index ada4fda..05dcaf2 100644 ---- a/libcomps/src/comps_radix.c -+++ b/libcomps/src/comps_radix.c -@@ -529,7 +529,6 @@ void comps_rtree_unite(COMPS_RTree *rt1, COMPS_RTree *rt2) { - struct Pair { - COMPS_HSList * subnodes; - char * key; -- char added; - } *pair, *parent_pair; - - pair = malloc(sizeof(struct Pair)); --- -2.19.1 - diff --git a/libcomps-0.1.8.tar.gz b/libcomps-0.1.10.tar.gz similarity index 38% rename from libcomps-0.1.8.tar.gz rename to libcomps-0.1.10.tar.gz index e8b73d4a384bd125fcce9525e32d28266e3c5ba5..8e3d74dd12efbfd737ffe868e41dab5a2170cbd3 100644 Binary files a/libcomps-0.1.8.tar.gz and b/libcomps-0.1.10.tar.gz differ diff --git a/libcomps.spec b/libcomps.spec index 8eda3fb8257dadca1fd7f7ed3e23aaf0ea5c70df..241508c566fcfc2b1bfc63d75fddc3a0eddd98b4 100644 --- a/libcomps.spec +++ b/libcomps.spec @@ -2,16 +2,15 @@ %define with_python3 1 Name: libcomps -Version: 0.1.8 -Release: 20 +Version: 0.1.10 +Release: 1 Summary: Comps XML file manipulation library License: GPLv2+ URL: https://github.com/rpm-software-management/libcomps Source0: %{url}/archive/%{name}-%{version}/%{name}-%{version}.tar.gz -Patch6000: CVE-2019-3817-Fix-UAF-in-comps_objmrtree_unite-function.patch - BuildRequires: gcc cmake zlib-devel libxml2-devel check-devel expat-devel +Provides: libcomps.so.0.1.6()(64bit) %description Libcomps is library for structure-like manipulation with content of @@ -136,6 +135,12 @@ popd %endif %changelog +* Sat Aug 1 2020 zhangguangzhi - 0.1.10-1 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:Update to version 0.1.10 + * Thu Feb 20 2020 chengquan - 0.1.8-20 - Type:enhancement - ID:NA diff --git a/libcomps.yaml b/libcomps.yaml new file mode 100644 index 0000000000000000000000000000000000000000..6c406cb63431367bcd4bb9599ecce07310fb76e6 --- /dev/null +++ b/libcomps.yaml @@ -0,0 +1,4 @@ +version_control: git +src_repo: https://github.com/rpm-software-management/libcomps +tag_prefix: ^libcomps- +seperator: "."