开源软件构建与测试

_service:tar_scm:sane-backends.spec Changed

@@ -2,8 +2,8 @@
 %global __requires_exclude ^libsane-.*\.so\.0-9*(.*)?+$
 
 Name:              sane-backends
-Version:           1.0.28
-Release:           11
+Version:           1.2.1
+Release:           1
 Summary:           Scanner access software
 License:           GPLv2+ and GPLv2+ and Public Domain and IJG and LGPLv2+ and MIT
 URL:               http://www.sane-project.org
@@ -18,15 +18,8 @@
 Requires:          sane-backends-libs = %{version}-%{release}
 
 
-Patch0000:         0001-genesys-Make-sure-calib_reg-are-available-before-wri.patch
-Patch0001:         sane-xerox-mfp-blacklist-C460-for-JPEG.patch
-Patch0002:         sane-genesys-vector-glibcxxassert.patch
-Patch0003:         CVE-2020-12861-CVE-2020-12866-CVE-2020-12864.patch
-Patch0004:         CVE-2020-12867.patch
-Patch0005:         Add-check-for-ports-to-avoid-Segmentation-fault.patch
-Patch0006:         CVE-2020-12862.patch
-Patch0007:         CVE-2020-12865.patch
-Patch0008:	   CVE-2020-12863.patch
+Patch0000:         CVE-2020-12861-CVE-2020-12866-CVE-2020-12864.patch
+Patch0001:         Add-check-for-ports-to-avoid-Segmentation-fault.patch
 
 %description
 SANE (Scanner Access Now Easy) is a sane and simple interface to both local and networked scanners
@@ -209,6 +202,9 @@
 %{_unitdir}/*
 
 %changelog
+* Sat Oct 07 2023 wulei <wu_lei@hoperun.com> - 1.2.1-1
+- Update to 1.2.1
+
 * Sat Oct 09 2021 houyingchao <houyingchao@huawei.com> - 1.0.28-11
 - Fix CVE-2020-12863

_service:tar_scm:0001-genesys-Make-sure-calib_reg-are-available-before-wri.patch Deleted

_service:tar_scm:CVE-2020-12861-CVE-2020-12866-CVE-2020-12864.patch Changed

_service:tar_scm:CVE-2020-12862.patch Deleted

@@ -1,75 +0,0 @@
-From 27ea994d23ee52fe1ec1249c92ebc1080a358288 Mon Sep 17 00:00:00 2001
-From: Olaf Meeuwissen <paddy-hack@member.fsf.org>
-Date: Thu, 30 Apr 2020 21:15:45 +0900
-Subject: PATCH epsonds: Do not read beyond the end of the token
-
-Addresses GHSL-2020-082, re #279.
----
- backend/epsonds-cmd.c | 14 ++++++++------
- 1 file changed, 8 insertions(+), 6 deletions(-)
-
-diff --git a/backend/epsonds-cmd.c b/backend/epsonds-cmd.c
-index 9a4db3080..7ca660f1f 100644
---- a/backend/epsonds-cmd.c
-+++ b/backend/epsonds-cmd.c
-@@ -255,18 +255,20 @@ static int decode_value(char *buf, int len)
- }
- 
- /* h000 */
--static char *decode_binary(char *buf)
-+static char *decode_binary(char *buf, int len)
- {
- 	char tmp6;
- 	int hl;
- 
- 	memcpy(tmp, buf, 4);
- 	tmp4 = '\0';
-+	len -= 4;
- 
- 	if (buf0 != 'h')
- 		return NULL;
- 
- 	hl = strtol(tmp + 1, NULL, 16);
-+	if (hl > len) hl = len;
- 	if (hl) {
- 
- 		char *v = malloc(hl + 1);
-@@ -279,9 +281,9 @@ static char *decode_binary(char *buf)
- 	return NULL;
- }
- 
--static char *decode_string(char *buf)
-+static char *decode_string(char *buf, int len)
- {
--	char *p, *s = decode_binary(buf);
-+	char *p, *s = decode_binary(buf, len);
- 	if (s == NULL)
- 		return NULL;
- 
-@@ -326,20 +328,20 @@ static SANE_Status info_cb(void *userdata, char *token, int len)
- 
- 	if (strncmp("PRD", token, 3) == 0) {
- 		free(s->hw->model);
--		s->hw->model = decode_string(value);
-+		s->hw->model = decode_string(value, len);
- 		s->hw->sane.model = s->hw->model;
- 		DBG(1, " product: %s\n", s->hw->model);
- 		/* we will free the string later */
- 	}
- 
- 	if (strncmp("VER", token, 3) == 0) {
--		char *v = decode_string(value);
-+		char *v = decode_string(value, len);
- 		DBG(1, " version: %s\n", v);
- 		free(v);
- 	}
- 
- 	if (strncmp("S/N", token, 3) == 0) {
--		char *v = decode_string(value);
-+		char *v = decode_string(value, len);
- 		DBG(1, "  serial: %s\n", v);
- 		free(v);
- 	}
--- 
-GitLab
-

_service:tar_scm:CVE-2020-12863.patch Deleted

_service:tar_scm:CVE-2020-12865.patch Deleted

@@ -1,72 +0,0 @@
-From b9b0173409df73e235da2aa0dae5edd21fb55967 Mon Sep 17 00:00:00 2001
-From: Olaf Meeuwissen <paddy-hack@member.fsf.org>
-Date: Mon, 27 Apr 2020 18:48:29 +0900
-Subject: PATCH epsonds: Prevent possible buffer overflow when reading image
- data
-
-Addresses GHSL-2020-084, re #279.
----
- backend/epsonds-cmd.c |  5 +++++
- backend/epsonds.c     | 12 +++++++-----
- backend/epsonds.h     |  1 +
- 3 files changed, 13 insertions(+), 5 deletions(-)
-
-diff --git a/backend/epsonds-cmd.c b/backend/epsonds-cmd.c
-index 9a4db3080..c182aa51a 100644
---- a/backend/epsonds-cmd.c
-+++ b/backend/epsonds-cmd.c
-@@ -876,6 +876,11 @@ esci2_img(struct epsonds_scanner *s, SANE_Int *length)
- 		return parse_status;
- 	}
- 
-+	/* more data than was accounted for in s->buf */
-+	if (more > s->bsz) {
-+		return SANE_STATUS_IO_ERROR;
-+	}
-+
- 	/* ALWAYS read image data */
- 	if (s->hw->connection == SANE_EPSONDS_NET) {
- 		epsonds_net_request_read(s, more);
-diff --git a/backend/epsonds.c b/backend/epsonds.c
-index ff5d68106..fb9694a88 100644
---- a/backend/epsonds.c
-+++ b/backend/epsonds.c
-@@ -1230,16 +1230,18 @@ sane_start(SANE_Handle handle)
- 	if (s->line_buffer == NULL)
- 		return SANE_STATUS_NO_MEM;
- 
--	/* ring buffer for front page, twice bsz */
-+	/* transfer buffer size, bsz */
- 	/* XXX read value from scanner */
--	status = eds_ring_init(&s->front, (65536 * 4) * 2);
-+	s->bsz = (65536 * 4);
-+
-+	/* ring buffer for front page */
-+	status = eds_ring_init(&s->front, s->bsz * 2);
- 	if (status != SANE_STATUS_GOOD) {
- 		return status;
- 	}
- 
--	/* transfer buffer, bsz */
--	/* XXX read value from scanner */
--	s->buf = realloc(s->buf, 65536 * 4);
-+	/* transfer buffer */
-+	s->buf = realloc(s->buf, s->bsz);
- 	if (s->buf == NULL)
- 		return SANE_STATUS_NO_MEM;
- 
-diff --git a/backend/epsonds.h b/backend/epsonds.h
-index 0427ef3b4..401b0f32c 100644
---- a/backend/epsonds.h
-+++ b/backend/epsonds.h
-@@ -160,6 +160,7 @@ struct epsonds_scanner
- 	Option_Value valNUM_OPTIONS;
- 	SANE_Parameters params;
- 
-+	size_t bsz;		/* transfer buffer size */
- 	SANE_Byte *buf, *line_buffer;
- 	ring_buffer *current, front, back;
- 
--- 
-GitLab
-

_service:tar_scm:CVE-2020-12867.patch Deleted

@@ -1,249 +0,0 @@
-From fff83e7eacd0f27bb2d71c42488e0fd735c15ac3 Mon Sep 17 00:00:00 2001
-From: Olaf Meeuwissen <paddy-hack@member.fsf.org>
-Date: Thu, 30 Apr 2020 18:24:51 +0900
-Subject: PATCH epson2: Rewrite network I/O
-
-This addresses GHSL-2020-075 as well as all other problematic code
-uncovered as a result of investigating that.  This includes:
-
-- buffer overflows due to use of unchecked lengths
-- integer overflows due to type conversions
-- potential memory leaks
-- checking for memory allocation failures
-
-Re #279.
----
- backend/epson2_net.c | 140 +++++++++++++++++++++++++------------------
- backend/epson2_net.h |   4 +-
- 2 files changed, 85 insertions(+), 59 deletions(-)
-
-diff --git a/backend/epson2_net.c b/backend/epson2_net.c
-index 8d0fe9ea7..7f804eea8 100644
---- a/backend/epson2_net.c
-+++ b/backend/epson2_net.c
-@@ -32,11 +32,12 @@
- 
- #include "sane/sanei_debug.h"
- 
--static int
-+static ssize_t
- sanei_epson_net_read_raw(Epson_Scanner *s, unsigned char *buf, ssize_t wanted,
- 		       SANE_Status *status)
- {
--	int ready, read = -1;
-+	int ready;
-+	ssize_t read = -1;
- 	fd_set readable;
- 	struct timeval tv;
- 
-@@ -62,111 +63,136 @@ sanei_epson_net_read_raw(Epson_Scanner *s, unsigned char *buf, ssize_t wanted,
- 	return read;
- }
- 
--int
--sanei_epson_net_read(Epson_Scanner *s, unsigned char *buf, ssize_t wanted,
-+static ssize_t
-+sanei_epson_net_read_buf(Epson_Scanner *s, unsigned char *buf, ssize_t wanted,
- 		       SANE_Status * status)
- {
--	ssize_t size;
- 	ssize_t read = 0;
--	unsigned char header12;
- 
--	/* read from buffer, if available */
--	if (s->netptr != s->netbuf) {
--		DBG(23, "reading %lu from buffer at %p, %lu available\n",
--			(u_long) wanted, s->netptr, (u_long) s->netlen);
-+	DBG(23, "%s: reading up to %lu from buffer at %p, %lu available\n",
-+		__func__, (u_long) wanted, s->netptr, (u_long) s->netlen);
- 
--		memcpy(buf, s->netptr, wanted);
--		read = wanted;
-+	if ((size_t) wanted > s->netlen) {
-+		*status = SANE_STATUS_IO_ERROR;
-+		wanted = s->netlen;
-+	}
- 
--		s->netlen -= wanted;
-+	memcpy(buf, s->netptr, wanted);
-+	read = wanted;
- 
--		if (s->netlen == 0) {
--			DBG(23, "%s: freeing %p\n", __func__, s->netbuf);
--			free(s->netbuf);
--			s->netbuf = s->netptr = NULL;
--			s->netlen = 0;
--		}
-+	s->netptr += read;
-+	s->netlen -= read;
-+
-+	if (s->netlen == 0) {
-+		DBG(23, "%s: freeing %p\n", __func__, s->netbuf);
-+		free(s->netbuf);
-+		s->netbuf = s->netptr = NULL;
-+		s->netlen = 0;
-+	}
-+
-+	return read;
-+}
-+
-+ssize_t
-+sanei_epson_net_read(Epson_Scanner *s, unsigned char *buf, ssize_t wanted,
-+		       SANE_Status * status)
-+{
-+	if (wanted < 0) {
-+		*status = SANE_STATUS_INVAL;
-+		return 0;
-+	}
-+
-+	size_t size;
-+	ssize_t read = 0;
-+	unsigned char header12;
- 
--		return read;
-+	/* read from remainder of buffer */
-+	if (s->netptr) {
-+		return sanei_epson_net_read_buf(s, buf, wanted, status);
- 	}
- 
- 	/* receive net header */
--	size = sanei_epson_net_read_raw(s, header, 12, status);
--	if (size != 12) {
-+	read = sanei_epson_net_read_raw(s, header, 12, status);
-+	if (read != 12) {
- 		return 0;
- 	}
- 
-+	/* validate header */
- 	if (header0 != 'I' || header1 != 'S') {
- 		DBG(1, "header mismatch: %02X %02x\n", header0, header1);
- 		*status = SANE_STATUS_IO_ERROR;
- 		return 0;
- 	}
- 
-+	/* parse payload size */
- 	size = be32atoh(&header6);
- 
--	DBG(23, "%s: wanted = %lu, available = %lu\n", __func__,
--		(u_long) wanted, (u_long) size);
--
- 	*status = SANE_STATUS_GOOD;
- 
--	if (size == wanted) {
--
--		DBG(15, "%s: full read\n", __func__);
--
--		read = sanei_epson_net_read_raw(s, buf, size, status);
-+	if (!s->netbuf) {
-+		DBG(15, "%s: direct read\n", __func__);
-+		DBG(23, "%s: wanted = %lu, available = %lu\n", __func__,
-+			(u_long) wanted, (u_long) size);
- 
--		if (s->netbuf) {
--			free(s->netbuf);
--			s->netbuf = NULL;
--			s->netlen = 0;
-+		if ((size_t) wanted > size) {
-+			wanted = size;
- 		}
- 
--		if (read < 0) {
--			return 0;
--		}
--
--/*	} else if (wanted < size && s->netlen == size) { */
-+		read = sanei_epson_net_read_raw(s, buf, wanted, status);
- 	} else {
--		DBG(23, "%s: partial read\n", __func__);
-+		DBG(15, "%s: buffered read\n", __func__);
-+		DBG(23, "%s: bufferable = %lu, available = %lu\n", __func__,
-+			(u_long) s->netlen, (u_long) size);
- 
--		read = sanei_epson_net_read_raw(s, s->netbuf, size, status);
--		if (read != size) {
--			return 0;
-+		if (s->netlen > size) {
-+			s->netlen = size;
- 		}
- 
--		s->netlen = size - wanted;
--		s->netptr += wanted;
--		read = wanted;
--
--		DBG(23, "0,4 %02x %02x\n", s->netbuf0, s->netbuf4);
--		DBG(23, "storing %lu to buffer at %p, next read at %p, %lu bytes left\n",
--			(u_long) size, s->netbuf, s->netptr, (u_long) s->netlen);
-+		/* fill buffer */
-+		read = sanei_epson_net_read_raw(s, s->netbuf, s->netlen, status);
-+		s->netptr = s->netbuf;
-+		s->netlen = (read > 0 ? read : 0);
- 
--		memcpy(buf, s->netbuf, wanted);
-+		/* copy wanted part */
-+		read = sanei_epson_net_read_buf(s, buf, wanted, status);
- 	}
- 
- 	return read;
- }
- 
--
--int
-+size_t
- sanei_epson_net_write(Epson_Scanner *s, unsigned int cmd, const unsigned char *buf,
- 			size_t buf_size, size_t reply_len, SANE_Status *status)
- {
- 	unsigned char *h1, *h2, *payload;
- 	unsigned char *packet = malloc(12 + 8 + buf_size);
- 
--	/* XXX check allocation failure */
-+	if (!packet) {

_service:tar_scm:sane-genesys-vector-glibcxxassert.patch Deleted

_service:tar_scm:sane-xerox-mfp-blacklist-C460-for-JPEG.patch Deleted

_service Changed

_service:tar_scm:sane-backends-1.0.28.tar.gz -> _service:tar_scm:sane-backends-1.2.1.tar.gz Changed

Changes of Revision 3