Changes of Revision 2

_service:tar_scm:unixODBC.spec Changed
x
 
1
@@ -1,6 +1,6 @@
2
 Name:          unixODBC
3
 Version:       2.3.9
4
-Release:       3
5
+Release:       4
6
 Summary:       Open-source project that implements the ODBC API
7
 License:       GPLv2+ and LGPLv2+
8
 URL:           http://www.unixODBC.org/
9
@@ -8,6 +8,7 @@
10
 Source1:       odbcinst.ini
11
 Patch0000:     null_dereference_check.patch
12
 Patch0001:     delete_password.patch
13
+Patch6001:     backport-0001-CVE-2024-1013.patch
14
 Conflicts:     iodbc
15
 BuildRequires: automake autoconf libtool libtool-ltdl-devel bison flex readline-devel
16
 
17
@@ -90,6 +91,9 @@
18
 %exclude %{_datadir}/libtool
19
 
20
 %changelog
21
+* Thu Oct 24 2024 Funda Wang <fundawang@yeah.net> - 2.3.9-4
22
+- fix CVE-2024-1013
23
+
24
 * Thu Dec 16 2021 Haoran Yang <yanghaoran7@huawei.com> - 2.3.9-3
25
 - add delete_password.patch (hiding password in unixODBC log)
26
 
27
_service:tar_scm:backport-0001-CVE-2024-1013.patch Added
47
 
1
@@ -0,0 +1,45 @@
2
+From 45f501e1be2db6b017cc242c79bfb9de32b332a1 Mon Sep 17 00:00:00 2001
3
+From: Florian Weimer <fweimer@redhat.com>
4
+Date: Mon, 29 Jan 2024 08:27:29 +0100
5
+Subject: PATCH PostgreSQL driver: Fix incompatible pointer-to-integer types
6
+
7
+These result in out-of-bounds stack writes on 64-bit architectures
8
+(caller has 4 bytes, callee writes 8 bytes), and seem to have gone
9
+unnoticed on little-endian architectures (although big-endian
10
+architectures must be broken).
11
+
12
+This change is required to avoid a build failure with GCC 14.
13
+---
14
+ Drivers/Postgre7.1/info.c | 6 +++---
15
+ 1 file changed, 3 insertions(+), 3 deletions(-)
16
+
17
+diff --git a/Drivers/Postgre7.1/info.c b/Drivers/Postgre7.1/info.c
18
+index 63ac91f..2216ecd 100644
19
+--- a/Drivers/Postgre7.1/info.c
20
++++ b/Drivers/Postgre7.1/info.c
21
+@@ -1779,14 +1779,14 @@ char *table_name;
22
+ char index_nameMAX_INFO_STRING;
23
+ short fields_vector8;
24
+ char isunique10, isclustered10;
25
+-SDWORD index_name_len, fields_vector_len;
26
++SQLLEN index_name_len, fields_vector_len;
27
+ TupleNode *row;
28
+ int i;
29
+ HSTMT hcol_stmt;
30
+ StatementClass *col_stmt, *indx_stmt;
31
+ char column_nameMAX_INFO_STRING, relhasrulesMAX_INFO_STRING;
32
+ char **column_names = 0;
33
+-Int4 column_name_len;
34
++SQLLEN column_name_len;
35
+ int total_columns = 0;
36
+ char error = TRUE;
37
+ ConnInfo *ci;
38
+@@ -2136,7 +2136,7 @@ HSTMT htbl_stmt;
39
+ StatementClass *tbl_stmt;
40
+ char tables_querySTD_STATEMENT_LEN;
41
+ char attnameMAX_INFO_STRING;
42
+-SDWORD attname_len;
43
++SQLLEN attname_len;
44
+ char pktabMAX_TABLE_LEN + 1;
45
+ Int2 result_cols;
46
+ 
47
_service Changed
10
 
1
@@ -2,7 +2,7 @@
2
    <service name="tar_scm">
3
        <param name="scm">git</param>
4
        <param name="url">git@gitee.com:src-openeuler/unixODBC.git</param>
5
-       <param name="revision">openEuler-24.03-LTS-Next</param>
6
+       <param name="revision">openEuler-24.03-LTS-SP1</param>
7
        <param name="exclude">*</param>
8
        <param name="extract">*</param>
9
    </service>
10