开源软件构建与测试

Changes of Revision 2

_service:tar_scm:avahi.spec Changed

@@ -3,7 +3,7 @@
 
 Name:             avahi
 Version:          0.8
-Release:          18
+Release:          19
 Summary:          Avahi is a local network service discovery
 License:          LGPLv2+
 URL:              http://avahi.org
@@ -23,9 +23,8 @@
 Patch6004:        backport-CVE-2023-38470.patch
 Patch6005:        backport-CVE-2023-38473.patch
 Patch6006:        backport-CVE-2023-38472.patch
-Patch6007:        backport-0001-CVE-2023-38471.patch
-Patch6008:        backport-0002-CVE-2023-38471.patch
-Patch6009:        backport-CVE-2023-38469.patch
+Patch6007:        backport-CVE-2023-38471.patch
+Patch6008:        backport-CVE-2023-38469.patch
 
 BuildRequires:    gcc automake libtool desktop-file-utils gtk2-devel glib2-devel gcc-c++
 BuildRequires:    libcap-devel expat-devel gdbm-devel make
@@ -585,6 +584,9 @@
 %{_mandir}/man8/*
 
 %changelog
+* Sun Feb 4 2024 zhangpan <zhangpan103@h-partners.com> - 0.8-19
+- delete redundant patch
+
 * Mon Nov 6 2023 zhangpan <zhangpan103@h-partners.com> - 0.8-18
 - fix CVE-2023-38469 CVE-2023-38471 CVE-2023-38472 CVE-2023-38473

_service:tar_scm:backport-0001-CVE-2023-38471.patch Deleted

@@ -1,31 +0,0 @@
-From 1c599d80f0cdd6845ad2e9bd91465d59c9b0c211 Mon Sep 17 00:00:00 2001
-From: Evgeny Vereshchagin <evvers@ya.ru>
-Date: Fri, 9 Dec 2022 14:33:16 +0000
-Subject: PATCH dbus: deny SetHostName via org.freedesktop.Avahi.Server2 as
- well
-
-Looks like the policy wasn't updated when the Server2 interface was
-introduced.
-
-It's a follow-up to https://github.com/lathiat/avahi/pull/175
-
-Reference:https://github.com/lathiat/avahi/commit/1c599d80f0cdd6845ad2e9bd91465d59c9b0c211
-Conflict:NA
-
----
- avahi-daemon/avahi-dbus.conf.in | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/avahi-daemon/avahi-dbus.conf.in b/avahi-daemon/avahi-dbus.conf.in
-index 1df0cc478..a78f02850 100644
---- a/avahi-daemon/avahi-dbus.conf.in
-+++ b/avahi-daemon/avahi-dbus.conf.in
-@@ -18,6 +18,8 @@
- 
-     <deny send_destination="org.freedesktop.Avahi"
-           send_interface="org.freedesktop.Avahi.Server" send_member="SetHostName"/>
-+    <deny send_destination="org.freedesktop.Avahi"
-+          send_interface="org.freedesktop.Avahi.Server2" send_member="SetHostName"/>
-   </policy>
- 
-

_service:tar_scm:backport-0002-CVE-2023-38471.patch Deleted

@@ -1,71 +0,0 @@
-From 894f085f402e023a98cbb6f5a3d117bd88d93b09 Mon Sep 17 00:00:00 2001
-From: Michal Sekletar <msekleta@redhat.com>
-Date: Mon, 23 Oct 2023 13:38:35 +0200
-Subject: PATCH core: extract host name using avahi_unescape_label()
-
-Previously we could create invalid escape sequence when we split the
-string on dot. For example, from valid host name "foo\\.bar" we have
-created invalid name "foo\\" and tried to set that as the host name
-which crashed the daemon.
-
-Fixes #453
-
-CVE-2023-38471
-
-Reference:https://github.com/lathiat/avahi/commit/894f085f402e023a98cbb6f5a3d117bd88d93b09
-Conflict:NA
-
----
- avahi-core/server.c | 27 +++++++++++++++++++++------
- 1 file changed, 21 insertions(+), 6 deletions(-)
-
-diff --git a/avahi-core/server.c b/avahi-core/server.c
-index c32637af8..f6a21bb77 100644
---- a/avahi-core/server.c
-+++ b/avahi-core/server.c
-@@ -1295,7 +1295,11 @@ static void update_fqdn(AvahiServer *s) {
- }
- 
- int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
--    char *hn = NULL;
-+    char label_escapedAVAHI_LABEL_MAX*4+1;
-+    char labelAVAHI_LABEL_MAX;
-+    char *hn = NULL, *h;
-+    size_t len;
-+
-     assert(s);
- 
-     AVAHI_CHECK_VALIDITY(s, !host_name || avahi_is_valid_host_name(host_name), AVAHI_ERR_INVALID_HOST_NAME);
-@@ -1305,17 +1309,28 @@ int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
-     else
-         hn = avahi_normalize_name_strdup(host_name);
- 
--    hnstrcspn(hn, ".") = 0;
-+    h = hn;
-+    if (!avahi_unescape_label((const char **)&hn, label, sizeof(label))) {
-+        avahi_free(h);
-+        return AVAHI_ERR_INVALID_HOST_NAME;
-+    }
-+
-+    avahi_free(h);
-+
-+    h = label_escaped;
-+    len = sizeof(label_escaped);
-+    if (!avahi_escape_label(label, strlen(label), &h, &len))
-+        return AVAHI_ERR_INVALID_HOST_NAME;
- 
--    if (avahi_domain_equal(s->host_name, hn) && s->state != AVAHI_SERVER_COLLISION) {
--        avahi_free(hn);
-+    if (avahi_domain_equal(s->host_name, label_escaped) && s->state != AVAHI_SERVER_COLLISION)
-         return avahi_server_set_errno(s, AVAHI_ERR_NO_CHANGE);
--    }
- 
-     withdraw_host_rrs(s);
- 
-     avahi_free(s->host_name);
--    s->host_name = hn;
-+    s->host_name = avahi_strdup(label_escaped);
-+    if (!s->host_name)
-+        return AVAHI_ERR_NO_MEMORY;
- 
-     update_fqdn(s);

_service:tar_scm:backport-CVE-2023-38471.patch Added

@@ -0,0 +1,71 @@
+From 894f085f402e023a98cbb6f5a3d117bd88d93b09 Mon Sep 17 00:00:00 2001
+From: Michal Sekletar <msekleta@redhat.com>
+Date: Mon, 23 Oct 2023 13:38:35 +0200
+Subject: PATCH core: extract host name using avahi_unescape_label()
+
+Previously we could create invalid escape sequence when we split the
+string on dot. For example, from valid host name "foo\\.bar" we have
+created invalid name "foo\\" and tried to set that as the host name
+which crashed the daemon.
+
+Fixes #453
+
+CVE-2023-38471
+
+Reference:https://github.com/lathiat/avahi/commit/894f085f402e023a98cbb6f5a3d117bd88d93b09
+Conflict:NA
+
+---
+ avahi-core/server.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/avahi-core/server.c b/avahi-core/server.c
+index c32637af8..f6a21bb77 100644
+--- a/avahi-core/server.c
++++ b/avahi-core/server.c
+@@ -1295,7 +1295,11 @@ static void update_fqdn(AvahiServer *s) {
+ }
+ 
+ int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
+-    char *hn = NULL;
++    char label_escapedAVAHI_LABEL_MAX*4+1;
++    char labelAVAHI_LABEL_MAX;
++    char *hn = NULL, *h;
++    size_t len;
++
+     assert(s);
+ 
+     AVAHI_CHECK_VALIDITY(s, !host_name || avahi_is_valid_host_name(host_name), AVAHI_ERR_INVALID_HOST_NAME);
+@@ -1305,17 +1309,28 @@ int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
+     else
+         hn = avahi_normalize_name_strdup(host_name);
+ 
+-    hnstrcspn(hn, ".") = 0;
++    h = hn;
++    if (!avahi_unescape_label((const char **)&hn, label, sizeof(label))) {
++        avahi_free(h);
++        return AVAHI_ERR_INVALID_HOST_NAME;
++    }
++
++    avahi_free(h);
++
++    h = label_escaped;
++    len = sizeof(label_escaped);
++    if (!avahi_escape_label(label, strlen(label), &h, &len))
++        return AVAHI_ERR_INVALID_HOST_NAME;
+ 
+-    if (avahi_domain_equal(s->host_name, hn) && s->state != AVAHI_SERVER_COLLISION) {
+-        avahi_free(hn);
++    if (avahi_domain_equal(s->host_name, label_escaped) && s->state != AVAHI_SERVER_COLLISION)
+         return avahi_server_set_errno(s, AVAHI_ERR_NO_CHANGE);
+-    }
+ 
+     withdraw_host_rrs(s);
+ 
+     avahi_free(s->host_name);
+-    s->host_name = hn;
++    s->host_name = avahi_strdup(label_escaped);
++    if (!s->host_name)
++        return AVAHI_ERR_NO_MEMORY;
+ 
+     update_fqdn(s);

_service:tar_scm:avahi-1699492606.0b7f6fe.tar Deleted