nixo
/
guix-devel
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

gnu: a2ps: Fix CVE-2015-8107. 

* gnu/packages/pretty-print.scm (a2ps)[source]: Add patch.
* gnu/packages/patches/a2ps-CVE-2015-8107.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
This commit is contained in:
Efraim Flashner 2019-07-10 12:45:08 +03:00
parent 3e4afe0298
commit 841bddb4b4
No known key found for this signature in database
GPG Key ID: 41AAE7DCCA3D8351
3 changed files with 84 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
gnu/local.mk
View File

@ -660,6 +660,7 @@ dist_patch_DATA = \
%D%/packages/patches/4store-unset-preprocessor-directive.patch \
%D%/packages/patches/a2ps-CVE-2001-1593.patch \
%D%/packages/patches/a2ps-CVE-2014-0466.patch \
%D%/packages/patches/a2ps-CVE-2015-8107.patch \
%D%/packages/patches/abiword-explictly-cast-bools.patch \
%D%/packages/patches/abiword-black-drawing-with-gtk322.patch \
%D%/packages/patches/acl-fix-perl-regex.patch \

80
gnu/packages/patches/a2ps-CVE-2015-8107.patch Normal file
View File

@ -0,0 +1,80 @@
https://sources.debian.org/data/main/a/a2ps/1:4.14-2/debian/patches/fix-format-security.diff
Index: b/lib/psgen.c
===================================================================
--- a/lib/psgen.c
+++ b/lib/psgen.c
@@ -232,7 +232,7 @@
default:
*buf = '\0';
ps_escape_char (job, cp[i], buf);
- output (jdiv, (char *) buf);
+ output (jdiv, "%s", (char *) buf);
break;
}
}
Index: b/lib/output.c
===================================================================
--- a/lib/output.c
+++ b/lib/output.c
@@ -525,7 +525,7 @@
expand_user_string (job, FIRST_FILE (job),
(const uchar *) "Expand: requirement",
(const uchar *) token));
- output (dest, expansion);
+ output (dest, "%s", expansion);
continue;
}
Index: b/lib/parseppd.y
===================================================================
--- a/lib/parseppd.y
+++ b/lib/parseppd.y
@@ -154,7 +154,7 @@
void
yyerror (const char *msg)
{
- error_at_line (1, 0, ppdfilename, ppdlineno, msg);
+ error_at_line (1, 0, ppdfilename, ppdlineno, "%s", msg);
}
/*
Index: b/src/parsessh.y
===================================================================
--- a/src/parsessh.y
+++ b/src/parsessh.y
@@ -740,7 +740,7 @@
void
yyerror (const char *msg)
{
- error_at_line (1, 0, sshfilename, sshlineno, msg);
+ error_at_line (1, 0, sshfilename, sshlineno, "%s", msg);
}
/*
Index: b/lib/parseppd.c
===================================================================
--- a/lib/parseppd.c
+++ b/lib/parseppd.c
@@ -1707,7 +1707,7 @@
void
yyerror (const char *msg)
{
- error_at_line (1, 0, ppdfilename, ppdlineno, msg);
+ error_at_line (1, 0, ppdfilename, ppdlineno, "%s", msg);
}
/*
Index: b/src/parsessh.c
===================================================================
--- a/src/parsessh.c
+++ b/src/parsessh.c
@@ -2639,7 +2639,7 @@
void
yyerror (const char *msg)
{
- error_at_line (1, 0, sshfilename, sshlineno, msg);
+ error_at_line (1, 0, sshfilename, sshlineno, "%s", msg);
}
/*

5
gnu/packages/pretty-print.scm
View File

@ -1,5 +1,5 @@
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
;;; Copyright © 2016, 2019 Efraim Flashner <efraim@flashner.co.il>
;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
;;; Copyright © 2017 Ludovic Courtès <ludo@gnu.org>
@ -63,7 +63,8 @@
#t))
(patches (search-patches
"a2ps-CVE-2001-1593.patch"
"a2ps-CVE-2014-0466.patch"))))
"a2ps-CVE-2014-0466.patch"
"a2ps-CVE-2015-8107.patch"))))
(build-system gnu-build-system)
(inputs
`(("psutils" ,psutils)