From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs. Date: Thu, 12 Jan 2017 13:30:17 -0500 Message-ID: <20170112183017.GB23706@jasmine> References: <20170112180655.1588-1-mbakke@fastmail.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="envbJBWh7q8WU6mo" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:49391) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cRk8k-000756-W2 for guix-devel@gnu.org; Thu, 12 Jan 2017 13:30:26 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cRk8h-0005Vl-R2 for guix-devel@gnu.org; Thu, 12 Jan 2017 13:30:22 -0500 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:41524) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cRk8h-0005VI-MO for guix-devel@gnu.org; Thu, 12 Jan 2017 13:30:19 -0500 Content-Disposition: inline In-Reply-To: <20170112180655.1588-1-mbakke@fastmail.com> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Marius Bakke Cc: guix-devel@gnu.org --envbJBWh7q8WU6mo Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Thu, Jan 12, 2017 at 07:06:55PM +0100, Marius Bakke wrote: > * gnu/packages/patches/mupdf-mujs-heap-buffer-overflow.patch: New file. > * gnu/packages/patches/mupdf-mujs-null-pointer-dereference.patch: New file. > * gnu/local.mk (dist_patch_DATA): Add them. > * gnu/packages/pdf.scm (mupdf)[source]: Use them. Thanks! I'd write it like this, but it's not important: * gnu/packages/patches/mupdf-mujs-heap-buffer-overflow.patch, gnu/packages/patches/mupdf-mujs-null-pointer-dereference.patch: New file. Can you include links to the upstream bug reports in the patch files? Through cups, this requires ~600 rebuilds. I wonder if we can graft it? That is, is the ABI compatible? --envbJBWh7q8WU6mo Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlh3yzUACgkQJkb6MLrK fwiBRhAAtXS14ixQbcL2FTCCW/Y9IwzT4MEM/pHBctf6iY1pt1eAMt0PHW3fRPT5 teB4GJ9xBtMgjL6pa+0TRLJodpDe0+p6veJEoN6B5YVl9YZm0Be9zhkjpLeARuf8 DJB9jf9lJ+5X6I5fpmQxxyOc0ChowLxk7OVPBAq5HSGYa+0ZNBtLyY6jm/Ziphfn Pg5CaoT6ToO2bRYEtftaGKe9TZ2RGLciS3rIelFKUc/YSx4UKdRaMRM6a22F8YJg +2YBLZ4ff3mfFGKHNx41qsTWb9IWa0E01f2LPKpix2VHv9s6Fv2lyfhuqdOa8+EM xMgGrKPHRSczVmlVjPZ+EKVCqhFIt+2IxGoMnrYQm9I7x6rnlvhmqPRtVldYk622 UvnN98Q/sejEDAHJAumBfw1OytWc73F1whfggtSo7nhe51GdsiXl9GgXaLHo+QWD GI9D4A0aCKIv70xVHcEpL8XX22oNs1oIXC/3VFKXVZ8m9Vnhqnj771WVj3XShQu6 GbR0Wo78+GB4ysz5vP8W1fXKwo1tkFJNTY8G2xGHxVbvQoydnuZq18fg2aEJKEN7 e154wJGYcbO/iwOyrwkyknnQbWOIe4QEPnCEoXrK2xmh0ZmY8cDXFABWpY3z/gSr qv7HcY/RsCJ6okh9t1dxboUZhGgjoH+iYJsRlyzveTB27w1biBA= =K01m -----END PGP SIGNATURE----- --envbJBWh7q8WU6mo--