From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: [PATCH 0/1] Help wanted grafting Expat (CVE-2016-0718) Date: Thu, 19 May 2016 14:19:59 +0200 Message-ID: <874m9uw87k.fsf@gnu.org> References: <20160518173731.GA26295@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:51940) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1b3Mvw-0000ck-IO for guix-devel@gnu.org; Thu, 19 May 2016 08:20:09 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1b3Mvr-0003cb-GZ for guix-devel@gnu.org; Thu, 19 May 2016 08:20:07 -0400 In-Reply-To: <20160518173731.GA26295@jasmine> (Leo Famulari's message of "Wed, 18 May 2016 13:37:31 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org Hi! Leo Famulari skribis: > On Wed, May 18, 2016 at 12:36:50PM -0400, Leo Famulari wrote: >> I've attached my attempt at fixing CVE-2016-0718 in Expat [0]. The >> grafted expat updates to 2.1.1 and applies the patch from [1]. >>=20 >> The problem is that, when trying build something that depends on expat, >> I seem to have to rebuild *many* things. > > Of course this would happen, since I had removed the CVE-2015-1283 patch > from expat package definition. D'oh. > > I've attached an updated patch that seems to work as expected. > > This patch uses the CVE-2016-0718 patch from Debian [0], which has the > same diffs but does not require use of (patch-flags). > > It also includes an update to the patch for CVE-2015-1283 [1], which > apparently relied on undefined behavior. > > Finally, it does not upgrade to 2.1.1. This patch series does apply to > 2.1.0. This variant LGTM. > --- /dev/null > +++ b/gnu/packages/patches/expat-CVE-2016-0718.patch > @@ -0,0 +1,757 @@ > +Copied from Debian Could you add a URL here, for reference? > +++ b/gnu/packages/patches/expat-CVE-2016-0718.patch > @@ -0,0 +1,757 @@ > +Copied from Debian Same here. Thank you! Ludo=E2=80=99.