From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark H Weaver Subject: Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs. Date: Thu, 12 Jan 2017 19:59:40 -0500 Message-ID: <87shonai6b.fsf@netris.org> References: <20170112180655.1588-1-mbakke@fastmail.com> <20170112183017.GB23706@jasmine> <87wpe05adv.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> <20170112200346.GA11411@jasmine> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:33679) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cRqE7-0001Ir-R2 for guix-devel@gnu.org; Thu, 12 Jan 2017 20:00:20 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cRqE3-0002a3-JJ for guix-devel@gnu.org; Thu, 12 Jan 2017 20:00:19 -0500 Received: from world.peace.net ([50.252.239.5]:57444) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1cRqE3-0002OM-EZ for guix-devel@gnu.org; Thu, 12 Jan 2017 20:00:15 -0500 In-Reply-To: <20170112200346.GA11411@jasmine> (Leo Famulari's message of "Thu, 12 Jan 2017 15:03:46 -0500") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org Leo Famulari writes: > On Thu, Jan 12, 2017 at 08:46:52PM +0100, Marius Bakke wrote: >> Leo Famulari writes: >> >> > Through cups, this requires ~600 rebuilds. I wonder if we can graft it? >> > That is, is the ABI compatible? >> >> Good question. The null pointer dereference patch renames a function, >> and I can find it in /gnu/store/...-mupdf-1.10a/lib/libmupdfthird.a. So >> I guess not. >> >> There is also /lib/libmupdf.a which I assume most packages use, and does >> not seem to use anything from mujs. >> >> This package only provides static libraries, so grafting may not even >> work. In most cases I've come across, the static library is embedded >> with "ar" in the final package (cups do not retain a rerefence to >> mupdf). What to do? > > If we can't graft it, we should build it on a branch on Hydra. > > Mark, what do you think? Here's what we can do: in addition to mupdf itself, we can also add a graft for cups-filters (our only package that includes mupdf as an input). The replacement for cups-filters would change its mupdf input to refer directly to the fixed version of mupdf. What do you think? Mark