Re: [PATCH 0/1] Gst-plugins-good security update

[Leo Famulari <leo@famulari.name>]

[-- Attachment #1: Type: text/plain, Size: 1478 bytes --]

On Sat, Nov 26, 2016 at 09:51:30AM +0100, Marius Bakke wrote:
> Leo Famulari <leo@famulari.name> writes:
> 
> > This patch should fix the bugs named here:
> >
> > http://seclists.org/oss-sec/2016/q4/517
> >
> > I copied Debian's approach, which is to take all the recent patches for
> > the vulnerable component (the FLIC decoder).
> >
> > My understanding is that the first two patches fix the CVEs, the 3rd
> > fixes an unrelated bug, and the 4th is a total rewrite of the component,
> > because "code is terrible, it should be entirely re-written" [0].
> >
> > The CVE bug fixes are not split into discrete patches, so it doesn't
> > work to make patches for each CVE ID, like we normally do.
> >
> > Is this approach (concatenating the patches) okay?
> 
> I prefer having them separately, so the upstream commit can be clearly
> referenced in the patch header; and they can be reviewed and modified
> independently.
> 
> In this instance it's okay, since I just checked out the 1.10 branch and
> concatenated the four commits and ended up with the same patch :-)
> 
> That's not to say it should not be allowed. I think this approach is
> fine for long patch series, but at only four patches it's not the best
> precedent.
> 
> Anyway, thanks for taking care of this, and LGTM! Please push! :-)

I split them up and (hopefully) annotated them well enough that readers
can follow along.

Pushed as 9e46245b89e0f30397f69391a2219a29caa336a2

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]