Date: Friday, November 13, 2020 @ 19:26:44
Author: dvzrv
Revision: 400763
upgpkg: raptor 2.0.15-14: Rebuild to fix CVE-2017-18926.
Switch to correct list of licenses (Apache, GPL2, LGPL2.1).
Add all available sodeps in package() and the respective packages to
makedepends.
Add libraptor2.so to provides.
Apply upstreamed patch to fix CVE-2017-18926 (FS#68613).
Apply patch to fix out-of-bounds read.
Remove unused configure flag.
Run check() but do not fail on running tests (known problems with test suite).
Install docs.
Update maintainer info.
Added:
raptor/trunk/raptor-2.0.15-out_of_bounds.patch
Modified:
raptor/trunk/PKGBUILD
-----------------------------------+
PKGBUILD | 59 ++++++++++++++++++++++++++----------
raptor-2.0.15-out_of_bounds.patch | 14 ++++++++
2 files changed, 57 insertions(+), 16 deletions(-)
Modified: PKGBUILD
===================================================================
--- PKGBUILD 2020-11-13 17:59:01 UTC (rev 400762)
+++ PKGBUILD 2020-11-13 19:26:44 UTC (rev 400763)
@@ -1,36 +1,63 @@
-# Maintainer: Tom Gundersen <t...@jklm.no>
+# Maintainer: David Runge <dv...@archlinux.org>
+# Contributor: Tom Gundersen <t...@jklm.no>
# Contributor: Andreas Radke <andy...@archlinux.org>
# Contributor: eric <e...@archlinux.org>
# Contributor: Damir Perisa <damir.per...@bluewin.ch>
+_name=raptor2
pkgname=raptor
pkgver=2.0.15
-pkgrel=13
+pkgrel=14
pkgdesc="A C library that parses RDF/XML/N-Triples into RDF triples"
arch=('x86_64')
url="http://librdf.org/raptor";
-depends=('curl' 'libxslt' 'icu')
-license=('LGPL')
-source=("http://librdf.org/dist/source/raptor2-$pkgver.tar.gz"{,.asc})
-sha256sums=('ada7f0ba54787b33485d090d3d2680533520cd4426d2f7fb4782dd4a6a1480ed'
- 'SKIP')
+license=('Apache' 'GPL2' 'LGPL2.1')
+depends=('glibc' 'libxml2' 'libxslt' 'xz' 'zlib')
+makedepends=('curl' 'icu')
+provides=('libraptor2.so')
+source=("http://librdf.org/dist/source/${_name}-$pkgver.tar.gz"{,.asc}
+
"${pkgname}-2.0.15-CVE-2017-18926.patch::https://github.com/dajobe/raptor/commit/590681e546cd9aa18d57dc2ea1858cb734a3863f.patch";
+ "${pkgname}-2.0.15-out_of_bounds.patch")
+sha512sums=('563dd01869eb4df8524ec12e2c0a541653874dcd834bd1eb265bc2943bb616968f624121d4688579cdce11b4f00a8ab53b7099f1a0850e256bb0a2c16ba048ee'
+ 'SKIP'
+
'203ae75dae8242fb7988a199df8a7337b0660871f5caa6c9098167536ba880ad55765bb60fd4315020f208ed3ae8dc03eb1b91241851410a961a797192ecb969'
+
'140f90d74fad8cdc6ef7fa14fa655e425552947d57068021362f8ae9efdded8ed31295e9bdd495fe70e646967062e28fa3ecd5831f9902134da5fe0a82607735')
+b2sums=('0a39c7b5705bfbf2daa0ca633f79693953b4dfe24c144008d1646a9840a36d4d7ce153b527450647127ec2522047dbd0a6e71f307ee5656951f7e4b610adfd22'
+ 'SKIP'
+
'a3f83e34686dfd55ad1c4b9e97f6ae046be31b8224846dfa2b83ba9228cb987c6ebb19f37f48c196fab56a1e1d007d71225ed12acc2188e088b95c7cff5a0beb'
+
'ab11eeb648bf2cf8ac4ef4bbff4cdb77d1b713ad086268b656c7249363bf5752b535763f9a9fd34be4d72b3ff420cd87ee6970d3da6e24e5e2b067b9dbb9c29e')
validpgpkeys=('F879F0DEDA780198DD08DC6443EC92504F71955A') # Dave Beckett
<d...@dajobe.org>
+prepare() {
+ mv -v "${_name}-${pkgver}" "${pkgname}-${pkgver}"
+ cd "${pkgname}-${pkgver}"
+ # fix CVE-2017-18926:
+ # https://bugs.archlinux.org/task/68613
+ patch -Np1 -i "../${pkgname}-2.0.15-CVE-2017-18926.patch"
+ # fix out-of-bounds read:
+ # https://bugs.librdf.org/mantis/view.php?id=650
+ patch -Np1 -i "../${pkgname}-2.0.15-out_of_bounds.patch"
+ # autoreconf -vfi
+}
+
build() {
- cd raptor2-${pkgver}
+ cd "${pkgname}-${pkgver}"
- ./configure --prefix=/usr \
- --disable-static \
- --with-yajl=no \
- --with-icu-config=/usr/bin/icu-config
+ ./configure --prefix='/usr' \
+ --disable-static \
+ --with-icu-config='/usr/bin/icu-config'
make
}
-#check() {
-# make -C "raptor2-$pkgver" check // currently does not work
-#}
+check() {
+ cd "${pkgname}-${pkgver}"
+ make check || echo "Known to fail."
+}
package() {
- cd raptor2-${pkgver}
+ depends+=('libcurl.so' 'libicudata.so' 'libicui18n.so' 'libicuuc.so')
+ cd "${pkgname}-${pkgver}"
make prefix="${pkgdir}"/usr install
+ install -vDm 644 {AUTHORS,ChangeLog*,README} \
+ -t "${pkgdir}/usr/share/doc/${pkgname}/"
}
Added: raptor-2.0.15-out_of_bounds.patch
===================================================================
--- raptor-2.0.15-out_of_bounds.patch (rev 0)
+++ raptor-2.0.15-out_of_bounds.patch 2020-11-13 19:26:44 UTC (rev 400763)
@@ -0,0 +1,14 @@
+diff --git a/src/raptor_xml_writer.c b/src/raptor_xml_writer.c
+index 56993dc3..163f34d5 100644
+--- a/src/raptor_xml_writer.c
++++ b/src/raptor_xml_writer.c
+@@ -216,6 +216,9 @@ raptor_xml_writer_start_element_common(raptor_xml_writer*
xml_writer,
+
+ if(nstack && element->attributes) {
+ for(i = 0; i < element->attribute_count; i++) {
++ if (nspace_declarations_count > element->attribute_count)
++ goto error;
++
+ /* qname */
+ if(element->attributes[i]->nspace) {
+ /* Check if we need a namespace declaration attribute */
