Date: Friday, November 13, 2020 @ 19:26:44 Author: dvzrv Revision: 400763
upgpkg: raptor 2.0.15-14: Rebuild to fix CVE-2017-18926. Switch to correct list of licenses (Apache, GPL2, LGPL2.1). Add all available sodeps in package() and the respective packages to makedepends. Add libraptor2.so to provides. Apply upstreamed patch to fix CVE-2017-18926 (FS#68613). Apply patch to fix out-of-bounds read. Remove unused configure flag. Run check() but do not fail on running tests (known problems with test suite). Install docs. Update maintainer info. Added: raptor/trunk/raptor-2.0.15-out_of_bounds.patch Modified: raptor/trunk/PKGBUILD -----------------------------------+ PKGBUILD | 59 ++++++++++++++++++++++++++---------- raptor-2.0.15-out_of_bounds.patch | 14 ++++++++ 2 files changed, 57 insertions(+), 16 deletions(-) Modified: PKGBUILD =================================================================== --- PKGBUILD 2020-11-13 17:59:01 UTC (rev 400762) +++ PKGBUILD 2020-11-13 19:26:44 UTC (rev 400763) @@ -1,36 +1,63 @@ -# Maintainer: Tom Gundersen <[email protected]> +# Maintainer: David Runge <[email protected]> +# Contributor: Tom Gundersen <[email protected]> # Contributor: Andreas Radke <[email protected]> # Contributor: eric <[email protected]> # Contributor: Damir Perisa <[email protected]> +_name=raptor2 pkgname=raptor pkgver=2.0.15 -pkgrel=13 +pkgrel=14 pkgdesc="A C library that parses RDF/XML/N-Triples into RDF triples" arch=('x86_64') url="http://librdf.org/raptor"; -depends=('curl' 'libxslt' 'icu') -license=('LGPL') -source=("http://librdf.org/dist/source/raptor2-$pkgver.tar.gz"{,.asc}) -sha256sums=('ada7f0ba54787b33485d090d3d2680533520cd4426d2f7fb4782dd4a6a1480ed' - 'SKIP') +license=('Apache' 'GPL2' 'LGPL2.1') +depends=('glibc' 'libxml2' 'libxslt' 'xz' 'zlib') +makedepends=('curl' 'icu') +provides=('libraptor2.so') +source=("http://librdf.org/dist/source/${_name}-$pkgver.tar.gz"{,.asc} + "${pkgname}-2.0.15-CVE-2017-18926.patch::https://github.com/dajobe/raptor/commit/590681e546cd9aa18d57dc2ea1858cb734a3863f.patch"; + "${pkgname}-2.0.15-out_of_bounds.patch") +sha512sums=('563dd01869eb4df8524ec12e2c0a541653874dcd834bd1eb265bc2943bb616968f624121d4688579cdce11b4f00a8ab53b7099f1a0850e256bb0a2c16ba048ee' + 'SKIP' + '203ae75dae8242fb7988a199df8a7337b0660871f5caa6c9098167536ba880ad55765bb60fd4315020f208ed3ae8dc03eb1b91241851410a961a797192ecb969' + '140f90d74fad8cdc6ef7fa14fa655e425552947d57068021362f8ae9efdded8ed31295e9bdd495fe70e646967062e28fa3ecd5831f9902134da5fe0a82607735') +b2sums=('0a39c7b5705bfbf2daa0ca633f79693953b4dfe24c144008d1646a9840a36d4d7ce153b527450647127ec2522047dbd0a6e71f307ee5656951f7e4b610adfd22' + 'SKIP' + 'a3f83e34686dfd55ad1c4b9e97f6ae046be31b8224846dfa2b83ba9228cb987c6ebb19f37f48c196fab56a1e1d007d71225ed12acc2188e088b95c7cff5a0beb' + 'ab11eeb648bf2cf8ac4ef4bbff4cdb77d1b713ad086268b656c7249363bf5752b535763f9a9fd34be4d72b3ff420cd87ee6970d3da6e24e5e2b067b9dbb9c29e') validpgpkeys=('F879F0DEDA780198DD08DC6443EC92504F71955A') # Dave Beckett <[email protected]> +prepare() { + mv -v "${_name}-${pkgver}" "${pkgname}-${pkgver}" + cd "${pkgname}-${pkgver}" + # fix CVE-2017-18926: + # https://bugs.archlinux.org/task/68613 + patch -Np1 -i "../${pkgname}-2.0.15-CVE-2017-18926.patch" + # fix out-of-bounds read: + # https://bugs.librdf.org/mantis/view.php?id=650 + patch -Np1 -i "../${pkgname}-2.0.15-out_of_bounds.patch" + # autoreconf -vfi +} + build() { - cd raptor2-${pkgver} + cd "${pkgname}-${pkgver}" - ./configure --prefix=/usr \ - --disable-static \ - --with-yajl=no \ - --with-icu-config=/usr/bin/icu-config + ./configure --prefix='/usr' \ + --disable-static \ + --with-icu-config='/usr/bin/icu-config' make } -#check() { -# make -C "raptor2-$pkgver" check // currently does not work -#} +check() { + cd "${pkgname}-${pkgver}" + make check || echo "Known to fail." +} package() { - cd raptor2-${pkgver} + depends+=('libcurl.so' 'libicudata.so' 'libicui18n.so' 'libicuuc.so') + cd "${pkgname}-${pkgver}" make prefix="${pkgdir}"/usr install + install -vDm 644 {AUTHORS,ChangeLog*,README} \ + -t "${pkgdir}/usr/share/doc/${pkgname}/" } Added: raptor-2.0.15-out_of_bounds.patch =================================================================== --- raptor-2.0.15-out_of_bounds.patch (rev 0) +++ raptor-2.0.15-out_of_bounds.patch 2020-11-13 19:26:44 UTC (rev 400763) @@ -0,0 +1,14 @@ +diff --git a/src/raptor_xml_writer.c b/src/raptor_xml_writer.c +index 56993dc3..163f34d5 100644 +--- a/src/raptor_xml_writer.c ++++ b/src/raptor_xml_writer.c +@@ -216,6 +216,9 @@ raptor_xml_writer_start_element_common(raptor_xml_writer* xml_writer, + + if(nstack && element->attributes) { + for(i = 0; i < element->attribute_count; i++) { ++ if (nspace_declarations_count > element->attribute_count) ++ goto error; ++ + /* qname */ + if(element->attributes[i]->nspace) { + /* Check if we need a namespace declaration attribute */
