Hi, Thanks! It passed on the validation and the packet was created with a few other warnings (below); just enbled build of the 32 bits and OpenSUSE´s factory package
Just to keep you informed there´s the last warnings from OpenSUSE´s validation system: RPMLINT report: =============== ooRexx.x86_64: W: shlib-policy-missing-suffix Your package containing shared libraries does not end in a digit and should probably be split. ooRexx-devel.x86_64: W: no-version-dependency-on ooRexx*/ooRexx-libs/libooRexx* 4.2.0 ooRexx.x86_64: W: no-manual-page-for-binary rexximage ooRexx.x86_64: W: no-manual-page-for-binary rxapid ooRexx.x86_64: W: no-manual-page-for-binary rexx.cat ooRexx.x86_64: W: no-manual-page-for-binary rxapi ooRexx.x86_64: W: no-manual-page-for-binary rexx.img Each executable in standard binary directories should have a man page. ooRexx.x86_64: W: missing-call-to-setgroups-before-setuid /usr/lib64/librxunixsys.so.4.0.3 This executable is calling setuid and setgid without setgroups or initgroups. There is a high probability this mean it didn't relinquish all groups, and this would be a potential security issue to be fixed. Seek POS36-C on the web for details about the problem. ooRexx.x86_64: W: missing-call-to-chdir-with-chroot /usr/lib64/librxunixsys.so.4.0.3 This executable appears to call chroot without using chdir to change the current directory. This is likely an error and permits an attacker to break out of the chroot by using fchdir. While that's not always a security issue, this has to be checked. ooRexx.x86_64: I: binary-or-shlib-calls-gethostbyname /usr/lib64/librexxapi.so.4.0.3 ooRexx.x86_64: I: binary-or-shlib-calls-gethostbyname /usr/lib64/librxsock.so.4.0.3 ooRexx.x86_64: I: binary-or-shlib-calls-gethostbyname /usr/bin/rxapi The binary calls gethostbyname(). Please port the code to use getaddrinfo(). 2013/12/9 Mark Miesfeld <[email protected]>: > We can fix the first one. Can you open a bug for them. Just put in the > warning text. > > hostemu is mostly David's area. He can decide how he wants to handle it. > > -- > Mark Miesfeld > > > On Mon, Dec 9, 2013 at 12:46 PM, Perry Werneck <[email protected]> > wrote: >> >> Hi, >> >> It´s the only errors for now. Probably it will show a few other warning >> when they´re fixed because the package build just stops with this erros. >> >> I was able to "fix" the second error just adding a "return 0;" line in >> the last line of the affected method (not sure if it´s the right thing to do >> but, at least, the return isn´t random anymore). >> >> The first one it´s a little trick to me because seens like they´re macro >> calls. >> >> >> >> 2013/12/9 Mark Miesfeld <[email protected]> >>> >>> The first warning about strncat() is correct. The code does open up a >>> possible buffer overflow. >>> >>> The second warning is valid on the face of it, it is possible to return >>> from the non-void function without returning an explicit value. But, I >>> think cmdparse.ypp is produced by lex (or flex.) I'm not sure that needs to >>> be changed. >>> >>> Are those the only 2 warnings produced? >>> >>> -- >>> Mark Miesfeld >>> >>> >>> >>> On Mon, Dec 9, 2013 at 11:47 AM, Perry Werneck <[email protected]> >>> wrote: >>>> >>>> Hi, >>>> >>>> I got a few errors during the validation of the OpenSUSE install package >>>> for the ooRexx 4.2.0 beta: >>>> >>>> [ 189s] I: Statement might be overflowing a buffer in strncat. Common >>>> mistake: >>>> [ 189s] BAD: strncat(buffer,charptr,sizeof(buffer)) is wrong, it >>>> takes the left over size as 3rd argument >>>> [ 189s] GOOD: >>>> strncat(buffer,charptr,sizeof(buffer)-strlen(buffer)-1) >>>> [ 189s] E: ooRexx bufferoverflowstrncat >>>> ./interpreter/platform/unix/SysFileSystem.cpp:424:55 >>>> [ 189s] >>>> [ 189s] I: Program returns random data in a function >>>> [ 189s] E: ooRexx no-return-in-nonvoid-function >>>> ./extensions/hostemu/cmdparse.ypp:289 >>>> [ 189s] >>>> >>>> >>>> >>>> >>>> 2013/12/9 Mark Miesfeld <[email protected]> >>>>> >>>>> All - >>>>> >>>>> The Open Object Rexx Project is extremely happy to announce the first >>>>> ooRexx 4.2.0 beta. The first beta installation packages are available on >>>>> SourceForge at: >>>>> >>>>> >>>>> https://sourceforge.net/projects/oorexx/files/oorexx/4.2.0%20%28beta%29/? >>>>> >>>>> Installer packages are available for a few operating systems now. >>>>> Additional files will be added shortly, as they become available. >>>>> >>>>> ooRexx 4.2.0 is an enhancement and bug fix release. The first new >>>>> feature release in some time. There are a large number of new feature >>>>> requests that have been implemented in this release. In addition, many >>>>> reported bugs have been fixed. Please read the CHANGES document for a list >>>>> of the bug tracker items fixed and the feature request tracker items that >>>>> have been implemented. >>>>> >>>>> Please test the beta and report any issues uncovered on the SourceForge >>>>> bug tracker at: >>>>> >>>>> https://sourceforge.net/p/oorexx/bugs/ >>>>> >>>>> Note that the development team is limited both in resources and >>>>> numbers. Most members of the team run with the 4.2.0 code on their system >>>>> every day and have been continually testing ooRexx 4.2.0 since the release >>>>> of ooRexx 4.1.0. The bugs that the developers are likely to find, have >>>>> been >>>>> found and fixed. The bugs that currently exist in 4.2.0 need to be found >>>>> by >>>>> the users of ooRexx. >>>>> >>>>> The users of ooRexx are strongly urged to, at a minimum, run the Rexx >>>>> programs they use under the beta code. Bugs discovered during the beta >>>>> phase of ooRexx 4.2.0 will be fixed before the final release of 4.2.0. >>>>> Bugs >>>>> discovered the day after the final release will not make it into an >>>>> official >>>>> release of ooRexx for quite some time. >>>>> >>>>> Thank you, >>>>> The ooRexx Project Team >>>>> >>>>> >>>>> ------------------------------------------------------------------------------ >>>>> Sponsored by Intel(R) XDK >>>>> Develop, test and display web and hybrid apps with a single code base. >>>>> Download it for free now! >>>>> >>>>> http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk >>>>> _______________________________________________ >>>>> Oorexx-devel mailing list >>>>> [email protected] >>>>> https://lists.sourceforge.net/lists/listinfo/oorexx-devel >>>>> >>>> >>>> >>>> >>>> -- >>>> Perry Werneck >>>> Brasília/DF >>>> >>>> >>>> ------------------------------------------------------------------------------ >>>> Sponsored by Intel(R) XDK >>>> Develop, test and display web and hybrid apps with a single code base. >>>> Download it for free now! >>>> >>>> http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk >>>> _______________________________________________ >>>> Oorexx-devel mailing list >>>> [email protected] >>>> https://lists.sourceforge.net/lists/listinfo/oorexx-devel >>>> >>> >>> >>> >>> ------------------------------------------------------------------------------ >>> Sponsored by Intel(R) XDK >>> Develop, test and display web and hybrid apps with a single code base. >>> Download it for free now! >>> >>> http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk >>> _______________________________________________ >>> Oorexx-devel mailing list >>> [email protected] >>> https://lists.sourceforge.net/lists/listinfo/oorexx-devel >>> >> >> >> >> -- >> Perry Werneck >> Brasília/DF >> >> >> ------------------------------------------------------------------------------ >> Sponsored by Intel(R) XDK >> Develop, test and display web and hybrid apps with a single code base. >> Download it for free now! >> >> http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk >> _______________________________________________ >> Oorexx-devel mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/oorexx-devel >> > > > ------------------------------------------------------------------------------ > Sponsored by Intel(R) XDK > Develop, test and display web and hybrid apps with a single code base. > Download it for free now! > http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk > _______________________________________________ > Oorexx-devel mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/oorexx-devel > -- Perry Werneck Brasília/DF ------------------------------------------------------------------------------ Rapidly troubleshoot problems before they affect your business. Most IT organizations don't have a clear picture of how application performance affects their revenue. With AppDynamics, you get 100% visibility into your Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro! http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk _______________________________________________ Oorexx-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/oorexx-devel
