Hello community, here is the log from the commit of package liblouis for openSUSE:Factory checked in at 2018-06-02 11:55:17 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/liblouis (Old) and /work/SRC/openSUSE:Factory/.liblouis.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "liblouis" Sat Jun 2 11:55:17 2018 rev:35 rq:612861 version:3.5.0 Changes: -------- --- /work/SRC/openSUSE:Factory/liblouis/liblouis.changes 2018-03-08 10:48:31.092736571 +0100 +++ /work/SRC/openSUSE:Factory/.liblouis.new/liblouis.changes 2018-06-02 11:55:21.464936881 +0200 @@ -1,0 +2,46 @@ +Fri May 25 13:06:31 UTC 2018 - kbabi...@suse.com + +- Added CVE-2018-11410.patch: Fix a buffer overflow in table parsing + (bsc#1094685 CVE-2018-11410). + +------------------------------------------------------------------- +Fri May 25 12:48:28 UTC 2018 - kbabi...@suse.com + +- Updated to version 3.5.0: + - New features + - The same name can now be used in more than one ~class~ rule. The effect + is that both set of characters become part of that one class. + - Bug fixes + - Fix a regression in inputPositions thanks to Bert Frees + - Treat characters within the range ~compbrlStart~ and ~compbrlEnd~ as a + special case. This fixes many if not most of the problems with cursor + position and the ~compbrlAtCursor~ mode. Thanks to Dave Mielke. + - Fix ~swapdd~ opcode thanks to Bert Frees + - Fix negation of attribute matcher in multipass expressions thanks to Bert Frees + - Braille table improvements + - Backwards incompatible changes + - The translation mode ~comp8Dots~ has been removed as it was never really + implemented anyway + - Support for the ~pass1Only~ flag has now been removed. Thanks to Bue + Vester-Andersen. + - The old UEB tables ~UEBC-g1.ctb~ and ~UEBC-g2.ctb~ have been removed as + the have been superseded by ~en-ueb-g1.ctb~ and ~en-ueb-g2.ctb~. + - The french tables ~fr-2007.ctb~, ~fr-fr-g1.utb~, ~fr-fr-g2.ctb~, + ~fr-ca-g1.utb~ and ~fr-ca-g2.ctb~ have been removed. Use + ~fr-bfu-comp6.utb~ for 6 dots literary, ~fr-bfu-comp8.utb~ for 8 dots computer + and ~fr-bfu-g2.ctb~ for contracted braille instead. + +- Updated to version 3.4.0: + - New features + - Add support for ~inputPos~ and ~outputPos~ checking in + ~lou_checkyaml~ thanks to Bue Vester-Andersen. See the manual for + details and examples. + - Bug fixes + - output positions (~outputPos~) are now calculated based on input + positions (~inputPos~) thanks to Bert Frees. This avoids a whole + class of bugs that previously plagued the output positions. This fix + also obviates the need for the ~pass1Only~ flag. See below for the + deprecation notice. + - Braille table improvements + +------------------------------------------------------------------- Old: ---- liblouis-3.3.0.tar.gz New: ---- CVE-2018-11410.patch liblouis-3.5.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ liblouis.spec ++++++ --- /var/tmp/diff_new_pack.R5boLx/_old 2018-06-02 11:55:23.128875848 +0200 +++ /var/tmp/diff_new_pack.R5boLx/_new 2018-06-02 11:55:23.128875848 +0200 @@ -17,13 +17,14 @@ Name: liblouis -Version: 3.3.0 +Version: 3.5.0 Release: 0 Summary: Two-way braille translator License: LGPL-3.0-or-later Group: Productivity/Other URL: http://liblouis.org/ Source0: https://github.com/liblouis/liblouis/releases/download/v%{version}/liblouis-%{version}.tar.gz +Patch0: CVE-2018-11410.patch BuildRequires: fdupes BuildRequires: pkgconfig BuildRequires: python-rpm-macros @@ -121,6 +122,7 @@ %prep %setup -q +%patch0 -p1 %build %configure --disable-static --enable-ucs4 ++++++ CVE-2018-11410.patch ++++++ >From ed6b00aea08005945c9ae8a4a4503acc43f3a844 Mon Sep 17 00:00:00 2001 From: Samuel Thibault <samuel.thiba...@labri.fr> From: Karol Babioch <kbabi...@suse.de> Upstream: merged Date: Fri, 25 May 2018 10:25:33 +0200 Subject: [PATCH] Fix a buffer overflow in table parsing Fixes #573 --- liblouis/pattern.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) Index: liblouis-3.5.0/liblouis/pattern.c =================================================================== --- liblouis-3.5.0.orig/liblouis/pattern.c +++ liblouis-3.5.0/liblouis/pattern.c @@ -708,6 +708,8 @@ pattern_compile_expression(const widecha expr_crs, loop_cnts)) return 0; + if (*expr_crs + 3 >= expr_max) return 0; + EXPR_NXT(expr_sub) = *expr_crs; /* create end expression */ @@ -720,7 +722,7 @@ pattern_compile_expression(const widecha case '+': - if (*expr_crs + 4 >= expr_max) return 0; + if (*expr_crs + 5 >= expr_max) return 0; EXPR_TYPE(*expr_crs) = PTN_ONE_MORE; EXPR_DATA_1(*expr_crs) = (*loop_cnts)++; (*input_crs)++; @@ -728,7 +730,7 @@ pattern_compile_expression(const widecha case '*': - if (*expr_crs + 4 >= expr_max) return 0; + if (*expr_crs + 5 >= expr_max) return 0; EXPR_TYPE(*expr_crs) = PTN_ZERO_MORE; EXPR_DATA_1(*expr_crs) = (*loop_cnts)++; (*input_crs)++; ++++++ liblouis-3.3.0.tar.gz -> liblouis-3.5.0.tar.gz ++++++ /work/SRC/openSUSE:Factory/liblouis/liblouis-3.3.0.tar.gz /work/SRC/openSUSE:Factory/.liblouis.new/liblouis-3.5.0.tar.gz differ: char 5, line 1
