Hello community, here is the log from the commit of package lzo.2899 for openSUSE:13.1:Update checked in at 2014-07-21 09:20:26 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.1:Update/lzo.2899 (Old) and /work/SRC/openSUSE:13.1:Update/.lzo.2899.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "lzo.2899" Changes: -------- New Changes file: --- /dev/null 2014-06-12 08:28:52.960034756 +0200 +++ /work/SRC/openSUSE:13.1:Update/.lzo.2899.new/lzo.changes 2014-07-21 09:20:27.000000000 +0200 @@ -0,0 +1,143 @@ +------------------------------------------------------------------- +Tue Jul 1 13:32:52 UTC 2014 - mrueck...@suse.de + +- added lzo-integer_overflow.patch: (bnc#883947) CVE-2014-4607 + DoS or possible RCE by allowing an attacker to change + control flow. + +------------------------------------------------------------------- +Tue Apr 16 12:26:44 UTC 2013 - mmeis...@suse.com + +- Added url as source. + Please see http://en.opensuse.org/SourceUrls + +------------------------------------------------------------------- +Mon Aug 27 14:57:29 UTC 2012 - cfarr...@suse.com + +- license update: GPL-2.0+ + No GPL-2.0 "only" licenses found in the package + +------------------------------------------------------------------- +Sat Feb 11 19:32:14 UTC 2012 - crrodrig...@opensuse.org + +- move libraries back to %{_libdir}, /usr merge project + +------------------------------------------------------------------- +Sun Sep 25 17:06:01 UTC 2011 - crrodrig...@opensuse.org + +- Update to version 2.06 +* Some minor optimizations for big-endian architectures. +* Fixed overly strict malloc() misalignment check in examples. + +------------------------------------------------------------------- +Fri May 6 13:51:51 UTC 2011 - crrodrig...@opensuse.org + +- Update to version 2.05 + * Converted the configure system to non-recursive Automake. + * Applied some overdue speed optimizations for modern x86/x64 architectures + and current compilers like gcc 4.6 and MSVC 2010. + +------------------------------------------------------------------- +Wed Dec 22 03:29:01 UTC 2010 - a...@suse.de + +- Fix specfile (remove deleted lzo-2.03-alias.patch). + +------------------------------------------------------------------- +Fri Nov 12 11:09:42 UTC 2010 - mrueck...@suse.de + +- update to 2.0.4 + * Fixed a gcc-4.5 aliasing issue in lzo_init(). + * Updated the configure system. + * Assorted cleanups. +- dropped lzo-2.03-alias.patch: + solved differently upstream +- dropped debug_package_requires define + +------------------------------------------------------------------- +Sat Oct 30 19:05:43 UTC 2010 - cristian.rodrig...@opensuse.org + +- Use GCC visibility. + +------------------------------------------------------------------- +Thu Feb 11 12:30:25 CET 2010 - rguent...@suse.de + +- fix aliasing problems + +------------------------------------------------------------------- +Sat Dec 19 16:48:18 CET 2009 - jeng...@medozas.de + +- add baselibs.conf as a source +- enable parallel build + +------------------------------------------------------------------- +Wed Jan 7 12:34:56 CET 2009 - o...@suse.de + +- obsolete old -XXbit packages (bnc#437293) + +------------------------------------------------------------------- +Fri Aug 22 15:55:23 CEST 2008 - mrueck...@suse.de + +- update to 2.03 + featuring major speedups for 64-bit architectures like AMD64, + minor overall speedups, portability enhancements for LLP64 + programming models, and lots of other small improvements +- dropped lzo-noexec.patch: fix included upstream +- split out liblzo2-2 +- move the lib to /%_lib + +------------------------------------------------------------------- +Thu Apr 10 12:54:45 CEST 2008 - r...@suse.de + +- added baselibs.conf file to build xxbit packages + for multilib support + +------------------------------------------------------------------- +Mon Feb 25 06:27:57 CET 2008 - crrodrig...@suse.de + +- run ldconfig + +------------------------------------------------------------------- +Mon Feb 12 16:20:47 CET 2007 - meiss...@suse.de + +- added marker for nonexec stack/heap to i386 assembler. + +------------------------------------------------------------------- +Wed Sep 27 14:24:04 CEST 2006 - po...@suse.de + +- add BuildRequires: gcc-c++ for building on Fedora + +------------------------------------------------------------------- +Wed Jan 25 21:38:07 CET 2006 - m...@suse.de + +- converted neededforbuild to BuildRequires + +------------------------------------------------------------------- +Mon Jan 16 16:02:20 CET 2006 - mrueck...@suse.de + +- update to version 2.02 + +------------------------------------------------------------------- +Mon Sep 26 21:36:34 CEST 2005 - m...@suse.de + +- make devel package require base package + +------------------------------------------------------------------- +Tue Jun 28 10:59:59 CEST 2005 - cth...@suse.de + +- update to version 2.01 + +------------------------------------------------------------------- +Thu Jun 2 11:03:35 CEST 2005 - hvo...@suse.de + +- update to version 2.0 + +------------------------------------------------------------------- +Fri Jan 9 16:21:11 CET 2004 - adr...@suse.de + +- move devel files to -devel package + +------------------------------------------------------------------- +Wed Aug 20 14:37:01 CEST 2003 - c...@suse.de + +- initial release + New: ---- baselibs.conf lzo-2.06.tar.gz lzo-integer_overflow.patch lzo.changes lzo.spec ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ lzo.spec ++++++ # # spec file for package lzo # # Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed # upon. The license for this file, and modifications and additions to the # file, is the same license as for the pristine package itself (unless the # license for the pristine package is not an Open Source License, in which # case the license is the MIT License). An "Open Source License" is a # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. # Please submit bugfixes or comments via http://bugs.opensuse.org/ # Name: lzo Url: http://www.oberhumer.com/opensource/lzo/ Version: 2.06 Release: 0 Source: http://www.oberhumer.com/opensource/%{name}/download/%{name}-%{version}.tar.gz Source2: baselibs.conf Patch: lzo-integer_overflow.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: gcc-c++ # bug437293 %ifarch ppc64 Obsoletes: lzo-64bit %endif # Summary: A Real-Time Data Compression Library License: GPL-2.0+ Group: Development/Libraries/C and C++ %description LZO is a portable lossless data compression library written in ANSI C. It offers pretty fast compression and very fast decompression. Decompression requires no memory. LZO is suitable for data compression and decompression in real-time. This means it favors speed over compression ratio. Authors: -------- Markus Franz Xaver Johannes Oberhumer <mar...@oberhumer.com> %define library_package liblzo2-2 %package -n liblzo2-2 Summary: A Real-Time Data Compression Library Group: Development/Libraries/C and C++ Provides: lzo = %{version}-%{release} Obsoletes: lzo < %{version} # bug437293 %ifarch ppc64 Obsoletes: lzo-64bit %endif # %description -n liblzo2-2 LZO is a portable lossless data compression library written in ANSI C. It offers pretty fast compression and very fast decompression. Decompression requires no memory. LZO is suitable for data compression and decompression in real-time. This means it favors speed over compression ratio. Authors: -------- Markus Franz Xaver Johannes Oberhumer <mar...@oberhumer.com> %package devel Requires: %{library_package} = %{version} Summary: Development files for lzo Group: Development/Languages/C and C++ # bug437293 %ifarch ppc64 Obsoletes: lzo-devel-64bit %endif # %description devel LZO is a portable lossless data compression library written in ANSI C. It offers pretty fast compression and very fast decompression. Decompression requires no memory. LZO is suitable for data de-/compression in real-time. This means it favours speed over compression ratio. Authors: -------- Markus Franz Xaver Johannes Oberhumer <mar...@oberhumer.com> %prep %setup -q %patch -p1 %build export CFLAGS="%optflags -fvisibility=hidden" %configure --enable-shared \ --disable-static \ --disable-silent-rules \ --docdir=%{_docdir}/%{name}-devel #On windows, the build system defines __LZO_EXPORT1 to # __attribute__((dllexport))) which we can abuse to make #use of GCC visibility. ;-) #see http://gcc.gnu.org/wiki/Visibility #If you remove this, you must disable -fvisibility=hidden in CFLAGS! echo '#define __LZO_EXPORT1 __attribute__ ((visibility ("default")))' >> config.h %{__make} %{?_smp_mflags} %check %{__make} check test %install %makeinstall %{__rm} -v %{buildroot}%{_libdir}/liblzo2.la %clean %{__rm} -rf %{buildroot} %post -n %{library_package} -p /sbin/ldconfig %postun -n %{library_package} -p /sbin/ldconfig %files -n %{library_package} %defattr(-,root,root) %{_libdir}/liblzo2.so.* %files devel %defattr (-,root,root) %doc AUTHORS BUGS COPYING NEWS README THANKS %doc doc/* util/* %{_libdir}/liblzo2.so %_includedir/lzo %changelog ++++++ baselibs.conf ++++++ liblzo2-2 provides "lzo-<targettype> = <version>" obsoletes "lzo-<targettype> < <version>" lzo-devel requires -lzo-<targettype> requires "liblzo2-2-<targettype> = <version>" ++++++ lzo-integer_overflow.patch ++++++ --- a/minilzo/minilzo.c +++ a/minilzo/minilzo.c @@ -3547,6 +3547,8 @@ DO_COMPRESS ( const lzo_bytep in , lzo_uint in_len, #undef TEST_LBO #undef NEED_IP #undef NEED_OP +#undef TEST_IV +#undef TEST_OV #undef HAVE_TEST_IP #undef HAVE_TEST_OP #undef HAVE_NEED_IP @@ -3561,6 +3563,7 @@ DO_COMPRESS ( const lzo_bytep in , lzo_uint in_len, # if (LZO_TEST_OVERRUN_INPUT >= 2) # define NEED_IP(x) \ if ((lzo_uint)(ip_end - ip) < (lzo_uint)(x)) goto input_overrun +# define TEST_IV(x) if ((x) > (lzo_uint)0 - (511)) goto input_overrun # endif #endif @@ -3572,6 +3575,7 @@ DO_COMPRESS ( const lzo_bytep in , lzo_uint in_len, # undef TEST_OP # define NEED_OP(x) \ if ((lzo_uint)(op_end - op) < (lzo_uint)(x)) goto output_overrun +# define TEST_OV(x) if ((x) > (lzo_uint)0 - (511)) goto output_overrun # endif #endif @@ -3602,11 +3606,13 @@ DO_COMPRESS ( const lzo_bytep in , lzo_uint in_len, # define HAVE_NEED_IP 1 #else # define NEED_IP(x) ((void) 0) +# define TEST_IV(x) ((void) 0) #endif #if defined(NEED_OP) # define HAVE_NEED_OP 1 #else # define NEED_OP(x) ((void) 0) +# define TEST_OV(x) ((void) 0) #endif #if defined(HAVE_TEST_IP) || defined(HAVE_NEED_IP) @@ -3665,33 +3671,35 @@ DO_DECOMPRESS ( const lzo_bytep in , lzo_uint in_len, op = out; ip = in; + NEED_IP(1); if (*ip > 17) { t = *ip++ - 17; if (t < 4) goto match_next; - assert(t > 0); NEED_OP(t); NEED_IP(t+1); + assert(t > 0); NEED_OP(t); NEED_IP(t+3); do *op++ = *ip++; while (--t > 0); goto first_literal_run; } - while (TEST_IP && TEST_OP) + for (;;) { + NEED_IP(3); t = *ip++; if (t >= 16) goto match; if (t == 0) { - NEED_IP(1); while (*ip == 0) { t += 255; ip++; + TEST_IV(t); NEED_IP(1); } t += 15 + *ip++; } - assert(t > 0); NEED_OP(t+3); NEED_IP(t+4); + assert(t > 0); NEED_OP(t+3); NEED_IP(t+6); #if defined(LZO_UNALIGNED_OK_8) && defined(LZO_UNALIGNED_OK_4) t += 3; if (t >= 8) do @@ -3770,7 +3778,7 @@ first_literal_run: #endif goto match_done; - do { + for (;;) { match: if (t >= 64) { @@ -3830,14 +3838,15 @@ match: t &= 31; if (t == 0) { - NEED_IP(1); while (*ip == 0) { t += 255; ip++; + TEST_OV(t); NEED_IP(1); } t += 31 + *ip++; + NEED_IP(2); } #if defined(COPY_DICT) #if defined(LZO1Z) @@ -3874,14 +3883,15 @@ match: t &= 7; if (t == 0) { - NEED_IP(1); while (*ip == 0) { t += 255; ip++; + TEST_OV(t); NEED_IP(1); } t += 7 + *ip++; + NEED_IP(2); } #if defined(COPY_DICT) #if defined(LZO1Z) @@ -4014,16 +4024,10 @@ match_next: if (t > 1) { *op++ = *ip++; if (t > 2) { *op++ = *ip++; } } #endif t = *ip++; - } while (TEST_IP && TEST_OP); + } } -#if defined(HAVE_TEST_IP) || defined(HAVE_TEST_OP) - *out_len = pd(op, out); - return LZO_E_EOF_NOT_FOUND; -#endif - eof_found: - assert(t == 1); *out_len = pd(op, out); return (ip == ip_end ? LZO_E_OK : (ip < ip_end ? LZO_E_INPUT_NOT_CONSUMED : LZO_E_INPUT_OVERRUN)); @@ -4073,6 +4077,8 @@ lookbehind_overrun: #undef TEST_LBO #undef NEED_IP #undef NEED_OP +#undef TEST_IV +#undef TEST_OV #undef HAVE_TEST_IP #undef HAVE_TEST_OP #undef HAVE_NEED_IP @@ -4087,6 +4093,7 @@ lookbehind_overrun: # if (LZO_TEST_OVERRUN_INPUT >= 2) # define NEED_IP(x) \ if ((lzo_uint)(ip_end - ip) < (lzo_uint)(x)) goto input_overrun +# define TEST_IV(x) if ((x) > (lzo_uint)0 - (511)) goto input_overrun # endif #endif @@ -4098,6 +4105,7 @@ lookbehind_overrun: # undef TEST_OP # define NEED_OP(x) \ if ((lzo_uint)(op_end - op) < (lzo_uint)(x)) goto output_overrun +# define TEST_OV(x) if ((x) > (lzo_uint)0 - (511)) goto output_overrun # endif #endif @@ -4128,11 +4136,13 @@ lookbehind_overrun: # define HAVE_NEED_IP 1 #else # define NEED_IP(x) ((void) 0) +# define TEST_IV(x) ((void) 0) #endif #if defined(NEED_OP) # define HAVE_NEED_OP 1 #else # define NEED_OP(x) ((void) 0) +# define TEST_OV(x) ((void) 0) #endif #if defined(HAVE_TEST_IP) || defined(HAVE_NEED_IP) @@ -4191,33 +4201,35 @@ DO_DECOMPRESS ( const lzo_bytep in , lzo_uint in_len, op = out; ip = in; + NEED_IP(1); if (*ip > 17) { t = *ip++ - 17; if (t < 4) goto match_next; - assert(t > 0); NEED_OP(t); NEED_IP(t+1); + assert(t > 0); NEED_OP(t); NEED_IP(t+3); do *op++ = *ip++; while (--t > 0); goto first_literal_run; } - while (TEST_IP && TEST_OP) + for (;;) { + NEED_IP(3); t = *ip++; if (t >= 16) goto match; if (t == 0) { - NEED_IP(1); while (*ip == 0) { t += 255; ip++; + TEST_IV(t); NEED_IP(1); } t += 15 + *ip++; } - assert(t > 0); NEED_OP(t+3); NEED_IP(t+4); + assert(t > 0); NEED_OP(t+3); NEED_IP(t+6); #if defined(LZO_UNALIGNED_OK_8) && defined(LZO_UNALIGNED_OK_4) t += 3; if (t >= 8) do @@ -4296,7 +4308,7 @@ first_literal_run: #endif goto match_done; - do { + for (;;) { match: if (t >= 64) { @@ -4356,14 +4368,15 @@ match: t &= 31; if (t == 0) { - NEED_IP(1); while (*ip == 0) { t += 255; ip++; + TEST_OV(t); NEED_IP(1); } t += 31 + *ip++; + NEED_IP(2); } #if defined(COPY_DICT) #if defined(LZO1Z) @@ -4400,14 +4413,15 @@ match: t &= 7; if (t == 0) { - NEED_IP(1); while (*ip == 0) { t += 255; ip++; + TEST_OV(t); NEED_IP(1); } t += 7 + *ip++; + NEED_IP(2); } #if defined(COPY_DICT) #if defined(LZO1Z) @@ -4532,7 +4546,7 @@ match_done: break; match_next: - assert(t > 0); assert(t < 4); NEED_OP(t); NEED_IP(t+1); + assert(t > 0); assert(t < 4); NEED_OP(t); NEED_IP(t+3); #if 0 do *op++ = *ip++; while (--t > 0); #else @@ -4540,16 +4554,10 @@ match_next: if (t > 1) { *op++ = *ip++; if (t > 2) { *op++ = *ip++; } } #endif t = *ip++; - } while (TEST_IP && TEST_OP); + } } -#if defined(HAVE_TEST_IP) || defined(HAVE_TEST_OP) - *out_len = pd(op, out); - return LZO_E_EOF_NOT_FOUND; -#endif - eof_found: - assert(t == 1); *out_len = pd(op, out); return (ip == ip_end ? LZO_E_OK : (ip < ip_end ? LZO_E_INPUT_NOT_CONSUMED : LZO_E_INPUT_OVERRUN)); --- a/src/lzo1_d.ch +++ a/src/lzo1_d.ch @@ -76,6 +76,8 @@ #undef TEST_LBO #undef NEED_IP #undef NEED_OP +#undef TEST_IV +#undef TEST_OV #undef HAVE_TEST_IP #undef HAVE_TEST_OP #undef HAVE_NEED_IP @@ -91,6 +93,7 @@ # if (LZO_TEST_OVERRUN_INPUT >= 2) # define NEED_IP(x) \ if ((lzo_uint)(ip_end - ip) < (lzo_uint)(x)) goto input_overrun +# define TEST_IV(x) if ((x) > (lzo_uint)0 - (511)) goto input_overrun # endif #endif @@ -102,6 +105,7 @@ # undef TEST_OP /* don't need both of the tests here */ # define NEED_OP(x) \ if ((lzo_uint)(op_end - op) < (lzo_uint)(x)) goto output_overrun +# define TEST_OV(x) if ((x) > (lzo_uint)0 - (511)) goto output_overrun # endif #endif @@ -135,11 +139,13 @@ # define HAVE_NEED_IP 1 #else # define NEED_IP(x) ((void) 0) +# define TEST_IV(x) ((void) 0) #endif #if defined(NEED_OP) # define HAVE_NEED_OP 1 #else # define NEED_OP(x) ((void) 0) +# define TEST_OV(x) ((void) 0) #endif --- a/src/lzo1b_d.ch +++ a/src/lzo1b_d.ch @@ -187,6 +187,7 @@ match: { t += 255; ip++; + TEST_OV(t); NEED_IP(1); } t += (M4_MIN_LEN - M3_MIN_LEN) + *ip++; --- a/src/lzo1f_d.ch +++ a/src/lzo1f_d.ch @@ -84,6 +84,7 @@ DO_DECOMPRESS ( const lzo_bytep in , lzo_uint in_len, { t += 255; ip++; + TEST_IV(t); NEED_IP(1); } t += 31 + *ip++; @@ -138,6 +139,7 @@ match: { t += 255; ip++; + TEST_OV(t); NEED_IP(1); } t += 31 + *ip++; --- a/src/lzo1x_d.ch +++ a/src/lzo1x_d.ch @@ -97,35 +97,37 @@ DO_DECOMPRESS ( const lzo_bytep in , lzo_uint in_len, op = out; ip = in; + NEED_IP(1); if (*ip > 17) { t = *ip++ - 17; if (t < 4) goto match_next; - assert(t > 0); NEED_OP(t); NEED_IP(t+1); + assert(t > 0); NEED_OP(t); NEED_IP(t+3); do *op++ = *ip++; while (--t > 0); goto first_literal_run; } - while (TEST_IP && TEST_OP) + for (;;) { + NEED_IP(3); t = *ip++; if (t >= 16) goto match; /* a literal run */ if (t == 0) { - NEED_IP(1); while (*ip == 0) { t += 255; ip++; + TEST_IV(t); NEED_IP(1); } t += 15 + *ip++; } /* copy literals */ - assert(t > 0); NEED_OP(t+3); NEED_IP(t+4); + assert(t > 0); NEED_OP(t+3); NEED_IP(t+6); #if defined(LZO_UNALIGNED_OK_8) && defined(LZO_UNALIGNED_OK_4) t += 3; if (t >= 8) do @@ -208,7 +210,7 @@ first_literal_run: /* handle matches */ - do { + for (;;) { match: if (t >= 64) /* a M2 match */ { @@ -268,14 +270,15 @@ match: t &= 31; if (t == 0) { - NEED_IP(1); while (*ip == 0) { t += 255; ip++; + TEST_OV(t); NEED_IP(1); } t += 31 + *ip++; + NEED_IP(2); } #if defined(COPY_DICT) #if defined(LZO1Z) @@ -312,14 +315,15 @@ match: t &= 7; if (t == 0) { - NEED_IP(1); while (*ip == 0) { t += 255; ip++; + TEST_OV(t); NEED_IP(1); } t += 7 + *ip++; + NEED_IP(2); } #if defined(COPY_DICT) #if defined(LZO1Z) @@ -446,7 +450,7 @@ match_done: /* copy literals */ match_next: - assert(t > 0); assert(t < 4); NEED_OP(t); NEED_IP(t+1); + assert(t > 0); assert(t < 4); NEED_OP(t); NEED_IP(t+3); #if 0 do *op++ = *ip++; while (--t > 0); #else @@ -454,17 +458,10 @@ match_next: if (t > 1) { *op++ = *ip++; if (t > 2) { *op++ = *ip++; } } #endif t = *ip++; - } while (TEST_IP && TEST_OP); + } } -#if defined(HAVE_TEST_IP) || defined(HAVE_TEST_OP) - /* no EOF code was found */ - *out_len = pd(op, out); - return LZO_E_EOF_NOT_FOUND; -#endif - eof_found: - assert(t == 1); *out_len = pd(op, out); return (ip == ip_end ? LZO_E_OK : (ip < ip_end ? LZO_E_INPUT_NOT_CONSUMED : LZO_E_INPUT_OVERRUN)); --- a/src/lzo2a_d.ch +++ a/src/lzo2a_d.ch @@ -131,6 +131,7 @@ DO_DECOMPRESS ( const lzo_bytep in , lzo_uint in_len, { t += 255; ip++; + TEST_OV(t); NEED_IP(1); } t += *ip++; -- To unsubscribe, e-mail: opensuse-commit+unsubscr...@opensuse.org For additional commands, e-mail: opensuse-commit+h...@opensuse.org
