diff --git a/.gitignore b/.gitignore index 3250452..e0379d8 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,10 @@ +clog /6fb87d6eb01b.tar.bz2 /fb6fca832fd2.tar.bz2 +/alanxz-rabbitmq-c-0.2-69-g2059570.tar.gz +/db13342f2443.tar.bz2 +/rabbitmq-c-v0.3.0.tar.gz +/rabbitmq-c-0.4.1.tar.gz +/rabbitmq-c-0.5.0.tar.gz +/rabbitmq-c-0.5.1.tar.gz +/rabbitmq-c-0.5.2.tar.gz diff --git a/librabbitmq.spec b/librabbitmq.spec index 38bb17d..a8965a8 100644 --- a/librabbitmq.spec +++ b/librabbitmq.spec @@ -1,27 +1,27 @@ -%global client_tag fb6fca832fd2 -%global codegen_tag 6fb87d6eb01b +# spec file for librabbitmq +# +# Copyright (c) 2012-2014 Remi Collet +# License: CC-BY-SA +# http://creativecommons.org/licenses/by-sa/3.0/ +# +# Please, preserve the changelog entries +# Name: librabbitmq -Summary: Client library and command line tools for AMPQ -Version: 0.1 -Release: 0.2.hg%{client_tag}%{?dist} -License: MPLv1.1 or GPLv2+ +Summary: Client library for AMQP +Version: 0.5.2 +Release: 2%{?dist} +License: MIT Group: System Environment/Libraries -URL: http://www.rabbitmq.com/ +URL: https://github.com/alanxz/rabbitmq-c -Source0: http://hg.rabbitmq.com/rabbitmq-c/archive/%{client_tag}.tar.bz2 -Source1: http://hg.rabbitmq.com/rabbitmq-codegen/archive/%{codegen_tag}.tar.bz2 +Source0: https://github.com/alanxz/rabbitmq-c/releases/download/v%{version}/rabbitmq-c-%{version}.tar.gz +Patch0: rabbitmq-c-0.5.2-CVE-2019-18609.patch - -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: libtool -BuildRequires: python-simplejson +BuildRequires: openssl-devel # For tools -%if 0%{?rhel} == 5 -BuildRequires: popt -%else BuildRequires: popt-devel -%endif # For man page BuildRequires: xmlto @@ -30,13 +30,6 @@ BuildRequires: xmlto This is a C-language AMQP client library for use with AMQP servers speaking protocol versions 0-9-1. -It also provides several command line tools: -amqp-consume Consume messages from a queue on an AMQP server -amqp-declare-queue Declare a queue on an AMQP server -amqp-delete-queue Delete a queue from an AMQP server -amqp-get Get a message from a queue on an AMQP server -amqp-publish Publish a message on an AMQP server - %package devel Summary: Header files and development libraries for %{name} @@ -45,68 +38,113 @@ Requires: %{name}%{?_isa} = %{version}-%{release} %description devel This package contains the header files and development libraries -for %{name}. +for %{name}. + + +%package tools +Summary: Example tools built using the librabbitmq package +Group: Development/Libraries +Requires: %{name}%{?_isa} = %{version} + +%description tools +This package contains example tools built using %{name}. + +It provides: +amqp-consume Consume messages from a queue on an AMQP server +amqp-declare-queue Declare a queue on an AMQP server +amqp-delete-queue Delete a queue from an AMQP server +amqp-get Get a message from a queue on an AMQP server +amqp-publish Publish a message on an AMQP server %prep -%setup -qc -a 1 - -mv rabbitmq-c-%{client_tag} rabbitmq-c - -mv rabbitmq-codegen-%{codegen_tag} rabbitmq-codegen -ln rabbitmq-codegen/amqp-rabbitmq-0.9.1.json rabbitmq-codegen/amqp-0.9.1.json +%setup -q -n rabbitmq-c-%{version} +%patch0 -p1 -b .CVE-2019-18609 # Copy sources to be included in -devel docs. -cp -pr rabbitmq-c/examples examples +cp -pr examples Examples %build -cd rabbitmq-c autoreconf -i -%configure +%configure \ + --enable-tools \ + --enable-docs \ + --with-ssl=openssl + +# rpath removal +sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool +sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool + make %{_smp_mflags} %install -rm -rf %{buildroot} -cd rabbitmq-c make install DESTDIR="%{buildroot}" -rm %{buildroot}%{_libdir}/%{name}.{a,la} +rm %{buildroot}%{_libdir}/%{name}.la %check -cd rabbitmq-c +: check .pc is usable +grep @ %{buildroot}%{_libdir}/pkgconfig/librabbitmq.pc && exit 1 + +: upstream tests +export LD_LIBRARY_PATH=%{buildroot}%{_libdir} make check -%clean -rm -rf %{buildroot} - - %post -p /sbin/ldconfig - %postun -p /sbin/ldconfig - + %files -%defattr (-,root,root,-) -%doc rabbitmq-c/{AUTHORS,COPYING,README,THANKS,TODO,LICENSE*} -%{_libdir}/%{name}.so.* -%{_bindir}/amqp* -%{_mandir}/man1/amqp* -%{_mandir}/man7/%{name}* +%{!?_licensedir:%global license %%doc} +%license LICENSE-MIT +%{_libdir}/%{name}.so.1* %files devel -%defattr (-,root,root,-) -%doc examples +%doc AUTHORS THANKS TODO *.md +%doc Examples %{_libdir}/%{name}.so %{_includedir}/amqp* +%{_libdir}/pkgconfig/librabbitmq.pc + +%files tools +%{_bindir}/amqp-* +%doc %{_mandir}/man1/amqp-*.1* +%doc %{_mandir}/man7/librabbitmq-tools.7* %changelog +* Thu Apr 02 2020 Than Ngo - 0.5.2-2 +- Resolves: #1809991 - CVE-2019-18609, integer overflow + +* Mon Sep 15 2014 Remi Collet - 0.5.2-1 +- update to 0.5.2 + +* Wed Aug 13 2014 Remi Collet - 0.5.1-1 +- update to 0.5.1 +- fix license handling +- move all documentation in devel subpackage + +* Tue Apr 15 2014 Remi Collet - 0.5.0-2 +- upstream patch for missing function + +* Mon Feb 17 2014 Remi Collet - 0.5.0-1 +- update to 0.5.0 +- open https://github.com/alanxz/rabbitmq-c/issues/169 (version is 0.5.1-pre) +- open https://github.com/alanxz/rabbitmq-c/issues/170 (amqp_get_server_properties) +- drop BR python-simplejson +- add ssl support + +* Thu Aug 1 2013 Remi Collet - 0.3.0-1 +- update to 0.3.0 +- create sub-package for tools +- License is now MIT + * Sun Mar 11 2012 Remi Collet - 0.1-0.2.hgfb6fca832fd2 - add %%check (per review comment) diff --git a/rabbitmq-c-0.5.2-CVE-2019-18609.patch b/rabbitmq-c-0.5.2-CVE-2019-18609.patch new file mode 100644 index 0000000..7e02d14 --- /dev/null +++ b/rabbitmq-c-0.5.2-CVE-2019-18609.patch @@ -0,0 +1,28 @@ +diff -up rabbitmq-c-0.5.2/librabbitmq/amqp_connection.c.me rabbitmq-c-0.5.2/librabbitmq/amqp_connection.c +--- rabbitmq-c-0.5.2/librabbitmq/amqp_connection.c.me 2020-04-02 14:53:17.103227801 +0200 ++++ rabbitmq-c-0.5.2/librabbitmq/amqp_connection.c 2020-04-02 14:55:12.931800875 +0200 +@@ -276,11 +276,21 @@ int amqp_handle_input(amqp_connection_st + case CONNECTION_STATE_HEADER: { + amqp_channel_t channel; + amqp_pool_t *channel_pool; +- /* frame length is 3 bytes in */ ++ uint32_t frame_size; ++ + channel = amqp_d16(raw_frame, 1); + +- state->target_size +- = amqp_d32(raw_frame, 3) + HEADER_SIZE + FOOTER_SIZE; ++ /* frame length is 3 bytes in */ ++ frame_size = amqp_d32(raw_frame, 3); ++ /* To prevent the target_size calculation below from overflowing, check ++ * that the stated frame_size is smaller than a signed 32-bit. Given ++ * the library only allows configuring frame_max as an int32_t, and ++ * frame_size is uint32_t, the math below is safe from overflow. */ ++ if (frame_size >= INT32_MAX) { ++ return AMQP_STATUS_BAD_AMQP_DATA; ++ } ++ ++ state->target_size = frame_size + HEADER_SIZE + FOOTER_SIZE; + + if ((size_t)state->frame_max < state->target_size) { + return AMQP_STATUS_BAD_AMQP_DATA; diff --git a/sources b/sources index 865bb43..883d5b3 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -c96d5397911fa4029a03d8d40d90158a 6fb87d6eb01b.tar.bz2 -45c682111c87e70c3f9f5f000760ac60 fb6fca832fd2.tar.bz2 +aa8d4d0b949f508c0da25a9c20bd7da7 rabbitmq-c-0.5.2.tar.gz