Compare commits

..

2 commits

Author SHA1 Message Date
Zamir SUN
6f1bd7e45f Update in epel7
Signed-off-by: Zamir SUN <sztsian@gmail.com>
2019-09-20 13:10:47 +08:00
Than Ngo
557fcbe5ec bz#1451069 - CVE-2017-8933 menu-cache: Insecure temporary file creation in get_socket_name function 2017-05-16 10:28:08 +02:00
5 changed files with 84 additions and 216 deletions

12
.gitignore vendored
View file

@ -1,2 +1,10 @@
/menu-cache-*.tar.xz
/menu-cache-*.tar.gz
menu-cache-0.3.2.tar.gz
/menu-cache-0.3.3.tar.gz
/menu-cache-0.4.1.tar.gz
/menu-cache-0.5.1.tar.gz
/menu-cache-1.0.0.tar.xz
/menu-cache-1.0.0-D20151117git2d65876eb6948f122b35241d6611cf0f009b6f79.tar.gz
/menu-cache-1.0.0-D20151126git7e63ae3f66c30a4516bf04139fd98a3856e6a065.tar.gz
/menu-cache-1.0.0-D20151128git0b1e85c263f571f61384c7eb81c7edc2a69335dc.tar.gz
/menu-cache-1.0.1.tar.xz
/menu-cache-1.1.0.tar.xz

View file

@ -1,27 +0,0 @@
#!/bin/bash
set -x
set -e
REPONAME=menu-cache
GITURL=https://github.com/lxde/${REPONAME}.git
DATE=$(date '+%Y%m%d')
TIME=$(date '+%H%M')
TARNAME=${REPONAME}-${DATE}T${TIME}.tar.gz
PWDDIR=$(pwd)
TMPDIR=$(mktemp -d /var/tmp/libfm-XXXXXX)
pushd $TMPDIR
git clone --mirror $GITURL
tar czf ${TARNAME} ${REPONAME}.git/
pushd ${REPONAME}.git/
git log --format=fuller | head -n 12
popd
cp -p ${TARNAME} $PWDDIR
popd
rm -rf $TMPDIR

View file

@ -0,0 +1,30 @@
diff -up menu-cache-1.0.1/libmenu-cache/menu-cache.c.than menu-cache-1.0.1/libmenu-cache/menu-cache.c
--- menu-cache-1.0.1/libmenu-cache/menu-cache.c.than 2017-05-16 10:13:56.948205062 +0200
+++ menu-cache-1.0.1/libmenu-cache/menu-cache.c 2017-05-16 10:20:10.018120833 +0200
@@ -1522,8 +1522,13 @@ static void get_socket_name( char* buf,
if(*p)
*p = '\0';
}
+#if GLIB_CHECK_VERSION(2, 28, 0)
+ g_snprintf( buf, len, "%s/menu-cached-%s", g_get_user_runtime_dir(),
+ dpy ? dpy : ":0" );
+#else
g_snprintf( buf, len, "%s/.menu-cached-%s-%s", g_get_tmp_dir(),
dpy ? dpy : ":0", g_get_user_name() );
+#endif
g_free(dpy);
}
diff -up menu-cache-1.0.1/menu-cache-daemon/menu-cached.c.than menu-cache-1.0.1/menu-cache-daemon/menu-cached.c
--- menu-cache-1.0.1/menu-cache-daemon/menu-cached.c.than 2017-05-16 10:20:20.881710708 +0200
+++ menu-cache-1.0.1/menu-cache-daemon/menu-cached.c 2017-05-16 10:24:27.959382969 +0200
@@ -446,6 +446,9 @@ static void get_socket_name( char* buf,
if(*p)
*p = '\0';
}
+ /* NOTE: this socket name is incompatible with versions > 1.0.2,
+ although this function is never used since 0.7.0 but
+ libmenu-cache always requests exact socket name instead */
g_snprintf( buf, len, "%s/.menu-cached-%s-%s", g_get_tmp_dir(),
dpy ? dpy : ":0", g_get_user_name() );
g_free(dpy);

View file

@ -1,61 +1,44 @@
%global use_release 1
%global use_git 0
%global use_gitbare 0
%global usegit 0
%global mainrel 1
%if 0%{?use_git} < 1
%if 0%{?use_gitbare} < 1
# force
%global use_release 1
%global githash 8c8534159d4898935b47f9103cf32cd9b21b3df5
%global shorthash %(TMP=%githash ; echo ${TMP:0:10})
%global gitdate Thu, 14 Sep 2017 00:32:14 +0300
%global gitdate_num 20170914
%if 0%{?usegit} >= 1
%global fedorarel %{mainrel}.D%{gitdate_num}git%{shorthash}
%else
%global fedorarel %{?prever:0.}%{mainrel}%{?prever:.%{prerpmver}}
%endif
%endif
%global git_version %{nil}
%global git_ver_rpm %{nil}
%global git_builddir %{nil}
%if 0%{?use_gitbare}
%global gittardate 20250209
%global gittartime 1612
%global gitbaredate 20250128
%global git_rev 18bad9324b9e8990c73a67cee9b87d551d34be91
%global git_short %(echo %{git_rev} | cut -c-8)
%global git_version %{gitbaredate}git%{git_short}
%endif
%if 0%{?use_git} || 0%{?use_gitbare}
%global git_ver_rpm ^%{git_version}
%global git_builddir -%{git_version}
%endif
%global main_version 1.1.1
Name: menu-cache
Version: %{main_version}%{git_ver_rpm}
Release: 2%{?dist}
Version: 1.1.0
Release: %{fedorarel}%{?dist}.5
Summary: Caching mechanism for freedesktop.org compliant menus
# SPDX confirmed
License: LGPL-2.0-or-later
Group: System Environment/Libraries
License: LGPLv2+ and GPLv2+
URL: http://lxde.org
%if 0%{?use_gitbare}
Source0: %{name}-%{gittardate}T%{gittartime}.tar.gz
#VCS: git:git://lxde.git.sourceforge.net/gitroot/lxde/menu-cache
%if 0%{?usegit} >= 1
Source0: https://github.com/lxde/menu-cache/archive/%{githash}/%{name}-%{version}-D%{gitdate_num}git%{githash}.tar.gz
%else
Source0: http://downloads.sourceforge.net/lxde/%{name}-%{version}.tar.xz
%endif
%if 0%{?use_release}
Source0: https://github.com/lxde/%{name}/archive/%{version}/%{name}-%{version}.tar.gz
%if 0%{?el7}
# bz#1451069 - CVE-2017-8933 menu-cache: Insecure temporary file creation in get_socket_name function
Patch0: menu-cache-CVE-2017-8933.patch
%endif
Source1: create-menu-cache-git-bare-tarball.sh
BuildRequires: make
BuildRequires: gcc
BuildRequires: pkgconfig(glib-2.0)
BuildRequires: pkgconfig(libfm-extra)
%if 0%{?usegit} >= 1
BuildRequires: automake
BuildRequires: gtk-doc
BuildRequires: libtool
BuildRequires: /usr/bin/git
%endif
%description
Menu-cache is a caching mechanism for freedesktop.org compliant menus to
@ -64,6 +47,7 @@ components of the LXDE desktop environment such as LXPanel or LXLauncher.
%package devel
Summary: Development files for %{name}
Group: Development/Libraries
Requires: %{name}%{?_isa} = %{version}-%{release}
%description devel
@ -72,45 +56,27 @@ developing applications that use %{name}.
%prep
%if 0%{?use_release}
%setup -q -n %{name}-%{main_version}%{git_builddir}
git init
%endif
%if 0%{?use_gitbare}
%setup -q -c -T -n %{name}-%{main_version}%{git_builddir} -a 0
git clone ./%{name}.git/
cd %{name}
git checkout -b %{main_version}-fedora %{git_rev}
cp -a [A-Z]* ..
%endif
git config user.name "%{name} Fedora maintainer"
git config user.email "%{name}-maintainers@fedoraproject.org"
%if 0%{?use_release}
git add .
git commit -m "base" -q
%if 0%{?usegit} >= 1
%setup -q -n %{name}-%{githash}
%else
%setup -q
%endif
%if 0%{?usegit} >= 1
sh autogen.sh
%endif
%build
%if 0%{?use_gitbare}
cd %{name}
%endif
%configure --disable-static --disable-silent-rules
%make_build
# remove rpath in menu-cache-gen
#sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
#sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
make %{?_smp_mflags}
%install
%if 0%{?use_gitbare}
cd %{name}
%endif
%make_install
make install DESTDIR=%{buildroot}
find %{buildroot} -name '*.la' -exec rm -f {} ';'
%ldconfig_scriptlets
@ -120,7 +86,9 @@ find %{buildroot} -name '*.la' -exec rm -f {} ';'
#FIXME: add ChangeLog and NEWS if there is content
%doc AUTHORS
%license COPYING
%if 0%{?usegit} < 1
%doc NEWS
%endif
%doc README
%{_libexecdir}/%{name}/menu-cache-gen
%{_libexecdir}/%{name}/menu-cached
@ -136,126 +104,15 @@ find %{buildroot} -name '*.la' -exec rm -f {} ';'
%changelog
* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Sun Feb 16 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.1.1-1
- 1.1.1
* Sun Feb 09 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.1.0^20250128git18bad932-1
- Update to the latest git
* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0^20240821git83d90343-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Sun Aug 25 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.1.0^20240821git83d90343-1
- Update to the latest git
* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0^20230724git4a82095c-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0^20230724git4a82095c-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0^20230724git4a82095c-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Mon Aug 21 2023 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.1.0^20230724git4a82095c-1
- Update to the latest git
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-2.9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Mon Jun 12 2023 Than Ngo <than@redhat.com> - 1.1.0-2.8
- migrated to SPDX license
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-2.7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-2.6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-2.5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-2.4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-2.3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-2.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-2.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Fri Jan 23 2020 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.1.0-2
- Fix compilation with gcc10 -fno-common
* Fri Sep 20 2019 Zamir SUN <sztsian@gmail.com> - 1.1.0-1.5
- Improve compatibility for epel7
- Remove changelog that is out-of-order
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-1.4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-1.3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-1.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Mon Nov 6 2017 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.1.0-1
- 1.1.0
* Fri Sep 22 2017 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.0.2-7.D20170914git8c8534159d
- Update to the latest git
* Wed Sep 13 2017 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.0.2-6.D20170913gitfd52af607c
- Update to the latest git
- Yet another possible fix for #7
* Thu Sep 7 2017 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.0.2-5.D20170905git2ef9df036c
- Update to the latest git
- github #13 #16
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.2-4.D20170514git56f6668459.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.2-4.D20170514git56f6668459.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Mon May 15 2017 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.0.2-4.D20170514git56f6668459
- Update to the latest git
- use runtime home directory for socket path
instead of tmpdir
* Sun Apr 23 2017 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.0.2-3.D20170419gitdffb1314ec
- Update to the latest git
- New API needed for new lxqt-runner (github #15)
* Tue Apr 18 2017 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.0.2-2.D20170417git54ab9e4576
- Update to the latest git
- Tentative fix for menu-cache-gen segv (sourceforge bug 863)
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.2-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
* Tue Nov 8 2016 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.0.2-1
- 1.0.2
* Sun Oct 23 2016 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.0.1-3.D20161021git441f0ca9a1
- Update to the latest git
* Sat Aug 13 2016 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.0.1-2.D20160506git2932d67f30
- Update to the latest git
- Backport 2 patches from my branch
- removal of monitored *.menu file triggers core dump (github#8)
- menu-cached utilize 100% CPU (github#7)
* Tue May 16 2017 Than Ngo <than@redhat.com> - 1.0.1-2
- bz#1451069 - CVE-2017-8933 menu-cache: Insecure temporary file creation in get_socket_name function
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.1-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

View file

@ -1 +1 @@
SHA512 (menu-cache-1.1.1.tar.gz) = a2ede5663946d13a2992196a8547319ffa252cf5e37ba76dad559deb18450797ac6d5910415226ab996eab2131a2aa715b091a023a8a1eb39c83ea47043976e1
SHA512 (menu-cache-1.1.0.tar.xz) = e4c6619ade7b9a1b97c1366bb94dffb9975be5664b193cf0c69cf9470ef7ae19bda3390d04d98ee9a5b1658ec48aa5c83508c26c347af689161ee67c076b3c9e