diff --git a/rmagick-create-full-tarball.sh b/rmagick-create-full-tarball.sh index 4a60f3a..50b8afd 100644 --- a/rmagick-create-full-tarball.sh +++ b/rmagick-create-full-tarball.sh @@ -6,16 +6,6 @@ then exit 1 fi -preserve_timestamps() -{ - while read f - do - unixtime=$(git log -n 1 --pretty='%ct' -- $f) - touch -d "@${unixtime}" $f - done < <(git ls-tree -r --name-only HEAD) - -} - set -x set -e @@ -40,7 +30,6 @@ VERSION_TAG=RMagick_${VERSION_TAG} git clone https://github.com/rmagick/$NAME.git pushd ${NAME} git reset --hard ${VERSION_TAG} -preserve_timestamps popd ln -sf ${NAME} ${NAME}-${VERSION} diff --git a/rmagick-pr1406-draw-memleak-CVE-2023-5349.patch b/rmagick-pr1406-draw-memleak-CVE-2023-5349.patch new file mode 100644 index 0000000..6297ceb --- /dev/null +++ b/rmagick-pr1406-draw-memleak-CVE-2023-5349.patch @@ -0,0 +1,23 @@ +From da823515a13130010f74678dc48f8b08a70cbd14 Mon Sep 17 00:00:00 2001 +From: Watson +Date: Sun, 16 Jul 2023 17:59:52 +0900 +Subject: [PATCH] Fix memory leak in `Magick::Draw` for recentry ImageMagick 6 + by removing unnecessary `GetDrawInfo()` calling + +--- + ext/RMagick/rmdraw.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/ext/RMagick/rmdraw.c b/ext/RMagick/rmdraw.c +index b71a3958d..c523a6238 100644 +--- a/ext/RMagick/rmdraw.c ++++ b/ext/RMagick/rmdraw.c +@@ -1420,8 +1420,6 @@ DrawOptions_initialize(VALUE self) + rb_raise(rb_eNoMemError, "not enough memory to continue"); + } + +- GetDrawInfo(NULL, draw_options->info); +- + if (rb_block_given_p()) + { + rb_yield(self); diff --git a/rubygem-rmagick.spec b/rubygem-rmagick.spec index 5d0da22..f200e01 100644 --- a/rubygem-rmagick.spec +++ b/rubygem-rmagick.spec @@ -8,7 +8,7 @@ Requires: (ImageMagick%{?_isa} >= %2 with ImageMagick%{?_isa} < %3)\ %{nil} Name: rubygem-%{gem_name} -Version: 6.1.5 +Version: 5.2.0 Release: 2%{?dist} Summary: Ruby binding to ImageMagick @@ -19,26 +19,25 @@ Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem # %%{SOURCE2} %%{version} Source1: rubygem-%{gem_name}-%{version}-full.tar.gz Source2: rmagick-create-full-tarball.sh +# https://github.com/rmagick/rmagick/pull/1406 +# Fix Magick::Draw memleak, CVE-2023-5349 +Patch0: rmagick-pr1406-draw-memleak-CVE-2023-5349.patch -BuildRequires: gcc-c++ +BuildRequires: gcc BuildRequires: rubygems-devel BuildRequires: ruby-devel BuildRequires: rubygem(pkg-config) -BuildRequires: rubygem(observer) BuildRequires: rubygem(test-unit) BuildRequires: rubygem(rspec) BuildRequires: rubygem(pry) -# Due to ext/RMagick/rmmain.cpp test_Magick_version(), for now +# Due to test/RMagick/rmmain.c test_Magick_version(), for now # we specify the exact version for ImageMagick -# -# With rmagick <= 5.5.0, ImageMagick X.Y.Z should all match, -# with rmagick >= 6.0.0, ImageMagick X.Y should match. %if 0%{?fedora} -%setIMver 45 1:7.1 1:7.2 -%setIMver 44 1:7.1 1:7.2 -%setIMver 43 1:7.1 1:7.2 -%setIMver 42 1:7.1 1:7.2 -%setIMver 41 1:7.1 1:7.2 +%setIMver 40 1:7.1.0 1:7.1.1 +%setIMver 39 1:7.1.0 1:7.1.1 +%setIMver 38 1:7.1.0 1:7.1.1 +%setIMver 37 1:6.9.12 1:6.9.13 +%setIMver 36 1:6.9.12 1:6.9.13 %endif Obsoletes: ruby-RMagick < 2.13.2 @@ -62,11 +61,20 @@ Documentation for %{name}. %prep %setup -q -T -n %{gem_name}-%{version} -b 1 +%patch -P0 -p1 gem spec %{SOURCE0} -l --ruby > %{gem_name}.gemspec # permission find . -name \*.rb -or -name \*.gif | xargs chmod ugo-x +# kill rpath +sed -i ext/RMagick/extconf.rb \ + -e '\@LDFLAGS@s|[ \t]*-Wl,-rpath,[^ \t][^ \t]*"|"|' + +# kill gcc optflags suppressing warnings +sed -i ext/RMagick/extconf.rb \ + -e "\@-std=gnu99@s|-Wno[^ \t'][^ \t']*||g" + %build export MAKE="make %{?_smp_mflags}" # Make sure that .so is to be created newly @@ -134,7 +142,6 @@ done %{gem_libdir}/ %{gem_extdir_mri}/ -%{gem_instdir}/sig/ %exclude %{gem_cache} %{gem_spec} @@ -145,90 +152,8 @@ done %doc %{gem_instdir}/examples/ %changelog -* Thu Jan 08 2026 Mamoru TASAKA - 6.1.5-2 -- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_4.0 - -* Sun Dec 28 2025 Mamoru TASAKA - 6.1.5-1 -- 6.1.5 - -* Wed Oct 29 2025 Mamoru TASAKA - 6.1.4-2 -- Apply upstream patch for ruby3_5 Ractor change for testsuite - -* Sun Aug 24 2025 Mamoru TASAKA - 6.1.4-1 -- 6.1.4 - -* Sun Aug 17 2025 Mamoru TASAKA - 6.1.3-1 -- 6.1.3 - -* Fri Jul 25 2025 Fedora Release Engineering - 6.1.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Sun Jul 20 2025 Mamoru TASAKA - 6.1.2-1 -- 6.1.2 - -* Sun Feb 02 2025 Mamoru TASAKA - 6.1.1-1 -- 6.1.1 - -* Sun Jan 19 2025 Mamoru TASAKA - 6.1.0-1 -- 6.1.0 - -* Sat Jan 18 2025 Fedora Release Engineering - 6.0.1-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Tue Jan 07 2025 Mamoru TASAKA - 6.0.1-4 -- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4 - -* Sat Nov 02 2024 Mamoru TASAKA - 6.0.1-3 -- Add BR: rubygem(observer) explicitly - -* Fri Jul 19 2024 Fedora Release Engineering - 6.0.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Thu May 16 2024 Mamoru TASAKA - 6.0.1-1 -- 6.0.1 - -* Fri May 03 2024 Mamoru TASAKA - 6.0.0-1 -- 6.0.0 - -* Mon Apr 08 2024 Mamoru TASAKA - 5.5.0-1 -- 5.5.0 - -* Fri Feb 16 2024 Mamoru TASAKA - 5.4.4-1 -- 5.4.4 - -* Wed Feb 14 2024 Mamoru TASAKA - 5.4.3-1 -- 5.4.3 - -* Tue Feb 13 2024 Mamoru TASAKA - 5.4.2-1 -- 5.4.2 - -* Tue Feb 06 2024 Mamoru TASAKA - 5.4.1-1 -- 5.4.1 - -* Mon Feb 05 2024 Mamoru TASAKA - 5.4.0-1 -- 5.4.0 - -* Fri Jan 26 2024 Fedora Release Engineering - 5.3.0-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sun Jan 21 2024 Mamoru TASAKA - 5.3.0-3 -- Backport upstream patch to fix test with ImageMagick 7.1.1-26 - -* Wed Jan 03 2024 Mamoru TASAKA - 5.3.0-2 -- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - -* Sun Jul 23 2023 Mamoru TASAKA - 5.3.0-1 -- 5.3.0 - -* Fri Jul 21 2023 Fedora Release Engineering - 5.2.0-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Sun Apr 30 2023 Mamoru TASAKA - 5.2.0-3 -- SPDX migration -- Fix crash on ImageList#write with animation gif (upstream bug 1379) - -* Thu Mar 23 2023 Mamoru TASAKA - 5.2.0-2 -- F-39: Rebuild against ImageMagick 7.1.1 +* Tue Oct 31 2023 Mamoru TASAKA - 5.2.0-2 +- Backport upstream patch for Magick::Draw memleak (CVE-2023-5349) * Mon Mar 13 2023 Mamoru TASAKA - 5.2.0-1 - 5.2.0 diff --git a/sources b/sources index 6a164e1..ebfa6fe 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (rmagick-6.1.5.gem) = 15157dda3185e8677c08d9b33564d1c85e3c3573ad9f6ab2358c32ec8a790eb2aa765cde095f98eb500cd818e3b71535dd289524eb35c9c5e721be3af4b1ba18 -SHA512 (rubygem-rmagick-6.1.5-full.tar.gz) = ce65bacd8e775fc4751784d427ab52a5b936ca5a465751d63380d42e0928911389f3388474c936eeb59d93d242c9923240168911705c1243b8e5d195d258fd8a +SHA512 (rmagick-5.2.0.gem) = 198b8dd1e715f21621ca2f01e1e340ea04097342252ec7312f2695ee54f367d28cda3184d20312296386aeb7a092d19e098a44c64efa560f8faa20275996ac46 +SHA512 (rubygem-rmagick-5.2.0-full.tar.gz) = f557df4a106970ca67430d5654ee4b8c90e34081b3940f8e8fb5c5eb41ddb3f5ab59af803ca72bb6c9626a9ba398ccc684834c664795e8a3209b3678c2759d54