Modernize spec file

wmfrog-0.3.1-Fix-parsing-wmfrog-arguments.patch

@@ -0,0 +1,163 @@
+From 529c79dcfb0dc20c123865d1caf1142b085080d5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
+Date: Wed, 15 Feb 2017 15:05:35 +0100
+Subject: [PATCH] Fix parsing wmfrog arguments
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A command like "wmfrog -s KSEA -o 7 -tmp /home/stela010/tmp/wmfrog"
+crashed because the -tmp argument was bigger than a static buffer used
+for storing the argument value. There were similar issues with other
+argument values.
+
+This patch fixes it. It also fixes the fact that -tmp argument was
+always ignored and user's home directory was used instead.
+
+<https://bugzilla.redhat.com/show_bug.cgi?id=1422319>
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ Src/wmFrog.c | 66 +++++++++++++++++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 54 insertions(+), 12 deletions(-)
+
+diff --git a/Src/wmFrog.c b/Src/wmFrog.c
+index 24f795c..c422e55 100644
+--- a/Src/wmFrog.c
++++ b/Src/wmFrog.c
+@@ -12,6 +12,7 @@
+ /*
+  *   Includes
+  */
++#define _XOPEN_SOURCE 500 /* For strdup(3) */
+ #include <signal.h>
+ #include <stdio.h>
+ #include <math.h>
+@@ -74,7 +75,7 @@ int NeedsUpdate = 1;
+ int maxWind = MAX_WIND;
+ int timeOffset = TIME_OFFSET;
+ long UpdateDelay;
+-char* folder;
++char* folder = NULL;
+ int needsUpdate = 1;
+ 
+ /*
+@@ -91,7 +92,9 @@ int main(int argc, char *argv[]) {
+      */
+     ParseCMDLine(argc, argv);
+ 
+-    folder = GetTempDir(".wmapps");
++    if (NULL == folder) {
++        folder = GetTempDir(".wmapps");
++    }
+ 
+     initXwindow(argc, argv);
+ 
+@@ -343,7 +346,11 @@ void ParseCMDLine(int argc, char *argv[]) {
+                 print_usage();
+                 exit(-1);
+             }
+-            strcpy(folder, argv[++i]);
++            folder = strdup(argv[++i]);
++            if (NULL == folder) {
++                fprintf(stderr, "Not enough memory to copy -tmp argument.\n");
++                exit(-1);
++            }
+ 
+ 
+         } else if ((!strcmp(argv[i], "-station")) || (!strcmp(argv[i], "-s"))) {
+@@ -352,6 +359,10 @@ void ParseCMDLine(int argc, char *argv[]) {
+                 print_usage();
+                 exit(-1);
+             }
++            if (strlen(argv[i + 1]) >= sizeof(StationID)/sizeof(*StationID) - 1) {
++                fprintf(stderr, "METAR station ID is too long.\n");
++                exit(-1);
++            }
+             strcpy(StationID, StringToUpper(argv[++i]));
+             strcpy(Label, StationID);
+         } else if (!strcmp(argv[i], "-delay")) {
+@@ -377,6 +388,10 @@ void ParseCMDLine(int argc, char *argv[]) {
+                 print_usage();
+                 exit(-1);
+             }
++            if (strlen(argv[i + 1]) >= sizeof(Label)/sizeof(*Label) - 1) {
++                fprintf(stderr, "Station label is too long.\n");
++                exit(-1);
++            }
+             strcpy(Label, StringToUpper(argv[++i]));
+         }
+     }
+@@ -454,7 +469,8 @@ double UT;
+ // Will be called at regular interval to update the weather data (alarm)
+ 
+ void UpdateData() {
+-    char command[1024], Line[512], FileName[128];
++    char *command, Line[512], *FileName;
++    const char weatherPlScript[] = "/usr/lib/wmfrog/weather.pl";
+     int ign;
+     char* igns;
+     igns = (char*) malloc(512);
+@@ -492,13 +508,29 @@ void UpdateData() {
+     /*
+      *  Execute Perl script to grab the Latest METAR Report
+      */
+-    snprintf(command, 1024, "/usr/lib/wmfrog/weather.pl %s %s", StationID, folder);
+-    //printf("Retrieveing data\n");
+-    ign = system(command);
+-    snprintf(FileName, 128, "%s/%s", folder, StationID);
+-    //fprintf(stderr,"%s\n\n",FileName);
++    command = malloc(strlen(weatherPlScript) + 1 + strlen(StationID) + 1
++            + strlen(folder) + 1);
++    if (NULL == command) {
++        fprintf(stderr, "Not enough memory to build wheater.pl command.\n");
++    } else {
++        sprintf(command, "%s %s %s", weatherPlScript, StationID, folder);
++        //printf("Retrieveing data\n");
++        ign = system(command);
++        free(command);
++    }
++
++    FileName = malloc(strlen(folder) + 1 + strlen(StationID) + 1);
++    if (NULL == FileName) {
++        fprintf(stderr, "Not enough memory to build staion ID file name.\n");
++        fp = NULL;
++    } else {
++        sprintf(FileName, "%s/%s", folder, StationID);
++        //fprintf(stderr,"%s\n\n",FileName);
++        fp = fopen(FileName, "r");
++        free(FileName);
++    }
+ 
+-    if ((fp = fopen(FileName, "r")) != NULL) {
++    if (fp != NULL) {
+         ign = fscanf(fp, "Hour:%d", &weather.hour);
+         igns = fgets(Line, 512, fp); //h
+         ign = fscanf(fp, "Minute:%d", &weather.min);
+@@ -620,11 +652,21 @@ void UpdateData() {
+ char *GetTempDir(char *suffix) {
+     uid_t id;
+     struct passwd *userEntry;
+-    static char userHome[128];
++    char *userHome;
+ 
+     id = getuid();
+     userEntry = getpwuid(id);
+-    snprintf(userHome, 128, "%s/%s", userEntry->pw_dir, suffix);
++    if (NULL == userEntry) {
++        perror("Could not retrieve user's passwd entry");
++        exit(-1);
++    }
++
++    userHome = malloc(strlen(userEntry->pw_dir) + 1 + strlen(suffix) + 1);
++    if (NULL == userHome) {
++        fprintf(stderr, "Not enough memory for building temporary path.\n");
++        exit(-1);
++    }
++    sprintf(userHome, "%s/%s", userEntry->pw_dir, suffix);
+     return userHome;
+ }
+ 
+-- 
+2.7.4
+

wmfrog.spec

@@ -1,6 +1,6 @@
 Name:       wmfrog
 Version:    0.3.1
-Release:    15%{?dist}
+Release:    16%{?dist}
 Summary:    A weather application, it shows the weather in a graphical way
 Group:      Amusements/Graphics
 License:    GPLv2+
@@ -8,9 +8,17 @@ URL:        http://wiki.colar.net/wmfrog_dockapp
 Source0:    http://bitbucket.org/tcolar/%{name}/downloads/%{name}-%{version}.tgz
 # Bug 822219, submitted to upstream.
 Patch0:     %{name}-0.3.1-Skip-warning.patch
-BuildRequires:  libX11-devel, libXext-devel, libXpm-devel 
-Requires:   perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
-Requires:   wget
+# Fix a crash with overlong wmfrog -tmp argument, bug #1422319,
+# mailed to upstream.
+Patch1:     %{name}-0.3.1-Fix-parsing-wmfrog-arguments.patch
+BuildRequires:  make
+BuildRequires:  gcc
+BuildRequires:  libX11-devel
+BuildRequires:  libXext-devel
+BuildRequires:  libXpm-devel
+BuildRequires:  perl-generators
+BuildRequires:  sed
+Requires:       wget
 
 %description
 This is a weather application, it shows the weather in a graphical way. The
@@ -20,6 +28,7 @@ when I was 25, I'm a programmer not a designer :)
 %prep
 %setup -q -c
 %patch0 -p1 -b .warning
+%patch1 -p1
 sed -i -e 's|/lib/wmfrog|/libexec/wmfrog|' Src/Makefile
 sed -i -e 's|/usr/lib/|%{_libexecdir}/|' Src/wmFrog.c
 # Remove prebuilt binaries
@@ -34,11 +43,15 @@ cd Src
 make install DESTDIR=$RPM_BUILD_ROOT
 
 %files
+%license COPYING
+%doc CHANGES HINTS 
 %{_bindir}/%{name}
 %{_libexecdir}/%{name}
-%doc CHANGES COPYING HINTS 
 
 %changelog
+* Wed Feb 15 2017 Petr Pisar <ppisar@redhat.com> - 0.3.1-16
+- Fix a crash with overlong wmfrog -tmp argument (bug #1422319)
+
 * Fri Feb 05 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.3.1-15
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild