fix CVE-2020-13696 (#1882287)

This reverts commit 7c096a4bd7.

.gitignore

@@ -3,10 +3,6 @@ xawtv-3.98.tar.bz2
 /xawtv-3.99.rc2.tar.bz2
 /xawtv-3.99.rc3.tar.bz2
 /xawtv-3.99.rc4.tar.bz2
-/xawtv-3.99.rc6.tar.bz2
+/xawtv-3.99.rc5.tar.bz2
 /xawtv-3.100.tar.bz2
 /xawtv-3.101.tar.bz2
-/xawtv-3.103.tar.bz2
-/xawtv-3.105.tar.bz2
-/xawtv-3.106.tar.bz2
-/xawtv-3.107.tar.bz2

0001-fbtv-don-t-keep-a-black-screen-in-case-of-fatal-erro.patch

@@ -0,0 +1,84 @@
+From 185c8b182ac6f7fa6a5c69975f9dabdb9af6fce0 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Mon, 11 Jun 2018 13:34:08 -0300
+Subject: [PATCH 1/3] fbtv: don't keep a black screen in case of fatal errors
+
+If something bad happens and fbtv exits, it should restore
+the VT window, as otherwise the error messages won't be
+displayed.
+
+So, be sure to call fb_cleanup() before calling exit().
+
+Let's also start ncurses later, as this is used only to get
+keys, and this happens only within the image display loop.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+---
+ console/fbtv.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/console/fbtv.c b/console/fbtv.c
+index aba517e4fc8e..33372385b7c6 100644
+--- a/console/fbtv.c
++++ b/console/fbtv.c
+@@ -279,8 +279,8 @@ fb_initcolors(int fd, int gray)
+ #endif
+ 	break;
+     default:
+-	fprintf(stderr, "Oops: %i bit/pixel ???\n",
+-		fb_var.bits_per_pixel);
++	fb_cleanup();
++	fprintf(stderr, "Oops: %i bit/pixel ???\n", fb_var.bits_per_pixel);
+ 	exit(1);
+     }
+ 
+@@ -404,6 +404,7 @@ static void do_capture(int from, int to, int tmp_switch)
+ 	if (0 != ng_grabber_setformat(&fmt,1)) {
+ 	    gfmt = fmt;
+ 	    if (NULL == (conv = ng_grabber_findconv(&gfmt,0))) {
++		fb_cleanup();
+ 		fprintf(stderr,"can't find useful capture format\n");
+ 		exit(1);
+ 	    }
+@@ -528,6 +529,7 @@ grabber_init(void)
+ 
+     drv = ng_vid_open(&ng_dev.video, ng_dev.driver, &screen, 0, &h_drv);
+     if (NULL == drv) {
++	fb_cleanup();
+ 	fprintf(stderr,"no grabber device available\n");
+ 	exit(1);
+     }
+@@ -724,7 +726,6 @@ main(int argc, char *argv[])
+     exit_hook         = do_exit;
+     fullscreen_hook   = do_fullscreen;
+ 
+-    tty_init();
+     memset(&act,0,sizeof(act));
+     act.sa_handler = ctrlc;
+     sigemptyset(&act.sa_mask);
+@@ -770,6 +771,7 @@ main(int argc, char *argv[])
+     }
+ #endif
+ 
++    tty_init();
+     fb_memset(fb_mem+fb_mem_offset,0,fb_fix.smem_len);
+     for (;!sig;) {
+ 	if ((fb_switch_state == FB_ACTIVE || keep_dma_on) && !quiet) {
+@@ -824,6 +826,14 @@ main(int argc, char *argv[])
+ 		fps++;
+ 		/* grab + convert frame */
+ 		if (NULL == (buf = ng_grabber_grab_image(0))) {
++		    do_va_cmd(2,"capture","off");
++		    if (mute)
++			audio_off();
++		    drv->close(h_drv);
++		    if (fb_switch_state == FB_ACTIVE)
++			fb_memset(fb_mem+fb_mem_offset,0,fb_fix.smem_len);
++		    tty_cleanup();
++		    fb_cleanup();
+ 		    fprintf(stderr,"capturing image failed\n");
+ 		    exit(1);
+ 		}
+-- 
+2.17.1
+

0002-fbdev-prevent-writing-outsize-framebuffer-area.patch

@@ -0,0 +1,74 @@
+From bc3b0ec4d5f2af3e9b8e70287b4bdc885111f174 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Mon, 11 Jun 2018 16:54:13 -0300
+Subject: [PATCH 2/3] fbdev: prevent writing outsize framebuffer area
+
+There are a series of things at the code that could overflow
+and make it to try writing past the framebuffer. Prevent it.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+---
+ console/fbtv.c | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/console/fbtv.c b/console/fbtv.c
+index 33372385b7c6..1d700e6f945f 100644
+--- a/console/fbtv.c
++++ b/console/fbtv.c
+@@ -377,6 +377,14 @@ static void do_capture(int from, int to, int tmp_switch)
+ 	break;
+     }
+ 
++    /* Sanity check: don't accept resolution higher than framebuffer */
++    if (ww && hh) {
++	    if (ww > fb_var.xres)
++		    ww = fb_var.xres;
++	    if (hh > fb_var.yres)
++		    hh = fb_var.yres;
++    }
++
+     /* on */
+     memset(&buf,0,sizeof(buf));
+     switch (to) {
+@@ -411,8 +419,9 @@ static void do_capture(int from, int to, int tmp_switch)
+ 	    ch = ng_convert_alloc(conv,&gfmt,&fmt);
+ 	    ng_convert_init(ch);
+ 	}
+-	dx += (fb_var.xres-24-fmt.width)/2;
+-	dy += (fb_var.yres-16-fmt.height)/2;
++
++	dx += (fb_var.xres - 24 - fmt.width)/2;
++	dy += (fb_var.yres - 16 - fmt.height)/2;
+ 
+ 	if (f_drv & CAN_CAPTURE)
+ 	    drv->startvideo(h_drv,-1,2);
+@@ -464,6 +473,12 @@ static void do_capture(int from, int to, int tmp_switch)
+ 	}
+ 	break;
+     }
++
++    /* Sanity checks: some of the formula above could overflow */
++    if (dx < 0 || dx > fb_var.xres)
++	dx = 0;
++    if (dy < 0 || dy > fb_var.yres)
++	dy = 0;
+ }
+ 
+ static void
+@@ -848,7 +863,13 @@ main(int argc, char *argv[])
+ 
+ 		linesize = buf->fmt.width * (ng_vfmt_to_depth[fmt.fmtid] / 8);
+ 
++		/* Prevent writing at the next line */
++		if (linesize > fb_fix.line_length)
++			linesize = fb_fix.line_length;
+ 		for (ui = 0; ui < buf->fmt.height; ui++) {
++		    if ((char *)dst + linesize > (char *)fb_mem + fb_mem_offset + fb_fix.smem_len)
++			    break;
++
+ 		    memcpy(dst, src, linesize);
+ 		    src += buf->fmt.bytesperline;
+ 		    dst += fb_fix.line_length;
+-- 
+2.17.1
+

0003-fbtv-allow-displaying-texts-over-the-camera-streamin.patch

@@ -0,0 +1,85 @@
+From a4493b399e45a97b9dd14499f54719cc4095f447 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Mon, 11 Jun 2018 17:04:14 -0300
+Subject: [PATCH 3/3] fbtv: allow displaying texts over the camera streaming
+ screen
+
+When the image is too big, there won't be a f->height space
+before the streaming window. So, allow overwriting the fonts
+on the top of it.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+---
+ console/fbtv.c | 33 +++++++++++++++++++++------------
+ 1 file changed, 21 insertions(+), 12 deletions(-)
+
+diff --git a/console/fbtv.c b/console/fbtv.c
+index 1d700e6f945f..278443fcbf3c 100644
+--- a/console/fbtv.c
++++ b/console/fbtv.c
+@@ -604,7 +604,7 @@ main(int argc, char *argv[])
+     unsigned long   freq;
+     struct timeval  tv;
+     time_t          t;
+-    char            text[145],event[64],*env,*src,*dst;
++    char            text1[145], text2[145], event[64], *env, *src, *dst;
+     fd_set          set;
+     struct sigaction act,old;
+ 
+@@ -790,26 +790,28 @@ main(int argc, char *argv[])
+     fb_memset(fb_mem+fb_mem_offset,0,fb_fix.smem_len);
+     for (;!sig;) {
+ 	if ((fb_switch_state == FB_ACTIVE || keep_dma_on) && !quiet) {
+-	    /* clear first lines */
+-	    fb_memset(fb_mem+fb_mem_offset,0,f->height*fb_fix.line_length);
+ 	    if (message[0] != '\0') {
+-		strcpy(text,message);
++		strcpy(text1, message);
+ 	    } else {
+-		sprintf(text,"Framebuffer TV - %s",default_title);
++		sprintf(text1, "Framebuffer TV - %s",default_title);
+ 	    }
+ 	    /* debugging + preformance monitoring */
+ 	    switch (cur_capture) {
+ 	    case CAPTURE_GRABDISPLAY:
+-		sprintf(text+strlen(text), " - grab %d.%d fps",fps/5,(fps*2)%10);
++		sprintf(text1 + strlen(text1), " - grab %d.%d fps",
++			fps / 5, (fps * 2) % 10);
+ 		break;
+ 	    }
+-	    text_out(0,0,text);
+ 
+-	    if (dy > 0) {
+-		/* display time */
+-		time(&t);
+-		strftime(text,16,"%H:%M",localtime(&t));
+-		text_out(fb_var.xres - text_width(text) - f->width, 0, text);
++	    /* display time */
++	    time(&t);
++	    strftime(text2, 16, "%H:%M", localtime(&t));
++
++	    if (dy >= f->height) {
++		/* clear first lines */
++		fb_memset(fb_mem+fb_mem_offset,0,f->height*fb_fix.line_length);
++		text_out(0,0,text1);
++		text_out(fb_var.xres - text_width(text2) - f->width, 0, text2);
+ 	    }
+ 	}
+ 	if (switch_last != fb_switch_state)
+@@ -883,6 +885,13 @@ main(int argc, char *argv[])
+ 		tv.tv_usec = 0;
+ 		rc = select(fdmax,&set,NULL,NULL,&tv);
+ 	    }
++
++	    /* If space is too short, overlay text at screen */
++	    if ((fb_switch_state == FB_ACTIVE || keep_dma_on) && !quiet && dy < f->height) {
++		text_out(0,0,text1);
++		text_out(fb_var.xres - text_width(text2) - f->width, 0, text2);
++	    }
++
+ 	    err = errno;
+ 	    if (switch_last != fb_switch_state)
+ 		console_switch();
+-- 
+2.17.1
+

sources

@@ -1 +1 @@
-SHA512 (xawtv-3.107.tar.bz2) = 29935e9265a96223097e6c4ab65d06c45233238992901d63aa3008e6f35cb59d474cebabd4136e47451242ba35df9ef08f9ef762c01ad688833429bc72d61536
+SHA512 (xawtv-3.105.tar.bz2) = 0c1e2c3a73b3452778762b26a061f5646ef2a34de80027e17777ee9f6ca91ca5370b4790e2bdbe4b5edc864fe9775c9125c52e951fb08c83dc1706afbdf21e55

xawtv-3.105-cve_2020_13696.patch

@@ -0,0 +1,35 @@
+diff --git a/console/v4l-conf.c b/console/v4l-conf.c
+index c38bf16..c96886b 100644
+--- a/console/v4l-conf.c
++++ b/console/v4l-conf.c
+@@ -141,20 +141,23 @@ dev_open(const char *device, int major)
+ 	exit(1);
+     }
+ 
+-    /* open & check v4l device */
+-    if (-1 == (fd = open(device,O_RDWR))) {
+-	fprintf(stderr, "can't open %s: %s\n", device, strerror(errno));
++    /* First check if the device is really a devnode of the right type */
++    if (-1 == stat(device, &stb)) {
++	fprintf(stderr, "stat(%s): %s\n", device, strerror(errno));
+ 	exit(1);
+     }
+ 
+-    if (-1 == fstat(fd,&stb)) {
+-	fprintf(stderr, "fstat(%s): %s\n", device, strerror(errno));
+-	exit(1);
+-    }
+     if (!S_ISCHR(stb.st_mode) || (major(stb.st_rdev) != major)) {
+ 	fprintf(stderr, "%s: wrong device\n", device);
+ 	exit(1);
+     }
++
++    /* Then open it */
++    if (-1 == (fd = open(device,O_RDWR))) {
++	fprintf(stderr, "can't open %s: %s\n", device, strerror(errno));
++	exit(1);
++    }
++
+     return fd;
+ }
+ 

xawtv-3.107-XawListChange.patch

@@ -1,28 +0,0 @@
-#
-#  Since https://gitlab.freedesktop.org/xorg/lib/libxaw/-/commit/197e9d055f3cd351
-#  XawListChange() want the second argument to be (const char **) instead of (char **).
-#
-#  To avoid compiler issues when -Wcompatible-pointer-types just cast it to (void *) .
-#
-
-diff -Nrup xawtv-3.107/x11/propwatch.c xawtv-3.107-OK/x11/propwatch.c
---- xawtv-3.107/x11/propwatch.c	2020-05-16 02:32:25.000000000 +0300
-+++ xawtv-3.107-OK/x11/propwatch.c	2024-01-30 04:16:55.411559253 +0300
-@@ -316,7 +316,7 @@ RebuildList(void)
-     for (i=0, this=watchlist; this!=NULL; i++, this=this->next)
- 	str_list[i] = this->text;
-     qsort(str_list,str_count,sizeof(char*),cmp);
--    XawListChange(bl,str_count ? str_list : &empty,
-+    XawListChange(bl,(void *)(str_count ? str_list : &empty),
- 		  str_count ? str_count : 1,1000,1);
- }
- 
-@@ -495,7 +495,7 @@ ProcessPropertyChange(Display *dpy, XEve
- 		AddWatch(dpy,event->xproperty.window, i);
- 	    else {
- 		Update(dpy,event->xproperty.window,event->xproperty.atom);
--		XawListChange(bl,str_list,str_count,1000,1);
-+		XawListChange(bl,(void *)str_list,str_count,1000,1);
- 	    }
- 	}
-     }

xawtv-strsignal.patch

@@ -1,47 +0,0 @@
-diff --git a/console/fbtools.c b/console/fbtools.c
-index 9f876df..07739ff 100644
---- a/console/fbtools.c
-+++ b/console/fbtools.c
-@@ -520,6 +520,6 @@ fb_catch_exit_signals(void)
- 
-     /* cleanup */
-     fb_cleanup();
--    fprintf(stderr,"Oops: %s\n",sys_siglist[termsig]);
-+    fprintf(stderr,"Oops: %s\n",strsignal(termsig));
-     exit(42);
- }
-diff --git a/console/record.c b/console/record.c
-index 685221b..90f0c85 100644
---- a/console/record.c
-+++ b/console/record.c
-@@ -429,7 +429,7 @@ ctrlc(int signal)
- {
-     if (verbose)
- 	fprintf(stderr,"\n%s - exiting\n",
--		sys_siglist[signal]);
-+		strsignal(signal));
-     stop = 1;
- }
- 
-diff --git a/x11/rootv.c b/x11/rootv.c
-index 60a8406..4bf458b 100644
---- a/x11/rootv.c
-+++ b/x11/rootv.c
-@@ -133,7 +133,7 @@ catch_sig(int signal)
-     termsig = signal;
-     if (verbose)
- 	fprintf(stderr,"received signal %d [%s]\n",
--		termsig,sys_siglist[termsig]);
-+		termsig,strsignal(termsig));
- }
- 
- static void usage(FILE *fp)
-@@ -422,7 +422,7 @@ main(int argc, char *argv[])
-     }
-     if (verbose && termsig)
- 	fprintf(stderr,"exiting on signal %d [%s]\n",
--		termsig,sys_siglist[termsig]);
-+		termsig,strsignal(termsig));
-     if (do_mute && have_mute)
- 	XvSetPortAttribute(dpy,port,XV_MUTE,1);
-     XvStopVideo(dpy,port,win);

xawtv.spec

@@ -2,23 +2,23 @@
 
 Summary: TV applications for video4linux compliant devices
 Name: xawtv
-Version: 3.107
-Release: 18%{?dist}
-# Automatically converted from old format: GPLv2+ - review is highly recommended.
-License: GPL-2.0-or-later
+Version: 3.105
+Release: 2%{?dist}
+Group: Applications/Multimedia
+License: GPLv2+
 URL: http://linuxtv.org/wiki/index.php/Xawtv
 
 Source0: http://linuxtv.org/downloads/xawtv/%{name}-%{version}.tar.bz2
-Patch0: xawtv-strsignal.patch
-Patch1: xawtv-3.107-XawListChange.patch
+Patch0: 0001-fbtv-don-t-keep-a-black-screen-in-case-of-fatal-erro.patch
+Patch1: 0002-fbdev-prevent-writing-outsize-framebuffer-area.patch
+Patch2: 0003-fbtv-allow-displaying-texts-over-the-camera-streamin.patch
+Patch3: xawtv-3.105-cve_2020_13696.patch
 
-BuildRequires: make
-BuildRequires: gcc
 BuildRequires: mesa-libGL-devel, libXaw-devel, libXext-devel
 BuildRequires: libXft-devel, libXinerama-devel
 BuildRequires: libXpm-devel, libXrandr-devel, libXt-devel
 BuildRequires: libXxf86dga-devel, libXv-devel
-BuildRequires: motif-devel
+BuildRequires: openmotif-devel
 %{?with_quicktime:BuildRequires: libquicktime-devel}
 
 BuildRequires: ncurses-devel, coreutils, libjpeg-devel, libpng-devel
@@ -28,11 +28,10 @@ BuildRequires: libdv-devel
 %endif
 BuildRequires: zvbi-devel, aalib-devel
 BuildRequires: gpm-devel, slang-devel
-BuildRequires: ImageMagick desktop-file-utils libappstream-glib
+BuildRequires: ImageMagick desktop-file-utils
 BuildRequires: libv4l-devel
-BuildRequires: perl-interpreter
 
-Requires: polkit xorg-x11-fonts-misc hicolor-icon-theme
+Requires: usermode xorg-x11-fonts-misc hicolor-icon-theme
 
 %description
 Xawtv is a simple xaw-based TV program which uses the bttv driver or
@@ -60,11 +59,14 @@ which support teletext.
 
 %prep
 %setup -q
-%patch -P0 -p1
-%patch -P1 -p1
+%patch0 -p1
+%patch1 -p1
+%patch2 -p1
+%patch3 -p1
+
 
 %build
-export CFLAGS="$RPM_OPT_FLAGS -Wno-pointer-sign -fcommon"
+export CFLAGS="$RPM_OPT_FLAGS -Wno-pointer-sign"
 %configure %{!?_with_quicktime: --disable-quicktime}
 make %{?_smp_mflags} verbose=yes
 
@@ -82,69 +84,64 @@ for i in 16x16 32x32 48x48; do
     $RPM_BUILD_ROOT%{_datadir}/icons/hicolor/$i/apps/%{name}.png
 done
 
-mkdir -p $RPM_BUILD_ROOT%{_datadir}/appdata
 for i in xawtv motv mtt; do
-   desktop-file-install --dir $RPM_BUILD_ROOT%{_datadir}/applications \
-       contrib/$i.desktop
-   install -p -m 0644 contrib/$i.*.xml $RPM_BUILD_ROOT%{_datadir}/appdata
-   appstream-util validate-relax --nonet \
-       $RPM_BUILD_ROOT%{_datadir}/appdata/$i.*.xml
+    desktop-file-install --dir $RPM_BUILD_ROOT%{_datadir}/applications \
+	contrib/$i.desktop
 done
 
 #   v4l-conf  stuff
 
-mkdir -p $RPM_BUILD_ROOT%{_libexecdir} $RPM_BUILD_ROOT%{_datadir}/polkit-1/actions
+mkdir -p $RPM_BUILD_ROOT%{_sbindir} \
+	$RPM_BUILD_ROOT%{_sysconfdir}/pam.d \
+	$RPM_BUILD_ROOT%{_sysconfdir}/security/console.apps \
 
-mv $RPM_BUILD_ROOT%{_bindir}/v4l-conf $RPM_BUILD_ROOT%{_libexecdir}/
+cat >v4l-conf.pam <<!
+#%%PAM-1.0
+auth		sufficient	pam_rootok.so
+auth		required	pam_console.so
+account		required	pam_permit.so
+session		required	pam_permit.so
+session		optional	pam_xauth.so
+!
+install -m 0644 v4l-conf.pam $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/v4l-conf
 
-cat >v4l-conf.sh <<EOF
-#!/bin/sh
-exec %{_bindir}/pkexec %{_libexecdir}/v4l-conf
-EOF
-install -p -m 755 v4l-conf.sh $RPM_BUILD_ROOT%{_bindir}/v4l-conf
+cat >v4l-conf.apps <<!
+SESSION=true
+USER=root
+PROGRAM=%{_sbindir}/v4l-conf
+!
+install -p -m 0644 v4l-conf.apps $RPM_BUILD_ROOT%{_sysconfdir}/security/console.apps/v4l-conf
 
-cat >v4l-conf.policy <<EOF
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE policyconfig PUBLIC
- "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
- "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
-<policyconfig>
+mv $RPM_BUILD_ROOT%{_bindir}/v4l-conf $RPM_BUILD_ROOT%{_sbindir}/
+ln -s consolehelper $RPM_BUILD_ROOT%{_bindir}/v4l-conf
 
-  <vendor>XawTV Project</vendor>
-  <vendor_url>%{url}</vendor_url>
 
-  <action id="org.fedoraproject.v4l.conf.pkexec.run">
+%post
+touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
 
-    <description>Run v4l-conf with privileges required</description>
-    <message>Authentication is required for privileged operations of v4l-conf</message>
-    <defaults>
-      <allow_any>no</allow_any>
-      <allow_inactive>no</allow_inactive>
-      <allow_active>yes</allow_active>
-    </defaults>
-    <annotate key="org.freedesktop.policykit.exec.path">%{_libexecdir}/v4l-conf</annotate>
-    <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
-  </action>
+%postun
+if [ $1 -eq 0 ] ; then
+    touch --no-create %{_datadir}/icons/hicolor &>/dev/null
+    gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
+fi
 
-</policyconfig>
-EOF
-install -p -m 644 v4l-conf.policy $RPM_BUILD_ROOT%{_datadir}/polkit-1/actions/org.fedoraproject.v4l.conf.policy
+%posttrans
+gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 
 
 %files
-%doc README TODO contrib/frequencies*
-%license COPYING
+%doc COPYING README TODO contrib/frequencies*
+%config(noreplace) %{_sysconfdir}/pam.d/v4l-conf
+%config(noreplace) %{_sysconfdir}/security/console.apps/v4l-conf
 %{_bindir}/*
 %exclude %{_bindir}/motv
 %exclude %{_bindir}/mtt
-%{_libexecdir}/*
+%{_sbindir}/*
 %{_libdir}/xawtv
 %{_datadir}/xawtv
 %{_datadir}/X11/app-defaults/Xawtv
 %{_datadir}/icons/hicolor/*/apps/%{name}.png
-%{_datadir}/appdata/%{name}.appdata.xml
 %{_datadir}/applications/%{name}.desktop
-%{_datadir}/polkit-1/actions/*
 %{_mandir}/man?/*
 %exclude %{_mandir}/man1/motv.1*
 %exclude %{_mandir}/man1/mtt.1*
@@ -158,123 +155,28 @@ install -p -m 644 v4l-conf.policy $RPM_BUILD_ROOT%{_datadir}/polkit-1/actions/or
 %lang(de) %{_datadir}/X11/de_DE.UTF-8/app-defaults/MoTV*
 %lang(fr) %{_datadir}/X11/fr_FR.UTF-8/app-defaults/MoTV*
 %lang(it) %{_datadir}/X11/it_IT.UTF-8/app-defaults/MoTV*
-%{_datadir}/appdata/motv.metainfo.xml
 %{_datadir}/applications/motv.desktop
 
 %files mtt
 %{_bindir}/mtt
 %{_mandir}/man1/mtt.1*
 %{_datadir}/X11/app-defaults/mtt*
-%{_datadir}/appdata/mtt.metainfo.xml
 %{_datadir}/applications/mtt.desktop
 
 
 %changelog
-* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.107-18
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+* Sat Sep 26 2020 Dmitry Butskoy <Dmitry@Butskoy.name> - 3.105-2
+- fix CVE-2020-13696 (#1882287)
 
-* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.107-17
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+* Tue Jun 19 2018 Dmitry Butskoy <Dmitry@Butskoy.name> - 3.105-1
+- Upgrade to 3.105
+- spec file cleanup
 
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.107-16
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Fri Jan 24 2025 Dmitry Butskoy <Dmitry@Butskoy.name> - 3.107-15
-- switch to PolicyKit (#502723)
-- avoid /usr/sbin dir (#2341562)
-
-* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.107-14
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Fri Jul 26 2024 Miroslav Suchý <msuchy@redhat.com> - 3.107-13
-- convert license to SPDX
-
-* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.107-12
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Tue Jan 30 2024 Dmitry Butskoy <Dmitry@Butskoy.name> - 3.107-11
-- fix incompatible pointer types warnings (#2261796)
-
-* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.107-10
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.107-9
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.107-8
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.107-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.107-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.107-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.107-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.107-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Thu Jul 23 2020 Jeff Law <law@redhta.com> - 3.107-2
-- Use strsignal, not sys_siglist
-
-* Sat May 16 2020 Mauro Carvalho Chehab <mchehab+samsung@kernel.org> - 3.107-1
-- upgrade to version 3.107
-
-* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.106-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-- Use gcc -fcommon flag to build
-
-* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.106-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Thu Feb 21 2019 Mauro Carvalho Chehab <mchehab+samsung@kernel.org> - 3.106-1
-- upgrade to version 3.106
-
-* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.105-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.105-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Mon Jun 11 2018 Mauro Carvalho Chehab <mchehab+samsung@kernel.org> - 3.105-2
-- cleanup FB console if an error happens
-
-* Mon Jun 11 2018 Mauro Carvalho Chehab <mchehab+samsung@kernel.org> - 3.105-1
-- upgrade to version 3.105
-
-* Fri Jun  1 2018 Dmitry Butskoy <Dmitry@Butskoy.name> - 3.103-15
-- fix default console font for fbtv(1) (#1406549)
-
-* Thu Mar 15 2018 Dmitry Butskoy <Dmitry@Butskoy.name> - 3.103-14
-- fileutils no more exists (#1556548)
-- explicitly include sys/sysmacros.h
-
-* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.103-13
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
-* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.103-12
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.103-11
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Wed Feb 15 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.103-10
-- Add BR: perl (Fix F26BFS).
-
-* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.103-9
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Mon Feb 15 2016 Hans de Goede <hdegoede@redhat.com> - 3.103-8
+* Wed Feb 17 2016 Dmitry Butskoy <Dmitry@Butskoy.name> - 3.103-8
 - Bring in several bugfix patch from upstream
 - Fix crash with saa7134 driver (rhbz#1305389)
 - Use png instead of xpm for icons
-- Add appdata
-- Build motv and mtt now that we have a FOSS motif, put them in
+- Build motv and mtt now since we have a openmotif, put them in
   xawtv-motv resp xawtv-mtt sub-packages
 - Remove changelog entries older then 10 years