fix desktop file, CVE-2012-2142

xpdf-3.03-CVE-2012-2142.diff

@@ -0,0 +1,55 @@
+From 3945969e0072217c143fefa3044512a31ac2afa8 Mon Sep 17 00:00:00 2001
+From: mancha <mancha1@hush.com>
+Date: Sun, 11 Aug 2013
+Subject: CVE-2012-2142
+
+Filter stuff that might end up in the shell to address CVE-2012-2142.
+This code was adapted from the Poppler project.
+---
+ Error.cc |   21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+--- a/xpdf/Error.cc	2013-08-11
++++ b/xpdf/Error.cc	2013-08-11
+@@ -43,7 +43,7 @@ void setErrorCallback(void (*cbk)(void *
+ 
+ void CDECL error(ErrorCategory category, int pos, const char *msg, ...) {
+   va_list args;
+-  GString *s;
++  GString *s, *sanitized;
+ 
+   // NB: this can be called before the globalParams object is created
+   if (!errorCbk && globalParams && globalParams->getErrQuiet()) {
+@@ -52,17 +52,28 @@ void CDECL error(ErrorCategory category,
+   va_start(args, msg);
+   s = GString::formatv(msg, args);
+   va_end(args);
++
++  sanitized = new GString ();
++  for (int i = 0; i < s->getLength(); ++i) {
++    const char c = s->getChar(i);
++    if (c < (char)0x20 || c >= (char)0x7f) {
++      sanitized->appendf("<{0:02x}>", c & 0xff);
++    } else {
++      sanitized->append(c);
++    }
++  }
++
+   if (errorCbk) {
+-    (*errorCbk)(errorCbkData, category, pos, s->getCString());
++    (*errorCbk)(errorCbkData, category, pos, sanitized->getCString());
+   } else {
+     if (pos >= 0) {
+       fprintf(stderr, "%s (%d): %s\n",
+-	      errorCategoryNames[category], pos, s->getCString());
++	      errorCategoryNames[category], pos, sanitized->getCString());
+     } else {
+       fprintf(stderr, "%s: %s\n",
+-	      errorCategoryNames[category], s->getCString());
++	      errorCategoryNames[category], sanitized->getCString());
+     }
+     fflush(stderr);
+   }
+-  delete s;
++  delete sanitized;
+ }

xpdf.desktop

@@ -8,8 +8,8 @@ Name[de]=Xpdf PDF-Betrachter
 Comment=View Adobe PDF (acrobat) files
 Comment[sv]=Visar Adobe PDF-filer (acrobat-filer)
 Comment[de]=PDF-Betrachter
-Exec=xpdf
+Exec=xpdf %f
 Terminal=0
 Type=Application
-Icon=xpdf.png
+Icon=xpdf
 MimeType=application/pdf

xpdf.spec

@@ -1,7 +1,7 @@
 Summary: A PDF file viewer for the X Window System
 Name: xpdf
 Version: 3.03
-Release: 4%{?dist}
+Release: 8%{?dist}
 License: GPLv2 or GPLv3
 Epoch: 1
 Url: http://www.foolabs.com/xpdf/
@@ -39,14 +39,14 @@ Patch9: xpdf-3.00-papersize.patch
 Patch10: xpdf-3.00-gcc4.patch
 Patch11: xpdf-3.03-crash.patch
 Patch12: xpdf-3.03-64bit.patch
-# Patch13: xpdf-3.01-resize.patch
-# Patch14: xpdf-3.01-freetype-internals.patch
+# Patch13: xpdf-3.01-resize.patch# Patch14: xpdf-3.01-freetype-internals.patch
 Patch15: xpdf-3.01-nocmap.patch
 Patch16: xpdf-3.02-fontlist.patch
 Patch19: xpdf-3.02-additionalzoom.patch
 Patch20: xpdf-3.03-compile-fix.patch
 
 # Security patches
+Patch100: xpdf-3.03-CVE-2012-2142.diff
 
 # Debian patches
 Patch200: 02_permissions.dpatch
@@ -60,7 +60,11 @@ Requires: poppler-utils
 Requires: xorg-x11-fonts-ISO8859-1-75dpi
 Requires: xorg-x11-fonts-ISO8859-1-100dpi
 
+%if 0%{?rhel}
+BuildRequires: openmotif-devel
+%else
 BuildRequires: lesstif-devel
+%endif
 BuildRequires: freetype-devel >= 2.1.7
 BuildRequires: desktop-file-utils
 BuildRequires: libpaper-devel
@@ -101,6 +105,7 @@ standard X fonts.
 %patch20 -p1 -b .charfix
 
 # security patches
+%patch100 -p1 -b .CVE-2012-2142
 
 # debian patches
 %patch200 -p1 -b .permissions
@@ -151,7 +156,8 @@ mkdir -p $RPM_BUILD_ROOT%{_datadir}/xpdf/arabic \
 make install DESTDIR=$RPM_BUILD_ROOT
 
 mkdir -p $RPM_BUILD_ROOT%{_datadir}/applications/
-desktop-file-install --vendor "fedora"                  \
+desktop-file-install            \
+        --vendor "fedora"                  \
         --dir $RPM_BUILD_ROOT%{_datadir}/applications   \
         --add-category X-Fedora                         \
         %{SOURCE10}
@@ -254,6 +260,19 @@ update-desktop-database &> /dev/null ||:
 %{_datadir}/xpdf/latin2
 
 %changelog
+* Sun Sep 22 2013 Tom Callaway <spot@fedoraproject.org> - 1:3.03-8
+- fix CVE-2012-2142
+- fix issue with icon name in .desktop file (except on el5)
+
+* Sun Aug 04 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:3.03-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Sun Feb 10 2013 Parag Nemade <paragn AT fedoraproject DOT org> - 1:3.03-6
+- Remove vendor tag from desktop file as per https://fedorahosted.org/fesco/ticket/1077
+
+* Wed Nov 14 2012 Tom Callaway <spot@fedoraproject.org> - 1:3.03-5
+- fix desktop file to invoke xpdf with a file param (bz874644)
+
 * Sun Jul 22 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:3.03-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild