From 5e2d0297ea68d9c24d8278bdafa0cbb0ce099b7d Mon Sep 17 00:00:00 2001 From: Jakub Martisko Date: Wed, 1 Sep 2021 19:42:55 +0200 Subject: [PATCH 1/2] Sync the multilib patches with rhel Resolves: rhbz#1988061 --- multilib-32.patch | 29 +++++++++++++++++++++++++++++ multilib-64.patch | 29 +++++++++++++++++++++++++++++ zziplib-0.13.69-multilib.patch | 31 ------------------------------- zziplib.spec | 24 ++++++++++++++++++++---- 4 files changed, 78 insertions(+), 35 deletions(-) create mode 100644 multilib-32.patch create mode 100644 multilib-64.patch delete mode 100644 zziplib-0.13.69-multilib.patch diff --git a/multilib-32.patch b/multilib-32.patch new file mode 100644 index 0000000..ae99a59 --- /dev/null +++ b/multilib-32.patch @@ -0,0 +1,29 @@ +--- ./a/zzip/_config.h 2021-07-21 14:18:09.000000000 +0200 ++++ ./b/zzip/_config.h 2021-07-21 14:46:24.037432969 +0200 +@@ -138,9 +138,12 @@ + + /* whether the system defaults to 32bit off_t but can do 64bit when requested + */ ++#if __WORDSIZE == 32 + #ifndef ZZIP_LARGEFILE_SENSITIVE + #define ZZIP_LARGEFILE_SENSITIVE 1 + #endif ++#endif ++/* #undef LARGEFILE_SENSITIVE */ + + /* Define to the sub-directory where libtool stores uninstalled libraries. */ + #ifndef ZZIP_LT_OBJDIR +@@ -227,9 +230,13 @@ + #endif + + /* Number of bits in a file offset, on hosts where this is settable. */ ++#if __WORDSIZE == 32 + #ifndef ZZIP__FILE_OFFSET_BITS + #define ZZIP__FILE_OFFSET_BITS 64 + #endif ++#endif ++/* #undef _FILE_OFFSET_BITS */ ++ + + /* Define for large files, on AIX-style hosts. */ + /* #undef _LARGE_FILES */ diff --git a/multilib-64.patch b/multilib-64.patch new file mode 100644 index 0000000..5285e3a --- /dev/null +++ b/multilib-64.patch @@ -0,0 +1,29 @@ +--- ./a/zzip/_config.h 2021-07-21 14:18:14.000000000 +0200 ++++ ./b/zzip/_config.h 2021-07-21 14:46:24.037432969 +0200 +@@ -138,6 +138,11 @@ + + /* whether the system defaults to 32bit off_t but can do 64bit when requested + */ ++#if __WORDSIZE == 32 ++#ifndef ZZIP_LARGEFILE_SENSITIVE ++#define ZZIP_LARGEFILE_SENSITIVE 1 ++#endif ++#endif + /* #undef LARGEFILE_SENSITIVE */ + + /* Define to the sub-directory where libtool stores uninstalled libraries. */ +@@ -225,8 +230,14 @@ + #endif + + /* Number of bits in a file offset, on hosts where this is settable. */ ++#if __WORDSIZE == 32 ++#ifndef ZZIP__FILE_OFFSET_BITS ++#define ZZIP__FILE_OFFSET_BITS 64 ++#endif ++#endif + /* #undef _FILE_OFFSET_BITS */ + ++ + /* Define for large files, on AIX-style hosts. */ + /* #undef _LARGE_FILES */ + diff --git a/zziplib-0.13.69-multilib.patch b/zziplib-0.13.69-multilib.patch deleted file mode 100644 index 24cf64b..0000000 --- a/zziplib-0.13.69-multilib.patch +++ /dev/null @@ -1,31 +0,0 @@ -diff -up ./_builddir/zzip/_config.h.orig ./_builddir/zzip/_config.h ---- ./_builddir/zzip/_config.h.orig 2018-07-23 09:11:59.971840954 +0300 -+++ ./_builddir/zzip/_config.h 2018-07-23 09:12:07.438731527 +0300 -@@ -139,6 +139,11 @@ - /* whether the system defaults to 32bit off_t but can do 64bit when requested - */ - /* #undef LARGEFILE_SENSITIVE */ -+#if __WORDSIZE == 32 -+#ifndef ZZIP_LARGEFILE_SENSITIVE -+#define ZZIP_LARGEFILE_SENSITIVE 1 -+#endif -+#endif - - /* Define to the sub-directory where libtool stores uninstalled libraries. */ - #ifndef ZZIP_LT_OBJDIR -@@ -197,6 +202,15 @@ - /* The number of bytes in type short */ - /* #undef SIZEOF_SHORT */ - -+/* The number of bytes in type long */ -+#ifndef ZZIP_SIZEOF_LONG -+#if __WORDSIZE == 32 -+#define ZZIP_SIZEOF_LONG 4 -+#elif __WORDSIZE == 64 -+#define ZZIP_SIZEOF_LONG 8 -+#endif -+#endif -+ - /* Define to 1 if you have the ANSI C header files. */ - #ifndef ZZIP_STDC_HEADERS - #define ZZIP_STDC_HEADERS 1 diff --git a/zziplib.spec b/zziplib.spec index 2fc3e42..59447ce 100644 --- a/zziplib.spec +++ b/zziplib.spec @@ -1,11 +1,14 @@ Summary: Lightweight library to easily extract data from zip files Name: zziplib Version: 0.13.71 -Release: 4%{?dist} +Release: 5%{?dist} License: LGPLv2+ or MPLv1.1 URL: http://zziplib.sourceforge.net/ Source: https://github.com/gdraheim/zziplib/archive/v%{version}.tar.gz -Patch0: zziplib-0.13.69-multilib.patch + + +Patch100: multilib-32.patch +Patch101: multilib-64.patch BuildRequires: make BuildRequires: gcc @@ -73,9 +76,16 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool # Only patch generated _config.h on non-i686 and armv7hl # These platforms have a correct _config.h already -%ifnarch i686 armv7hl -%apply_patch %{PATCH0} -p2 + +pushd %{_builddir}/zziplib-%{version} +%ifarch i686 armv7hl + patch -p2 < %{PATCH100} %endif +%ifnarch i686 armv7hl + patch -p2 < %{PATCH101} +%endif +popd + %make_build @@ -102,6 +112,12 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool %{_mandir}/man3/* %changelog +* Wed Sep 01 2021 Jakub Martisko - 0.13.71-5 +- Use the multilib patches from RHEL +- Resolves ftbfs +Resolves: rhbz#1988061 +Related: rhbz#1915747 + * Fri Jul 23 2021 Fedora Release Engineering - 0.13.71-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 361f0fd1c4a053bca098a37d4a736c38c7ed3c39 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 9 Feb 2022 19:04:27 +0200 Subject: [PATCH 2/2] Package 0.13.72 - Fixes CVE-2020-18442 - Resolves: rhbz#1973831 - Switch build to CMake, drop 32-bit patches as checks integrated in CMake already Signed-off-by: Alexander Bokovoy (cherry picked from commit 79ad2633a3dd8c5bfb7d554c46244ec7e33b1e65) --- .gitignore | 1 + multilib-32.patch | 29 ----------------------------- multilib-64.patch | 29 ----------------------------- sources | 2 +- zziplib.spec | 47 +++++++++++++---------------------------------- 5 files changed, 15 insertions(+), 93 deletions(-) delete mode 100644 multilib-32.patch delete mode 100644 multilib-64.patch diff --git a/.gitignore b/.gitignore index 2b7387c..061bb6d 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ zziplib-0.13.49.tar.bz2 /v0.13.68.tar.gz /v0.13.69.tar.gz /v0.13.71.tar.gz +/v0.13.72.tar.gz diff --git a/multilib-32.patch b/multilib-32.patch deleted file mode 100644 index ae99a59..0000000 --- a/multilib-32.patch +++ /dev/null @@ -1,29 +0,0 @@ ---- ./a/zzip/_config.h 2021-07-21 14:18:09.000000000 +0200 -+++ ./b/zzip/_config.h 2021-07-21 14:46:24.037432969 +0200 -@@ -138,9 +138,12 @@ - - /* whether the system defaults to 32bit off_t but can do 64bit when requested - */ -+#if __WORDSIZE == 32 - #ifndef ZZIP_LARGEFILE_SENSITIVE - #define ZZIP_LARGEFILE_SENSITIVE 1 - #endif -+#endif -+/* #undef LARGEFILE_SENSITIVE */ - - /* Define to the sub-directory where libtool stores uninstalled libraries. */ - #ifndef ZZIP_LT_OBJDIR -@@ -227,9 +230,13 @@ - #endif - - /* Number of bits in a file offset, on hosts where this is settable. */ -+#if __WORDSIZE == 32 - #ifndef ZZIP__FILE_OFFSET_BITS - #define ZZIP__FILE_OFFSET_BITS 64 - #endif -+#endif -+/* #undef _FILE_OFFSET_BITS */ -+ - - /* Define for large files, on AIX-style hosts. */ - /* #undef _LARGE_FILES */ diff --git a/multilib-64.patch b/multilib-64.patch deleted file mode 100644 index 5285e3a..0000000 --- a/multilib-64.patch +++ /dev/null @@ -1,29 +0,0 @@ ---- ./a/zzip/_config.h 2021-07-21 14:18:14.000000000 +0200 -+++ ./b/zzip/_config.h 2021-07-21 14:46:24.037432969 +0200 -@@ -138,6 +138,11 @@ - - /* whether the system defaults to 32bit off_t but can do 64bit when requested - */ -+#if __WORDSIZE == 32 -+#ifndef ZZIP_LARGEFILE_SENSITIVE -+#define ZZIP_LARGEFILE_SENSITIVE 1 -+#endif -+#endif - /* #undef LARGEFILE_SENSITIVE */ - - /* Define to the sub-directory where libtool stores uninstalled libraries. */ -@@ -225,8 +230,14 @@ - #endif - - /* Number of bits in a file offset, on hosts where this is settable. */ -+#if __WORDSIZE == 32 -+#ifndef ZZIP__FILE_OFFSET_BITS -+#define ZZIP__FILE_OFFSET_BITS 64 -+#endif -+#endif - /* #undef _FILE_OFFSET_BITS */ - -+ - /* Define for large files, on AIX-style hosts. */ - /* #undef _LARGE_FILES */ - diff --git a/sources b/sources index 562f581..daf2dbb 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.13.71.tar.gz) = e035d0ac26dca78335ae3defc652543ff7b353a1a95d76ed1beeb21a08e16f287a62d488f528cfbb77d5b558581b68d439aa0823577524e9aa61a3cf5f208cb5 +SHA512 (v0.13.72.tar.gz) = 4bb089e74813c6fac9657cd96e44e4a6469bf86aba3980d885c4573e8db45e74fd07bbdfcec9f36297c72227c8c0b2c37dab1bc4326cef8529960e482fe501c8 diff --git a/zziplib.spec b/zziplib.spec index 59447ce..5be4347 100644 --- a/zziplib.spec +++ b/zziplib.spec @@ -1,17 +1,13 @@ Summary: Lightweight library to easily extract data from zip files Name: zziplib -Version: 0.13.71 -Release: 5%{?dist} +Version: 0.13.72 +Release: 1%{?dist} License: LGPLv2+ or MPLv1.1 URL: http://zziplib.sourceforge.net/ Source: https://github.com/gdraheim/zziplib/archive/v%{version}.tar.gz - -Patch100: multilib-32.patch -Patch101: multilib-64.patch - BuildRequires: make -BuildRequires: gcc +BuildRequires: gcc BuildRequires: perl-interpreter BuildRequires: python3 BuildRequires: python3-rpm-macros @@ -20,8 +16,7 @@ BuildRequires: xmlto BuildRequires: zlib-devel BuildRequires: SDL-devel BuildRequires: pkgconfig -#BuildRequires: autoconf -#BuildRequires: automake +BuildRequires: cmake %description The zziplib library is intentionally lightweight, it offers the ability to @@ -63,35 +58,13 @@ zziplib library. %prep %setup -q - %build -export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing" -%configure \ - --disable-static \ - --enable-sdl \ - --enable-frame-pointer -# Remove rpath on 64bit archs -sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool -sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool -# Only patch generated _config.h on non-i686 and armv7hl -# These platforms have a correct _config.h already - - -pushd %{_builddir}/zziplib-%{version} -%ifarch i686 armv7hl - patch -p2 < %{PATCH100} -%endif -%ifnarch i686 armv7hl - patch -p2 < %{PATCH101} -%endif -popd - - -%make_build +%cmake -B "%{_vpath_builddir}" +%make_build -C "%{_vpath_builddir}" %install -%make_install +%make_install -C "%{_vpath_builddir}" %ldconfig_scriptlets @@ -112,6 +85,12 @@ popd %{_mandir}/man3/* %changelog +* Wed Feb 09 2022 Alexander Bokovoy - 0.13.72-1 +- 0.13.72 +- Fixes CVE-2020-18442 +- Resolves: rhbz#1973831 +- Switch build to CMake, drop 32-bit patches as checks integrated in CMake already + * Wed Sep 01 2021 Jakub Martisko - 0.13.71-5 - Use the multilib patches from RHEL - Resolves ftbfs