commit 31a0d2b382f64f3ec9c6e6e115537034369c66de Author: overweight <5324761+overweight@user.noreply.gitee.com> Date: Mon Sep 30 10:33:37 2019 -0400 Package init diff --git a/0001-bzip2-1.0.4-saneso.patch b/0001-bzip2-1.0.4-saneso.patch new file mode 100644 index 0000000..6b3430c --- /dev/null +++ b/0001-bzip2-1.0.4-saneso.patch @@ -0,0 +1,12 @@ +diff -up bzip2-1.0.6/Makefile-libbz2_so.pom bzip2-1.0.6/Makefile-libbz2_so +--- bzip2-1.0.6/Makefile-libbz2_so.pom 2010-09-11 01:07:52.000000000 +0200 ++++ bzip2-1.0.6/Makefile-libbz2_so 2010-09-22 10:31:46.000000000 +0200 +@@ -35,7 +35,7 @@ OBJS= blocksort.o \ + bzlib.o + + all: $(OBJS) +- $(CC) -shared -Wl,-soname -Wl,libbz2.so.1.0 -o libbz2.so.1.0.6 $(OBJS) ++ $(CC) -shared -Wl,-soname -Wl,libbz2.so.1 -o libbz2.so.1.0.6 $(OBJS) + $(CC) $(CFLAGS) -o bzip2-shared bzip2.c libbz2.so.1.0.6 + rm -f libbz2.so.1.0 + ln -s libbz2.so.1.0.6 libbz2.so.1.0 diff --git a/0002-bzip2-1.0.4-cflags.patch b/0002-bzip2-1.0.4-cflags.patch new file mode 100644 index 0000000..209d738 --- /dev/null +++ b/0002-bzip2-1.0.4-cflags.patch @@ -0,0 +1,12 @@ +diff -up bzip2-1.0.6/Makefile-libbz2_so.pom bzip2-1.0.6/Makefile-libbz2_so +--- bzip2-1.0.6/Makefile-libbz2_so.pom 2010-09-22 10:36:24.000000000 +0200 ++++ bzip2-1.0.6/Makefile-libbz2_so 2010-09-22 10:36:58.000000000 +0200 +@@ -35,7 +35,7 @@ OBJS= blocksort.o \ + bzlib.o + + all: $(OBJS) +- $(CC) -shared -Wl,-soname -Wl,libbz2.so.1 -o libbz2.so.1.0.6 $(OBJS) ++ $(CC) $(CFLAGS) -shared -Wl,-soname -Wl,libbz2.so.1 -o libbz2.so.1.0.6 $(OBJS) + $(CC) $(CFLAGS) -o bzip2-shared bzip2.c libbz2.so.1.0.6 + rm -f libbz2.so.1.0 + ln -s libbz2.so.1.0.6 libbz2.so.1.0 diff --git a/0003-bzip2-1.0.4-bzip2recover.patch b/0003-bzip2-1.0.4-bzip2recover.patch new file mode 100644 index 0000000..e2bfe1c --- /dev/null +++ b/0003-bzip2-1.0.4-bzip2recover.patch @@ -0,0 +1,12 @@ +--- bzip2-1.0.4/bzip2recover.c.pom 2007-01-03 03:00:55.000000000 +0100 ++++ bzip2-1.0.4/bzip2recover.c 2007-02-05 11:55:17.000000000 +0100 +@@ -309,7 +309,8 @@ + UInt32 buffHi, buffLo, blockCRC; + Char* p; + +- strcpy ( progName, argv[0] ); ++ strncpy ( progName, argv[0], BZ_MAX_FILENAME-1); ++ progName[BZ_MAX_FILENAME-1]='\0'; + inFileName[0] = outFileName[0] = 0; + + fprintf ( stderr, diff --git a/0004-bzip2-ldflags.patch b/0004-bzip2-ldflags.patch new file mode 100644 index 0000000..2281262 --- /dev/null +++ b/0004-bzip2-ldflags.patch @@ -0,0 +1,36 @@ +diff -up bzip2-1.0.6/Makefile.jx bzip2-1.0.6/Makefile +--- bzip2-1.0.6/Makefile.jx 2010-09-10 18:46:02.000000000 -0400 ++++ bzip2-1.0.6/Makefile 2015-08-14 13:04:33.891504131 -0400 +@@ -18,10 +18,6 @@ SHELL=/bin/sh + CC=gcc + AR=ar + RANLIB=ranlib +-LDFLAGS= +- +-BIGFILES=-D_FILE_OFFSET_BITS=64 +-CFLAGS=-Wall -Winline -O2 -g $(BIGFILES) + + # Where you want it installed when you do 'make install' + PREFIX=/usr/local +diff -up bzip2-1.0.6/Makefile-libbz2_so.jx bzip2-1.0.6/Makefile-libbz2_so +--- bzip2-1.0.6/Makefile-libbz2_so.jx 2015-08-14 13:04:33.885503955 -0400 ++++ bzip2-1.0.6/Makefile-libbz2_so 2015-08-14 13:06:52.554581179 -0400 +@@ -24,7 +24,6 @@ + SHELL=/bin/sh + CC=gcc + BIGFILES=-D_FILE_OFFSET_BITS=64 +-CFLAGS=-fpic -fPIC -Wall -Winline -O2 -g $(BIGFILES) + + OBJS= blocksort.o \ + huffman.o \ +@@ -35,8 +34,8 @@ OBJS= blocksort.o \ + bzlib.o + + all: $(OBJS) +- $(CC) $(CFLAGS) -shared -Wl,-soname -Wl,libbz2.so.1 -o libbz2.so.1.0.6 $(OBJS) +- $(CC) $(CFLAGS) -o bzip2-shared bzip2.c libbz2.so.1.0.6 ++ $(CC) $(CFLAGS) $(LDFLAGS) -shared -Wl,-soname -Wl,libbz2.so.1 -o libbz2.so.1.0.6 $(OBJS) ++ $(CC) $(CFLAGS) $(LDFLAGS) -o bzip2-shared bzip2.c libbz2.so.1.0.6 + rm -f libbz2.so.1.0 + ln -s libbz2.so.1.0.6 libbz2.so.1.0 + diff --git a/0005-set-out-file-to-null.patch b/0005-set-out-file-to-null.patch new file mode 100644 index 0000000..18d193b --- /dev/null +++ b/0005-set-out-file-to-null.patch @@ -0,0 +1,11 @@ +diff -up ./bzip2recover.c.old ./bzip2recover.c +--- ./bzip2recover.c.old 2016-03-22 08:49:38.855620000 +0100 ++++ ./bzip2recover.c 2016-03-30 10:22:27.341430099 +0200 +@@ -458,6 +458,7 @@ Int32 main ( Int32 argc, Char** argv ) + bsPutUChar ( bsWr, 0x50 ); bsPutUChar ( bsWr, 0x90 ); + bsPutUInt32 ( bsWr, blockCRC ); + bsClose ( bsWr ); ++ outFile = NULL; + } + if (wrBlock >= rbCtr) break; + wrBlock++; diff --git a/0006-CVE-2019-12900.patch b/0006-CVE-2019-12900.patch new file mode 100644 index 0000000..9213a71 --- /dev/null +++ b/0006-CVE-2019-12900.patch @@ -0,0 +1,32 @@ +From 74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc Mon Sep 17 00:00:00 2001 +From: Albert Astals Cid +Date: Tue, 28 May 2019 19:35:18 +0200 +Subject: [PATCH] Make sure nSelectors is not out of range + +nSelectors is used in a loop from 0 to nSelectors to access selectorMtf +which is + UChar selectorMtf[BZ_MAX_SELECTORS]; +so if nSelectors is bigger than BZ_MAX_SELECTORS it'll do an invalid memory +access + +Fixes out of bounds access discovered while fuzzying karchive +--- + decompress.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/decompress.c b/decompress.c +index ab6a624..f3db91d 100644 +--- a/decompress.c ++++ b/decompress.c +@@ -287,7 +287,7 @@ Int32 BZ2_decompress ( DState* s ) + GET_BITS(BZ_X_SELECTOR_1, nGroups, 3); + if (nGroups < 2 || nGroups > 6) RETURN(BZ_DATA_ERROR); + GET_BITS(BZ_X_SELECTOR_2, nSelectors, 15); +- if (nSelectors < 1) RETURN(BZ_DATA_ERROR); ++ if (nSelectors < 1 || nSelectors > BZ_MAX_SELECTORS) RETURN(BZ_DATA_ERROR); + for (i = 0; i < nSelectors; i++) { + j = 0; + while (True) { +-- +2.21.0 + diff --git a/bzip2-1.0.6.tar.gz b/bzip2-1.0.6.tar.gz new file mode 100644 index 0000000..e47e903 Binary files /dev/null and b/bzip2-1.0.6.tar.gz differ diff --git a/bzip2.pc b/bzip2.pc new file mode 100644 index 0000000..ff40d85 --- /dev/null +++ b/bzip2.pc @@ -0,0 +1,11 @@ +prefix=/usr +exec_prefix=/usr +bindir=/usr/bin +libdir= +includedir=/usr/include + +Name: bzip2 +Description: A file compression library +Version: 1.0.6 +Libs: -L${libdir} -lbz2 +Cflags: -I${includedir} diff --git a/bzip2.spec b/bzip2.spec new file mode 100644 index 0000000..6de4ddb --- /dev/null +++ b/bzip2.spec @@ -0,0 +1,119 @@ +Name: bzip2 +Version: 1.0.6 +Release: 33 +Summary: A high-quality data compressor + +License: BSD +URL: https://www.sourceware.org/bzip2/ +Source0: https://sourceware.org/pub/bzip2/%{name}-%{version}.tar.gz +Source1: bzip2.pc + +Patch0: 0001-bzip2-1.0.4-saneso.patch +Patch1: 0002-bzip2-1.0.4-cflags.patch +Patch2: 0003-bzip2-1.0.4-bzip2recover.patch +Patch3: 0004-bzip2-ldflags.patch +Patch4: 0005-set-out-file-to-null.patch +Patch5: 0006-CVE-2019-12900.patch + +BuildRequires: gcc + +Provides: bzip2-libs +Obsoletes: bzip2-libs + +%description +bzip2 is a freely available, patent free, high-quality data compressor. +It typically compresses files to within 10% to 15% of the best available +techniques (the PPM family of statistical compressors), whilst being +around twice as fast at compression and six times faster at decompression. + +%package devel +Summary: header files for bzip2 +Requires: %{name} = %{version}-%{release} +Provides: bzip2-static +Obsoletes: bzip2-static + +%description devel +header files for bzip2 + +%package_help + +%prep +%autosetup -n %{name}-%{version} -p1 + +%build +%make_build -f Makefile-libbz2_so "CFLAGS=%{optflags} -Winline -D_FILE_OFFSET_BITS=64" +%make_build "CFLAGS=%{optflags} -fpic -fPIC -Winline -D_FILE_OFFSET_BITS=64" + +%install +rm -rf %RPM_BUILD_ROOT +%make_install PREFIX=%{buildroot}%{_prefix} + +# Default install path is /usr/bin lib man, change dest dirs here. +pushd %{buildroot}%{_prefix} +mkdir -p share +mv man/ share/ +mv lib lib64 +popd + +ln -fs bzdiff %{buildroot}%{_bindir}/bzcmp +ln -fs bzgrep %{buildroot}%{_bindir}/bzegrep +ln -fs bzgrep %{buildroot}%{_bindir}/bzfgrep +ln -fs bzmore %{buildroot}%{_bindir}/bzless +install -m 0755 *.so* %{buildroot}%{_libdir} +ln -s libbz2.so.%{version} %{buildroot}%{_libdir}/libbz2.so.1 +ln -s libbz2.so.%{version} %{buildroot}%{_libdir}/libbz2.so +cp %{SOURCE1} . +sed -i "s@^libdir=@libdir=%{_libdir}@" bzip2.pc +mkdir -p %{buildroot}%{_libdir}/pkgconfig +install -m 0644 bzip2.pc %{buildroot}%{_libdir}/pkgconfig/ +ln -s bzip2.1.gz %{buildroot}%{_mandir}/man1/bunzip2.1.gz +ln -s bzip2.1.gz %{buildroot}%{_mandir}/man1/bzcat.1.gz +ln -s bzip2.1.gz %{buildroot}%{_mandir}/man1/bzip2recover.1.gz + +%check +make check + +%ldconfig_scriptlets + +%files +%defattr(-,root,root) +%doc CHANGES LICENSE README +%license LICENSE +%{_bindir}/* +%{_libdir}/*.so.* + +%files devel +%defattr(-,root,root) +%{_includedir}/bzlib.h +%{_libdir}/*.so +%{_libdir}/pkgconfig/ +%{_libdir}/*.a + +%files help +%doc manual.html manual.pdf +%{_mandir}/man1/b*.1.gz + +%changelog +* Tue Sep 24 2019 shenyangyang - 1.0.6-33 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:add help package and combine packages + +* Mon Aug 12 2019 openEuler Builteam - 1.0.6-32 +- rewrite spec + +* Thu Jul 25 2019 wangchan - 1.0.6-31 +- Modify version number + +* Tue Jul 16 2019 wangchan - 1.0.6-30 +- Modify version number + +* Mon Jul 15 2019 wangchan - 1.0.6-29 +- Type:security +- ID:CVE-2019-12900 +- SUG:restart +- DESC: fix CVE-2019-12900 + +* Thu Jul 12 2018 openEuler Builteam > - 1.0.6-28 +- Package init