!46 [sync] PR-41: fix CVE-2024-6655: Library injection from CWD

From: @openeuler-sync-bot 
Reviewed-by: @t_feng 
Signed-off-by: @t_feng

CVE-2024-6655.patch

@@ -0,0 +1,34 @@
+From: Matthias Clasen <mclasen@redhat.com>
+Date: Sat, 15 Jun 2024 14:18:01 -0400
+Subject: Stop looking for modules in cwd
+
+This is just not a good idea. It is surprising, and can be misused.
+
+Fixes: https://gitlab.gnome.org/GNOME/gtk/-/issues/6786
+(cherry picked from commit 3bbf0b6176d42836d23c36a6ac410e807ec0a7a7)
+
+Origin: gtk 3.24.43
+---
+ gtk/gtkmodules.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/gtk/gtkmodules.c b/gtk/gtkmodules.c
+index 50729b6..c0f0c30 100644
+--- a/gtk/gtkmodules.c
++++ b/gtk/gtkmodules.c
+@@ -229,13 +229,8 @@ find_module (const gchar *name)
+   gchar *module_name;
+ 
+   module_name = _gtk_find_module (name, "modules");
+-  if (!module_name)
+-    {
+-      /* As last resort, try loading without an absolute path (using system
+-       * library path)
+-       */
+-      module_name = g_module_build_path (NULL, name);
+-    }
++  if (module_name == NULL)
++    return NULL;
+ 
+   module = g_module_open (module_name, G_MODULE_BIND_LOCAL | G_MODULE_BIND_LAZY);
+ 

gtk2.spec

@@ -6,9 +6,9 @@
 #Basic Information
 Name:            gtk2
 Version:         2.24.33
-Release:         5
+Release:         10
 Summary:         GTK+ graphical user interface library
-License:         LGPLv2+
+License:         LGPL-2.0-or-later
 URL:             http://www.gtk.org
 Source:          http://download.gnome.org/sources/gtk+/2.24/gtk+-%{version}.tar.xz
 Source2:         im-cedilla.conf
@@ -21,6 +21,8 @@ Patch1:  icon-padding.patch
 Patch2:  tooltip-positioning.patch
 # https://bugzilla.gnome.org/show_bug.cgi?id=611313
 Patch3: window-dragging.patch
+# https://gitlab.gnome.org/GNOME/gtk/-/issues/6786
+Patch4: CVE-2024-6655.patch
 
 #Dependency
 BuildRequires:   pkgconfig(glib-2.0) >= 2.28.0 pkgconfig(atk) >= 2.28.0
@@ -29,7 +31,7 @@ BuildRequires:   pkgconfig(cairo) >= 1.6  pkgconfig(gobject-introspection-1.0) >
 BuildRequires:   pkgconfig(xi) pkgconfig(xrandr) pkgconfig(xrender) pkgconfig(xcursor)
 BuildRequires:   pkgconfig(xinerama) pkgconfig(xcomposite) pkgconfig(xdamage)
 BuildRequires:   gettext libxslt python3-devel
-BuildRequires:   gtk-doc automake autoconf libtool pkgconfig 
+BuildRequires:   gtk-doc automake autoconf libtool pkgconfig
 %if 0%{?openEuler}
 BuildRequires:	 cups-devel
 %endif
@@ -224,7 +226,7 @@ gtk-query-immodules-2.0-64 --update-cache
 %{_libdir}/pkgconfig/*
 %{_bindir}/gtk-builder-convert
 %{_bindir}/gtk-demo
-%{_datadir}/gtk-2.0/demo
+%exclude %{_datadir}/gtk-2.0/demo
 %{_datadir}/aclocal/*
 %{_datadir}/gir-1.0
 %{_includedir}/*
@@ -233,11 +235,25 @@ gtk-query-immodules-2.0-64 --update-cache
 %{_datadir}/gtk-doc
 %doc tmpdocs/tutorial
 %doc tmpdocs/faq
-%doc tmpdocs/examples
 %{_mandir}/man1/gtk-query-immodules-2.0*
-%{_mandir}/man1/gtk-builder-convert.1.gz
+%{_mandir}/man1/gtk-builder-convert.1*
 
 %changelog
+* Mon Jul 15 2024 Funda Wang <fundawang@yeah.net> - 2.24.33-10
+- fix CVE-2024-6655: Library injection from CWD
+
+* Thu Jan 18 2024 zhangpan <zhangpan103@h-partners.com> - 2.24.33-9
+- revert last commit
+
+* Tue Jan 16 2024 zhangpan <zhangpan103@h-partners.com> - 2.24.33-8
+- delete taboo words
+
+* Thu Dec 15 2022 zhouwenpei <zhouwenpei1@h-partners.com> - 2.24.33-7
+- remove *.c and demo* from help and devel
+
+* Sat Jun 11 2022 wangkeorng <wangkeorng@h-partners.com> - 2.24.33-6
+- delete autosetup macro in changelog
+
 * Sat May 7 2022 dongyuzhen <dongyuzhen@h-partners.com> - 2.24.33-5
 - fix changelog
 
@@ -245,7 +261,7 @@ gtk-query-immodules-2.0-64 --update-cache
 - Other distros disable cups
 
 * Fri Jul 30 2021 chenyanpanHW <chenyanpan@huawei.com> - 2.24.33-3
-- DESC: delete -Sgit from %autosetup, and delete BuildRequires git
+- DESC: delete -Sgit from autosetup, and delete BuildRequires git
 
 * Wed Mar 10 2021 yanan <yanan@huawei.com> - 2.24.33-2
 - use multi-thread to build