CVE-2022-44617-1.patch

@@ -1,154 +0,0 @@
-From f80fa6ae47ad4a5beacb287c0030c9913b046643 Mon Sep 17 00:00:00 2001
-From: Alan Coopersmith <alan.coopersmith@oracle.com>
-Date: Sat, 7 Jan 2023 12:44:28 -0800
-Subject: [PATCH] Fix CVE-2022-44617: Runaway loop with width of 0 and enormous
- height
-
-When reading XPM images from a file with libXpm 3.5.14 or older, if a
-image has a width of 0 and a very large height, the ParsePixels() function
-will loop over the entire height calling getc() and ungetc() repeatedly,
-or in some circumstances, may loop seemingly forever, which may cause a
-denial of service to the calling program when given a small crafted XPM
-file to parse.
-
-Closes: #2
-
-Reported-by: Martin Ettl <ettl.martin78@googlemail.com>
-Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
-
-Origin:
-https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb287c0030c9913b046643
----
- lib/Xm/Xpmdata.c  | 20 ++++++++++++++------
- lib/Xm/Xpmparse.c | 31 +++++++++++++++++++++++++++----
- 2 files changed, 41 insertions(+), 10 deletions(-)
-
-diff --git a/lib/Xm/Xpmdata.c b/lib/Xm/Xpmdata.c
-index d65ae57..45ccfae 100644
---- a/lib/Xm/Xpmdata.c
-+++ b/lib/Xm/Xpmdata.c
-@@ -189,19 +189,23 @@ xpmNextString(mdata)
- 	register char c;
- 
- 	/* get to the end of the current string */
--	if (mdata->Eos)
--	    while ((c = *mdata->cptr++) && c != mdata->Eos);
-+	if (mdata->Eos) {
-+	    while ((c = *mdata->cptr++) && c != mdata->Eos && c != '\0');
-+
-+	    if (c == '\0')
-+		return XpmFileInvalid;
-+	}
- 
- 	/*
- 	 * then get to the beginning of the next string looking for possible
- 	 * comment
- 	 */
- 	if (mdata->Bos) {
--	    while ((c = *mdata->cptr++) && c != mdata->Bos)
-+	    while ((c = *mdata->cptr++) && c != mdata->Bos && c != '\0')
- 		if (mdata->Bcmt && c == mdata->Bcmt[0])
- 		    ParseComment(mdata);
- 	} else if (mdata->Bcmt) {	/* XPM2 natural */
--	    while ((c = *mdata->cptr++) == mdata->Bcmt[0])
-+	    while (((c = *mdata->cptr++) == mdata->Bcmt[0]) && c != '\0')
- 		ParseComment(mdata);
- 	    mdata->cptr--;
- 	}
-@@ -210,9 +214,13 @@ xpmNextString(mdata)
- 	FILE *file = mdata->stream.file;
- 
- 	/* get to the end of the current string */
--	if (mdata->Eos)
-+	if (mdata->Eos) {
- 	    while ((c = getc(file)) != mdata->Eos && c != EOF);
- 
-+	    if (c == EOF)
-+		return XpmFileInvalid;
-+        }
-+
- 	/*
- 	 * then get to the beginning of the next string looking for possible
- 	 * comment
-@@ -228,7 +236,7 @@ xpmNextString(mdata)
- 	    ungetc(c, file);
- 	}
-     }
--    return 0;
-+    return XpmSuccess;
- }
- 
- 
-diff --git a/lib/Xm/Xpmparse.c b/lib/Xm/Xpmparse.c
-index a54bca9..da21dbb 100644
---- a/lib/Xm/Xpmparse.c
-+++ b/lib/Xm/Xpmparse.c
-@@ -523,6 +523,13 @@ ParsePixels(data, width, height, ncolors, cpp, colorTable, hashtable, pixels)
- {
-     unsigned int *iptr, *iptr2 = NULL; /* found by Egbert Eich */
-     unsigned int a, x, y;
-+    int ErrorStatus;
-+
-+    if ((width == 0) && (height != 0))
-+       return (XpmFileInvalid);
-+
-+    if ((height == 0) && (width != 0))
-+       return (XpmFileInvalid);
- 
-     if ((height > 0 && width >= UINT_MAX / height) ||
- 	width * height >= UINT_MAX / sizeof(unsigned int)) 
-@@ -560,7 +567,11 @@ ParsePixels(data, width, height, ncolors, cpp, colorTable, hashtable, pixels)
- 		colidx[(unsigned char)colorTable[a].string[0]] = a + 1;
- 
- 	    for (y = 0; y < height; y++) {
--		xpmNextString(data);
-+		ErrorStatus = xpmNextString(data);
-+		if (ErrorStatus != XpmSuccess) {
-+		    XpmFree(iptr2);
-+		    return (ErrorStatus);
-+		}
- 		for (x = 0; x < width; x++, iptr++) {
- 		    int c = xpmGetC(data);
- 
-@@ -607,7 +618,11 @@ do \
- 	    }
- 
- 	    for (y = 0; y < height; y++) {
--		xpmNextString(data);
-+		ErrorStatus = xpmNextString(data);
-+		if (ErrorStatus != XpmSuccess) {
-+		    XpmFree(iptr2);
-+		    return (ErrorStatus);
-+		}
- 		for (x = 0; x < width; x++, iptr++) {
- 		    int cc1 = xpmGetC(data);
- 		    if (cc1 > 0 && cc1 < 256) {
-@@ -646,7 +661,11 @@ do \
- 		xpmHashAtom *slot;
- 
- 		for (y = 0; y < height; y++) {
--		    xpmNextString(data);
-+		    ErrorStatus = xpmNextString(data);
-+		    if (ErrorStatus != XpmSuccess) {
-+			XpmFree(iptr2);
-+			return (ErrorStatus);
-+		    }
- 		    for (x = 0; x < width; x++, iptr++) {
- 			for (a = 0, s = buf; a < cpp; a++, s++)
- 			    *s = xpmGetC(data); /* int assigned to char, not a problem here */
-@@ -660,7 +679,11 @@ do \
- 		}
- 	    } else {
- 		for (y = 0; y < height; y++) {
--		    xpmNextString(data);
-+		    ErrorStatus = xpmNextString(data);
-+		    if (ErrorStatus != XpmSuccess) {
-+			XpmFree(iptr2);
-+			return (ErrorStatus);
-+		    }
- 		    for (x = 0; x < width; x++, iptr++) {
- 			for (a = 0, s = buf; a < cpp; a++, s++)
- 			    *s = xpmGetC(data); /* int assigned to char, not a problem here */
--- 
-2.46.0
-

CVE-2022-44617-2.patch

@@ -1,43 +0,0 @@
-From c5ab17bcc34914c0b0707d2135dbebe9a367c5f0 Mon Sep 17 00:00:00 2001
-From: Matthieu Herrb <matthieu@herrb.eu>
-Date: Thu, 12 Jan 2023 15:05:39 +1000
-Subject: [PATCH] Prevent a double free in the error code path
-
-xpmParseDataAndCreate() calls XDestroyImage() in the error path.
-Reproducible with sxpm "zero-width.xpm", that file is in the test/
-directory.
-
-The same approach is needed in the bytes_per_line == 0 condition though
-here it just plugs a memory leak.
-
-Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
-
-Origin:
-https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/c5ab17bcc34914c0b0707d2135dbebe9a367c5f0
----
- lib/Xm/Xpmcreate.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/lib/Xm/Xpmcreate.c b/lib/Xm/Xpmcreate.c
-index d0f3c3b..01c5d1a 100644
---- a/lib/Xm/Xpmcreate.c
-+++ b/lib/Xm/Xpmcreate.c
-@@ -954,10 +954,14 @@ CreateXImage(display, visual, depth, format, width, height, image_return)
- #ifndef FOR_MSW
-     if (height != 0 && (*image_return)->bytes_per_line >= INT_MAX / height) {
-   	XDestroyImage(*image_return);
-+  	*image_return = NULL;
-         return (XpmNoMemory);
-     }
--    if((*image_return)->bytes_per_line == 0 ||  height == 0)
-+    if((*image_return)->bytes_per_line == 0 ||  height == 0) {
-+        XDestroyImage(*image_return);
-+        *image_return = NULL;
-         return XpmNoMemory;
-+    }
-     /* now that bytes_per_line must have been set properly alloc data */
-     (*image_return)->data =
- 	(char *) XpmMalloc((*image_return)->bytes_per_line * height);
--- 
-2.46.0
-

CVE-2022-46285.patch

@@ -1,39 +0,0 @@
-From 4636007dd4cebca8ee10738a7833f629d8687529 Mon Sep 17 00:00:00 2001
-From: Alan Coopersmith <alan.coopersmith@oracle.com>
-Date: Sat, 17 Dec 2022 12:23:45 -0800
-Subject: Fix CVE-2022-46285: Infinite loop on unclosed  comments
-
-When reading XPM images from a file with libXpm 3.5.14 or older, if a
-comment in the file is not closed (i.e. a C-style comment starts with
-"/*" and is missing the closing "*/"), the ParseComment() function will
-loop forever calling getc() to try to read the rest of the comment,
-failing to notice that it has returned EOF, which may cause a denial of
-service to the calling program.
-
-Reported-by: Marco Ivaldi <raptor@0xdeadbeef.info>
-Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
-
-Origin:
-https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/a3a7c6dcc3b629d765014816c566c63165c63ca8
----
- lib/Xm/Xpmdata.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/lib/Xm/Xpmdata.c b/lib/Xm/Xpmdata.c
-index d65ae57..9c53f90 100644
---- a/lib/Xm/Xpmdata.c
-+++ b/lib/Xm/Xpmdata.c
-@@ -171,6 +171,10 @@ ParseComment(mdata)
- 		notend = 0;
- 		ungetc(*s, file);
- 	    }
-+	    else if (c == EOF) {
-+		/* hit end of file before the end of the comment */
-+		return XpmFileInvalid;
-+	    }
- 	}
- 	return 0;
-     }
--- 
-2.46.0
-

Fix-issues-with-Werror-format-security.patch

@@ -1,26 +0,0 @@
-From c84b26e5367ee6a0ab856c14bf1e18aa274926f9 Mon Sep 17 00:00:00 2001
-From: cherry530 <707078654@qq.com>
-Date: Fri, 25 Aug 2023 17:33:50 +0800
-Subject: [PATCH] Fix issues with Werror format security
-
-Signed-off-by: cherry530 <707078654@qq.com>
----
- tools/wml/wmlouth.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tools/wml/wmlouth.c b/tools/wml/wmlouth.c
-index ead4512..e92d181 100644
---- a/tools/wml/wmlouth.c
-+++ b/tools/wml/wmlouth.c
-@@ -799,7 +799,7 @@ for ( ndx=0 ; ndx<wml_obj_arg_ptr->cnt ; ndx++ )
-     }
- if ( bitno != 8 )
-     fprintf (outfil, "%s", maskbuf);
--fprintf (outfil, canned1a);
-+fprintf (outfil, "%s", canned1a);
- 
- /*
-  * close the output file
--- 
-2.27.0
-

motif.spec

@@ -1,6 +1,6 @@
 Name:          motif
 Version:       2.3.8
-Release:       7
+Release:       2
 Summary:       Run-time libraries and programs
 License:       LGPLv2+
 URL:           https://motif.ics.com/
@@ -13,12 +13,7 @@ Requires:      xorg-x11-xbitmaps, xorg-x11-xinit
 Requires:      %{name}-help = %{version}-%{release}
 Provides:      openmotif = %{version}-%{release}
 Conflicts:     lesstif <= 0.92.32-6
-
 Patch0:	 0001-fix-motif-no-autogen.patch
-Patch1:        Fix-issues-with-Werror-format-security.patch
-Patch2:        CVE-2022-44617-1.patch
-Patch3:        CVE-2022-44617-2.patch
-Patch4:        CVE-2022-46285.patch
 
 %description
 This module is motif run-time environment, which includes the motif shared libraries.
@@ -46,10 +41,6 @@ This package includes man files for %{name}.
 %prep
 %autosetup -p1
 sed -i 's/-fno-strict-aliasing/-fstack-protector-strong -fno-strict-aliasing/g' configure.ac
-%ifarch loongarch64 riscv64 sw_64
-%_update_config_guess
-%_update_config_sub
-%endif
 
 %build
 CFLAGS="$RPM_OPT_FLAGS -D_FILE_OFFSET_BITS=64"
@@ -91,21 +82,6 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
 %{_mandir}/man*/*
 
 %changelog
-* Mon Feb 17 2025 zhangshaoning <zhangshaoning@uniontech.com> - 2.3.8-7
-- Add sw_64 support
-
-* Fri Oct 25 2024 yaoxin <yao_xin001@hoperun.com> - 2.3.8-6
-- Fix CVE-2022-44617 and CVE-2022-46285
-
-* Fri Aug 25 2023 xu_ping <707078654@qq.com> - 2.3.8-5
-- Fix issues with Werror format security
-
-* Wed Jun 28 2023 laokz <zhangkai@iscas.ac.cn> - 2.3.8-4
-- update config.guess and config.sub for riscv64
-
-* Tue Dec 13 2022 huajingyun <huajingyun@loongson.cn> - 2.3.8-3
-- update config.guess and config.sub for loongarch64
-
 * Thu Aug 25 2022 Ge Wang <wangge20@h-partners.com> - 2.3.8-2
 - add security compile option -fstack-protector-strong