diff options
Diffstat (limited to 'gnu/packages/patches')
21 files changed, 1305 insertions, 315 deletions
diff --git a/gnu/packages/patches/allegro4-mesa-18.2.5-and-later.patch b/gnu/packages/patches/allegro4-mesa-18.2.5-and-later.patch deleted file mode 100644 index a4944821db..0000000000 --- a/gnu/packages/patches/allegro4-mesa-18.2.5-and-later.patch +++ /dev/null @@ -1,41 +0,0 @@ -Fixes compilation with Mesa >= 18.2.5. - -Modified from upstream to work on allegro4: - -https://github.com/liballeg/allegro5/commit/a40d30e21802ecf5c9382cf34af9b01bd3781e47 - -diff --git a/addons/allegrogl/include/alleggl.h b/addons/allegrogl/include/alleggl.h -index 0f86a6768..652dd024e 100644 ---- a/addons/allegrogl/include/alleggl.h -+++ b/addons/allegrogl/include/alleggl.h -@@ -103,10 +103,14 @@ - - /* HACK: Prevent both Mesa and SGI's broken headers from screwing us */ - #define __glext_h_ -+#define __gl_glext_h_ - #define __glxext_h_ -+#define __glx_glxext_h_ - #include <GL/gl.h> - #undef __glext_h_ -+#undef __gl_glext_h_ - #undef __glxext_h_ -+#undef __glx_glxext_h_ - - #endif /* ALLEGRO_MACOSX */ - -diff --git a/addons/allegrogl/include/allegrogl/GLext/glx_ext_defs.h b/addons/allegrogl/include/allegrogl/GLext/glx_ext_defs.h -index 49c502091..fba8aea5d 100644 ---- a/addons/allegrogl/include/allegrogl/GLext/glx_ext_defs.h -+++ b/addons/allegrogl/include/allegrogl/GLext/glx_ext_defs.h -@@ -1,7 +1,9 @@ - /* HACK: Prevent both Mesa and SGI's broken headers from screwing us */ - #define __glxext_h_ -+#define __glx_glxext_h_ - #include <GL/glx.h> - #undef __glxext_h_ -+#undef __glx_glxext_h_ - - #ifndef GLX_VERSION_1_3 - #define _ALLEGRO_GLX_VERSION_1_3 --- -2.20.0 diff --git a/gnu/packages/patches/clang-7.0-libc-search-path.patch b/gnu/packages/patches/clang-7.0-libc-search-path.patch new file mode 100644 index 0000000000..07ff8c90bd --- /dev/null +++ b/gnu/packages/patches/clang-7.0-libc-search-path.patch @@ -0,0 +1,82 @@ +Clang attempts to guess file names based on the OS and distro (yes!), +but unfortunately, that doesn't work for us. + +This patch makes it easy to insert libc's $libdir so that Clang passes the +correct absolute file name of crt1.o etc. to 'ld'. It also disables all +the distro-specific stuff and removes the hard-coded FHS directory names +to make sure Clang also works on non-GuixSD systems. + +--- a/lib/Driver/ToolChains/Linux.cpp ++++ b/lib/Driver/ToolChains/Linux.cpp +@@ -225,7 +225,9 @@ Linux::Linux(const Driver &D, const llvm::Triple &Triple, const ArgList &Args) + PPaths.push_back(Twine(GCCInstallation.getParentLibPath() + "/../" + + GCCInstallation.getTriple().str() + "/bin") + .str()); +- ++ // Comment out the distro-specific tweaks so that they don't bite when ++ // using Guix on a foreign distro. ++#if 0 + Distro Distro(D.getVFS()); + + if (Distro.IsAlpineLinux()) { +@@ -284,6 +286,7 @@ Linux::Linux(const Driver &D, const llvm::Triple &Triple, const ArgList &Args) + + if (IsAndroid || Distro.IsOpenSUSE()) + ExtraOpts.push_back("--enable-new-dtags"); ++#endif + + // The selection of paths to try here is designed to match the patterns which + // the GCC driver itself uses, as this is part of the GCC-compatible driver. +@@ -342,7 +345,7 @@ Linux::Linux(const Driver &D, const llvm::Triple &Triple, const ArgList &Args) + // the cross. Note that GCC does include some of these directories in some + // configurations but this seems somewhere between questionable and simply + // a bug. +- if (StringRef(LibPath).startswith(SysRoot)) { ++ if (0) { + addPathIfExists(D, LibPath + "/" + MultiarchTriple, Paths); + addPathIfExists(D, LibPath + "/../" + OSLibDir, Paths); + } +@@ -361,6 +364,8 @@ Linux::Linux(const Driver &D, const llvm::Triple &Triple, const ArgList &Args) + addPathIfExists(D, SysRoot + "/lib/" + MultiarchTriple, Paths); + addPathIfExists(D, SysRoot + "/lib/../" + OSLibDir, Paths); + ++ // This requires the commented distro tweaks above. ++#if 0 + if (IsAndroid) { + // Android sysroots contain a library directory for each supported OS + // version as well as some unversioned libraries in the usual multiarch +@@ -389,10 +394,14 @@ Linux::Linux(const Driver &D, const llvm::Triple &Triple, const ArgList &Args) + addPathIfExists(D, SysRoot + "/" + OSLibDir + "/" + ABIName, Paths); + addPathIfExists(D, SysRoot + "/usr/" + OSLibDir + "/" + ABIName, Paths); + } ++#endif + + // Try walking via the GCC triple path in case of biarch or multiarch GCC + // installations with strange symlinks. + if (GCCInstallation.isValid()) { ++ // The following code would end up adding things like ++ // "/usr/lib/x86_64-unknown-linux-gnu/../../lib64" to the search path. ++#if 0 + addPathIfExists(D, + SysRoot + "/usr/lib/" + GCCInstallation.getTriple().str() + + "/../../" + OSLibDir, +@@ -405,6 +414,7 @@ Linux::Linux(const Driver &D, const llvm::Triple &Triple, const ArgList &Args) + BiarchSibling.gccSuffix(), + Paths); + } ++#endif + + // See comments above on the multilib variant for details of why this is + // included even from outside the sysroot. +@@ -429,8 +439,9 @@ Linux::Linux(const Driver &D, const llvm::Triple &Triple, const ArgList &Args) + if (StringRef(D.Dir).startswith(SysRoot)) + addPathIfExists(D, D.Dir + "/../lib", Paths); + +- addPathIfExists(D, SysRoot + "/lib", Paths); +- addPathIfExists(D, SysRoot + "/usr/lib", Paths); ++ // Add libc's lib/ directory to the search path, so that crt1.o, crti.o, ++ // and friends can be found. ++ addPathIfExists(D, "@GLIBC_LIBDIR@", Paths); + } + + bool Linux::HasNativeLLVMSupport() const { return true; } diff --git a/gnu/packages/patches/dealii-mpi-deprecations.patch b/gnu/packages/patches/dealii-mpi-deprecations.patch new file mode 100644 index 0000000000..816d54140a --- /dev/null +++ b/gnu/packages/patches/dealii-mpi-deprecations.patch @@ -0,0 +1,28 @@ +From 40538ad31a71495649d174b0f7be5f7135d0a905 Mon Sep 17 00:00:00 2001 +From: David Wells <drwells@email.unc.edu> +Date: Sat, 2 Feb 2019 10:00:38 -0500 +Subject: [PATCH] Avoid calling a deprecated MPI function. + +This was deprecated a long time ago (1996) and is not present in the +latest version of openMPI (4.0): see + +https://www.open-mpi.org/faq/?category=mpi-removed + +Credit goes to Pratik Nayak for finding this issue. +--- + source/base/mpi.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source/base/mpi.cc b/source/base/mpi.cc +index bd1f7f9846a..b8cd45e7c26 100644 +--- a/source/base/mpi.cc ++++ b/source/base/mpi.cc +@@ -448,7 +448,7 @@ namespace Utilities + MPI_Aint displacements[] = {0, offsetof(MinMaxAvg, min_index)}; + MPI_Datatype types[] = {MPI_DOUBLE, MPI_INT}; + +- ierr = MPI_Type_struct(2, lengths, displacements, types, &type); ++ ierr = MPI_Type_create_struct(2, lengths, displacements, types, &type); + AssertThrowMPI(ierr); + + ierr = MPI_Type_commit(&type); diff --git a/gnu/packages/patches/doxygen-test.patch b/gnu/packages/patches/doxygen-test.patch index 5ac063adbf..8ccb9ec3c4 100644 --- a/gnu/packages/patches/doxygen-test.patch +++ b/gnu/packages/patches/doxygen-test.patch @@ -5,14 +5,14 @@ test. diff -u -r doxygen-1.8.7.orig/testing/012/citelist.xml doxygen-1.8.7/testing/012/citelist.xml --- doxygen-1.8.7.orig/testing/012/citelist.xml 2014-04-24 23:43:34.000000000 +0200 +++ doxygen-1.8.7/testing/012/citelist.xml 2014-04-24 23:49:43.000000000 +0200 -@@ -4,17 +4,6 @@ - <compoundname>citelist</compoundname> - <title>Bibliography</title> +@@ -6,17 +6,6 @@ + <briefdescription> + </briefdescription> <detaileddescription> - <para> - <variablelist> - <varlistentry> -- <term><anchor id="_1CITEREF_knuth79"/>[1]</term> +- <term><anchor id="citelist_1CITEREF_knuth79"/>[1]</term> - </varlistentry> - <listitem> - <para>Donald<nonbreakablespace/>E. Knuth. <emphasis>Tex and Metafont, New Directions in Typesetting</emphasis>. American Mathematical Society and Digital Press, Stanford, 1979.</para> diff --git a/gnu/packages/patches/gd-CVE-2019-6977.patch b/gnu/packages/patches/gd-CVE-2019-6977.patch new file mode 100644 index 0000000000..b21a8ac619 --- /dev/null +++ b/gnu/packages/patches/gd-CVE-2019-6977.patch @@ -0,0 +1,36 @@ +Fix CVE-2019-6977: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6977 + +Patch copied from Debian: + +https://salsa.debian.org/debian/libgd2/commit/2d7d3b68bb79843e5271a05543e996fd5a3a8cd1 + +Description: Heap-based buffer overflow in gdImageColorMatch +Origin: other, https://gist.github.com/cmb69/1f36d285eb297ed326f5c821d7aafced +Bug-PHP: https://bugs.php.net/bug.php?id=77270 +Bug-Debian: https://bugs.debian.org/920645 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-6977 +Forwarded: no +Author: "Christoph M. Becker" <cmbecker69@gmx.de> +Last-Update: 2019-02-01 + +At least some of the image reading functions may return images which +use color indexes greater than or equal to im->colorsTotal. We cater +to this by always using a buffer size which is sufficient for +`gdMaxColors` in `gdImageColorMatch()`. +--- + +--- a/src/gd_color_match.c ++++ b/src/gd_color_match.c +@@ -31,8 +31,8 @@ BGD_DECLARE(int) gdImageColorMatch (gdIm + return -4; /* At least 1 color must be allocated */ + } + +- buf = (unsigned long *)gdMalloc(sizeof(unsigned long) * 5 * im2->colorsTotal); +- memset (buf, 0, sizeof(unsigned long) * 5 * im2->colorsTotal ); ++ buf = (unsigned long *)gdMalloc(sizeof(unsigned long) * 5 * gdMaxColors); ++ memset (buf, 0, sizeof(unsigned long) * 5 * gdMaxColors ); + + for (x=0; x < im1->sx; x++) { + for( y=0; y<im1->sy; y++ ) { diff --git a/gnu/packages/patches/gd-CVE-2019-6978.patch b/gnu/packages/patches/gd-CVE-2019-6978.patch new file mode 100644 index 0000000000..69fc5056fc --- /dev/null +++ b/gnu/packages/patches/gd-CVE-2019-6978.patch @@ -0,0 +1,301 @@ +Fix CVE-2019-6978: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6978 + +Patch copied from upstream source repository: + +https://github.com/libgd/libgd/commit/553702980ae89c83f2d6e254d62cf82e204956d0 + +From 553702980ae89c83f2d6e254d62cf82e204956d0 Mon Sep 17 00:00:00 2001 +From: "Christoph M. Becker" <cmbecker69@gmx.de> +Date: Thu, 17 Jan 2019 11:54:55 +0100 +Subject: [PATCH] Fix #492: Potential double-free in gdImage*Ptr() + +Whenever `gdImage*Ptr()` calls `gdImage*Ctx()` and the latter fails, we +must not call `gdDPExtractData()`; otherwise a double-free would +happen. Since `gdImage*Ctx()` are void functions, and we can't change +that for BC reasons, we're introducing static helpers which are used +internally. + +We're adding a regression test for `gdImageJpegPtr()`, but not for +`gdImageGifPtr()` and `gdImageWbmpPtr()` since we don't know how to +trigger failure of the respective `gdImage*Ctx()` calls. + +This potential security issue has been reported by Solmaz Salimi (aka. +Rooney). +--- + src/gd_gif_out.c | 18 +++++++++++++++--- + src/gd_jpeg.c | 20 ++++++++++++++++---- + src/gd_wbmp.c | 21 ++++++++++++++++++--- + tests/jpeg/.gitignore | 1 + + tests/jpeg/CMakeLists.txt | 1 + + tests/jpeg/Makemodule.am | 3 ++- + tests/jpeg/jpeg_ptr_double_free.c | 31 +++++++++++++++++++++++++++++++ + 7 files changed, 84 insertions(+), 11 deletions(-) + create mode 100644 tests/jpeg/jpeg_ptr_double_free.c + +diff --git a/src/gd_gif_out.c b/src/gd_gif_out.c +index 298a581..d5a9534 100644 +--- a/src/gd_gif_out.c ++++ b/src/gd_gif_out.c +@@ -99,6 +99,7 @@ static void char_init(GifCtx *ctx); + static void char_out(int c, GifCtx *ctx); + static void flush_char(GifCtx *ctx); + ++static int _gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out); + + + +@@ -131,8 +132,11 @@ BGD_DECLARE(void *) gdImageGifPtr(gdImagePtr im, int *size) + void *rv; + gdIOCtx *out = gdNewDynamicCtx(2048, NULL); + if (out == NULL) return NULL; +- gdImageGifCtx(im, out); +- rv = gdDPExtractData(out, size); ++ if (!_gdImageGifCtx(im, out)) { ++ rv = gdDPExtractData(out, size); ++ } else { ++ rv = NULL; ++ } + out->gd_free(out); + return rv; + } +@@ -220,6 +224,12 @@ BGD_DECLARE(void) gdImageGif(gdImagePtr im, FILE *outFile) + + */ + BGD_DECLARE(void) gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out) ++{ ++ _gdImageGifCtx(im, out); ++} ++ ++/* returns 0 on success, 1 on failure */ ++static int _gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out) + { + gdImagePtr pim = 0, tim = im; + int interlace, BitsPerPixel; +@@ -231,7 +241,7 @@ BGD_DECLARE(void) gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out) + based temporary image. */ + pim = gdImageCreatePaletteFromTrueColor(im, 1, 256); + if(!pim) { +- return; ++ return 1; + } + tim = pim; + } +@@ -247,6 +257,8 @@ BGD_DECLARE(void) gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out) + /* Destroy palette based temporary image. */ + gdImageDestroy( pim); + } ++ ++ return 0; + } + + +diff --git a/src/gd_jpeg.c b/src/gd_jpeg.c +index fc05842..96ef430 100644 +--- a/src/gd_jpeg.c ++++ b/src/gd_jpeg.c +@@ -117,6 +117,8 @@ static void fatal_jpeg_error(j_common_ptr cinfo) + exit(99); + } + ++static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality); ++ + /* + * Write IM to OUTFILE as a JFIF-formatted JPEG image, using quality + * QUALITY. If QUALITY is in the range 0-100, increasing values +@@ -231,8 +233,11 @@ BGD_DECLARE(void *) gdImageJpegPtr(gdImagePtr im, int *size, int quality) + void *rv; + gdIOCtx *out = gdNewDynamicCtx(2048, NULL); + if (out == NULL) return NULL; +- gdImageJpegCtx(im, out, quality); +- rv = gdDPExtractData(out, size); ++ if (!_gdImageJpegCtx(im, out, quality)) { ++ rv = gdDPExtractData(out, size); ++ } else { ++ rv = NULL; ++ } + out->gd_free(out); + return rv; + } +@@ -253,6 +258,12 @@ void jpeg_gdIOCtx_dest(j_compress_ptr cinfo, gdIOCtx *outfile); + + */ + BGD_DECLARE(void) gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality) ++{ ++ _gdImageJpegCtx(im, outfile, quality); ++} ++ ++/* returns 0 on success, 1 on failure */ ++static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality) + { + struct jpeg_compress_struct cinfo; + struct jpeg_error_mgr jerr; +@@ -287,7 +298,7 @@ BGD_DECLARE(void) gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality) + if(row) { + gdFree(row); + } +- return; ++ return 1; + } + + cinfo.err->emit_message = jpeg_emit_message; +@@ -328,7 +339,7 @@ BGD_DECLARE(void) gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality) + if(row == 0) { + gd_error("gd-jpeg: error: unable to allocate JPEG row structure: gdCalloc returns NULL\n"); + jpeg_destroy_compress(&cinfo); +- return; ++ return 1; + } + + rowptr[0] = row; +@@ -405,6 +416,7 @@ BGD_DECLARE(void) gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality) + jpeg_finish_compress(&cinfo); + jpeg_destroy_compress(&cinfo); + gdFree(row); ++ return 0; + } + + +diff --git a/src/gd_wbmp.c b/src/gd_wbmp.c +index f19a1c9..a49bdbe 100644 +--- a/src/gd_wbmp.c ++++ b/src/gd_wbmp.c +@@ -88,6 +88,8 @@ int gd_getin(void *in) + return (gdGetC((gdIOCtx *)in)); + } + ++static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out); ++ + /* + Function: gdImageWBMPCtx + +@@ -100,6 +102,12 @@ int gd_getin(void *in) + out - the stream where to write + */ + BGD_DECLARE(void) gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out) ++{ ++ _gdImageWBMPCtx(image, fg, out); ++} ++ ++/* returns 0 on success, 1 on failure */ ++static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out) + { + int x, y, pos; + Wbmp *wbmp; +@@ -107,7 +115,7 @@ BGD_DECLARE(void) gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out) + /* create the WBMP */ + if((wbmp = createwbmp(gdImageSX(image), gdImageSY(image), WBMP_WHITE)) == NULL) { + gd_error("Could not create WBMP\n"); +- return; ++ return 1; + } + + /* fill up the WBMP structure */ +@@ -123,11 +131,15 @@ BGD_DECLARE(void) gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out) + + /* write the WBMP to a gd file descriptor */ + if(writewbmp(wbmp, &gd_putout, out)) { ++ freewbmp(wbmp); + gd_error("Could not save WBMP\n"); ++ return 1; + } + + /* des submitted this bugfix: gdFree the memory. */ + freewbmp(wbmp); ++ ++ return 0; + } + + /* +@@ -271,8 +283,11 @@ BGD_DECLARE(void *) gdImageWBMPPtr(gdImagePtr im, int *size, int fg) + void *rv; + gdIOCtx *out = gdNewDynamicCtx(2048, NULL); + if (out == NULL) return NULL; +- gdImageWBMPCtx(im, fg, out); +- rv = gdDPExtractData(out, size); ++ if (!_gdImageWBMPCtx(im, fg, out)) { ++ rv = gdDPExtractData(out, size); ++ } else { ++ rv = NULL; ++ } + out->gd_free(out); + return rv; + } +#diff --git a/tests/jpeg/.gitignore b/tests/jpeg/.gitignore +#index c28aa87..13bcf04 100644 +#--- a/tests/jpeg/.gitignore +#+++ b/tests/jpeg/.gitignore +#@@ -3,5 +3,6 @@ +# /jpeg_empty_file +# /jpeg_im2im +# /jpeg_null +#+/jpeg_ptr_double_free +# /jpeg_read +# /jpeg_resolution +diff --git a/tests/jpeg/CMakeLists.txt b/tests/jpeg/CMakeLists.txt +index 19964b0..a8d8162 100644 +--- a/tests/jpeg/CMakeLists.txt ++++ b/tests/jpeg/CMakeLists.txt +@@ -2,6 +2,7 @@ IF(JPEG_FOUND) + LIST(APPEND TESTS_FILES + jpeg_empty_file + jpeg_im2im ++ jpeg_ptr_double_free + jpeg_null + ) + +diff --git a/tests/jpeg/Makemodule.am b/tests/jpeg/Makemodule.am +index 7e5d317..b89e169 100644 +--- a/tests/jpeg/Makemodule.am ++++ b/tests/jpeg/Makemodule.am +@@ -2,7 +2,8 @@ if HAVE_LIBJPEG + libgd_test_programs += \ + jpeg/jpeg_empty_file \ + jpeg/jpeg_im2im \ +- jpeg/jpeg_null ++ jpeg/jpeg_null \ ++ jpeg/jpeg_ptr_double_free + + if HAVE_LIBPNG + libgd_test_programs += \ +diff --git a/tests/jpeg/jpeg_ptr_double_free.c b/tests/jpeg/jpeg_ptr_double_free.c +new file mode 100644 +index 0000000..df5a510 +--- /dev/null ++++ b/tests/jpeg/jpeg_ptr_double_free.c +@@ -0,0 +1,31 @@ ++/** ++ * Test that failure to convert to JPEG returns NULL ++ * ++ * We are creating an image, set its width to zero, and pass this image to ++ * `gdImageJpegPtr()` which is supposed to fail, and as such should return NULL. ++ * ++ * See also <https://github.com/libgd/libgd/issues/381> ++ */ ++ ++ ++#include "gd.h" ++#include "gdtest.h" ++ ++ ++int main() ++{ ++ gdImagePtr src, dst; ++ int size; ++ ++ src = gdImageCreateTrueColor(1, 10); ++ gdTestAssert(src != NULL); ++ ++ src->sx = 0; /* this hack forces gdImageJpegPtr() to fail */ ++ ++ dst = gdImageJpegPtr(src, &size, 0); ++ gdTestAssert(dst == NULL); ++ ++ gdImageDestroy(src); ++ ++ return gdNumFailures(); ++} +-- +2.20.1 + diff --git a/gnu/packages/patches/glibc-CVE-2018-11236.patch b/gnu/packages/patches/glibc-CVE-2018-11236.patch new file mode 100644 index 0000000000..4f8a72943c --- /dev/null +++ b/gnu/packages/patches/glibc-CVE-2018-11236.patch @@ -0,0 +1,149 @@ +https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=patch;h=5460617d1567657621107d895ee2dd83bc1f88f2 +with ChangeLog removed + +From 5460617d1567657621107d895ee2dd83bc1f88f2 Mon Sep 17 00:00:00 2001 +From: Paul Pluzhnikov <ppluzhnikov@google.com> +Date: Tue, 8 May 2018 18:12:41 -0700 +Subject: [PATCH] Fix BZ 22786: integer addition overflow may cause stack + buffer overflow when realpath() input length is close to SSIZE_MAX. + +2018-05-09 Paul Pluzhnikov <ppluzhnikov@google.com> + + [BZ #22786] + * stdlib/canonicalize.c (__realpath): Fix overflow in path length + computation. + * stdlib/Makefile (test-bz22786): New test. + * stdlib/test-bz22786.c: New test. +--- + ChangeLog | 8 +++++ + stdlib/Makefile | 2 +- + stdlib/canonicalize.c | 2 +- + stdlib/test-bz22786.c | 90 +++++++++++++++++++++++++++++++++++++++++++++++++++ + 4 files changed, 100 insertions(+), 2 deletions(-) + create mode 100644 stdlib/test-bz22786.c + +diff --git a/stdlib/Makefile b/stdlib/Makefile +index af1643c..1ddb1f9 100644 +--- a/stdlib/Makefile ++++ b/stdlib/Makefile +@@ -84,7 +84,7 @@ tests := tst-strtol tst-strtod testmb testrand testsort testdiv \ + tst-cxa_atexit tst-on_exit test-atexit-race \ + test-at_quick_exit-race test-cxa_atexit-race \ + test-on_exit-race test-dlclose-exit-race \ +- tst-makecontext-align ++ tst-makecontext-align test-bz22786 + + tests-internal := tst-strtod1i tst-strtod3 tst-strtod4 tst-strtod5i \ + tst-tls-atexit tst-tls-atexit-nodelete +diff --git a/stdlib/canonicalize.c b/stdlib/canonicalize.c +index 4135f3f..390fb43 100644 +--- a/stdlib/canonicalize.c ++++ b/stdlib/canonicalize.c +@@ -181,7 +181,7 @@ __realpath (const char *name, char *resolved) + extra_buf = __alloca (path_max); + + len = strlen (end); +- if ((long int) (n + len) >= path_max) ++ if (path_max - n <= len) + { + __set_errno (ENAMETOOLONG); + goto error; +diff --git a/stdlib/test-bz22786.c b/stdlib/test-bz22786.c +new file mode 100644 +index 0000000..e7837f9 +--- /dev/null ++++ b/stdlib/test-bz22786.c +@@ -0,0 +1,90 @@ ++/* Bug 22786: test for buffer overflow in realpath. ++ Copyright (C) 2018 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <http://www.gnu.org/licenses/>. */ ++ ++/* This file must be run from within a directory called "stdlib". */ ++ ++#include <errno.h> ++#include <limits.h> ++#include <stdio.h> ++#include <stdlib.h> ++#include <string.h> ++#include <unistd.h> ++#include <sys/stat.h> ++#include <sys/types.h> ++#include <support/test-driver.h> ++#include <libc-diag.h> ++ ++static int ++do_test (void) ++{ ++ const char dir[] = "bz22786"; ++ const char lnk[] = "bz22786/symlink"; ++ ++ rmdir (dir); ++ if (mkdir (dir, 0755) != 0 && errno != EEXIST) ++ { ++ printf ("mkdir %s: %m\n", dir); ++ return EXIT_FAILURE; ++ } ++ if (symlink (".", lnk) != 0 && errno != EEXIST) ++ { ++ printf ("symlink (%s, %s): %m\n", dir, lnk); ++ return EXIT_FAILURE; ++ } ++ ++ const size_t path_len = (size_t) INT_MAX + 1; ++ ++ DIAG_PUSH_NEEDS_COMMENT; ++#if __GNUC_PREREQ (7, 0) ++ /* GCC 7 warns about too-large allocations; here we need such ++ allocation to succeed for the test to work. */ ++ DIAG_IGNORE_NEEDS_COMMENT (7, "-Walloc-size-larger-than="); ++#endif ++ char *path = malloc (path_len); ++ DIAG_POP_NEEDS_COMMENT; ++ ++ if (path == NULL) ++ { ++ printf ("malloc (%zu): %m\n", path_len); ++ return EXIT_UNSUPPORTED; ++ } ++ ++ /* Construct very long path = "bz22786/symlink/aaaa....." */ ++ char *p = mempcpy (path, lnk, sizeof (lnk) - 1); ++ *(p++) = '/'; ++ memset (p, 'a', path_len - (path - p) - 2); ++ p[path_len - (path - p) - 1] = '\0'; ++ ++ /* This call crashes before the fix for bz22786 on 32-bit platforms. */ ++ p = realpath (path, NULL); ++ ++ if (p != NULL || errno != ENAMETOOLONG) ++ { ++ printf ("realpath: %s (%m)", p); ++ return EXIT_FAILURE; ++ } ++ ++ /* Cleanup. */ ++ unlink (lnk); ++ rmdir (dir); ++ ++ return 0; ++} ++ ++#define TEST_FUNCTION do_test ++#include <support/test-driver.c> +-- +2.9.3 + diff --git a/gnu/packages/patches/glibc-CVE-2018-11237.patch b/gnu/packages/patches/glibc-CVE-2018-11237.patch new file mode 100644 index 0000000000..8a7c604ecd --- /dev/null +++ b/gnu/packages/patches/glibc-CVE-2018-11237.patch @@ -0,0 +1,55 @@ +https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=patch;h=9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e +with the ChangeLog removed + +From 9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e Mon Sep 17 00:00:00 2001 +From: Andreas Schwab <schwab@suse.de> +Date: Tue, 22 May 2018 10:37:59 +0200 +Subject: [PATCH] Don't write beyond destination in + __mempcpy_avx512_no_vzeroupper (bug 23196) + +When compiled as mempcpy, the return value is the end of the destination +buffer, thus it cannot be used to refer to the start of it. +--- + ChangeLog | 9 +++++++++ + string/test-mempcpy.c | 1 + + sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S | 5 +++-- + 3 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/string/test-mempcpy.c b/string/test-mempcpy.c +index c08fba8..d98ecdd 100644 +--- a/string/test-mempcpy.c ++++ b/string/test-mempcpy.c +@@ -18,6 +18,7 @@ + <http://www.gnu.org/licenses/>. */ + + #define MEMCPY_RESULT(dst, len) (dst) + (len) ++#define MIN_PAGE_SIZE 131072 + #define TEST_MAIN + #define TEST_NAME "mempcpy" + #include "test-string.h" +diff --git a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S +index 23c0f7a..effc3ac 100644 +--- a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S ++++ b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S +@@ -336,6 +336,7 @@ L(preloop_large): + vmovups (%rsi), %zmm4 + vmovups 0x40(%rsi), %zmm5 + ++ mov %rdi, %r11 + /* Align destination for access with non-temporal stores in the loop. */ + mov %rdi, %r8 + and $-0x80, %rdi +@@ -366,8 +367,8 @@ L(gobble_256bytes_nt_loop): + cmp $256, %rdx + ja L(gobble_256bytes_nt_loop) + sfence +- vmovups %zmm4, (%rax) +- vmovups %zmm5, 0x40(%rax) ++ vmovups %zmm4, (%r11) ++ vmovups %zmm5, 0x40(%r11) + jmp L(check) + + L(preloop_large_bkw): +-- +2.9.3 + diff --git a/gnu/packages/patches/kio-search-smbd-on-PATH.patch b/gnu/packages/patches/kio-search-smbd-on-PATH.patch index 47e20cfc0b..55535ffa11 100644 --- a/gnu/packages/patches/kio-search-smbd-on-PATH.patch +++ b/gnu/packages/patches/kio-search-smbd-on-PATH.patch @@ -16,7 +16,7 @@ pkgs/development/libraries/kde-frameworks/kio/samba-search-path.patch + QLatin1Char pathSep(':'); + QStringList paths = QFile::decodeName(pathEnv).split(pathSep, QString::SkipEmptyParts); + for (QStringList::iterator it = paths.begin(); it != paths.end(); ++it) { -+ it->append("/smbd"); ++ it->append(QStringLiteral("/smbd")); + if (QFile::exists(*it)) { + return true; + } diff --git a/gnu/packages/patches/ledger-revert-boost-python-fix.patch b/gnu/packages/patches/ledger-revert-boost-python-fix.patch deleted file mode 100644 index 99f48f6e46..0000000000 --- a/gnu/packages/patches/ledger-revert-boost-python-fix.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 01220484f428a447e9b00e071a0d85185f30e1de Mon Sep 17 00:00:00 2001 -From: Alexis Hildebrandt <afh@surryhill.net> -Date: Wed, 22 Jun 2016 15:43:37 +0200 -Subject: [PATCH] Revert "[python] Add fix for Boost.Python compile errors" - -This reverts commit 11590e134eafa768ccc4a171cc7fb216e906095f. ---- - src/py_commodity.cc | 3 --- - src/py_journal.cc | 3 --- - 2 files changed, 6 deletions(-) - -diff --git a/src/py_commodity.cc b/src/py_commodity.cc -index 5aafa6c..c457e64 100644 ---- a/src/py_commodity.cc -+++ b/src/py_commodity.cc -@@ -243,9 +243,6 @@ namespace { - - void export_commodity() - { --#if BOOST_VERSION >= 106000 -- python::register_ptr_to_python< shared_ptr<commodity_pool_t> >(); --#endif - class_< commodity_pool_t, shared_ptr<commodity_pool_t>, - boost::noncopyable > ("CommodityPool", no_init) - .add_property("null_commodity", -diff --git a/src/py_journal.cc b/src/py_journal.cc -index c1c38a9..879f954 100644 ---- a/src/py_journal.cc -+++ b/src/py_journal.cc -@@ -232,9 +232,6 @@ void export_journal() - boost::noncopyable >("PostHandler") - ; - --#if BOOST_VERSION >= 106000 -- python::register_ptr_to_python< shared_ptr<collector_wrapper> >(); --#endif - class_< collector_wrapper, shared_ptr<collector_wrapper>, - boost::noncopyable >("PostCollectorWrapper", no_init) - .def("__len__", &collector_wrapper::length) diff --git a/gnu/packages/patches/mrustc-0.8.0-fix-variable-length-integer-receiving.patch b/gnu/packages/patches/mrustc-0.8.0-fix-variable-length-integer-receiving.patch new file mode 100644 index 0000000000..9e76653a07 --- /dev/null +++ b/gnu/packages/patches/mrustc-0.8.0-fix-variable-length-integer-receiving.patch @@ -0,0 +1,15 @@ +https://github.com/thepowersgang/mrustc/issues/109 +From: Danny Milosavljevic <dannym@scratchpost.org> +Date: Fri, 3 Jan 2019 13:00:00 +0100 + +--- mrustc/src/expand/proc_macro.cpp.orig 2019-02-01 14:16:54.208486062 +0100 ++++ mrustc/src/expand/proc_macro.cpp 2019-02-01 14:17:14.350925705 +0100 +@@ -977,7 +977,7 @@ + for(;;) + { + auto b = recv_u8(); +- v |= static_cast<uint64_t>(b) << ofs; ++ v |= static_cast<uint64_t>(b & 0x7F) << ofs; + if( (b & 0x80) == 0 ) + break; + ofs += 7; diff --git a/gnu/packages/patches/pius.patch b/gnu/packages/patches/pius.patch deleted file mode 100644 index da39731d4d..0000000000 --- a/gnu/packages/patches/pius.patch +++ /dev/null @@ -1,38 +0,0 @@ -See https://github.com/jaymzh/pius/pull/96 - -commit 4dba0bf75ab351969622f7b9c38484657411a528 -Author: Martin Kletzander <nert.pinx+github@gmail.com> -Date: Thu May 17 17:55:27 2018 +0200 - - Don't fail on ENCRYPTION_COMPLIANCE_MODE line from too new GnuPG (#96) - - GnuPG started printing information about encryption compliance in [commit - f31dc2540acf](https://dev.gnupg.org/rGf31dc2540acf7cd7f09fd94658e815822222bfcb) - and since then signing with pius fails. - - Closes #95 - - Signed-off-by: Martin Kletzander <nert.pinx@gmail.com> - -diff --git a/libpius/signer.py b/libpius/signer.py -index 3c7262f..13013bb 100644 ---- a/libpius/signer.py -+++ b/libpius/signer.py -@@ -45,6 +45,7 @@ class PiusSigner(object): - GPG_PINENTRY_LAUNCHED = '[GNUPG:] PINENTRY_LAUNCHED' - GPG_KEY_CONSIDERED = '[GNUPG:] KEY_CONSIDERED' - GPG_WARN_VERSION = '[GNUPG:] WARNING server_version_mismatch' -+ GPG_ENC_COMPLIANT_MODE = '[GNUPG:] ENCRYPTION_COMPLIANCE_MODE' - - def __init__(self, signer, force_signer, mode, keyring, gpg_path, tmpdir, - outdir, encrypt_outfiles, mail, mailer, verbose, sort_keyring, -@@ -431,6 +432,9 @@ class PiusSigner(object): - if PiusSigner.GPG_ENC_BEG in line: - debug('Got GPG_ENC_BEG') - continue -+ elif PiusSigner.GPG_ENC_COMPLIANT_MODE in line: -+ debug('Got ENCRYPTION_COMPLIANCE_MODE') -+ continue - elif PiusSigner.GPG_ENC_END in line: - debug('Got GPG_ENC_END') - break diff --git a/gnu/packages/patches/qtbase-old-kernel.patch b/gnu/packages/patches/qtbase-old-kernel.patch new file mode 100644 index 0000000000..aa26fb6c4f --- /dev/null +++ b/gnu/packages/patches/qtbase-old-kernel.patch @@ -0,0 +1,25 @@ +https://672856.bugs.gentoo.org/attachment.cgi?id=557978 +https://bugs.gentoo.org/672856 + +The patch fixes building qtbase with linux kernels < 4.11. +See bug #34431. + +diff -Naurp a/src/corelib/global/minimum-linux_p.h b/src/corelib/global/minimum-linux_p.h +--- a/src/corelib/global/minimum-linux_p.h 2018-11-25 15:51:11.000000000 +0300 ++++ b/src/corelib/global/minimum-linux_p.h 2018-12-17 13:25:38.176823753 +0300 +@@ -75,14 +75,9 @@ QT_BEGIN_NAMESPACE + * - accept4 2.6.28 + * - renameat2 3.16 QT_CONFIG(renameat2) + * - getrandom 3.17 QT_CONFIG(getentropy) +- * - statx 4.11 QT_CONFIG(statx) + */ + +-#if QT_CONFIG(statx) +-# define MINLINUX_MAJOR 4 +-# define MINLINUX_MINOR 11 +-# define MINLINUX_PATCH 0 +-#elif QT_CONFIG(getentropy) ++#if QT_CONFIG(getentropy) + # define MINLINUX_MAJOR 3 + # define MINLINUX_MINOR 17 + # define MINLINUX_PATCH 0 diff --git a/gnu/packages/patches/red-eclipse-remove-gamma-name-hack.patch b/gnu/packages/patches/red-eclipse-remove-gamma-name-hack.patch new file mode 100644 index 0000000000..573920cb99 --- /dev/null +++ b/gnu/packages/patches/red-eclipse-remove-gamma-name-hack.patch @@ -0,0 +1,52 @@ +From b16b4963c1ad81bb9ef784bc4913a4c8ab5f1bb4 Mon Sep 17 00:00:00 2001 +From: Lee Salzman <lsalzman@gmail.com> +Date: Tue, 12 Sep 2017 14:45:10 -0400 +Subject: [PATCH] remove gamma name hack + +--- + src/engine/main.cpp | 6 +++--- + src/shared/cube.h | 8 -------- + 2 files changed, 3 insertions(+), 11 deletions(-) + +diff --git a/src/engine/main.cpp b/src/engine/main.cpp +index 1032004d..77c9233a 100644 +--- a/src/engine/main.cpp ++++ b/src/engine/main.cpp +@@ -278,10 +278,10 @@ static void setgamma(int val) + } + + static int curgamma = 100; +-VARF(IDF_PERSIST, gamma, 30, 100, 300, ++VARFN(IDF_PERSIST, gamma, reqgamma, 30, 100, 300, + { +- if(initing || gamma == curgamma) return; +- curgamma = gamma; ++ if(initing || reqgamma == curgamma) return; ++ curgamma = reqgamma; + setgamma(curgamma); + }); + +diff --git a/src/shared/cube.h b/src/shared/cube.h +index 3864c492..7ff5e267 100644 +--- a/src/shared/cube.h ++++ b/src/shared/cube.h +@@ -3,19 +3,11 @@ + + #define _FILE_OFFSET_BITS 64 + +-#ifdef __GNUC__ +-#define gamma __gamma +-#endif +- + #ifdef WIN32 + #define _USE_MATH_DEFINES + #endif + #include <math.h> + +-#ifdef __GNUC__ +-#undef gamma +-#endif +- + #include <string.h> + #include <stdio.h> + #include <stdlib.h> diff --git a/gnu/packages/patches/ruby-safe-yaml-add-require-time.patch b/gnu/packages/patches/ruby-safe-yaml-add-require-time.patch new file mode 100644 index 0000000000..92e5505985 --- /dev/null +++ b/gnu/packages/patches/ruby-safe-yaml-add-require-time.patch @@ -0,0 +1,19 @@ +From 9dd1e8d9ad0396a8c9092c2e9f17d498c58e0208 Mon Sep 17 00:00:00 2001 +From: elifoster <elifosterwy@gmail.com> +Date: Tue, 5 Dec 2017 14:30:13 -0800 +Subject: [PATCH] Fix uninitialized constant DateTime Close #80 + +--- + lib/safe_yaml/parse/date.rb | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/safe_yaml/parse/date.rb b/lib/safe_yaml/parse/date.rb +index cd3c62a..3a30a8b 100644 +--- a/lib/safe_yaml/parse/date.rb ++++ b/lib/safe_yaml/parse/date.rb +@@ -1,3 +1,5 @@ ++require 'time' ++ + module SafeYAML + class Parse + class Date diff --git a/gnu/packages/patches/runc-CVE-2019-5736.patch b/gnu/packages/patches/runc-CVE-2019-5736.patch new file mode 100644 index 0000000000..f629fcbfb4 --- /dev/null +++ b/gnu/packages/patches/runc-CVE-2019-5736.patch @@ -0,0 +1,343 @@ +Fix CVE-2019-5736: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5736 +https://seclists.org/oss-sec/2019/q1/119 + +Patch copied from upstream source repository: + +https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b + +From 0a8e4117e7f715d5fbeef398405813ce8e88558b Mon Sep 17 00:00:00 2001 +From: Aleksa Sarai <asarai@suse.de> +Date: Wed, 9 Jan 2019 13:40:01 +1100 +Subject: [PATCH] nsenter: clone /proc/self/exe to avoid exposing host binary + to container + +There are quite a few circumstances where /proc/self/exe pointing to a +pretty important container binary is a _bad_ thing, so to avoid this we +have to make a copy (preferably doing self-clean-up and not being +writeable). + +We require memfd_create(2) -- though there is an O_TMPFILE fallback -- +but we can always extend this to use a scratch MNT_DETACH overlayfs or +tmpfs. The main downside to this approach is no page-cache sharing for +the runc binary (which overlayfs would give us) but this is far less +complicated. + +This is only done during nsenter so that it happens transparently to the +Go code, and any libcontainer users benefit from it. This also makes +ExtraFiles and --preserve-fds handling trivial (because we don't need to +worry about it). + +Fixes: CVE-2019-5736 +Co-developed-by: Christian Brauner <christian.brauner@ubuntu.com> +Signed-off-by: Aleksa Sarai <asarai@suse.de> +--- + libcontainer/nsenter/cloned_binary.c | 268 +++++++++++++++++++++++++++ + libcontainer/nsenter/nsexec.c | 11 ++ + 2 files changed, 279 insertions(+) + create mode 100644 libcontainer/nsenter/cloned_binary.c + +diff --git a/libcontainer/nsenter/cloned_binary.c b/libcontainer/nsenter/cloned_binary.c +new file mode 100644 +index 000000000..c8a42c23f +--- /dev/null ++++ b/libcontainer/nsenter/cloned_binary.c +@@ -0,0 +1,268 @@ ++/* ++ * Copyright (C) 2019 Aleksa Sarai <cyphar@cyphar.com> ++ * Copyright (C) 2019 SUSE LLC ++ * ++ * Licensed under the Apache License, Version 2.0 (the "License"); ++ * you may not use this file except in compliance with the License. ++ * You may obtain a copy of the License at ++ * ++ * http://www.apache.org/licenses/LICENSE-2.0 ++ * ++ * Unless required by applicable law or agreed to in writing, software ++ * distributed under the License is distributed on an "AS IS" BASIS, ++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++ * See the License for the specific language governing permissions and ++ * limitations under the License. ++ */ ++ ++#define _GNU_SOURCE ++#include <unistd.h> ++#include <stdio.h> ++#include <stdlib.h> ++#include <stdbool.h> ++#include <string.h> ++#include <limits.h> ++#include <fcntl.h> ++#include <errno.h> ++ ++#include <sys/types.h> ++#include <sys/stat.h> ++#include <sys/vfs.h> ++#include <sys/mman.h> ++#include <sys/sendfile.h> ++#include <sys/syscall.h> ++ ++/* Use our own wrapper for memfd_create. */ ++#if !defined(SYS_memfd_create) && defined(__NR_memfd_create) ++# define SYS_memfd_create __NR_memfd_create ++#endif ++#ifdef SYS_memfd_create ++# define HAVE_MEMFD_CREATE ++/* memfd_create(2) flags -- copied from <linux/memfd.h>. */ ++# ifndef MFD_CLOEXEC ++# define MFD_CLOEXEC 0x0001U ++# define MFD_ALLOW_SEALING 0x0002U ++# endif ++int memfd_create(const char *name, unsigned int flags) ++{ ++ return syscall(SYS_memfd_create, name, flags); ++} ++#endif ++ ++/* This comes directly from <linux/fcntl.h>. */ ++#ifndef F_LINUX_SPECIFIC_BASE ++# define F_LINUX_SPECIFIC_BASE 1024 ++#endif ++#ifndef F_ADD_SEALS ++# define F_ADD_SEALS (F_LINUX_SPECIFIC_BASE + 9) ++# define F_GET_SEALS (F_LINUX_SPECIFIC_BASE + 10) ++#endif ++#ifndef F_SEAL_SEAL ++# define F_SEAL_SEAL 0x0001 /* prevent further seals from being set */ ++# define F_SEAL_SHRINK 0x0002 /* prevent file from shrinking */ ++# define F_SEAL_GROW 0x0004 /* prevent file from growing */ ++# define F_SEAL_WRITE 0x0008 /* prevent writes */ ++#endif ++ ++#define RUNC_SENDFILE_MAX 0x7FFFF000 /* sendfile(2) is limited to 2GB. */ ++#ifdef HAVE_MEMFD_CREATE ++# define RUNC_MEMFD_COMMENT "runc_cloned:/proc/self/exe" ++# define RUNC_MEMFD_SEALS \ ++ (F_SEAL_SEAL | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_WRITE) ++#endif ++ ++static void *must_realloc(void *ptr, size_t size) ++{ ++ void *old = ptr; ++ do { ++ ptr = realloc(old, size); ++ } while(!ptr); ++ return ptr; ++} ++ ++/* ++ * Verify whether we are currently in a self-cloned program (namely, is ++ * /proc/self/exe a memfd). F_GET_SEALS will only succeed for memfds (or rather ++ * for shmem files), and we want to be sure it's actually sealed. ++ */ ++static int is_self_cloned(void) ++{ ++ int fd, ret, is_cloned = 0; ++ ++ fd = open("/proc/self/exe", O_RDONLY|O_CLOEXEC); ++ if (fd < 0) ++ return -ENOTRECOVERABLE; ++ ++#ifdef HAVE_MEMFD_CREATE ++ ret = fcntl(fd, F_GET_SEALS); ++ is_cloned = (ret == RUNC_MEMFD_SEALS); ++#else ++ struct stat statbuf = {0}; ++ ret = fstat(fd, &statbuf); ++ if (ret >= 0) ++ is_cloned = (statbuf.st_nlink == 0); ++#endif ++ close(fd); ++ return is_cloned; ++} ++ ++/* ++ * Basic wrapper around mmap(2) that gives you the file length so you can ++ * safely treat it as an ordinary buffer. Only gives you read access. ++ */ ++static char *read_file(char *path, size_t *length) ++{ ++ int fd; ++ char buf[4096], *copy = NULL; ++ ++ if (!length) ++ return NULL; ++ ++ fd = open(path, O_RDONLY | O_CLOEXEC); ++ if (fd < 0) ++ return NULL; ++ ++ *length = 0; ++ for (;;) { ++ int n; ++ ++ n = read(fd, buf, sizeof(buf)); ++ if (n < 0) ++ goto error; ++ if (!n) ++ break; ++ ++ copy = must_realloc(copy, (*length + n) * sizeof(*copy)); ++ memcpy(copy + *length, buf, n); ++ *length += n; ++ } ++ close(fd); ++ return copy; ++ ++error: ++ close(fd); ++ free(copy); ++ return NULL; ++} ++ ++/* ++ * A poor-man's version of "xargs -0". Basically parses a given block of ++ * NUL-delimited data, within the given length and adds a pointer to each entry ++ * to the array of pointers. ++ */ ++static int parse_xargs(char *data, int data_length, char ***output) ++{ ++ int num = 0; ++ char *cur = data; ++ ++ if (!data || *output != NULL) ++ return -1; ++ ++ while (cur < data + data_length) { ++ num++; ++ *output = must_realloc(*output, (num + 1) * sizeof(**output)); ++ (*output)[num - 1] = cur; ++ cur += strlen(cur) + 1; ++ } ++ (*output)[num] = NULL; ++ return num; ++} ++ ++/* ++ * "Parse" out argv and envp from /proc/self/cmdline and /proc/self/environ. ++ * This is necessary because we are running in a context where we don't have a ++ * main() that we can just get the arguments from. ++ */ ++static int fetchve(char ***argv, char ***envp) ++{ ++ char *cmdline = NULL, *environ = NULL; ++ size_t cmdline_size, environ_size; ++ ++ cmdline = read_file("/proc/self/cmdline", &cmdline_size); ++ if (!cmdline) ++ goto error; ++ environ = read_file("/proc/self/environ", &environ_size); ++ if (!environ) ++ goto error; ++ ++ if (parse_xargs(cmdline, cmdline_size, argv) <= 0) ++ goto error; ++ if (parse_xargs(environ, environ_size, envp) <= 0) ++ goto error; ++ ++ return 0; ++ ++error: ++ free(environ); ++ free(cmdline); ++ return -EINVAL; ++} ++ ++static int clone_binary(void) ++{ ++ int binfd, memfd; ++ ssize_t sent = 0; ++ ++#ifdef HAVE_MEMFD_CREATE ++ memfd = memfd_create(RUNC_MEMFD_COMMENT, MFD_CLOEXEC | MFD_ALLOW_SEALING); ++#else ++ memfd = open("/tmp", O_TMPFILE | O_EXCL | O_RDWR | O_CLOEXEC, 0711); ++#endif ++ if (memfd < 0) ++ return -ENOTRECOVERABLE; ++ ++ binfd = open("/proc/self/exe", O_RDONLY | O_CLOEXEC); ++ if (binfd < 0) ++ goto error; ++ ++ sent = sendfile(memfd, binfd, NULL, RUNC_SENDFILE_MAX); ++ close(binfd); ++ if (sent < 0) ++ goto error; ++ ++#ifdef HAVE_MEMFD_CREATE ++ int err = fcntl(memfd, F_ADD_SEALS, RUNC_MEMFD_SEALS); ++ if (err < 0) ++ goto error; ++#else ++ /* Need to re-open "memfd" as read-only to avoid execve(2) giving -EXTBUSY. */ ++ int newfd; ++ char *fdpath = NULL; ++ ++ if (asprintf(&fdpath, "/proc/self/fd/%d", memfd) < 0) ++ goto error; ++ newfd = open(fdpath, O_RDONLY | O_CLOEXEC); ++ free(fdpath); ++ if (newfd < 0) ++ goto error; ++ ++ close(memfd); ++ memfd = newfd; ++#endif ++ return memfd; ++ ++error: ++ close(memfd); ++ return -EIO; ++} ++ ++int ensure_cloned_binary(void) ++{ ++ int execfd; ++ char **argv = NULL, **envp = NULL; ++ ++ /* Check that we're not self-cloned, and if we are then bail. */ ++ int cloned = is_self_cloned(); ++ if (cloned > 0 || cloned == -ENOTRECOVERABLE) ++ return cloned; ++ ++ if (fetchve(&argv, &envp) < 0) ++ return -EINVAL; ++ ++ execfd = clone_binary(); ++ if (execfd < 0) ++ return -EIO; ++ ++ fexecve(execfd, argv, envp); ++ return -ENOEXEC; ++} +diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c +index 28269dfc0..7750af35e 100644 +--- a/libcontainer/nsenter/nsexec.c ++++ b/libcontainer/nsenter/nsexec.c +@@ -534,6 +534,9 @@ void join_namespaces(char *nslist) + free(namespaces); + } + ++/* Defined in cloned_binary.c. */ ++extern int ensure_cloned_binary(void); ++ + void nsexec(void) + { + int pipenum; +@@ -549,6 +552,14 @@ void nsexec(void) + if (pipenum == -1) + return; + ++ /* ++ * We need to re-exec if we are not in a cloned binary. This is necessary ++ * to ensure that containers won't be able to access the host binary ++ * through /proc/self/exe. See CVE-2019-5736. ++ */ ++ if (ensure_cloned_binary() < 0) ++ bail("could not ensure we are a cloned binary"); ++ + /* Parse all of the netlink configuration. */ + nl_parse(pipenum, &config); + diff --git a/gnu/packages/patches/scalapack-blacs-mpi-deprecations.patch b/gnu/packages/patches/scalapack-blacs-mpi-deprecations.patch new file mode 100644 index 0000000000..6ec1b8f21f --- /dev/null +++ b/gnu/packages/patches/scalapack-blacs-mpi-deprecations.patch @@ -0,0 +1,170 @@ +From f11c3f094ed5ca727ec819983425b6641db8227c Mon Sep 17 00:00:00 2001 +From: Eric Bavier <bavier@member.fsf.org> +Date: Wed, 13 Feb 2019 09:32:11 -0600 +Subject: [PATCH] BLACS: Remove use of long-deprecated MPI1 functions. + +* BLACS/SRC/blacs_get_.c: 'MPI_Attr_get' -> 'MPI_Comm_get_attr'. +* BLACS/SRC/cgamn2d_.c, BLACS/SRC/cgamx2d_.c, BLACS/SRC/dgamn2d_.c, +BLACS/SRC/dgamx2d_.c, BLACS/SRC/igamn2d_.c, BLACS/SRC/igamx2d_.c, +BLACS/SRC/sgamn2d_.c, BLACS/SRC/sgamx2d_.c, BLACS/SRC/zgamn2d_.c, +BLACS/SRC/zgamx2d_.c: 'MPI_Type_struct' -> 'MPI_Type_create_struct'. +--- + BLACS/SRC/blacs_get_.c | 2 +- + BLACS/SRC/cgamn2d_.c | 2 +- + BLACS/SRC/cgamx2d_.c | 2 +- + BLACS/SRC/dgamn2d_.c | 2 +- + BLACS/SRC/dgamx2d_.c | 2 +- + BLACS/SRC/igamn2d_.c | 2 +- + BLACS/SRC/igamx2d_.c | 2 +- + BLACS/SRC/sgamn2d_.c | 2 +- + BLACS/SRC/sgamx2d_.c | 2 +- + BLACS/SRC/zgamn2d_.c | 2 +- + BLACS/SRC/zgamx2d_.c | 2 +- + 11 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/BLACS/SRC/blacs_get_.c b/BLACS/SRC/blacs_get_.c +index e979767..d4b04cf 100644 +--- a/BLACS/SRC/blacs_get_.c ++++ b/BLACS/SRC/blacs_get_.c +@@ -23,7 +23,7 @@ F_VOID_FUNC blacs_get_(int *ConTxt, int *what, int *val) + case SGET_MSGIDS: + if (BI_COMM_WORLD == NULL) Cblacs_pinfo(val, &val[1]); + iptr = &val[1]; +- ierr=MPI_Attr_get(MPI_COMM_WORLD, MPI_TAG_UB, (BVOID **) &iptr,val); ++ ierr=MPI_Comm_get_attr(MPI_COMM_WORLD, MPI_TAG_UB, (BVOID **) &iptr,val); + val[0] = 0; + val[1] = *iptr; + break; +diff --git a/BLACS/SRC/cgamn2d_.c b/BLACS/SRC/cgamn2d_.c +index 2db6ccb..6958f32 100644 +--- a/BLACS/SRC/cgamn2d_.c ++++ b/BLACS/SRC/cgamn2d_.c +@@ -221,7 +221,7 @@ F_VOID_FUNC cgamn2d_(int *ConTxt, F_CHAR scope, F_CHAR top, int *m, int *n, + { + #endif + i = 2; +- ierr=MPI_Type_struct(i, len, disp, dtypes, &MyType); ++ ierr=MPI_Type_create_struct(i, len, disp, dtypes, &MyType); + ierr=MPI_Type_commit(&MyType); + bp->N = bp2->N = 1; + bp->dtype = bp2->dtype = MyType; +diff --git a/BLACS/SRC/cgamx2d_.c b/BLACS/SRC/cgamx2d_.c +index 707c0b6..f802d01 100644 +--- a/BLACS/SRC/cgamx2d_.c ++++ b/BLACS/SRC/cgamx2d_.c +@@ -221,7 +221,7 @@ F_VOID_FUNC cgamx2d_(int *ConTxt, F_CHAR scope, F_CHAR top, int *m, int *n, + { + #endif + i = 2; +- ierr=MPI_Type_struct(i, len, disp, dtypes, &MyType); ++ ierr=MPI_Type_create_struct(i, len, disp, dtypes, &MyType); + ierr=MPI_Type_commit(&MyType); + bp->N = bp2->N = 1; + bp->dtype = bp2->dtype = MyType; +diff --git a/BLACS/SRC/dgamn2d_.c b/BLACS/SRC/dgamn2d_.c +index dff23b4..a2627ac 100644 +--- a/BLACS/SRC/dgamn2d_.c ++++ b/BLACS/SRC/dgamn2d_.c +@@ -221,7 +221,7 @@ F_VOID_FUNC dgamn2d_(int *ConTxt, F_CHAR scope, F_CHAR top, int *m, int *n, + { + #endif + i = 2; +- ierr=MPI_Type_struct(i, len, disp, dtypes, &MyType); ++ ierr=MPI_Type_create_struct(i, len, disp, dtypes, &MyType); + ierr=MPI_Type_commit(&MyType); + bp->N = bp2->N = 1; + bp->dtype = bp2->dtype = MyType; +diff --git a/BLACS/SRC/dgamx2d_.c b/BLACS/SRC/dgamx2d_.c +index a51f731..2a644d0 100644 +--- a/BLACS/SRC/dgamx2d_.c ++++ b/BLACS/SRC/dgamx2d_.c +@@ -221,7 +221,7 @@ F_VOID_FUNC dgamx2d_(int *ConTxt, F_CHAR scope, F_CHAR top, int *m, int *n, + { + #endif + i = 2; +- ierr=MPI_Type_struct(i, len, disp, dtypes, &MyType); ++ ierr=MPI_Type_create_struct(i, len, disp, dtypes, &MyType); + ierr=MPI_Type_commit(&MyType); + bp->N = bp2->N = 1; + bp->dtype = bp2->dtype = MyType; +diff --git a/BLACS/SRC/igamn2d_.c b/BLACS/SRC/igamn2d_.c +index 16bc003..f6a7859 100644 +--- a/BLACS/SRC/igamn2d_.c ++++ b/BLACS/SRC/igamn2d_.c +@@ -218,7 +218,7 @@ F_VOID_FUNC igamn2d_(int *ConTxt, F_CHAR scope, F_CHAR top, int *m, int *n, + { + #endif + i = 2; +- ierr=MPI_Type_struct(i, len, disp, dtypes, &MyType); ++ ierr=MPI_Type_create_struct(i, len, disp, dtypes, &MyType); + ierr=MPI_Type_commit(&MyType); + bp->N = bp2->N = 1; + bp->dtype = bp2->dtype = MyType; +diff --git a/BLACS/SRC/igamx2d_.c b/BLACS/SRC/igamx2d_.c +index 8165cbe..a7cfcc6 100644 +--- a/BLACS/SRC/igamx2d_.c ++++ b/BLACS/SRC/igamx2d_.c +@@ -218,7 +218,7 @@ F_VOID_FUNC igamx2d_(int *ConTxt, F_CHAR scope, F_CHAR top, int *m, int *n, + { + #endif + i = 2; +- ierr=MPI_Type_struct(i, len, disp, dtypes, &MyType); ++ ierr=MPI_Type_create_struct(i, len, disp, dtypes, &MyType); + ierr=MPI_Type_commit(&MyType); + bp->N = bp2->N = 1; + bp->dtype = bp2->dtype = MyType; +diff --git a/BLACS/SRC/sgamn2d_.c b/BLACS/SRC/sgamn2d_.c +index d6c95e5..569c797 100644 +--- a/BLACS/SRC/sgamn2d_.c ++++ b/BLACS/SRC/sgamn2d_.c +@@ -221,7 +221,7 @@ F_VOID_FUNC sgamn2d_(int *ConTxt, F_CHAR scope, F_CHAR top, int *m, int *n, + { + #endif + i = 2; +- ierr=MPI_Type_struct(i, len, disp, dtypes, &MyType); ++ ierr=MPI_Type_create_struct(i, len, disp, dtypes, &MyType); + ierr=MPI_Type_commit(&MyType); + bp->N = bp2->N = 1; + bp->dtype = bp2->dtype = MyType; +diff --git a/BLACS/SRC/sgamx2d_.c b/BLACS/SRC/sgamx2d_.c +index 4b0af6f..8897ece 100644 +--- a/BLACS/SRC/sgamx2d_.c ++++ b/BLACS/SRC/sgamx2d_.c +@@ -221,7 +221,7 @@ F_VOID_FUNC sgamx2d_(int *ConTxt, F_CHAR scope, F_CHAR top, int *m, int *n, + { + #endif + i = 2; +- ierr=MPI_Type_struct(i, len, disp, dtypes, &MyType); ++ ierr=MPI_Type_create_struct(i, len, disp, dtypes, &MyType); + ierr=MPI_Type_commit(&MyType); + bp->N = bp2->N = 1; + bp->dtype = bp2->dtype = MyType; +diff --git a/BLACS/SRC/zgamn2d_.c b/BLACS/SRC/zgamn2d_.c +index 9de2b23..37897df 100644 +--- a/BLACS/SRC/zgamn2d_.c ++++ b/BLACS/SRC/zgamn2d_.c +@@ -221,7 +221,7 @@ F_VOID_FUNC zgamn2d_(int *ConTxt, F_CHAR scope, F_CHAR top, int *m, int *n, + { + #endif + i = 2; +- ierr=MPI_Type_struct(i, len, disp, dtypes, &MyType); ++ ierr=MPI_Type_create_struct(i, len, disp, dtypes, &MyType); + ierr=MPI_Type_commit(&MyType); + bp->N = bp2->N = 1; + bp->dtype = bp2->dtype = MyType; +diff --git a/BLACS/SRC/zgamx2d_.c b/BLACS/SRC/zgamx2d_.c +index 414c381..0e9d474 100644 +--- a/BLACS/SRC/zgamx2d_.c ++++ b/BLACS/SRC/zgamx2d_.c +@@ -221,7 +221,7 @@ F_VOID_FUNC zgamx2d_(int *ConTxt, F_CHAR scope, F_CHAR top, int *m, int *n, + { + #endif + i = 2; +- ierr=MPI_Type_struct(i, len, disp, dtypes, &MyType); ++ ierr=MPI_Type_create_struct(i, len, disp, dtypes, &MyType); + ierr=MPI_Type_commit(&MyType); + bp->N = bp2->N = 1; + bp->dtype = bp2->dtype = MyType; +-- +2.20.1 + diff --git a/gnu/packages/patches/soundconverter-remove-gconf-dependency.patch b/gnu/packages/patches/soundconverter-remove-gconf-dependency.patch index f065b9a3d4..29cdeb6e8d 100644 --- a/gnu/packages/patches/soundconverter-remove-gconf-dependency.patch +++ b/gnu/packages/patches/soundconverter-remove-gconf-dependency.patch @@ -1,83 +1,29 @@ -From: Sebastian Ramacher <sebastian@ramacher.at> -Date: Fri, 6 Apr 2018 13:25:35 +0200 -Subject: Only fetch profiles if GConf is still available +From: Tobias Geerinckx-Rice <me@tobias.gr> +Date: Tue, 19 Feb 2019 07:46:28 +0100 +Subject: [PATCH] gnu: soundconverter: Catch (and ignore) the right error. ---- - bin/soundconverter.py | 1 - - soundconverter/gstreamer.py | 44 ++++++++++++++++++++++++-------------------- - 2 files changed, 24 insertions(+), 21 deletions(-) +Without this patch and GConf: -diff --git a/bin/soundconverter.py b/bin/soundconverter.py -index 39055ce..5198443 100644 ---- a/bin/soundconverter.py -+++ b/bin/soundconverter.py -@@ -66,7 +66,6 @@ def _check_libs(): - import gi - gi.require_version('Gst', '1.0') - gi.require_version('Gtk', '3.0') -- gi.require_version('GConf', '2.0') - from gi.repository import GObject - # force GIL creation - see https://bugzilla.gnome.org/show_bug.cgi?id=710447 - import threading -diff --git a/soundconverter/gstreamer.py b/soundconverter/gstreamer.py -index 23aaa9b..211b052 100644 ---- a/soundconverter/gstreamer.py -+++ b/soundconverter/gstreamer.py -@@ -25,7 +25,7 @@ from urllib.parse import urlparse - from gettext import gettext as _ - - import gi --from gi.repository import Gst, Gtk, GObject, GConf, Gio -+from gi.repository import Gst, Gtk, GObject, Gio - - from soundconverter.fileoperations import vfs_encode_filename, file_encode_filename - from soundconverter.fileoperations import unquote_filename, vfs_makedirs, vfs_unlink -@@ -66,25 +66,29 @@ _GCONF_PROFILE_LIST_PATH = "/system/gstreamer/1.0/audio/global/profile_list" - audio_profiles_list = [] - audio_profiles_dict = {} - --_GCONF = GConf.Client.get_default() --profiles = _GCONF.all_dirs(_GCONF_PROFILE_LIST_PATH) --for name in profiles: -- if _GCONF.get_bool(_GCONF_PROFILE_PATH + name + "/active"): -- # get profile -- description = _GCONF.get_string(_GCONF_PROFILE_PATH + name + "/name") -- extension = _GCONF.get_string(_GCONF_PROFILE_PATH + name + "/extension") -- pipeline = _GCONF.get_string(_GCONF_PROFILE_PATH + name + "/pipeline") -- # check profile validity -- if not extension or not pipeline: -- continue -- if not description: -- description = extension -- if description in audio_profiles_dict: -- continue -- # store -- profile = description, extension, pipeline -- audio_profiles_list.append(profile) -- audio_profiles_dict[description] = profile -+try: -+ from gi.repository import GConf -+ _GCONF = GConf.Client.get_default() -+ profiles = _GCONF.all_dirs(_GCONF_PROFILE_LIST_PATH) -+ for name in profiles: -+ if _GCONF.get_bool(_GCONF_PROFILE_PATH + name + "/active"): -+ # get profile -+ description = _GCONF.get_string(_GCONF_PROFILE_PATH + name + "/name") -+ extension = _GCONF.get_string(_GCONF_PROFILE_PATH + name + "/extension") -+ pipeline = _GCONF.get_string(_GCONF_PROFILE_PATH + name + "/pipeline") -+ # check profile validity -+ if not extension or not pipeline: -+ continue -+ if not description: -+ description = extension -+ if description in audio_profiles_dict: -+ continue -+ # store -+ profile = description, extension, pipeline -+ audio_profiles_list.append(profile) -+ audio_profiles_dict[description] = profile -+except ImportError: -+ pass + Traceback (most recent call last): + File "/gnu/…/bin/...soundconverter-real-real-real", line 164, in <module> + from soundconverter.batch import cli_convert_main + File "/gnu/…/lib/soundconverter/python/soundconverter/batch.py", line 31, in <module> + from soundconverter.gstreamer import TagReader + File "/gnu/…/lib/soundconverter/python/soundconverter/gstreamer.py", line 70, in <module> + gi.require_version('GConf', '2.0') + File "/gnu/…/lib/python3.7/site-packages/gi/__init__.py", line 130, in require_version + raise ValueError('Namespace %s not available' % namespace) + ValueError: Namespace GConf not available +--- +diff -Naur soundconverter-3.0.1/soundconverter/gstreamer.py soundconverter-3.0.1/soundconverter/gstreamer.py +--- soundconverter-3.0.1/soundconverter/gstreamer.py 2018-11-23 20:38:46.000000000 +0100 ++++ soundconverter-3.0.1/soundconverter/gstreamer.py 2019-02-19 07:42:15.767684388 +0100 +@@ -88,7 +88,7 @@ + profile = description, extension, pipeline + audio_profiles_list.append(profile) + audio_profiles_dict[description] = profile +-except ImportError: ++except ValueError: + pass required_elements = ('decodebin', 'fakesink', 'audioconvert', 'typefind', 'audiorate') - for element in required_elements: diff --git a/gnu/packages/patches/tomsfastmath-constness.patch b/gnu/packages/patches/tomsfastmath-constness.patch deleted file mode 100644 index 7c6ab5bbec..0000000000 --- a/gnu/packages/patches/tomsfastmath-constness.patch +++ /dev/null @@ -1,76 +0,0 @@ -From dac089515901d6bf315cd15a6e744b8d2c02c1cb Mon Sep 17 00:00:00 2001 -From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> -Date: Sat, 31 Oct 2015 22:48:07 +0100 -Subject: [PATCH] tfm: make a few functions static - -clamav expects them to be static and it does not seem bad to do so. - -Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> ---- - src/bin/fp_read_radix.c | 2 +- - src/bin/fp_read_signed_bin.c | 2 +- - src/bin/fp_read_unsigned_bin.c | 2 +- - src/headers/tfm.h | 6 +++--- - 4 files changed, 6 insertions(+), 6 deletions(-) - -diff --git a/src/bin/fp_read_radix.c b/src/bin/fp_read_radix.c -index 0b5e826..431afa0 100644 ---- a/src/bin/fp_read_radix.c -+++ b/src/bin/fp_read_radix.c -@@ -9,7 +9,7 @@ - */ - #include <tfm_private.h> - --int fp_read_radix(fp_int *a, char *str, int radix) -+int fp_read_radix(fp_int *a, const char *str, int radix) - { - int y, neg; - char ch; -diff --git a/src/bin/fp_read_signed_bin.c b/src/bin/fp_read_signed_bin.c -index e2b8003..6467d19 100644 ---- a/src/bin/fp_read_signed_bin.c -+++ b/src/bin/fp_read_signed_bin.c -@@ -9,7 +9,7 @@ - */ - #include <tfm_private.h> - --void fp_read_signed_bin(fp_int *a, unsigned char *b, int c) -+void fp_read_signed_bin(fp_int *a, const unsigned char *b, int c) - { - /* read magnitude */ - fp_read_unsigned_bin (a, b + 1, c - 1); -diff --git a/src/bin/fp_read_unsigned_bin.c b/src/bin/fp_read_unsigned_bin.c -index 3ee64c0..2ee89cb 100644 ---- a/src/bin/fp_read_unsigned_bin.c -+++ b/src/bin/fp_read_unsigned_bin.c -@@ -9,7 +9,7 @@ - */ - #include <tfm_private.h> - --void fp_read_unsigned_bin(fp_int *a, unsigned char *b, int c) -+void fp_read_unsigned_bin(fp_int *a, const unsigned char *b, int c) - { - /* zero the int */ - fp_zero (a); -diff --git a/src/headers/tfm.h b/src/headers/tfm.h -index af87b56..f406388 100644 ---- a/src/headers/tfm.h -+++ b/src/headers/tfm.h -@@ -467,14 +467,14 @@ int fp_prime_random_ex(fp_int *a, int t, int size, int flags, tfm_prime_callback - int fp_count_bits(fp_int *a); - - int fp_unsigned_bin_size(fp_int *a); --void fp_read_unsigned_bin(fp_int *a, unsigned char *b, int c); -+void fp_read_unsigned_bin(fp_int *a, const unsigned char *b, int c); - void fp_to_unsigned_bin(fp_int *a, unsigned char *b); - - int fp_signed_bin_size(fp_int *a); --void fp_read_signed_bin(fp_int *a, unsigned char *b, int c); -+void fp_read_signed_bin(fp_int *a, const unsigned char *b, int c); - void fp_to_signed_bin(fp_int *a, unsigned char *b); - --int fp_read_radix(fp_int *a, char *str, int radix); -+int fp_read_radix(fp_int *a, const char *str, int radix); - - int fp_radix_size(fp_int *a, int radix, int *size); - int fp_toradix(fp_int *a, char *str, int radix); diff --git a/gnu/packages/patches/xf86-video-i128-remove-mibstore.patch b/gnu/packages/patches/xf86-video-i128-remove-mibstore.patch deleted file mode 100644 index b269d63473..0000000000 --- a/gnu/packages/patches/xf86-video-i128-remove-mibstore.patch +++ /dev/null @@ -1,23 +0,0 @@ -Removes references to mibstore.h and miInitializeBackingStore, which -have been removed from xorg-server. Zack Rusin <zackr@vmware.com> -wrote: "It was a noop for at least 5 years and it has been removed." -See: http://patches.openembedded.org/patch/46133/ - ---- xf86-video-i128-1.3.6/src/i128_driver.c.~1~ 2012-07-17 01:21:15.000000000 -0400 -+++ xf86-video-i128-1.3.6/src/i128_driver.c 2014-12-19 00:47:16.140087736 -0500 -@@ -51,7 +51,6 @@ - #include "mipointer.h" - - /* All drivers implementing backing store need this */ --#include "mibstore.h" - #include "micmap.h" - - #include "xf86DDC.h" -@@ -1557,7 +1556,6 @@ - return FALSE; - } - -- miInitializeBackingStore(pScreen); - xf86SetBackingStore(pScreen); - xf86SetSilkenMouse(pScreen); - diff --git a/gnu/packages/patches/xmodmap-asprintf.patch b/gnu/packages/patches/xmodmap-asprintf.patch deleted file mode 100644 index 6dfe8514e5..0000000000 --- a/gnu/packages/patches/xmodmap-asprintf.patch +++ /dev/null @@ -1,14 +0,0 @@ -This patch allows the 'asprintf' declaration to be visible, by -including <config.h>, which defines _GNU_SOURCE. - - ---- xmodmap-1.0.7/xmodmap.c 2013-11-25 23:25:25.000000000 +0100 -+++ xmodmap-1.0.7/xmodmap.c 2013-11-25 23:25:27.000000000 +0100 -@@ -26,6 +26,7 @@ from The Open Group. - - */ - -+#include <config.h> - #include <X11/Xos.h> - #include <X11/Xlib.h> - #include <stdio.h> |