May 2014 - openSUSE Commits - openSUSE Mailing Lists

commit kfilemetadata for openSUSE:Factory
by root＠hilbert.suse.de 26 May '14

26 May '14

Hello community, here is the log from the commit of package kfilemetadata for openSUSE:Factory checked in at 2014-05-26 14:40:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kfilemetadata (Old) and /work/SRC/openSUSE:Factory/.kfilemetadata.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "kfilemetadata" Changes: -------- --- /work/SRC/openSUSE:Factory/kfilemetadata/kfilemetadata.changes 2014-05-06 17:41:16.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.kfilemetadata.new/kfilemetadata.changes 2014-05-26 14:40:29.000000000 +0200 @@ -1,0 +2,9 @@ +Fri May 9 16:39:46 UTC 2014 - tittiatcoke(a)gmail.com + +- Update to 4.13.1 + * KDE 4.13.1 bug fix release + * See http://www.kde.org/announcements/announce-4.13.1.php + +i- Drop patch optimize.patch (Upstreamed) + +------------------------------------------------------------------- Old: ---- kfilemetadata-4.13.0.tar.xz optimize.patch New: ---- kfilemetadata-4.13.1.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kfilemetadata.spec ++++++ --- /var/tmp/diff_new_pack.dsuKIt/_old 2014-05-26 14:40:31.000000000 +0200 +++ /var/tmp/diff_new_pack.dsuKIt/_new 2014-05-26 14:40:31.000000000 +0200 @@ -17,14 +17,12 @@ Name: kfilemetadata -Version: 4.13.0 +Version: 4.13.1 Release: 0 Summary: Extract Metadata License: GPL-2.0+ and LGPL-2.1+ and LGPL-3.0 Group: System/GUI/KDE Source0: %{name}-%{version}.tar.xz -# PATCH-FIX-UPSTREAM optimize.patch -- Optimize word count in PlainTextExtractor -Patch0: optimize.patch BuildRequires: libepub-devel BuildRequires: libexiv2-devel BuildRequires: libkde4-devel @@ -47,7 +45,6 @@ %prep %setup -q -%patch0 -p1 %build %cmake_kde4 -d build ++++++ kfilemetadata-4.13.0.tar.xz -> kfilemetadata-4.13.1.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kfilemetadata-4.13.0/autotests/CMakeLists.txt new/kfilemetadata-4.13.1/autotests/CMakeLists.txt --- old/kfilemetadata-4.13.0/autotests/CMakeLists.txt 2014-04-09 09:58:41.000000000 +0200 +++ new/kfilemetadata-4.13.1/autotests/CMakeLists.txt 2014-05-09 13:17:52.000000000 +0200 @@ -1,7 +1,7 @@ configure_file(indexerextractortestsconfig.h.in ${CMAKE_CURRENT_BINARY_DIR}/indexerextractortestsconfig.h @ONLY) -kde4_add_unit_test(extractortests +kde4_add_unit_test(extractortests NOGUI indexerextractortests.cpp simpleresult.cpp ../src/extractors/plaintextextractor.cpp @@ -16,7 +16,7 @@ # # Property Info # -kde4_add_unit_test(propertyinfotest +kde4_add_unit_test(propertyinfotest NOGUI propertyinfotest.cpp ) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kfilemetadata-4.13.0/autotests/indexerextractortests.cpp new/kfilemetadata-4.13.1/autotests/indexerextractortests.cpp --- old/kfilemetadata-4.13.0/autotests/indexerextractortests.cpp 2014-04-09 09:58:41.000000000 +0200 +++ new/kfilemetadata-4.13.1/autotests/indexerextractortests.cpp 2014-05-09 13:17:52.000000000 +0200 @@ -42,10 +42,24 @@ void IndexerExtractorTests::benchMarkPlainTextExtractor() { - QScopedPointer<ExtractorPlugin> plugin(new PlainTextExtractor(this, QVariantList())); + PlainTextExtractor plugin(this, QVariantList()); - SimpleResult result(testFilePath("plain_text_file.txt"), "text/plain"); - plugin->extract(&result); + // generate a test file with varying number of words per line + QTemporaryFile file("XXXXXX.txt"); + QVERIFY(file.open()); + QByteArray chunk("foo bar "); + for (int line = 0; line < 10000; ++line) { + for (int i = 0; i < line % 100; ++i) { + file.write(chunk); + } + file.write("\n"); + } + + SimpleResult result(file.fileName(), "text/plain"); + + QBENCHMARK { + plugin.extract(&result); + } } void IndexerExtractorTests::testPlainTextExtractor() @@ -64,8 +78,7 @@ QCOMPARE(result.types().size(), 1); QCOMPARE(result.types().first(), Type::Text); - QCOMPARE(result.properties().size(), 2); - QCOMPARE(result.properties().value(Property::WordCount), QVariant(17)); + QCOMPARE(result.properties().size(), 1); QCOMPARE(result.properties().value(Property::LineCount), QVariant(4)); content.replace(QLatin1Char('\n'), QLatin1Char(' ')); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kfilemetadata-4.13.0/src/extractors/CMakeLists.txt new/kfilemetadata-4.13.1/src/extractors/CMakeLists.txt --- old/kfilemetadata-4.13.0/src/extractors/CMakeLists.txt 2014-04-09 09:58:41.000000000 +0200 +++ new/kfilemetadata-4.13.1/src/extractors/CMakeLists.txt 2014-05-09 13:17:52.000000000 +0200 @@ -116,7 +116,6 @@ target_link_libraries( kfilemetadata_plaintextextractor kfilemetadata ${KDE4_KIO_LIBS} - ${FFMPEG_LIBRARIES} ) install( diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kfilemetadata-4.13.0/src/extractors/plaintextextractor.cpp new/kfilemetadata-4.13.1/src/extractors/plaintextextractor.cpp --- old/kfilemetadata-4.13.0/src/extractors/plaintextextractor.cpp 2014-04-09 09:58:41.000000000 +0200 +++ new/kfilemetadata-4.13.1/src/extractors/plaintextextractor.cpp 2014-05-09 13:17:52.000000000 +0200 @@ -19,9 +19,9 @@ #include "plaintextextractor.h" - #include <QFile> -#include <QTextStream> + +#include <fstream> using namespace KFileMetaData; @@ -36,34 +36,25 @@ return QStringList() << QLatin1String("text/"); } -// TODO: Make this iterative! And remove the size filter void PlainTextExtractor::extract(ExtractionResult* result) { - QFile file(result->inputUrl()); + std::string line; + int lines = 0; - if (!file.open(QIODevice::ReadOnly | QIODevice::Text)) { + std::ifstream fstream(QFile::encodeName(result->inputUrl())); + if (!fstream.is_open()) { return; } - int lines = 0; - int words = 0; - - QRegExp wordsRegex("\\b\\w+\\b"); - - QTextStream ts(&file); - while (!ts.atEnd()) { - QString str = ts.readLine(); - result->append(str); + while (std::getline(fstream, line)) { + QByteArray arr = QByteArray::fromRawData(line.c_str(), line.size()); + result->append(QString::fromUtf8(arr)); lines += 1; - words += str.count(wordsRegex); } - result->add(Property::WordCount, words); result->add(Property::LineCount, lines); result->addType(Type::Text); - - return; } KFILEMETADATA_EXPORT_EXTRACTOR(KFileMetaData::PlainTextExtractor, "kfilemetadata_plaintextextractor") diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kfilemetadata-4.13.0/src/kfilemetadata_export.h new/kfilemetadata-4.13.1/src/kfilemetadata_export.h --- old/kfilemetadata-4.13.0/src/kfilemetadata_export.h 2014-04-09 09:58:41.000000000 +0200 +++ new/kfilemetadata-4.13.1/src/kfilemetadata_export.h 2014-05-09 13:17:52.000000000 +0200 @@ -27,7 +27,7 @@ # if defined(KDELIBS_STATIC_LIBS) /* No export/import for static libraries */ # define KFILEMETADATA_EXPORT -# elif defined(MAKE_KMETADATA_LIB) +# elif defined(MAKE_KFILEMETADATA_LIB) /* We are building this library */ # define KFILEMETADATA_EXPORT KDE_EXPORT # else -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit baloo for openSUSE:Factory
by root＠hilbert.suse.de 26 May '14

26 May '14

Hello community, here is the log from the commit of package baloo for openSUSE:Factory checked in at 2014-05-26 14:40:20 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/baloo (Old) and /work/SRC/openSUSE:Factory/.baloo.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "baloo" Changes: -------- --- /work/SRC/openSUSE:Factory/baloo/baloo.changes 2014-04-26 09:59:30.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.baloo.new/baloo.changes 2014-05-26 14:40:27.000000000 +0200 @@ -1,0 +2,24 @@ +Fri May 9 16:39:53 UTC 2014 - tittiatcoke(a)gmail.com + +- Update to 4.13.1 + * KDE 4.13.1 bug fix release + * See http://www.kde.org/announcements/announce-4.13.1.php + +- Drop patches due to upstream inclusion + 0006-Extractor-Check-if-the-file-should-be-indexed.patch + 0005-FileIndexingJob-Pause-it-when-on-battery.patch + 0001-Cleaner-Do-not-commit-each-time-after-1000-documents.patch + 0002-XapianSearchStore-Catch-the-database-modified-except.patch + 0002-Cleaner-Remove-the-database-file-on-disabling.patch + 0003-Use-QFile-encodeName-and-catch-some-exceptions.patch + 0004-KCM-Show-the-home-folder-name-when-excluding-it.patch + 0001-Bug-333566-Quick-filter-in-KMail-4.13-stops-working-.patch + + +------------------------------------------------------------------- +Mon Apr 28 16:28:20 UTC 2014 - hrvoje.senjan(a)gmail.com + +- Added 0006-Extractor-Check-if-the-file-should-be-indexed.patch and + 0005-FileIndexingJob-Pause-it-when-on-battery.patch (kde#332444) + +------------------------------------------------------------------- Old: ---- 0001-Bug-333566-Quick-filter-in-KMail-4.13-stops-working-.patch 0001-Cleaner-Do-not-commit-each-time-after-1000-documents.patch 0002-Cleaner-Remove-the-database-file-on-disabling.patch 0002-XapianSearchStore-Catch-the-database-modified-except.patch 0003-Use-QFile-encodeName-and-catch-some-exceptions.patch 0004-KCM-Show-the-home-folder-name-when-excluding-it.patch baloo-4.13.0.tar.xz New: ---- baloo-4.13.1.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ baloo.spec ++++++ --- /var/tmp/diff_new_pack.M5MPc8/_old 2014-05-26 14:40:29.000000000 +0200 +++ /var/tmp/diff_new_pack.M5MPc8/_new 2014-05-26 14:40:29.000000000 +0200 @@ -17,24 +17,12 @@ Name: baloo -Version: 4.13.0 +Version: 4.13.1 Release: 0 Summary: Framework for searching and managing metadata License: GPL-2.0+ and LGPL-2.1+ Group: System/GUI/KDE Source0: %{name}-%{version}.tar.xz -# PATCH-FIX-UPSTREAM 0001-Bug-333566-Quick-filter-in-KMail-4.13-stops-working-.patch -- fixes KMail searches with non-Latin characters -Patch2: 0001-Bug-333566-Quick-filter-in-KMail-4.13-stops-working-.patch -# PATCH-FIX-UPSTREAM 0002-Cleaner-Remove-the-database-file-on-disabling.patch -Patch3: 0002-Cleaner-Remove-the-database-file-on-disabling.patch -# PATCH-FIX-UPSTREAM 0003-Use-QFile-encodeName-and-catch-some-exceptions.patch -Patch4: 0003-Use-QFile-encodeName-and-catch-some-exceptions.patch -# PATCH-FIX-UPSTREAM 0004-KCM-Show-the-home-folder-name-when-excluding-it.patch -Patch5: 0004-KCM-Show-the-home-folder-name-when-excluding-it.patch -# PATCH-FIX-UPSTREAM 0001-Cleaner-Do-not-commit-each-time-after-1000-documents.patch -Patch6: 0001-Cleaner-Do-not-commit-each-time-after-1000-documents.patch -# PATCH-FIX-UPSTREAM 0002-XapianSearchStore-Catch-the-database-modified-except.patch -Patch7: 0002-XapianSearchStore-Catch-the-database-modified-except.patch BuildRequires: kfilemetadata-devel >= %{version} BuildRequires: libakonadiprotocolinternals-devel BuildRequires: libattr-devel @@ -124,12 +112,6 @@ %prep %setup -q -%patch2 -p1 -%patch3 -p1 -%patch4 -p1 -%patch5 -p1 -%patch6 -p1 -%patch7 -p1 %build %cmake_kde4 -d build @@ -177,6 +159,7 @@ %{_kde4_bindir}/baloo_file %{_kde4_bindir}/baloo_file_cleaner %{_kde4_bindir}/baloo_file_extractor +%{_kde4_bindir}/balooctl %{_kde4_datadir}/autostart/baloo_file.desktop %{_kde4_servicesdir}/kcm_baloofile.desktop %{_kde4_modulesdir}/kcm_baloofile.so ++++++ baloo-4.13.0.tar.xz -> baloo-4.13.1.tar.xz ++++++ ++++ 2092 lines of diff (skipped) -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit mediastreamer2 for openSUSE:Factory
by root＠hilbert.suse.de 26 May '14

26 May '14

Hello community, here is the log from the commit of package mediastreamer2 for openSUSE:Factory checked in at 2014-05-26 14:40:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mediastreamer2 (Old) and /work/SRC/openSUSE:Factory/.mediastreamer2.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "mediastreamer2" Changes: -------- --- /work/SRC/openSUSE:Factory/mediastreamer2/mediastreamer2.changes 2013-08-13 15:47:09.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.mediastreamer2.new/mediastreamer2.changes 2014-05-26 14:40:25.000000000 +0200 @@ -1,0 +2,7 @@ +Sun May 25 19:13:51 UTC 2014 - crrodriguez(a)opensuse.org + +- Use LFS_CFLAGS in 32 bit systems, a mediastreamer without + large file support is not very pleasant.. +- Make the build verbose. + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mediastreamer2.spec ++++++ --- /var/tmp/diff_new_pack.kzVj9f/_old 2014-05-26 14:40:27.000000000 +0200 +++ /var/tmp/diff_new_pack.kzVj9f/_new 2014-05-26 14:40:27.000000000 +0200 @@ -92,8 +92,8 @@ %setup -q -n mediastreamer-%{version} %build -export CFLAGS="%{optflags}" -export CXXFLAGS="%{optflags}" +export CFLAGS="%{optflags} $(getconf LFS_CFLAGS)" +export CXXFLAGS="%{optflags} $(getconf LFS_CFLAGS)" %configure \ --enable-shared \ %if 0%{?packman_bs} @@ -101,7 +101,7 @@ %else --disable-video %endif -make %{?_smp_mflags} +make %{?_smp_mflags} V=1 %install %makeinstall -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit SDL for openSUSE:Factory
by root＠hilbert.suse.de 26 May '14

26 May '14

Hello community, here is the log from the commit of package SDL for openSUSE:Factory checked in at 2014-05-26 14:40:17 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/SDL (Old) and /work/SRC/openSUSE:Factory/.SDL.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "SDL" Changes: -------- --- /work/SRC/openSUSE:Factory/SDL/SDL.changes 2013-12-19 12:51:31.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.SDL.new/SDL.changes 2014-05-26 14:40:23.000000000 +0200 @@ -1,0 +2,6 @@ +Sun May 25 16:30:19 UTC 2014 - crrodriguez(a)opensuse.org + +- Update SDL-lfs.patch, after a recent verification I found + that something is not including SDL_config.h (config.h) + therefore not using large file offsets. +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ SDL.spec ++++++ --- /var/tmp/diff_new_pack.LveiWq/_old 2014-05-26 14:40:24.000000000 +0200 +++ /var/tmp/diff_new_pack.LveiWq/_new 2014-05-26 14:40:24.000000000 +0200 @@ -1,7 +1,7 @@ # # spec file for package SDL # -# Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2014 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed ++++++ sdl-lfs.patch ++++++ --- /var/tmp/diff_new_pack.LveiWq/_old 2014-05-26 14:40:25.000000000 +0200 +++ /var/tmp/diff_new_pack.LveiWq/_new 2014-05-26 14:40:25.000000000 +0200 @@ -9,3 +9,14 @@ AC_PROG_CXX AC_PROG_INSTALL AC_PROG_MAKE_SET +--- Makefile.in.orig ++++ Makefile.in +@@ -21,7 +21,7 @@ distfile = $(distdir).tar.gz + SHELL = @SHELL@ + CC = @CC@ + INCLUDE = @INCLUDE@ +-CFLAGS = @BUILD_CFLAGS@ ++CFLAGS = @BUILD_CFLAGS@ -include include/SDL_config.h + EXTRA_CFLAGS = @EXTRA_CFLAGS@ + LDFLAGS = @BUILD_LDFLAGS@ + EXTRA_LDFLAGS = @EXTRA_LDFLAGS@ -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit ldb for openSUSE:Factory
by root＠hilbert.suse.de 26 May '14

26 May '14

Hello community, here is the log from the commit of package ldb for openSUSE:Factory checked in at 2014-05-26 14:40:16 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ldb (Old) and /work/SRC/openSUSE:Factory/.ldb.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "ldb" Changes: -------- --- /work/SRC/openSUSE:Factory/ldb/ldb.changes 2014-05-10 08:31:44.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.ldb.new/ldb.changes 2014-05-26 14:40:22.000000000 +0200 @@ -1,0 +2,6 @@ +Fri May 23 15:39:36 UTC 2014 - lmuelle(a)suse.com + +- Require pkg-config from the devel sub packages and do not BuildRequire it + from libldb. + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ldb.spec ++++++ --- /var/tmp/diff_new_pack.vmbeZT/_old 2014-05-26 14:40:23.000000000 +0200 +++ /var/tmp/diff_new_pack.vmbeZT/_new 2014-05-26 14:40:23.000000000 +0200 @@ -60,11 +60,6 @@ %package -n %{libldb_name} Summary: An LDAP-like embedded database Group: System/Libraries -%if 0%{?suse_version} > 1020 -BuildRequires: pkg-config -%else -BuildRequires: pkgconfig -%endif PreReq: /sbin/ldconfig %description -n %{libldb_name} @@ -77,6 +72,11 @@ Summary: Libraries and Header Files to Develop Programs with ldb1 Support Group: Development/Libraries/C and C++ Requires: %{libldb_name} = %{version} +%if 0%{?suse_version} > 1020 +Requires: pkg-config +%else +Requires: pkgconfig +%endif %description -n libldb-devel Ldb is an LDAP-like embedded database. @@ -106,6 +106,11 @@ Summary: Development files for the Python bindings for the LDB library Group: Development/Libraries/Python Requires: pyldb = %{version} +%if 0%{?suse_version} > 1020 +Requires: pkg-config +%else +Requires: pkgconfig +%endif %description -n pyldb-devel This package contains the development files for the Python bindings for the -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit tdb for openSUSE:Factory
by root＠hilbert.suse.de 26 May '14

26 May '14

Hello community, here is the log from the commit of package tdb for openSUSE:Factory checked in at 2014-05-26 14:40:12 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/tdb (Old) and /work/SRC/openSUSE:Factory/.tdb.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "tdb" Changes: -------- --- /work/SRC/openSUSE:Factory/tdb/tdb.changes 2014-03-23 22:29:26.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.tdb.new/tdb.changes 2014-05-26 14:40:19.000000000 +0200 @@ -1,0 +2,38 @@ +Fri May 23 20:48:25 UTC 2014 - lmuelle(a)suse.com + +- Update to version 1.3.0. + + add TDB_MUTEX_LOCKING support + + consolidate tdb allocation code - re-use dead records at hash top. + + don't alter errno on success of tdb_open_ex() + + introduce tdb->hdr_ofs + + introduce TDB_SUPPORTED_FEATURE_FLAGS + + return ENOSYS if the tdb was created with spinlocks. + + use asprintf() to simplify tdb_summary() + + test: add a "skip()" macro. + add marklock deadlock test + add mutex related tests + add PING command to external-agent.c + add shutdown_agent() helper function + add UNMAP command to external-agent.c + always call fflush() after [f]printf() in tap-interface.h + avoid const warnings by using 'discard_const_p(uint8_t,' instead of + '(void *)' + correctly use stderr, not stdout, in fail() + remove "\n" in diag() arguments + + tools: add -l option to tdbbackup + add -l option to tdbtool + add -m option to tdbtorture + Allow tdbtool to r/o open mutexed tdbs + avoid const warnings in tdbdump.c + explicitly use TDB_NOLOCK in tdbdump + + tdb_wrap: Remove tdb_wrap_open_ again + + wscript: maintain a global list of unit tests +- Include stdbool.h in tdb.h; (bso#10625). + + include_stdbool_bso10625.patch + +------------------------------------------------------------------- +Fri May 23 20:10:17 UTC 2014 - lmuelle(a)suse.com + +- Don't require pkg-config from the libtdb package. + +------------------------------------------------------------------- Old: ---- tdb-1.2.13.tar.asc tdb-1.2.13.tar.gz New: ---- include_stdbool_bso10625.patch tdb-1.3.0.tar.asc tdb-1.3.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ tdb.spec ++++++ --- /var/tmp/diff_new_pack.lCr5zu/_old 2014-05-26 14:40:21.000000000 +0200 +++ /var/tmp/diff_new_pack.lCr5zu/_new 2014-05-26 14:40:21.000000000 +0200 @@ -37,7 +37,7 @@ %endif BuildRequires: python-devel Url: http://tdb.samba.org/ -Version: 1.2.13 +Version: 1.3.0 Release: 0 Summary: Samba Trivial Database License: GPL-3.0+ @@ -48,6 +48,7 @@ Source4: baselibs.conf Patch0: ignore-tdb1-run-transaction-expand.diff Patch1: build_pie.patch +Patch2: include_stdbool_bso10625.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build %description @@ -61,11 +62,6 @@ %package -n %{libtdb_name} Summary: Libraries and Header Files to Develop Programs with tdb1 Support Group: System/Libraries -%if 0%{?suse_version} > 1020 -Requires: pkg-config -%else -Requires: pkgconfig -%endif PreReq: /sbin/ldconfig %description -n %{libtdb_name} @@ -130,6 +126,7 @@ %patch0 -p1 %endif %patch1 -p1 +%patch2 -p3 %build %if 0%{?suse_version} && 0%{?suse_version} < 911 ++++++ build_pie.patch ++++++ --- /var/tmp/diff_new_pack.lCr5zu/_old 2014-05-26 14:40:21.000000000 +0200 +++ /var/tmp/diff_new_pack.lCr5zu/_new 2014-05-26 14:40:21.000000000 +0200 @@ -7,7 +7,7 @@ =================================================================== --- tdb-1.2.12.orig/wscript +++ tdb-1.2.12/wscript -@@ -94,20 +94,27 @@ def build(bld): +@@ -149,20 +149,27 @@ def build(bld): bld.SAMBA_BINARY('tdbrestore', 'tools/tdbrestore.c', ++++++ ignore-tdb1-run-transaction-expand.diff ++++++ --- /var/tmp/diff_new_pack.lCr5zu/_old 2014-05-26 14:40:21.000000000 +0200 +++ /var/tmp/diff_new_pack.lCr5zu/_new 2014-05-26 14:40:21.000000000 +0200 @@ -5,7 +5,7 @@ =================================================================== --- tdb-1.2.11.orig/wscript +++ tdb-1.2.11/wscript -@@ -196,8 +196,9 @@ def testonly(ctx): +@@ -213,8 +213,9 @@ def testonly(ctx): if ret != 0: print("%s failed:" % f) samba_utils.RUN_COMMAND("cat " + os.path.join(testdir, 'test-output')) ++++++ include_stdbool_bso10625.patch ++++++ >From 4e14a437963ba54987cd58b4e0705d9a6d8aea6f Mon Sep 17 00:00:00 2001 From: Adam Williamson <awilliam(a)redhat.com> Date: Fri, 23 May 2014 10:08:14 -0700 Subject: [PATCH] tdb/include: include stdbool.h in tdb.h Commit db5bda56bf08 (tdb: add TDB_MUTEX_LOCKING support) adds a bool, but does not include stdbool.h. This causes any build including tdb.h to fail, at least for me with GCC 4.9.0. --- lib/tdb/include/tdb.h | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/tdb/include/tdb.h b/lib/tdb/include/tdb.h index 5ea5e60..03e429c 100644 --- a/lib/tdb/include/tdb.h +++ b/lib/tdb/include/tdb.h @@ -31,6 +31,7 @@ extern "C" { #endif #include <signal.h> +#include <stdbool.h> /** * @defgroup tdb The tdb API -- 1.9.3 ++++++ tdb-1.2.13.tar.gz -> tdb-1.3.0.tar.gz ++++++ ++++ 5751 lines of diff (skipped) -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit qemu for openSUSE:Factory
by root＠hilbert.suse.de 26 May '14

26 May '14

Hello community, here is the log from the commit of package qemu for openSUSE:Factory checked in at 2014-05-26 14:40:11 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/qemu (Old) and /work/SRC/openSUSE:Factory/.qemu.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "qemu" Changes: -------- --- /work/SRC/openSUSE:Factory/qemu/qemu.changes 2014-05-17 22:01:30.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.qemu.new/qemu.changes 2014-05-26 14:40:15.000000000 +0200 @@ -1,0 +2,46 @@ +Sat May 24 10:01:36 UTC 2014 - afaerber(a)suse.de + +- Fix CVE-2013-4148 (bnc#864812) + 0048-virtio-net-fix-buffer-overflow-on-i.patch +- Fix CVE-2013-4149 (bnc#864649) + 0068-virtio-net-out-of-bounds-buffer-wri.patch +- Fix CVE-2013-4150 (bnc#864650) + 0049-virtio-net-out-of-bounds-buffer-wri.patch +- Fix CVE-2013-4151 (bnc#864653) + 0050-virtio-out-of-bounds-buffer-write-o.patch +- Fix CVE-2013-4526 (bnc#864671) + 0051-ahci-fix-buffer-overrun-on-invalid-.patch +- Fix CVE-2013-4527 (bnc#864673) + 0052-hpet-fix-buffer-overrun-on-invalid-.patch +- Fix CVE-2013-4529 (bnc#864678) + 0053-hw-pci-pcie_aer.c-fix-buffer-overru.patch +- Fix CVE-2013-4530 (bnc#864682) + 0054-pl022-fix-buffer-overun-on-invalid-.patch +- Fix CVE-2013-4531 (bnc#864796) + 0055-vmstate-fix-buffer-overflow-in-targ.patch +- Fix CVE-2013-4533 (bnc#864655) + 0058-pxa2xx-avoid-buffer-overrun-on-inco.patch +- Fix CVE-2013-4534 (bnc#864811) + 0067-openpic-avoid-buffer-overrun-on-inc.patch +- Fix CVE-2013-4535 / CVE-2013-4536 (bnc#864665) + 0057-virtio-validate-num_sg-when-mapping.patch +- Fix CVE-2013-4537 (bnc#864391) + 0066-ssi-sd-fix-buffer-overrun-on-invali.patch +- Fix CVE-2013-4538 (bnc#864769) + 0059-ssd0323-fix-buffer-overun-on-invali.patch +- Fix CVE-2013-4539 (bnc#864805) + 0060-tsc210x-fix-buffer-overrun-on-inval.patch +- Fix CVE-2013-4540 (bnc#864801) + 0061-zaurus-fix-buffer-overrun-on-invali.patch +- Fix CVE-2013-4541 (bnc#864802) + 0064-usb-sanity-check-setup_index-setup_.patch +- Fix CVE-2013-4542 (bnc#864804) + 0062-virtio-scsi-fix-buffer-overrun-on-i.patch +- Fix CVE-2013-6399 (bnc#864814) + 0067-virtio-avoid-buffer-overrun-on-inco.patch +- Fix CVE-2014-0182 (bnc#874788) + 0069-virtio-validate-config_len-on-load.patch +- Backported patch from stable branch (brogers): + 0070-virtio-allow-mapping-up-to-max-queu.patch + +------------------------------------------------------------------- New: ---- 0046-vmstate-add-VMS_MUST_EXIST.patch 0047-vmstate-add-VMSTATE_VALIDATE.patch 0048-virtio-net-fix-buffer-overflow-on-i.patch 0049-virtio-net-out-of-bounds-buffer-wri.patch 0050-virtio-out-of-bounds-buffer-write-o.patch 0051-ahci-fix-buffer-overrun-on-invalid-.patch 0052-hpet-fix-buffer-overrun-on-invalid-.patch 0053-hw-pci-pcie_aer.c-fix-buffer-overru.patch 0054-pl022-fix-buffer-overun-on-invalid-.patch 0055-vmstate-fix-buffer-overflow-in-targ.patch 0056-virtio-avoid-buffer-overrun-on-inco.patch 0057-virtio-validate-num_sg-when-mapping.patch 0058-pxa2xx-avoid-buffer-overrun-on-inco.patch 0059-ssd0323-fix-buffer-overun-on-invali.patch 0060-tsc210x-fix-buffer-overrun-on-inval.patch 0061-zaurus-fix-buffer-overrun-on-invali.patch 0062-virtio-scsi-fix-buffer-overrun-on-i.patch 0063-vmstate-s-VMSTATE_INT32_LE-VMSTATE_.patch 0064-usb-sanity-check-setup_index-setup_.patch 0065-savevm-Ignore-minimum_version_id_ol.patch 0066-ssi-sd-fix-buffer-overrun-on-invali.patch 0067-openpic-avoid-buffer-overrun-on-inc.patch 0068-virtio-net-out-of-bounds-buffer-wri.patch 0069-virtio-validate-config_len-on-load.patch 0070-virtio-allow-mapping-up-to-max-queu.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ qemu-linux-user.spec ++++++ --- /var/tmp/diff_new_pack.DlxQke/_old 2014-05-26 14:40:18.000000000 +0200 +++ /var/tmp/diff_new_pack.DlxQke/_new 2014-05-26 14:40:18.000000000 +0200 @@ -70,6 +70,31 @@ Patch0043: 0043-arm-translate.c-Fix-smlald-Instruct.patch Patch0044: 0044-target-arm-A64-fix-unallocated-test.patch Patch0045: 0045-tcg-ppc64-Support-the-ELFv2-ABI.patch +Patch0046: 0046-vmstate-add-VMS_MUST_EXIST.patch +Patch0047: 0047-vmstate-add-VMSTATE_VALIDATE.patch +Patch0048: 0048-virtio-net-fix-buffer-overflow-on-i.patch +Patch0049: 0049-virtio-net-out-of-bounds-buffer-wri.patch +Patch0050: 0050-virtio-out-of-bounds-buffer-write-o.patch +Patch0051: 0051-ahci-fix-buffer-overrun-on-invalid-.patch +Patch0052: 0052-hpet-fix-buffer-overrun-on-invalid-.patch +Patch0053: 0053-hw-pci-pcie_aer.c-fix-buffer-overru.patch +Patch0054: 0054-pl022-fix-buffer-overun-on-invalid-.patch +Patch0055: 0055-vmstate-fix-buffer-overflow-in-targ.patch +Patch0056: 0056-virtio-avoid-buffer-overrun-on-inco.patch +Patch0057: 0057-virtio-validate-num_sg-when-mapping.patch +Patch0058: 0058-pxa2xx-avoid-buffer-overrun-on-inco.patch +Patch0059: 0059-ssd0323-fix-buffer-overun-on-invali.patch +Patch0060: 0060-tsc210x-fix-buffer-overrun-on-inval.patch +Patch0061: 0061-zaurus-fix-buffer-overrun-on-invali.patch +Patch0062: 0062-virtio-scsi-fix-buffer-overrun-on-i.patch +Patch0063: 0063-vmstate-s-VMSTATE_INT32_LE-VMSTATE_.patch +Patch0064: 0064-usb-sanity-check-setup_index-setup_.patch +Patch0065: 0065-savevm-Ignore-minimum_version_id_ol.patch +Patch0066: 0066-ssi-sd-fix-buffer-overrun-on-invali.patch +Patch0067: 0067-openpic-avoid-buffer-overrun-on-inc.patch +Patch0068: 0068-virtio-net-out-of-bounds-buffer-wri.patch +Patch0069: 0069-virtio-validate-config_len-on-load.patch +Patch0070: 0070-virtio-allow-mapping-up-to-max-queu.patch # Please do not add patches manually here, run update_git.sh. # this is to make lint happy Source300: rpmlintrc @@ -168,6 +193,31 @@ %patch0043 -p1 %patch0044 -p1 %patch0045 -p1 +%patch0046 -p1 +%patch0047 -p1 +%patch0048 -p1 +%patch0049 -p1 +%patch0050 -p1 +%patch0051 -p1 +%patch0052 -p1 +%patch0053 -p1 +%patch0054 -p1 +%patch0055 -p1 +%patch0056 -p1 +%patch0057 -p1 +%patch0058 -p1 +%patch0059 -p1 +%patch0060 -p1 +%patch0061 -p1 +%patch0062 -p1 +%patch0063 -p1 +%patch0064 -p1 +%patch0065 -p1 +%patch0066 -p1 +%patch0067 -p1 +%patch0068 -p1 +%patch0069 -p1 +%patch0070 -p1 %build ./configure --prefix=%_prefix --sysconfdir=%_sysconfdir \ ++++++ qemu.spec ++++++ --- /var/tmp/diff_new_pack.DlxQke/_old 2014-05-26 14:40:18.000000000 +0200 +++ /var/tmp/diff_new_pack.DlxQke/_new 2014-05-26 14:40:18.000000000 +0200 @@ -99,6 +99,31 @@ Patch0043: 0043-arm-translate.c-Fix-smlald-Instruct.patch Patch0044: 0044-target-arm-A64-fix-unallocated-test.patch Patch0045: 0045-tcg-ppc64-Support-the-ELFv2-ABI.patch +Patch0046: 0046-vmstate-add-VMS_MUST_EXIST.patch +Patch0047: 0047-vmstate-add-VMSTATE_VALIDATE.patch +Patch0048: 0048-virtio-net-fix-buffer-overflow-on-i.patch +Patch0049: 0049-virtio-net-out-of-bounds-buffer-wri.patch +Patch0050: 0050-virtio-out-of-bounds-buffer-write-o.patch +Patch0051: 0051-ahci-fix-buffer-overrun-on-invalid-.patch +Patch0052: 0052-hpet-fix-buffer-overrun-on-invalid-.patch +Patch0053: 0053-hw-pci-pcie_aer.c-fix-buffer-overru.patch +Patch0054: 0054-pl022-fix-buffer-overun-on-invalid-.patch +Patch0055: 0055-vmstate-fix-buffer-overflow-in-targ.patch +Patch0056: 0056-virtio-avoid-buffer-overrun-on-inco.patch +Patch0057: 0057-virtio-validate-num_sg-when-mapping.patch +Patch0058: 0058-pxa2xx-avoid-buffer-overrun-on-inco.patch +Patch0059: 0059-ssd0323-fix-buffer-overun-on-invali.patch +Patch0060: 0060-tsc210x-fix-buffer-overrun-on-inval.patch +Patch0061: 0061-zaurus-fix-buffer-overrun-on-invali.patch +Patch0062: 0062-virtio-scsi-fix-buffer-overrun-on-i.patch +Patch0063: 0063-vmstate-s-VMSTATE_INT32_LE-VMSTATE_.patch +Patch0064: 0064-usb-sanity-check-setup_index-setup_.patch +Patch0065: 0065-savevm-Ignore-minimum_version_id_ol.patch +Patch0066: 0066-ssi-sd-fix-buffer-overrun-on-invali.patch +Patch0067: 0067-openpic-avoid-buffer-overrun-on-inc.patch +Patch0068: 0068-virtio-net-out-of-bounds-buffer-wri.patch +Patch0069: 0069-virtio-validate-config_len-on-load.patch +Patch0070: 0070-virtio-allow-mapping-up-to-max-queu.patch # Please do not add patches manually here, run update_git.sh. # roms/ipxe patches @@ -524,6 +549,31 @@ %patch0043 -p1 %patch0044 -p1 %patch0045 -p1 +%patch0046 -p1 +%patch0047 -p1 +%patch0048 -p1 +%patch0049 -p1 +%patch0050 -p1 +%patch0051 -p1 +%patch0052 -p1 +%patch0053 -p1 +%patch0054 -p1 +%patch0055 -p1 +%patch0056 -p1 +%patch0057 -p1 +%patch0058 -p1 +%patch0059 -p1 +%patch0060 -p1 +%patch0061 -p1 +%patch0062 -p1 +%patch0063 -p1 +%patch0064 -p1 +%patch0065 -p1 +%patch0066 -p1 +%patch0067 -p1 +%patch0068 -p1 +%patch0069 -p1 +%patch0070 -p1 %patch1000 -p1 %patch1001 -p1 ++++++ 0046-vmstate-add-VMS_MUST_EXIST.patch ++++++ >From 52c324d64cd57ad37b25ebc5f4df31b33901d03b Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:50:31 +0300 Subject: [PATCH] vmstate: add VMS_MUST_EXIST MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Can be used to verify a required field exists or validate state in some other way. Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 5bf81c8d63db0216a4d29dc87f9ce530bb791dd1) Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- include/migration/vmstate.h | 1 + vmstate.c | 10 ++++++++++ 2 files changed, 11 insertions(+) diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h index e7e1705..de970ab 100644 --- a/include/migration/vmstate.h +++ b/include/migration/vmstate.h @@ -100,6 +100,7 @@ enum VMStateFlags { VMS_MULTIPLY = 0x200, /* multiply "size" field by field_size */ VMS_VARRAY_UINT8 = 0x400, /* Array with size in uint8_t field*/ VMS_VARRAY_UINT32 = 0x800, /* Array with size in uint32_t field*/ + VMS_MUST_EXIST = 0x1000, /* Field must exist in input */ }; typedef struct { diff --git a/vmstate.c b/vmstate.c index b689f2f..d856319 100644 --- a/vmstate.c +++ b/vmstate.c @@ -78,6 +78,10 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd, return ret; } } + } else if (field->flags & VMS_MUST_EXIST) { + fprintf(stderr, "Input validation failed: %s/%s\n", + vmsd->name, field->name); + return -1; } field++; } @@ -138,6 +142,12 @@ void vmstate_save_state(QEMUFile *f, const VMStateDescription *vmsd, field->info->put(f, addr, size); } } + } else { + if (field->flags & VMS_MUST_EXIST) { + fprintf(stderr, "Output state validation failed: %s/%s\n", + vmsd->name, field->name); + assert(!(field->flags & VMS_MUST_EXIST)); + } } field++; } ++++++ 0047-vmstate-add-VMSTATE_VALIDATE.patch ++++++ >From e258560116c8413cd5c52af69ab73dc82142dae9 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:50:35 +0300 Subject: [PATCH] vmstate: add VMSTATE_VALIDATE MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Validate state using VMS_ARRAY with num = 0 and VMS_MUST_EXIST Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 4082f0889ba04678fc14816c53e1b9251ea9207e) Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- include/migration/vmstate.h | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h index de970ab..5b71370 100644 --- a/include/migration/vmstate.h +++ b/include/migration/vmstate.h @@ -204,6 +204,14 @@ extern const VMStateInfo vmstate_info_bitmap; .offset = vmstate_offset_value(_state, _field, _type), \ } +/* Validate state using a boolean predicate. */ +#define VMSTATE_VALIDATE(_name, _test) { \ + .name = (_name), \ + .field_exists = (_test), \ + .flags = VMS_ARRAY | VMS_MUST_EXIST, \ + .num = 0, /* 0 elements: no data, only run _test */ \ +} + #define VMSTATE_POINTER(_field, _state, _version, _info, _type) { \ .name = (stringify(_field)), \ .version_id = (_version), \ ++++++ 0048-virtio-net-fix-buffer-overflow-on-i.patch ++++++ >From e3f320a759052a77b4da97618a94f8adcb0a6490 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:50:39 +0300 Subject: [PATCH] virtio-net: fix buffer overflow on invalid state load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4148 QEMU 1.0 integer conversion in virtio_net_load()(a)hw/net/virtio-net.c Deals with loading a corrupted savevm image. > n->mac_table.in_use = qemu_get_be32(f); in_use is int so it can get negative when assigned 32bit unsigned value. > /* MAC_TABLE_ENTRIES may be different from the saved image */ > if (n->mac_table.in_use <= MAC_TABLE_ENTRIES) { passing this check ^^^ > qemu_get_buffer(f, n->mac_table.macs, > n->mac_table.in_use * ETH_ALEN); with good in_use value, "n->mac_table.in_use * ETH_ALEN" can get positive and bigger than mac_table.macs. For example 0x81000000 satisfies this condition when ETH_ALEN is 6. Fix it by making the value unsigned. For consistency, change first_multi as well. Note: all call sites were audited to confirm that making them unsigned didn't cause any issues: it turns out we actually never do math on them, so it's easy to validate because both values are always <= MAC_TABLE_ENTRIES. Reviewed-by: Michael Roth <mdroth(a)linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Laszlo Ersek <lersek(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 71f7fe48e10a8437c9d42d859389f37157f59980) [AF: BNC#864812] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- include/hw/virtio/virtio-net.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h index df60f16..4b32440 100644 --- a/include/hw/virtio/virtio-net.h +++ b/include/hw/virtio/virtio-net.h @@ -176,8 +176,8 @@ typedef struct VirtIONet { uint8_t nobcast; uint8_t vhost_started; struct { - int in_use; - int first_multi; + uint32_t in_use; + uint32_t first_multi; uint8_t multi_overflow; uint8_t uni_overflow; uint8_t *macs; ++++++ 0049-virtio-net-out-of-bounds-buffer-wri.patch ++++++ >From 0c0a6b53c543e4095da9243eb5299e03d2c88c06 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:50:56 +0300 Subject: [PATCH] virtio-net: out-of-bounds buffer write on invalid state load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4150 QEMU 1.5.0 out-of-bounds buffer write in virtio_net_load()(a)hw/net/virtio-net.c This code is in hw/net/virtio-net.c: if (n->max_queues > 1) { if (n->max_queues != qemu_get_be16(f)) { error_report("virtio-net: different max_queues "); return -1; } n->curr_queues = qemu_get_be16(f); for (i = 1; i < n->curr_queues; i++) { n->vqs[i].tx_waiting = qemu_get_be32(f); } } Number of vqs is max_queues, so if we get invalid input here, for example if max_queues = 2, curr_queues = 3, we get write beyond end of the buffer, with data that comes from wire. This might be used to corrupt qemu memory in hard to predict ways. Since we have lots of function pointers around, RCE might be possible. Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Reviewed-by: Michael Roth <mdroth(a)linux.vnet.ibm.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit eea750a5623ddac7a61982eec8f1c93481857578) [AF: BNC#864650] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/net/virtio-net.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index 33bd233..0a8cb40 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -1407,6 +1407,11 @@ static int virtio_net_load(QEMUFile *f, void *opaque, int version_id) } n->curr_queues = qemu_get_be16(f); + if (n->curr_queues > n->max_queues) { + error_report("virtio-net: curr_queues %x > max_queues %x", + n->curr_queues, n->max_queues); + return -1; + } for (i = 1; i < n->curr_queues; i++) { n->vqs[i].tx_waiting = qemu_get_be32(f); } ++++++ 0050-virtio-out-of-bounds-buffer-write-o.patch ++++++ >From a76b7609802937bfc6f35a75cf0809c8f7197f76 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:51:14 +0300 Subject: [PATCH] virtio: out-of-bounds buffer write on invalid state load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4151 QEMU 1.0 out-of-bounds buffer write in virtio_load(a)hw/virtio/virtio.c So we have this code since way back when: num = qemu_get_be32(f); for (i = 0; i < num; i++) { vdev->vq[i].vring.num = qemu_get_be32(f); array of vqs has size VIRTIO_PCI_QUEUE_MAX, so on invalid input this will write beyond end of buffer. Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Michael Roth <mdroth(a)linux.vnet.ibm.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit cc45995294b92d95319b4782750a3580cabdbc0c) [AF: BNC#864653] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/virtio/virtio.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index aeabf3a..05f05e7 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -891,7 +891,8 @@ int virtio_set_features(VirtIODevice *vdev, uint32_t val) int virtio_load(VirtIODevice *vdev, QEMUFile *f) { - int num, i, ret; + int i, ret; + uint32_t num; uint32_t features; uint32_t supported_features; BusState *qbus = qdev_get_parent_bus(DEVICE(vdev)); @@ -919,6 +920,11 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f) num = qemu_get_be32(f); + if (num > VIRTIO_PCI_QUEUE_MAX) { + error_report("Invalid number of PCI queues: 0x%x", num); + return -1; + } + for (i = 0; i < num; i++) { vdev->vq[i].vring.num = qemu_get_be32(f); if (k->has_variable_vring_alignment) { ++++++ 0051-ahci-fix-buffer-overrun-on-invalid-.patch ++++++ >From b591a65b23630ee3707647d61fc69b3f0ff16665 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:51:18 +0300 Subject: [PATCH] ahci: fix buffer overrun on invalid state load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4526 Within hw/ide/ahci.c, VARRAY refers to ports which is also loaded. So we use the old version of ports to read the array but then allow any value for ports. This can cause the code to overflow. There's no reason to migrate ports - it never changes. So just make sure it matches. Reported-by: Anthony Liguori <anthony(a)codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Peter Maydell <peter.maydell(a)linaro.org> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit ae2158ad6ce0845b2fae2a22aa7f19c0d7a71ce5) [AF: BNC#864671] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/ide/ahci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c index bfe633f..457a7a1 100644 --- a/hw/ide/ahci.c +++ b/hw/ide/ahci.c @@ -1293,7 +1293,7 @@ const VMStateDescription vmstate_ahci = { VMSTATE_UINT32(control_regs.impl, AHCIState), VMSTATE_UINT32(control_regs.version, AHCIState), VMSTATE_UINT32(idp_index, AHCIState), - VMSTATE_INT32(ports, AHCIState), + VMSTATE_INT32_EQUAL(ports, AHCIState), VMSTATE_END_OF_LIST() }, }; ++++++ 0052-hpet-fix-buffer-overrun-on-invalid-.patch ++++++ >From 085771b0f84bc9e3a9d868ff67c229e83b8431a2 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:51:23 +0300 Subject: [PATCH] hpet: fix buffer overrun on invalid state load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4527 hw/timer/hpet.c buffer overrun hpet is a VARRAY with a uint8 size but static array of 32 To fix, make sure num_timers is valid using VMSTATE_VALID hook. Reported-by: Anthony Liguori <anthony(a)codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 3f1c49e2136fa08ab1ef3183fd55def308829584) [AF: BNC#864673] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/timer/hpet.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c index e15d6bc..2792f89 100644 --- a/hw/timer/hpet.c +++ b/hw/timer/hpet.c @@ -239,6 +239,18 @@ static int hpet_pre_load(void *opaque) return 0; } +static bool hpet_validate_num_timers(void *opaque, int version_id) +{ + HPETState *s = opaque; + + if (s->num_timers < HPET_MIN_TIMERS) { + return false; + } else if (s->num_timers > HPET_MAX_TIMERS) { + return false; + } + return true; +} + static int hpet_post_load(void *opaque, int version_id) { HPETState *s = opaque; @@ -307,6 +319,7 @@ static const VMStateDescription vmstate_hpet = { VMSTATE_UINT64(isr, HPETState), VMSTATE_UINT64(hpet_counter, HPETState), VMSTATE_UINT8_V(num_timers, HPETState, 2), + VMSTATE_VALIDATE("num_timers in range", hpet_validate_num_timers), VMSTATE_STRUCT_VARRAY_UINT8(timer, HPETState, num_timers, 0, vmstate_hpet_timer, HPETTimer), VMSTATE_END_OF_LIST() ++++++ 0053-hw-pci-pcie_aer.c-fix-buffer-overru.patch ++++++ >From 3f2e8a7a3af50578270a058e658ce70680891bd8 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:51:31 +0300 Subject: [PATCH] hw/pci/pcie_aer.c: fix buffer overruns on invalid state load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 4) CVE-2013-4529 hw/pci/pcie_aer.c pcie aer log can overrun the buffer if log_num is too large There are two issues in this file: 1. log_max from remote can be larger than on local then buffer will overrun with data coming from state file. 2. log_num can be larger then we get data corruption again with an overflow but not adversary controlled. Fix both issues. Reported-by: Anthony Liguori <anthony(a)codemonkey.ws> Reported-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 5f691ff91d323b6f97c6600405a7f9dc115a0ad1) [AF: BNC#864678] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/pci/pcie_aer.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/hw/pci/pcie_aer.c b/hw/pci/pcie_aer.c index 991502e..535be2c 100644 --- a/hw/pci/pcie_aer.c +++ b/hw/pci/pcie_aer.c @@ -795,6 +795,13 @@ static const VMStateDescription vmstate_pcie_aer_err = { } }; +static bool pcie_aer_state_log_num_valid(void *opaque, int version_id) +{ + PCIEAERLog *s = opaque; + + return s->log_num <= s->log_max; +} + const VMStateDescription vmstate_pcie_aer_log = { .name = "PCIE_AER_ERROR_LOG", .version_id = 1, @@ -802,7 +809,8 @@ const VMStateDescription vmstate_pcie_aer_log = { .minimum_version_id_old = 1, .fields = (VMStateField[]) { VMSTATE_UINT16(log_num, PCIEAERLog), - VMSTATE_UINT16(log_max, PCIEAERLog), + VMSTATE_UINT16_EQUAL(log_max, PCIEAERLog), + VMSTATE_VALIDATE("log_num <= log_max", pcie_aer_state_log_num_valid), VMSTATE_STRUCT_VARRAY_POINTER_UINT16(log, PCIEAERLog, log_num, vmstate_pcie_aer_err, PCIEAERErr), VMSTATE_END_OF_LIST() ++++++ 0054-pl022-fix-buffer-overun-on-invalid-.patch ++++++ >From d4e6359ea7c11e7ae6b8ff3c03394db96a2a6932 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:51:35 +0300 Subject: [PATCH] pl022: fix buffer overun on invalid state load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4530 pl022.c did not bounds check tx_fifo_head and rx_fifo_head after loading them from file and before they are used to dereference array. Reported-by: Michael S. Tsirkin <mst(a)redhat.com Reported-by: Anthony Liguori <anthony(a)codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit d8d0a0bc7e194300e53a346d25fe5724fd588387) [AF: BNC#864682] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/ssi/pl022.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/hw/ssi/pl022.c b/hw/ssi/pl022.c index fd479ef..b19bc71 100644 --- a/hw/ssi/pl022.c +++ b/hw/ssi/pl022.c @@ -240,11 +240,25 @@ static const MemoryRegionOps pl022_ops = { .endianness = DEVICE_NATIVE_ENDIAN, }; +static int pl022_post_load(void *opaque, int version_id) +{ + PL022State *s = opaque; + + if (s->tx_fifo_head < 0 || + s->tx_fifo_head >= ARRAY_SIZE(s->tx_fifo) || + s->rx_fifo_head < 0 || + s->rx_fifo_head >= ARRAY_SIZE(s->rx_fifo)) { + return -1; + } + return 0; +} + static const VMStateDescription vmstate_pl022 = { .name = "pl022_ssp", .version_id = 1, .minimum_version_id = 1, .minimum_version_id_old = 1, + .post_load = pl022_post_load, .fields = (VMStateField[]) { VMSTATE_UINT32(cr0, PL022State), VMSTATE_UINT32(cr1, PL022State), ++++++ 0055-vmstate-fix-buffer-overflow-in-targ.patch ++++++ >From 5c94e6582aaf791f603afbf4b1d8d86652d87f93 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:51:42 +0300 Subject: [PATCH] vmstate: fix buffer overflow in target-arm/machine.c MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4531 cpreg_vmstate_indexes is a VARRAY_INT32. A negative value for cpreg_vmstate_array_len will cause a buffer overflow. VMSTATE_INT32_LE was supposed to protect against this but doesn't because it doesn't validate that input is non-negative. Fix this macro to valide the value appropriately. The only other user of VMSTATE_INT32_LE doesn't ever use negative numbers so it doesn't care. Reported-by: Anthony Liguori <anthony(a)codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit d2ef4b61fe6d33d2a5dcf100a9b9440de341ad62) [AF: BNC#864796] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- vmstate.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/vmstate.c b/vmstate.c index d856319..105f184 100644 --- a/vmstate.c +++ b/vmstate.c @@ -333,8 +333,9 @@ const VMStateInfo vmstate_info_int32_equal = { .put = put_int32, }; -/* 32 bit int. Check that the received value is less than or equal to - the one in the field */ +/* 32 bit int. Check that the received value is non-negative + * and less than or equal to the one in the field. + */ static int get_int32_le(QEMUFile *f, void *pv, size_t size) { @@ -342,7 +343,7 @@ static int get_int32_le(QEMUFile *f, void *pv, size_t size) int32_t loaded; qemu_get_sbe32s(f, &loaded); - if (loaded <= *cur) { + if (loaded >= 0 && loaded <= *cur) { *cur = loaded; return 0; } ++++++ 0056-virtio-avoid-buffer-overrun-on-inco.patch ++++++ >From 49af37a1dfdb6e7a54ae4ab9fd1c7816763bf6c1 Mon Sep 17 00:00:00 2001 From: Michael Roth <mdroth(a)linux.vnet.ibm.com> Date: Thu, 3 Apr 2014 19:51:46 +0300 Subject: [PATCH] virtio: avoid buffer overrun on incoming migration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-6399 vdev->queue_sel is read from the wire, and later used in the emulation code as an index into vdev->vq[]. If the value of vdev->queue_sel exceeds the length of vdev->vq[], currently allocated to be VIRTIO_PCI_QUEUE_MAX elements, subsequent PIO operations such as VIRTIO_PCI_QUEUE_PFN can be used to overrun the buffer with arbitrary data originating from the source. Fix this by failing migration if the value from the wire exceeds VIRTIO_PCI_QUEUE_MAX. Signed-off-by: Michael Roth <mdroth(a)linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Peter Maydell <peter.maydell(a)linaro.org> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 4b53c2c72cb5541cf394033b528a6fe2a86c0ac1) [AF: BNC#864814] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/virtio/virtio.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 05f05e7..0072542 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -907,6 +907,9 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f) qemu_get_8s(f, &vdev->status); qemu_get_8s(f, &vdev->isr); qemu_get_be16s(f, &vdev->queue_sel); + if (vdev->queue_sel >= VIRTIO_PCI_QUEUE_MAX) { + return -1; + } qemu_get_be32s(f, &features); if (virtio_set_features(vdev, features) < 0) { ++++++ 0057-virtio-validate-num_sg-when-mapping.patch ++++++ >From c5b839d16efe607af264cd6c2d99124b2a10bc02 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:51:53 +0300 Subject: [PATCH] virtio: validate num_sg when mapping MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4535 CVE-2013-4536 Both virtio-block and virtio-serial read, VirtQueueElements are read in as buffers, and passed to virtqueue_map_sg(), where num_sg is taken from the wire and can force writes to indicies beyond VIRTQUEUE_MAX_SIZE. To fix, validate num_sg. Reported-by: Michael Roth <mdroth(a)linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Cc: Amit Shah <amit.shah(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 36cf2a37132c7f01fa9adb5f95f5312b27742fd4) [AF: BNC#864665] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/virtio/virtio.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 0072542..a70169a 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -430,6 +430,12 @@ void virtqueue_map_sg(struct iovec *sg, hwaddr *addr, unsigned int i; hwaddr len; + if (num_sg >= VIRTQUEUE_MAX_SIZE) { + error_report("virtio: map attempt out of bounds: %zd > %d", + num_sg, VIRTQUEUE_MAX_SIZE); + exit(1); + } + for (i = 0; i < num_sg; i++) { len = sg[i].iov_len; sg[i].iov_base = cpu_physical_memory_map(addr[i], &len, is_write); ++++++ 0058-pxa2xx-avoid-buffer-overrun-on-inco.patch ++++++ >From f1cebceb572956ff820ecc29362c6ade0020d570 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:51:57 +0300 Subject: [PATCH] pxa2xx: avoid buffer overrun on incoming migration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4533 s->rx_level is read from the wire and used to determine how many bytes to subsequently read into s->rx_fifo[]. If s->rx_level exceeds the length of s->rx_fifo[] the buffer can be overrun with arbitrary data from the wire. Fix this by validating rx_level against the size of s->rx_fifo. Cc: Don Koch <dkoch(a)verizon.com> Reported-by: Michael Roth <mdroth(a)linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Peter Maydell <peter.maydell(a)linaro.org> Reviewed-by: Don Koch <dkoch(a)verizon.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit caa881abe0e01f9931125a0977ec33c5343e4aa7) [AF: BNC#864655] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/arm/pxa2xx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c index 0429148..e0cd847 100644 --- a/hw/arm/pxa2xx.c +++ b/hw/arm/pxa2xx.c @@ -732,7 +732,7 @@ static void pxa2xx_ssp_save(QEMUFile *f, void *opaque) static int pxa2xx_ssp_load(QEMUFile *f, void *opaque, int version_id) { PXA2xxSSPState *s = (PXA2xxSSPState *) opaque; - int i; + int i, v; s->enable = qemu_get_be32(f); @@ -746,7 +746,11 @@ static int pxa2xx_ssp_load(QEMUFile *f, void *opaque, int version_id) qemu_get_8s(f, &s->ssrsa); qemu_get_8s(f, &s->ssacd); - s->rx_level = qemu_get_byte(f); + v = qemu_get_byte(f); + if (v < 0 || v > ARRAY_SIZE(s->rx_fifo)) { + return -EINVAL; + } + s->rx_level = v; s->rx_start = 0; for (i = 0; i < s->rx_level; i ++) s->rx_fifo[i] = qemu_get_byte(f); ++++++ 0059-ssd0323-fix-buffer-overun-on-invali.patch ++++++ >From fb4795c3470c9258f96324a7e49fabf33ae1b98b Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:52:05 +0300 Subject: [PATCH] ssd0323: fix buffer overun on invalid state load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4538 s->cmd_len used as index in ssd0323_transfer() to store 32-bit field. Possible this field might then be supplied by guest to overwrite a return addr somewhere. Same for row/col fields, which are indicies into framebuffer array. To fix validate after load. Additionally, validate that the row/col_start/end are within bounds; otherwise the guest can provoke an overrun by either setting the _end field so large that the row++ increments just walk off the end of the array, or by setting the _start value to something bogus and then letting the "we hit end of row" logic reset row to row_start. For completeness, validate mode as well. Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Peter Maydell <peter.maydell(a)linaro.org> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit ead7a57df37d2187813a121308213f41591bd811) [AF: BNC#864769] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/display/ssd0323.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/hw/display/ssd0323.c b/hw/display/ssd0323.c index 971152e..9727007 100644 --- a/hw/display/ssd0323.c +++ b/hw/display/ssd0323.c @@ -312,18 +312,42 @@ static int ssd0323_load(QEMUFile *f, void *opaque, int version_id) return -EINVAL; s->cmd_len = qemu_get_be32(f); + if (s->cmd_len < 0 || s->cmd_len > ARRAY_SIZE(s->cmd_data)) { + return -EINVAL; + } s->cmd = qemu_get_be32(f); for (i = 0; i < 8; i++) s->cmd_data[i] = qemu_get_be32(f); s->row = qemu_get_be32(f); + if (s->row < 0 || s->row >= 80) { + return -EINVAL; + } s->row_start = qemu_get_be32(f); + if (s->row_start < 0 || s->row_start >= 80) { + return -EINVAL; + } s->row_end = qemu_get_be32(f); + if (s->row_end < 0 || s->row_end >= 80) { + return -EINVAL; + } s->col = qemu_get_be32(f); + if (s->col < 0 || s->col >= 64) { + return -EINVAL; + } s->col_start = qemu_get_be32(f); + if (s->col_start < 0 || s->col_start >= 64) { + return -EINVAL; + } s->col_end = qemu_get_be32(f); + if (s->col_end < 0 || s->col_end >= 64) { + return -EINVAL; + } s->redraw = qemu_get_be32(f); s->remap = qemu_get_be32(f); s->mode = qemu_get_be32(f); + if (s->mode != SSD0323_CMD && s->mode != SSD0323_DATA) { + return -EINVAL; + } qemu_get_buffer(f, s->framebuffer, sizeof(s->framebuffer)); ss->cs = qemu_get_be32(f); ++++++ 0060-tsc210x-fix-buffer-overrun-on-inval.patch ++++++ >From 9258d36c4392e02156a986a03a0d8ee8fb0c4284 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:52:09 +0300 Subject: [PATCH] tsc210x: fix buffer overrun on invalid state load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4539 s->precision, nextprecision, function and nextfunction come from wire and are used as idx into resolution[] in TSC_CUT_RESOLUTION. Validate after load to avoid buffer overrun. Cc: Andreas Färber <afaerber(a)suse.de> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 5193be3be35f29a35bc465036cd64ad60d43385f) [AF: BNC#864805] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/input/tsc210x.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/hw/input/tsc210x.c b/hw/input/tsc210x.c index 485c9e5..aa5b688 100644 --- a/hw/input/tsc210x.c +++ b/hw/input/tsc210x.c @@ -1070,9 +1070,21 @@ static int tsc210x_load(QEMUFile *f, void *opaque, int version_id) s->enabled = qemu_get_byte(f); s->host_mode = qemu_get_byte(f); s->function = qemu_get_byte(f); + if (s->function < 0 || s->function >= ARRAY_SIZE(mode_regs)) { + return -EINVAL; + } s->nextfunction = qemu_get_byte(f); + if (s->nextfunction < 0 || s->nextfunction >= ARRAY_SIZE(mode_regs)) { + return -EINVAL; + } s->precision = qemu_get_byte(f); + if (s->precision < 0 || s->precision >= ARRAY_SIZE(resolution)) { + return -EINVAL; + } s->nextprecision = qemu_get_byte(f); + if (s->nextprecision < 0 || s->nextprecision >= ARRAY_SIZE(resolution)) { + return -EINVAL; + } s->filter = qemu_get_byte(f); s->pin_func = qemu_get_byte(f); s->ref = qemu_get_byte(f); ++++++ 0061-zaurus-fix-buffer-overrun-on-invali.patch ++++++ >From a075e63d02fed4153136742624696b376918a820 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:52:13 +0300 Subject: [PATCH] zaurus: fix buffer overrun on invalid state load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4540 Within scoop_gpio_handler_update, if prev_level has a high bit set, then we get bit > 16 and that causes a buffer overrun. Since prev_level comes from wire indirectly, this can happen on invalid state load. Similarly for gpio_level and gpio_dir. To fix, limit to 16 bit. Reported-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 52f91c3723932f8340fe36c8ec8b18a757c37b2b) [AF: BNC#864801] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/gpio/zaurus.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/gpio/zaurus.c b/hw/gpio/zaurus.c index dc79a8b..8e2ce04 100644 --- a/hw/gpio/zaurus.c +++ b/hw/gpio/zaurus.c @@ -203,6 +203,15 @@ static bool is_version_0 (void *opaque, int version_id) return version_id == 0; } +static bool vmstate_scoop_validate(void *opaque, int version_id) +{ + ScoopInfo *s = opaque; + + return !(s->prev_level & 0xffff0000) && + !(s->gpio_level & 0xffff0000) && + !(s->gpio_dir & 0xffff0000); +} + static const VMStateDescription vmstate_scoop_regs = { .name = "scoop", .version_id = 1, @@ -215,6 +224,7 @@ static const VMStateDescription vmstate_scoop_regs = { VMSTATE_UINT32(gpio_level, ScoopInfo), VMSTATE_UINT32(gpio_dir, ScoopInfo), VMSTATE_UINT32(prev_level, ScoopInfo), + VMSTATE_VALIDATE("irq levels are 16 bit", vmstate_scoop_validate), VMSTATE_UINT16(mcr, ScoopInfo), VMSTATE_UINT16(cdr, ScoopInfo), VMSTATE_UINT16(ccr, ScoopInfo), ++++++ 0062-virtio-scsi-fix-buffer-overrun-on-i.patch ++++++ >From 2f55ce6ce26c16796443a7765a7d5fad157340ed Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:52:17 +0300 Subject: [PATCH] virtio-scsi: fix buffer overrun on invalid state load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4542 hw/scsi/scsi-bus.c invokes load_request. virtio_scsi_load_request does: qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem)); this probably can make elem invalid, for example, make in_num or out_num huge, then: virtio_scsi_parse_req(s, vs->cmd_vqs[n], req); will do: if (req->elem.out_num > 1) { qemu_sgl_init_external(req, &req->elem.out_sg[1], &req->elem.out_addr[1], req->elem.out_num - 1); } else { qemu_sgl_init_external(req, &req->elem.in_sg[1], &req->elem.in_addr[1], req->elem.in_num - 1); } and this will access out of array bounds. Note: this adds security checks within assert calls since SCSIBusInfo's load_request cannot fail. For now simply disable builds with NDEBUG - there seems to be little value in supporting these. Cc: Andreas Färber <afaerber(a)suse.de> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 3c3ce981423e0d6c18af82ee62f1850c2cda5976) [AF: BNC#864804] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/scsi/virtio-scsi.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c index b0d7517..1752193 100644 --- a/hw/scsi/virtio-scsi.c +++ b/hw/scsi/virtio-scsi.c @@ -147,6 +147,15 @@ static void *virtio_scsi_load_request(QEMUFile *f, SCSIRequest *sreq) qemu_get_be32s(f, &n); assert(n < vs->conf.num_queues); qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem)); + /* TODO: add a way for SCSIBusInfo's load_request to fail, + * and fail migration instead of asserting here. + * When we do, we might be able to re-enable NDEBUG below. + */ +#ifdef NDEBUG +#error building with NDEBUG is not supported +#endif + assert(req->elem.in_num <= ARRAY_SIZE(req->elem.in_sg)); + assert(req->elem.out_num <= ARRAY_SIZE(req->elem.out_sg)); virtio_scsi_parse_req(s, vs->cmd_vqs[n], req); scsi_req_ref(sreq); ++++++ 0063-vmstate-s-VMSTATE_INT32_LE-VMSTATE_.patch ++++++ >From 075764d38e7916de4f2621c329d3b7d810a76500 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:52:21 +0300 Subject: [PATCH] vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit As the macro verifies the value is positive, rename it to make the function clearer. Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 3476436a44c29725efef0cabf5b3ea4e70054d57) Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/pci/pci.c | 4 ++-- include/migration/vmstate.h | 2 +- target-arm/machine.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/hw/pci/pci.c b/hw/pci/pci.c index 2a9f08e..517ff2a 100644 --- a/hw/pci/pci.c +++ b/hw/pci/pci.c @@ -475,7 +475,7 @@ const VMStateDescription vmstate_pci_device = { .minimum_version_id = 1, .minimum_version_id_old = 1, .fields = (VMStateField []) { - VMSTATE_INT32_LE(version_id, PCIDevice), + VMSTATE_INT32_POSITIVE_LE(version_id, PCIDevice), VMSTATE_BUFFER_UNSAFE_INFO(config, PCIDevice, 0, vmstate_info_pci_config, PCI_CONFIG_SPACE_SIZE), @@ -492,7 +492,7 @@ const VMStateDescription vmstate_pcie_device = { .minimum_version_id = 1, .minimum_version_id_old = 1, .fields = (VMStateField []) { - VMSTATE_INT32_LE(version_id, PCIDevice), + VMSTATE_INT32_POSITIVE_LE(version_id, PCIDevice), VMSTATE_BUFFER_UNSAFE_INFO(config, PCIDevice, 0, vmstate_info_pci_config, PCIE_CONFIG_SPACE_SIZE), diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h index 5b71370..7e45048 100644 --- a/include/migration/vmstate.h +++ b/include/migration/vmstate.h @@ -601,7 +601,7 @@ extern const VMStateInfo vmstate_info_bitmap; #define VMSTATE_UINT64_EQUAL(_f, _s) \ VMSTATE_UINT64_EQUAL_V(_f, _s, 0) -#define VMSTATE_INT32_LE(_f, _s) \ +#define VMSTATE_INT32_POSITIVE_LE(_f, _s) \ VMSTATE_SINGLE(_f, _s, 0, vmstate_info_int32_le, int32_t) #define VMSTATE_UINT8_TEST(_f, _s, _t) \ diff --git a/target-arm/machine.c b/target-arm/machine.c index 7ced87a..5746ffd 100644 --- a/target-arm/machine.c +++ b/target-arm/machine.c @@ -246,7 +246,7 @@ const VMStateDescription vmstate_arm_cpu = { /* The length-check must come before the arrays to avoid * incoming data possibly overflowing the array. */ - VMSTATE_INT32_LE(cpreg_vmstate_array_len, ARMCPU), + VMSTATE_INT32_POSITIVE_LE(cpreg_vmstate_array_len, ARMCPU), VMSTATE_VARRAY_INT32(cpreg_vmstate_indexes, ARMCPU, cpreg_vmstate_array_len, 0, vmstate_info_uint64, uint64_t), ++++++ 0064-usb-sanity-check-setup_index-setup_.patch ++++++ >From b94f504fbb4910705803236ec84805ac4ac9139e Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Thu, 3 Apr 2014 19:52:25 +0300 Subject: [PATCH] usb: sanity check setup_index+setup_len in post_load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4541 s->setup_len and s->setup_index are fed into usb_packet_copy as size/offset into s->data_buf, it's possible for invalid state to exploit this to load arbitrary data. setup_len and setup_index should be checked to make sure they are not negative. Cc: Gerd Hoffmann <kraxel(a)redhat.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Gerd Hoffmann <kraxel(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 9f8e9895c504149d7048e9fc5eb5cbb34b16e49a) [AF: BNC#864802] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/usb/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hw/usb/bus.c b/hw/usb/bus.c index fe70429..e48b19f 100644 --- a/hw/usb/bus.c +++ b/hw/usb/bus.c @@ -49,7 +49,9 @@ static int usb_device_post_load(void *opaque, int version_id) } else { dev->attached = 1; } - if (dev->setup_index >= sizeof(dev->data_buf) || + if (dev->setup_index < 0 || + dev->setup_len < 0 || + dev->setup_index >= sizeof(dev->data_buf) || dev->setup_len >= sizeof(dev->data_buf)) { return -EINVAL; } ++++++ 0065-savevm-Ignore-minimum_version_id_ol.patch ++++++ >From 9ad9afb2ff3fa91c1315bd198e0118f8025b8805 Mon Sep 17 00:00:00 2001 From: Peter Maydell <peter.maydell(a)linaro.org> Date: Thu, 3 Apr 2014 19:52:28 +0300 Subject: [PATCH] savevm: Ignore minimum_version_id_old if there is no load_state_old MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit At the moment we require vmstate definitions to set minimum_version_id_old to the same value as minimum_version_id if they do not provide a load_state_old handler. Since the load_state_old functionality is required only for a handful of devices that need to retain migration compatibility with a pre-vmstate implementation, this means the bulk of devices have pointless boilerplate. Relax the definition so that minimum_version_id_old is ignored if there is no load_state_old handler. Note that under the old scheme we would segfault if the vmstate specified a minimum_version_id_old that was less than minimum_version_id but did not provide a load_state_old function, and the incoming state specified a version number between minimum_version_id_old and minimum_version_id. Under the new scheme this will just result in our failing the migration. Signed-off-by: Peter Maydell <peter.maydell(a)linaro.org> Reviewed-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 767adce2d9cd397de3418caa16be35ea18d56f22) Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- docs/migration.txt | 12 +++++------- vmstate.c | 9 +++++---- 2 files changed, 10 insertions(+), 11 deletions(-) diff --git a/docs/migration.txt b/docs/migration.txt index 0e0a1d4..fe1f2bb 100644 --- a/docs/migration.txt +++ b/docs/migration.txt @@ -139,7 +139,6 @@ static const VMStateDescription vmstate_kbd = { .name = "pckbd", .version_id = 3, .minimum_version_id = 3, - .minimum_version_id_old = 3, .fields = (VMStateField []) { VMSTATE_UINT8(write_cmd, KBDState), VMSTATE_UINT8(status, KBDState), @@ -168,12 +167,13 @@ You can see that there are several version fields: - minimum_version_id: the minimum version_id that VMState is able to understand for that device. - minimum_version_id_old: For devices that were not able to port to vmstate, we can - assign a function that knows how to read this old state. + assign a function that knows how to read this old state. This field is + ignored if there is no load_state_old handler. So, VMState is able to read versions from minimum_version_id to -version_id. And the function load_state_old() is able to load state -from minimum_version_id_old to minimum_version_id. This function is -deprecated and will be removed when no more users are left. +version_id. And the function load_state_old() (if present) is able to +load state from minimum_version_id_old to minimum_version_id. This +function is deprecated and will be removed when no more users are left. === Massaging functions === @@ -255,7 +255,6 @@ const VMStateDescription vmstate_ide_drive_pio_state = { .name = "ide_drive/pio_state", .version_id = 1, .minimum_version_id = 1, - .minimum_version_id_old = 1, .pre_save = ide_drive_pio_pre_save, .post_load = ide_drive_pio_post_load, .fields = (VMStateField []) { @@ -275,7 +274,6 @@ const VMStateDescription vmstate_ide_drive = { .name = "ide_drive", .version_id = 3, .minimum_version_id = 0, - .minimum_version_id_old = 0, .post_load = ide_drive_post_load, .fields = (VMStateField []) { .... several fields .... diff --git a/vmstate.c b/vmstate.c index 105f184..582c321 100644 --- a/vmstate.c +++ b/vmstate.c @@ -19,11 +19,12 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd, if (version_id > vmsd->version_id) { return -EINVAL; } - if (version_id < vmsd->minimum_version_id_old) { - return -EINVAL; - } if (version_id < vmsd->minimum_version_id) { - return vmsd->load_state_old(f, opaque, version_id); + if (vmsd->load_state_old && + version_id >= vmsd->minimum_version_id_old) { + return vmsd->load_state_old(f, opaque, version_id); + } + return -EINVAL; } if (vmsd->pre_load) { int ret = vmsd->pre_load(opaque); ++++++ 0066-ssi-sd-fix-buffer-overrun-on-invali.patch ++++++ >From 9ec43fe48680cf5917eb3d41ad85201d4137871f Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Mon, 28 Apr 2014 16:08:14 +0300 Subject: [PATCH] ssi-sd: fix buffer overrun on invalid state load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4537 s->arglen is taken from wire and used as idx in ssi_sd_transfer(). Validate it before access. Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit a9c380db3b8c6af19546a68145c8d1438a09c92b) [AF: BNC#864391] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/sd/ssi-sd.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c index 3273c8a..b012e57 100644 --- a/hw/sd/ssi-sd.c +++ b/hw/sd/ssi-sd.c @@ -230,8 +230,17 @@ static int ssi_sd_load(QEMUFile *f, void *opaque, int version_id) for (i = 0; i < 5; i++) s->response[i] = qemu_get_be32(f); s->arglen = qemu_get_be32(f); + if (s->mode == SSI_SD_CMDARG && + (s->arglen < 0 || s->arglen >= ARRAY_SIZE(s->cmdarg))) { + return -EINVAL; + } s->response_pos = qemu_get_be32(f); s->stopping = qemu_get_be32(f); + if (s->mode == SSI_SD_RESPONSE && + (s->response_pos < 0 || s->response_pos >= ARRAY_SIZE(s->response) || + (!s->stopping && s->arglen > ARRAY_SIZE(s->response)))) { + return -EINVAL; + } ss->cs = qemu_get_be32(f); ++++++ 0067-openpic-avoid-buffer-overrun-on-inc.patch ++++++ >From e70b97747393a4d5544bdb9eb64a7f5b69b0bb91 Mon Sep 17 00:00:00 2001 From: Michael Roth <mdroth(a)linux.vnet.ibm.com> Date: Mon, 28 Apr 2014 16:08:17 +0300 Subject: [PATCH] openpic: avoid buffer overrun on incoming migration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4534 opp->nb_cpus is read from the wire and used to determine how many IRQDest elements to read into opp->dst[]. If the value exceeds the length of opp->dst[], MAX_CPU, opp->dst[] can be overrun with arbitrary data from the wire. Fix this by failing migration if the value read from the wire exceeds MAX_CPU. Signed-off-by: Michael Roth <mdroth(a)linux.vnet.ibm.com> Reviewed-by: Alexander Graf <agraf(a)suse.de> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 73d963c0a75cb99c6aaa3f6f25e427aa0b35a02e) [AF: BNC#864811] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/intc/openpic.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/hw/intc/openpic.c b/hw/intc/openpic.c index be76fbd..17136c9 100644 --- a/hw/intc/openpic.c +++ b/hw/intc/openpic.c @@ -41,6 +41,7 @@ #include "hw/sysbus.h" #include "hw/pci/msi.h" #include "qemu/bitops.h" +#include "qapi/qmp/qerror.h" //#define DEBUG_OPENPIC @@ -1416,7 +1417,7 @@ static void openpic_load_IRQ_queue(QEMUFile* f, IRQQueue *q) static int openpic_load(QEMUFile* f, void *opaque, int version_id) { OpenPICState *opp = (OpenPICState *)opaque; - unsigned int i; + unsigned int i, nb_cpus; if (version_id != 1) { return -EINVAL; @@ -1428,7 +1429,11 @@ static int openpic_load(QEMUFile* f, void *opaque, int version_id) qemu_get_be32s(f, &opp->spve); qemu_get_be32s(f, &opp->tfrr); - qemu_get_be32s(f, &opp->nb_cpus); + qemu_get_be32s(f, &nb_cpus); + if (opp->nb_cpus != nb_cpus) { + return -EINVAL; + } + assert(nb_cpus > 0 && nb_cpus <= MAX_CPU); for (i = 0; i < opp->nb_cpus; i++) { qemu_get_sbe32s(f, &opp->dst[i].ctpr); @@ -1567,6 +1572,13 @@ static void openpic_realize(DeviceState *dev, Error **errp) {NULL} }; + if (opp->nb_cpus > MAX_CPU) { + error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE, + TYPE_OPENPIC, "nb_cpus", (uint64_t)opp->nb_cpus, + (uint64_t)0, (uint64_t)MAX_CPU); + return; + } + switch (opp->model) { case OPENPIC_MODEL_FSL_MPIC_20: default: ++++++ 0068-virtio-net-out-of-bounds-buffer-wri.patch ++++++ >From 2eae80d0ad4c9d0de849fbe8ad6d7d5fa788fdfb Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Mon, 28 Apr 2014 16:08:21 +0300 Subject: [PATCH] virtio-net: out-of-bounds buffer write on load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2013-4149 QEMU 1.3.0 out-of-bounds buffer write in virtio_net_load()(a)hw/net/virtio-net.c > } else if (n->mac_table.in_use) { > uint8_t *buf = g_malloc0(n->mac_table.in_use); We are allocating buffer of size n->mac_table.in_use > qemu_get_buffer(f, buf, n->mac_table.in_use * ETH_ALEN); and read to the n->mac_table.in_use size buffer n->mac_table.in_use * ETH_ALEN bytes, corrupting memory. If adversary controls state then memory written there is controlled by adversary. Reviewed-by: Michael Roth <mdroth(a)linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit 98f93ddd84800f207889491e0b5d851386b459cf) [AF: BNC#864649] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/net/virtio-net.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index 0a8cb40..940a7cf 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -1362,10 +1362,17 @@ static int virtio_net_load(QEMUFile *f, void *opaque, int version_id) if (n->mac_table.in_use <= MAC_TABLE_ENTRIES) { qemu_get_buffer(f, n->mac_table.macs, n->mac_table.in_use * ETH_ALEN); - } else if (n->mac_table.in_use) { - uint8_t *buf = g_malloc0(n->mac_table.in_use); - qemu_get_buffer(f, buf, n->mac_table.in_use * ETH_ALEN); - g_free(buf); + } else { + int64_t i; + + /* Overflow detected - can happen if source has a larger MAC table. + * We simply set overflow flag so there's no need to maintain the + * table of addresses, discard them all. + * Note: 64 bit math to avoid integer overflow. + */ + for (i = 0; i < (int64_t)n->mac_table.in_use * ETH_ALEN; ++i) { + qemu_get_byte(f); + } n->mac_table.multi_overflow = n->mac_table.uni_overflow = 1; n->mac_table.in_use = 0; } ++++++ 0069-virtio-validate-config_len-on-load.patch ++++++ >From 5d2ec830b492cc18205d3a10d9ed3595559cd831 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Mon, 28 Apr 2014 16:08:23 +0300 Subject: [PATCH] virtio: validate config_len on load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Malformed input can have config_len in migration stream exceed the array size allocated on destination, the result will be heap overflow. To fix, that config_len matches on both sides. CVE-2014-0182 Reported-by: "Dr. David Alan Gilbert" <dgilbert(a)redhat.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Juan Quintela <quintela(a)redhat.com> -- v2: use %ix and %zx to print config_len values Signed-off-by: Juan Quintela <quintela(a)redhat.com> (cherry picked from commit a890a2f9137ac3cf5b607649e66a6f3a5512d8dc) [AF: BNC#874788] Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/virtio/virtio.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index a70169a..7f4e7ec 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -898,6 +898,7 @@ int virtio_set_features(VirtIODevice *vdev, uint32_t val) int virtio_load(VirtIODevice *vdev, QEMUFile *f) { int i, ret; + int32_t config_len; uint32_t num; uint32_t features; uint32_t supported_features; @@ -924,7 +925,12 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f) features, supported_features); return -1; } - vdev->config_len = qemu_get_be32(f); + config_len = qemu_get_be32(f); + if (config_len != vdev->config_len) { + error_report("Unexpected config length 0x%x. Expected 0x%zx", + config_len, vdev->config_len); + return -1; + } qemu_get_buffer(f, vdev->config, vdev->config_len); num = qemu_get_be32(f); ++++++ 0070-virtio-allow-mapping-up-to-max-queu.patch ++++++ >From f609ef91bccd8b1637575516a94a5dc0af804b40 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst(a)redhat.com> Date: Mon, 12 May 2014 12:04:20 +0300 Subject: [PATCH] virtio: allow mapping up to max queue size MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It's a loop from i < num_sg and the array is VIRTQUEUE_MAX_SIZE - so it's OK if the value read is VIRTQUEUE_MAX_SIZE. Not a big problem in practice as people don't use such big queues, but it's inelegant. Reported-by: "Dr. David Alan Gilbert" <dgilbert(a)redhat.com> Cc: qemu-stable(a)nongnu.org Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> (cherry picked from commit 937251408051e0489f78e4db3c92e045b147b38b) Signed-off-by: Andreas Färber <afaerber(a)suse.de> --- hw/virtio/virtio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 7f4e7ec..3557c17 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -430,7 +430,7 @@ void virtqueue_map_sg(struct iovec *sg, hwaddr *addr, unsigned int i; hwaddr len; - if (num_sg >= VIRTQUEUE_MAX_SIZE) { + if (num_sg > VIRTQUEUE_MAX_SIZE) { error_report("virtio: map attempt out of bounds: %zd > %d", num_sg, VIRTQUEUE_MAX_SIZE); exit(1); -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit yast2-packager for openSUSE:Factory
by root＠hilbert.suse.de 26 May '14

26 May '14

Hello community, here is the log from the commit of package yast2-packager for openSUSE:Factory checked in at 2014-05-26 14:40:11 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/yast2-packager (Old) and /work/SRC/openSUSE:Factory/.yast2-packager.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "yast2-packager" Changes: -------- --- /work/SRC/openSUSE:Factory/yast2-packager/yast2-packager.changes 2014-05-17 22:02:03.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.yast2-packager.new/yast2-packager.changes 2014-05-26 14:40:12.000000000 +0200 @@ -1,0 +2,7 @@ +Fri May 23 17:46:18 CEST 2014 - locilka(a)suse.com + +- SlideShow refactoring: constantized, removed unused methods, + Rubyized (all for bnc#865037) +- 3.1.19 + +------------------------------------------------------------------- Old: ---- yast2-packager-3.1.18.tar.bz2 New: ---- yast2-packager-3.1.19.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ yast2-packager.spec ++++++ --- /var/tmp/diff_new_pack.W8GDh2/_old 2014-05-26 14:40:13.000000000 +0200 +++ /var/tmp/diff_new_pack.W8GDh2/_new 2014-05-26 14:40:13.000000000 +0200 @@ -17,7 +17,7 @@ Name: yast2-packager -Version: 3.1.18 +Version: 3.1.19 Release: 0 BuildRoot: %{_tmppath}/%{name}-%{version}-build ++++++ yast2-packager-3.1.18.tar.bz2 -> yast2-packager-3.1.19.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-packager-3.1.18/package/yast2-packager.changes new/yast2-packager-3.1.19/package/yast2-packager.changes --- old/yast2-packager-3.1.18/package/yast2-packager.changes 2014-05-16 16:10:15.000000000 +0200 +++ new/yast2-packager-3.1.19/package/yast2-packager.changes 2014-05-23 17:49:45.000000000 +0200 @@ -1,4 +1,11 @@ ------------------------------------------------------------------- +Fri May 23 17:46:18 CEST 2014 - locilka(a)suse.com + +- SlideShow refactoring: constantized, removed unused methods, + Rubyized (all for bnc#865037) +- 3.1.19 + +------------------------------------------------------------------- Fri May 16 15:41:44 CEST 2014 - locilka(a)suse.com - Added support for software->optional_default_patterns to handle diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-packager-3.1.18/package/yast2-packager.spec new/yast2-packager-3.1.19/package/yast2-packager.spec --- old/yast2-packager-3.1.18/package/yast2-packager.spec 2014-05-16 16:10:15.000000000 +0200 +++ new/yast2-packager-3.1.19/package/yast2-packager.spec 2014-05-23 17:49:45.000000000 +0200 @@ -17,7 +17,7 @@ Name: yast2-packager -Version: 3.1.18 +Version: 3.1.19 Release: 0 BuildRoot: %{_tmppath}/%{name}-%{version}-build diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-packager-3.1.18/src/modules/PackageSlideShow.rb new/yast2-packager-3.1.19/src/modules/PackageSlideShow.rb --- old/yast2-packager-3.1.18/src/modules/PackageSlideShow.rb 2014-05-16 16:10:15.000000000 +0200 +++ new/yast2-packager-3.1.19/src/modules/PackageSlideShow.rb 2014-05-23 17:49:46.000000000 +0200 @@ -11,6 +11,21 @@ module Yast class PackageSlideShowClass < Module + include Yast::Logger + + # seconds to cut off predicted time + MAX_TIME_PER_CD = 7200 + + # minimum time displayed per CD if there is something to install + MIN_TIME_PER_CD = 10 + + # Column index for refreshing statistics: remaining size + SIZE_COLUMN_POSITION = 1 + # Column index for refreshing statistics: remaining number of packages + PKG_COUNT_COLUMN_POSITION = 2 + # Column index for refreshing statistics: remaining time + TIME_COLUMN_POSITION = 3 + def main Yast.import "UI" Yast.import "Pkg" @@ -38,11 +53,7 @@ @total_count_to_download = 0 @total_count_downloaded = 0 @downloading_pct = 0 - @min_time_per_cd = 10 # const - minimum time displayed per CD if there is something to install - @max_time_per_cd = 7200 # const - seconds to cut off predicted time (it's bogus anyway) - @size_column = 1 # const - column number for remaining size per CD - @pkg_count_column = 2 # const - column number for remaining number of packages per CD - @time_column = 3 # const - column number for remaining time per CD + @current_src_no = -1 # 1..n @current_cd_no = -1 # 1..n @next_src_no = -1 @@ -115,50 +126,6 @@ #************** Formatting functions and helpers ************************** #*************************************************************************** - # Get version info for a package (without build no.) - # - # @param [String] pkg_name name of the package without path and ".rpm" extension - # @return version string - # - def StripReleaseNo(pkg_name) - build_no_pos = Builtins.findlastof(pkg_name, "-") # find trailing build no. - - if build_no_pos != nil && Ops.greater_than(build_no_pos, 0) - # cut off trailing build no. - pkg_name = Builtins.substring(pkg_name, 0, build_no_pos) - end - - pkg_name - end - - # Get package file name from path - # - # @param [String] pkg_name location of the package - # @return [String] package file name - # - def StripPath(pkg_name) - return nil if pkg_name == nil - - file_pos = Builtins.findlastof(pkg_name, "/") - - if file_pos != nil && Ops.greater_than(file_pos, 0) - # return just the file name - pkg_name = Builtins.substring(pkg_name, Ops.add(file_pos, 1)) - end - - pkg_name - end - - - # set media type "CD" or "DVD" - def SetMediaType(new_media_type) - Builtins.y2warning( - "PackageSlideShow::SetMediaType() is obsoled, do not use!" - ) - - nil - end - # Sum up all list items # def ListSum(sizes) @@ -206,7 +173,7 @@ def TotalRemainingTime ListSumCutOff( Builtins.flatten(@remaining_times_per_cd_per_src), - @max_time_per_cd + MAX_TIME_PER_CD ) end @@ -656,22 +623,15 @@ # @return true if recalculated, false if not # def RecalcRemainingTimes(force_recalc) - if !force_recalc && - Ops.less_than(Builtins.time, SlideShow.next_recalc_time) + if !force_recalc && ::Time.now.to_i < SlideShow.next_recalc_time # Nothing to do (yet) - simply return return false end - - # Actually do recalculation - elapsed = SlideShow.total_time_elapsed - if Ops.greater_or_equal(SlideShow.start_time, 0) - elapsed = Ops.subtract( - Ops.add(elapsed, Builtins.time), - SlideShow.start_time - ) + if SlideShow.start_time >= 0 + elapsed += ::Time.now.to_i - SlideShow.start_time end if elapsed == 0 @@ -684,7 +644,7 @@ # This is the real thing. - real_bytes_per_second = Ops.divide(@total_size_installed, elapsed) + real_bytes_per_second = @total_size_installed.to_f / elapsed # But this turns out to be way to optimistic - RPM gets slower and # slower while installing. So let's add some safety margin to make @@ -700,26 +660,11 @@ pessimistic_factor = 1.0 - if Ops.greater_than(@total_size_to_install, 0) - pessimistic_factor = Ops.subtract( - 1.7, - Ops.divide( - Builtins.tofloat(@total_size_installed), - Builtins.tofloat(@total_size_to_install) - ) - ) + if @total_size_to_install > 0 + pessimistic_factor = 1.7 - @total_size_installed.to_f / @total_size_to_install end - @bytes_per_second = Builtins.tointeger( - Ops.add( - Ops.divide( - Builtins.tofloat(real_bytes_per_second), - pessimistic_factor - ), - 0.5 - ) - ) - @bytes_per_second = 1 if Ops.less_than(@bytes_per_second, 1) + @bytes_per_second = (real_bytes_per_second / pessimistic_factor + 1).floor @remaining_times_per_cd_per_src = [] @@ -728,43 +673,38 @@ Builtins.foreach(@remaining_sizes_per_cd_per_src) do |remaining_sizes_list| remaining_times_list = [] remaining_time = -1 - Builtins.foreach(remaining_sizes_list) do |remaining_size| + + remaining_sizes_list.each do |remaining_size| remaining_time = remaining_size - if Ops.greater_than(remaining_size, 0) - remaining_time = Ops.divide(remaining_size, @bytes_per_second) - if Ops.less_than(remaining_time, @min_time_per_cd) + if remaining_size > 0 + remaining_time = remaining_size.to_f / @bytes_per_second + + if remaining_time < MIN_TIME_PER_CD # It takes at least this long for the CD drive to spin up and # for RPM to do _anything_. Times below this values are # ridiculously unrealistic. - remaining_time = @min_time_per_cd - elsif Ops.greater_than(remaining_time, @max_time_per_cd) # clip off at 2 hours + remaining_time = MIN_TIME_PER_CD + elsif remaining_time > MAX_TIME_PER_CD # clip off at 2 hours # When data throughput goes downhill (stalled network connection etc.), # cut off the predicted time at a reasonable maximum. - remaining_time = @max_time_per_cd + remaining_time = MAX_TIME_PER_CD end end - remaining_times_list = Builtins.add( - remaining_times_list, - remaining_time - ) + + remaining_times_list << remaining_time end - @remaining_times_per_cd_per_src = Builtins.add( - @remaining_times_per_cd_per_src, - remaining_times_list - ) + + @remaining_times_per_cd_per_src << remaining_times_list end # Recalculate slide interval if Slides.HaveSlides - slides_remaining = Ops.subtract( - Ops.subtract(Builtins.size(Slides.slides), SlideShow.current_slide_no), - 1 - ) + slides_remaining = Slides.slides.size - SlideShow.current_slide_no - 1 - if Ops.greater_than(slides_remaining, 0) + if slides_remaining > 0 # The remaining time for the rest of the slides depends on the # remaining time for the current CD only: This is where the # slide images and texts reside. Normally, only CD1 has slides @@ -784,7 +724,7 @@ ], 1 ), - Builtins.time + ::Time.now.to_i ), SlideShow.slide_start_time ) @@ -823,10 +763,7 @@ end end - SlideShow.next_recalc_time = Ops.add( - Builtins.time, - SlideShow.recalc_interval - ) + SlideShow.next_recalc_time = ::Time.now.to_i + SlideShow.recalc_interval true end @@ -837,7 +774,7 @@ def SwitchToSecondsIfNecessary if @unit_is_seconds || Ops.less_than( - Builtins.time, + ::Time.now.to_i, Ops.add(SlideShow.start_time, SlideShow.initial_recalc_delay) ) return false # no need to switch @@ -883,7 +820,7 @@ Ops.subtract(@current_src_no, 1), Ops.subtract(@current_cd_no, 1) ), - @size_column + SIZE_COLUMN_POSITION ), FormatRemainingSize(remaining) ) @@ -897,7 +834,7 @@ Ops.subtract(@current_src_no, 1), Ops.subtract(@current_cd_no, 1) ), - @pkg_count_column + PKG_COUNT_COLUMN_POSITION ), FormatRemainingCount( Ops.get( @@ -915,10 +852,10 @@ remaining = 0 if Ops.less_or_equal(remaining, 0) - if Ops.greater_than(remaining, @max_time_per_cd) # clip off at 2 hours + if Ops.greater_than(remaining, MAX_TIME_PER_CD) # clip off at 2 hours # When data throughput goes downhill (stalled network connection etc.), # cut off the predicted time at a reasonable maximum. - remaining = Ops.unary_minus(@max_time_per_cd) + remaining = Ops.unary_minus(MAX_TIME_PER_CD) end UI.ChangeWidget( @@ -930,7 +867,7 @@ Ops.subtract(@current_src_no, 1), Ops.subtract(@current_cd_no, 1) ), - @time_column + TIME_COLUMN_POSITION ), FormatTimeShowOverflow(remaining) ) @@ -943,20 +880,20 @@ UI.ChangeWidget( Id(:cdStatisticsTable), - term(:Item, "total", @size_column), + term(:Item, "total", SIZE_COLUMN_POSITION), FormatRemainingSize(TotalRemainingSize()) ) UI.ChangeWidget( Id(:cdStatisticsTable), - term(:Item, "total", @pkg_count_column), + term(:Item, "total", PKG_COUNT_COLUMN_POSITION), FormatRemainingCount(TotalRemainingPkgCount()) ) if @unit_is_seconds UI.ChangeWidget( Id(:cdStatisticsTable), - term(:Item, "total", @time_column), + term(:Item, "total", TIME_COLUMN_POSITION), FormatTimeShowOverflow(TotalRemainingTime()) ) end @@ -1099,12 +1036,12 @@ remaining = Ops.divide(remaining, @bytes_per_second) rem_time = String.FormatTime(remaining) # column #2 - if Ops.greater_than(remaining, @max_time_per_cd) # clip off at 2 hours + if Ops.greater_than(remaining, MAX_TIME_PER_CD) # clip off at 2 hours # When data throughput goes downhill (stalled network connection etc.), # cut off the predicted time at a reasonable maximum. # "%1" is a predefined maximum time. rem_time = FormatTimeShowOverflow( - Ops.unary_minus(@max_time_per_cd) + Ops.unary_minus(MAX_TIME_PER_CD) ) end end @@ -1326,24 +1263,22 @@ end - - - - - # package start display update # - this is called at the beginning of a new package # # @param [String] pkg_name package name + # @param [String] pkg_location full path to a package # @param [String] pkg_summary package summary (short description) + # @param [Integer] pkg_size package size in bytes # @param [Boolean] deleting Flag: deleting (true) or installing (false) package? # def SlideDisplayStart(pkg_name, pkg_location, pkg_summary, pkg_size, deleting) return if !SanityCheck(false) # remove path - pkg_filename = StripPath(pkg_location) - Builtins.y2milestone("pkg_name: %1", pkg_name) + pkg_location ||= "" + pkg_filename = File.basename(pkg_location) + log.info "pkg_name: #{pkg_name}" if deleting pkg_size = -1 @@ -1358,10 +1293,11 @@ # Note: This will begin to fail when some day packages are deleted in the middle of the # installaton process. + # FIXME: SlideShow.PauseTimer SlideShow.ResetTimer end - pkg_summary = "" if pkg_summary == nil + pkg_summary ||= "" msg = "" @@ -1506,9 +1442,6 @@ publish :variable => :bytes_per_second, :type => "integer" publish :variable => :init_pkg_data_complete, :type => "boolean" publish :function => :GetPackageSummary, :type => "map <string, any> ()" - publish :function => :StripReleaseNo, :type => "string (string)" - publish :function => :StripPath, :type => "string (string)" - publish :function => :SetMediaType, :type => "void (string)" publish :function => :InitPkgData, :type => "void (boolean)" publish :function => :SetCurrentCdNo, :type => "void (integer, integer)" publish :function => :UpdateCurrentCdProgress, :type => "void (boolean)" -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit grep for openSUSE:Factory
by root＠hilbert.suse.de 26 May '14

26 May '14

Hello community, here is the log from the commit of package grep for openSUSE:Factory checked in at 2014-05-26 14:39:40 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/grep (Old) and /work/SRC/openSUSE:Factory/.grep.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "grep" Changes: -------- --- /work/SRC/openSUSE:Factory/grep/grep.changes 2014-04-06 09:53:58.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.grep.new/grep.changes 2014-05-26 14:39:54.000000000 +0200 @@ -1,0 +2,47 @@ +Sat May 24 16:50:50 UTC 2014 - andreas.stieger(a)gmx.de + +- GNU grep 2.19 +- Improvements: + * Performance has improved, typically by 10% and in some cases by + a factor of 200. However, performance of grep -P in UTF-8 + locales has gotten worse as part of the fix for the crashes + mentioned below. +- Bug fixes: + * grep no longer mishandles patterns like [a-[.z.]], and no + longer mishandles patterns like [^a] in locales that have + multicharacter collating sequences so that [^a] can match a + string of two characters. + * grep no longer mishandles an empty pattern at the end of a + pattern list. + * grep -C NUM now outputs separators consistently even when NUM + is zero, and similarly for grep -A NUM and grep -B NUM. + * grep -f no longer mishandles patterns containing NUL bytes. + * Plain grep, grep -E, and grep -F now treat encoding errors in + patterns the same way the GNU regular expression matcher treats + them, with respect to whether the errors can match parts of + multibyte characters in data. + * grep -w no longer mishandles a potential match adjacent to a + letter that takes up two or more bytes in a multibyte encoding. + Similarly, the patterns '\<', '\>', '\b', and '\B' no longer + mishandle word-boundary matches in multibyte locales. + * grep -P now reports an error and exits when given invalid UTF-8 + data. Previously it was unreliable, and sometimes crashed or + looped. + * grep -P now works with -w and -x and backreferences. Before, + echo aa|grep -Pw '(.)\1' would fail to match, yet + echo aa|grep -Pw '(.)\2' would match. + * grep -Pw now works like grep -w in that the matched string has + to be preceded and followed by non-word components or the + beginning and end of the line (as opposed to word boundaries + before). Before, this + echo a@@a| grep -Pw @@ would match, yet this + echo a@@a| grep -w @@ would not. Now, they both fail to match, + per the documentation on how grep's -w works. + * grep -i no longer mishandles patterns containing titlecase + characters. For example, in a locale containing the titlecase + character 'ǈ' (U+01C8 LATIN CAPITAL LETTER L WITH SMALL LETTER + J), 'grep -i ǈ' now matches both 'Ǉ' (U+01C7 LATIN CAPITAL + LETTER LJ) and 'ǉ' (U+01C9 LATIN SMALL LETTER LJ). +- remove mb-non-UTF8-performance.patch, committed upstream + +------------------------------------------------------------------- Old: ---- grep-2.18.tar.xz grep-2.18.tar.xz.sig mb-non-UTF8-performance.patch New: ---- grep-2.19.tar.xz grep-2.19.tar.xz.sig ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ grep.spec ++++++ --- /var/tmp/diff_new_pack.nnoVsk/_old 2014-05-26 14:39:56.000000000 +0200 +++ /var/tmp/diff_new_pack.nnoVsk/_new 2014-05-26 14:39:56.000000000 +0200 @@ -17,7 +17,7 @@ Name: grep -Version: 2.18 +Version: 2.19 Release: 0 Summary: Print lines matching a pattern License: GPL-3.0+ @@ -26,20 +26,16 @@ Source0: http://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz Source2: http://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz.sig Source3: http://savannah.gnu.org/project/memberlist-gpgkeys.php?group=grep&download=… -# PATCH-FIX-UPSTREAM http://git.savannah.gnu.org/cgit/grep.git/commit/?id=6e3ea0dd74426fd394225d… -Patch0: mb-non-UTF8-performance.patch - BuildRequires: makeinfo BuildRequires: pcre-devel BuildRequires: xz +Requires(pre): %{install_info_prereq} +Provides: base:%{_bindir}/grep +BuildRoot: %{_tmppath}/%{name}-%{version}-build %if 0%{?suse_version} < 1120 BuildRequires: pcre %endif -Provides: base:/usr/bin/grep -Requires(pre): %{install_info_prereq} -BuildRoot: %{_tmppath}/%{name}-%{version}-build - %description The grep command searches one or more input files for lines containing a match to a specified pattern. By default, grep prints @@ -47,7 +43,6 @@ %prep %setup -q -%patch0 -p1 %if 0%{?suse_version} < 1120 echo "ac_cv_search_pcre_compile=\${ac_cv_search_pcre_compile=%{_libdir}/libpcre.a}" >config.cache %endif ++++++ grep-2.18.tar.xz -> grep-2.19.tar.xz ++++++ ++++ 38131 lines of diff (skipped) -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit gcc48 for openSUSE:Factory
by root＠hilbert.suse.de 26 May '14

26 May '14

Hello community, here is the log from the commit of package gcc48 for openSUSE:Factory checked in at 2014-05-26 14:39:39 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gcc48 (Old) and /work/SRC/openSUSE:Factory/.gcc48.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "gcc48" Changes: -------- --- /work/SRC/openSUSE:Factory/gcc48/cross-aarch64-gcc48-icecream-backend.changes 2014-04-11 13:23:40.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.gcc48.new/cross-aarch64-gcc48-icecream-backend.changes 2014-05-26 14:39:40.000000000 +0200 @@ -1,0 +2,25 @@ +Thu May 22 08:17:14 UTC 2014 - rguenther(a)suse.com + +- Update to gcc-4_8-branch head (r210846). + * Includes GCC 4.8.3 release. + * Fixes ppc64le HTM ttest code generation. [bnc#879504] +- Fix libstdc++48-doc build conditional to really only build from + libgcj48.spec. + +------------------------------------------------------------------- +Fri May 16 08:10:00 UTC 2014 - rguenther(a)suse.com + +- Update to gcc-4_8-branch head (r210488). + * pulls GCC 4.8.3 release candidate + * pulls fix for ppc64le ABI incompatibility with s390 for HTM. + [bnc#878065] + +------------------------------------------------------------------- +Tue May 13 11:55:36 UTC 2014 - rguenther(a)suse.com + +- Build libstdc++48-doc package from the libgcj48 build and build + the libstdc++ API reference, build-requiring doxygen and graphviz. + Add patch gcc48-libstdc++-api-reference.patch to refer to that + instead of the online version. [bnc#871501] + +------------------------------------------------------------------- cross-armv6hl-gcc48-icecream-backend.changes: same change cross-armv7hl-gcc48-icecream-backend.changes: same change cross-hppa-gcc48-icecream-backend.changes: same change cross-i386-gcc48-icecream-backend.changes: same change cross-ia64-gcc48-icecream-backend.changes: same change cross-ppc-gcc48-icecream-backend.changes: same change cross-ppc64-gcc48-icecream-backend.changes: same change cross-ppc64le-gcc48-icecream-backend.changes: same change cross-s390-gcc48-icecream-backend.changes: same change cross-s390x-gcc48-icecream-backend.changes: same change cross-x86_64-gcc48-icecream-backend.changes: same change gcc48-testresults.changes: same change gcc48.changes: same change libffi48.changes: same change libgcj48.changes: same change Old: ---- gcc-4.8.2-r209122.tar.bz2 gcc48-pr59844.diff New: ---- gcc-4.8.3-r210837.tar.bz2 gcc48-libstdc++-api-reference.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cross-aarch64-gcc48-icecream-backend.spec ++++++ --- /var/tmp/diff_new_pack.2hIpN2/_old 2014-05-26 14:39:53.000000000 +0200 +++ /var/tmp/diff_new_pack.2hIpN2/_new 2014-05-26 14:39:53.000000000 +0200 @@ -91,7 +91,7 @@ %define biarch_targets x86_64 s390x powerpc64 powerpc sparc sparc64 Url: http://gcc.gnu.org/ -Version: 4.8.2+r209122 +Version: 4.8.3+r210837 Release: 0 %define gcc_version %(echo %version | sed 's/+.*//') %define gcc_dir_version %(echo %gcc_version | cut -d '.' -f 1-2) @@ -122,6 +122,7 @@ Patch36: stack-protector-aarch64.patch Patch37: function-profiling-aarch64.patch Patch38: gcc48-lto-plugin-short-readwrite.diff +Patch39: gcc48-libstdc++-api-reference.patch # A set of patches from the RH srpm Patch51: gcc41-ia64-stack-protector.patch Patch55: gcc41-java-slow_pthread_self.patch @@ -198,6 +199,7 @@ %patch36 -p1 %patch37 -p1 %patch38 +%patch39 %patch51 %patch55 %patch57 cross-armv6hl-gcc48-icecream-backend.spec: same change cross-armv7hl-gcc48-icecream-backend.spec: same change cross-hppa-gcc48-icecream-backend.spec: same change cross-i386-gcc48-icecream-backend.spec: same change cross-ia64-gcc48-icecream-backend.spec: same change cross-ppc-gcc48-icecream-backend.spec: same change cross-ppc64-gcc48-icecream-backend.spec: same change cross-ppc64le-gcc48-icecream-backend.spec: same change cross-s390-gcc48-icecream-backend.spec: same change cross-s390x-gcc48-icecream-backend.spec: same change cross-x86_64-gcc48-icecream-backend.spec: same change ++++++ gcc48-testresults.spec ++++++ --- /var/tmp/diff_new_pack.2hIpN2/_old 2014-05-26 14:39:53.000000000 +0200 +++ /var/tmp/diff_new_pack.2hIpN2/_new 2014-05-26 14:39:53.000000000 +0200 @@ -176,6 +176,9 @@ %endif %if 0%{?building_libjava:1}%{?building_testsuite:1} BuildRequires: fastjar +# For building the libstdc++ API reference +BuildRequires: doxygen +BuildRequires: graphviz %endif %if 0%{?building_libffi:1} BuildRequires: pkg-config @@ -223,7 +226,7 @@ %define biarch_targets x86_64 s390x powerpc64 powerpc sparc sparc64 Url: http://gcc.gnu.org/ -Version: 4.8.2+r209122 +Version: 4.8.3+r210837 Release: 0 %define gcc_version %(echo %version | sed 's/+.*//') %define gcc_dir_version %(echo %gcc_version | cut -d '.' -f 1-2) @@ -280,6 +283,7 @@ Patch36: stack-protector-aarch64.patch Patch37: function-profiling-aarch64.patch Patch38: gcc48-lto-plugin-short-readwrite.diff +Patch39: gcc48-libstdc++-api-reference.patch # A set of patches from the RH srpm Patch51: gcc41-ia64-stack-protector.patch Patch55: gcc41-java-slow_pthread_self.patch @@ -406,6 +410,7 @@ %patch36 -p1 %patch37 -p1 %patch38 +%patch39 %patch51 %patch55 %patch57 @@ -696,6 +701,9 @@ make STAGE1_CFLAGS="$STAGE1_FLAGS" BOOT_CFLAGS="$RPM_OPT_FLAGS" $PARALLEL %endif make info +%if 0%{?building_libjava:1} +make -C %{GCCDIST}/libstdc++-v3/doc doc-html-doxygen +%endif %if 0%{?run_tests:1} echo "Run testsuite" (make -C %{GCCDIST}/libstdc++-v3 check-abi || true) ++++++ gcc48.spec ++++++ --- /var/tmp/diff_new_pack.2hIpN2/_old 2014-05-26 14:39:53.000000000 +0200 +++ /var/tmp/diff_new_pack.2hIpN2/_new 2014-05-26 14:39:53.000000000 +0200 @@ -158,6 +158,9 @@ %endif %if 0%{?building_libjava:1}%{?building_testsuite:1} BuildRequires: fastjar +# For building the libstdc++ API reference +BuildRequires: doxygen +BuildRequires: graphviz %endif %if 0%{?building_libffi:1} BuildRequires: pkg-config @@ -205,7 +208,7 @@ %define biarch_targets x86_64 s390x powerpc64 powerpc sparc sparc64 Url: http://gcc.gnu.org/ -Version: 4.8.2+r209122 +Version: 4.8.3+r210837 Release: 0 %define gcc_version %(echo %version | sed 's/+.*//') %define gcc_dir_version %(echo %gcc_version | cut -d '.' -f 1-2) @@ -262,6 +265,7 @@ Patch36: stack-protector-aarch64.patch Patch37: function-profiling-aarch64.patch Patch38: gcc48-lto-plugin-short-readwrite.diff +Patch39: gcc48-libstdc++-api-reference.patch # A set of patches from the RH srpm Patch51: gcc41-ia64-stack-protector.patch Patch55: gcc41-java-slow_pthread_self.patch @@ -409,17 +413,6 @@ This package contains all the headers and libraries of the standard C++ library. It is needed for compiling C++ code. -%package -n libstdc++48-doc -Summary: Documentation for the GNU C++ standard library -License: GPL-3.0+ -Group: Documentation/HTML -%if 0%{?suse_version} >= 1120 -BuildArch: noarch -%endif - -%description -n libstdc++48-doc -Extensive HTML documentation for the GNU C++ standard library. - %package -n libgcc_s%{libgcc_s}%{libgcc_s_suffix} Summary: C compiler runtime library @@ -1288,6 +1281,19 @@ %description -n gcc48-gij This package contains the java bytecode interpreter gij and related tools. + +%package -n libstdc++48-doc +Summary: Documentation for the GNU C++ standard library +License: GPL-3.0+ +Group: Documentation/HTML +%if 0%{?suse_version} >= 1120 +BuildArch: noarch +%endif + +%description -n libstdc++48-doc +Extensive HTML documentation for the GNU C++ standard library. + + %package -n libffi%{libffi_sover}%{libffi_suffix} Summary: Foreign Function Interface library License: BSD-3-Clause @@ -1481,6 +1487,7 @@ %patch36 -p1 %patch37 -p1 %patch38 +%patch39 %patch51 %patch55 %patch57 @@ -1771,6 +1778,9 @@ make STAGE1_CFLAGS="$STAGE1_FLAGS" BOOT_CFLAGS="$RPM_OPT_FLAGS" $PARALLEL %endif make info +%if 0%{?building_libjava:1} +make -C %{GCCDIST}/libstdc++-v3/doc doc-html-doxygen +%endif %if 0%{?run_tests:1} echo "Run testsuite" (make -C %{GCCDIST}/libstdc++-v3 check-abi || true) @@ -1798,6 +1808,8 @@ make -C gcc java.install-man DESTDIR=$RPM_BUILD_ROOT make -C gcc java.install-common DESTDIR=$RPM_BUILD_ROOT make -C gcc install-common DESTDIR=$RPM_BUILD_ROOT COMPILERS='jc1$(exeext) jvgenmain$(exeext)' +# copy the libstdc++ API reference +cp -r %{GCCDIST}/libstdc++-v3/doc/doxygen/html ../libstdc++-v3/doc/html/api # install-common also installs collect2, gcov and the g++ and gfortran driver %if %{build_cp} rm $RPM_BUILD_ROOT%{_prefix}/bin/g++%{binsuffix} @@ -2465,10 +2477,6 @@ %dir %{_datadir}/gdb/auto-load/%{mainlibdirbi} %{_datadir}/gdb/auto-load/%{mainlibdirbi}/libstdc++.so.*-gdb.py %endif - -%files -n libstdc++48-doc -%defattr(-,root,root) -%doc libstdc++-v3/doc/html %endif %files -n libgcc_s%{libgcc_s}%{libgcc_s_suffix} @@ -2868,6 +2876,12 @@ %endif %endif +%if 0%{?building_libjava:1} +%files -n libstdc++48-doc +%defattr(-,root,root) +%doc libstdc++-v3/doc/html +%endif + %if %{build_java} %if 0%{?building_libffi:1} %files -n libffi%{libffi_sover}%{libffi_suffix} ++++++ libffi48.spec ++++++ --- /var/tmp/diff_new_pack.2hIpN2/_old 2014-05-26 14:39:53.000000000 +0200 +++ /var/tmp/diff_new_pack.2hIpN2/_new 2014-05-26 14:39:53.000000000 +0200 @@ -175,6 +175,9 @@ %endif %if 0%{?building_libjava:1}%{?building_testsuite:1} BuildRequires: fastjar +# For building the libstdc++ API reference +BuildRequires: doxygen +BuildRequires: graphviz %endif %if 0%{?building_libffi:1} BuildRequires: pkg-config @@ -222,7 +225,7 @@ %define biarch_targets x86_64 s390x powerpc64 powerpc sparc sparc64 Url: http://gcc.gnu.org/ -Version: 4.8.2+r209122 +Version: 4.8.3+r210837 Release: 0 %define gcc_version %(echo %version | sed 's/+.*//') %define gcc_dir_version %(echo %gcc_version | cut -d '.' -f 1-2) @@ -279,6 +282,7 @@ Patch36: stack-protector-aarch64.patch Patch37: function-profiling-aarch64.patch Patch38: gcc48-lto-plugin-short-readwrite.diff +Patch39: gcc48-libstdc++-api-reference.patch # A set of patches from the RH srpm Patch51: gcc41-ia64-stack-protector.patch Patch55: gcc41-java-slow_pthread_self.patch @@ -494,6 +498,7 @@ %patch36 -p1 %patch37 -p1 %patch38 +%patch39 %patch51 %patch55 %patch57 @@ -784,6 +789,9 @@ make STAGE1_CFLAGS="$STAGE1_FLAGS" BOOT_CFLAGS="$RPM_OPT_FLAGS" $PARALLEL %endif make info +%if 0%{?building_libjava:1} +make -C %{GCCDIST}/libstdc++-v3/doc doc-html-doxygen +%endif %if 0%{?run_tests:1} echo "Run testsuite" (make -C %{GCCDIST}/libstdc++-v3 check-abi || true) @@ -811,6 +819,8 @@ make -C gcc java.install-man DESTDIR=$RPM_BUILD_ROOT make -C gcc java.install-common DESTDIR=$RPM_BUILD_ROOT make -C gcc install-common DESTDIR=$RPM_BUILD_ROOT COMPILERS='jc1$(exeext) jvgenmain$(exeext)' +# copy the libstdc++ API reference +cp -r %{GCCDIST}/libstdc++-v3/doc/doxygen/html ../libstdc++-v3/doc/html/api # install-common also installs collect2, gcov and the g++ and gfortran driver %if %{build_cp} rm $RPM_BUILD_ROOT%{_prefix}/bin/g++%{binsuffix} ++++++ libgcj48.spec ++++++ --- /var/tmp/diff_new_pack.2hIpN2/_old 2014-05-26 14:39:53.000000000 +0200 +++ /var/tmp/diff_new_pack.2hIpN2/_new 2014-05-26 14:39:53.000000000 +0200 @@ -175,6 +175,9 @@ %endif %if 0%{?building_libjava:1}%{?building_testsuite:1} BuildRequires: fastjar +# For building the libstdc++ API reference +BuildRequires: doxygen +BuildRequires: graphviz %endif %if 0%{?building_libffi:1} BuildRequires: pkg-config @@ -222,7 +225,7 @@ %define biarch_targets x86_64 s390x powerpc64 powerpc sparc sparc64 Url: http://gcc.gnu.org/ -Version: 4.8.2+r209122 +Version: 4.8.3+r210837 Release: 0 %define gcc_version %(echo %version | sed 's/+.*//') %define gcc_dir_version %(echo %gcc_version | cut -d '.' -f 1-2) @@ -279,6 +282,7 @@ Patch36: stack-protector-aarch64.patch Patch37: function-profiling-aarch64.patch Patch38: gcc48-lto-plugin-short-readwrite.diff +Patch39: gcc48-libstdc++-api-reference.patch # A set of patches from the RH srpm Patch51: gcc41-ia64-stack-protector.patch Patch55: gcc41-java-slow_pthread_self.patch @@ -386,6 +390,19 @@ %description -n gcc48-gij This package contains the java bytecode interpreter gij and related tools. + +%package -n libstdc++48-doc +Summary: Documentation for the GNU C++ standard library +License: GPL-3.0+ +Group: Documentation/HTML +%if 0%{?suse_version} >= 1120 +BuildArch: noarch +%endif + +%description -n libstdc++48-doc +Extensive HTML documentation for the GNU C++ standard library. + + %package -n libffi%{libffi_sover}%{libffi_suffix} Summary: Foreign Function Interface library License: BSD-3-Clause @@ -579,6 +596,7 @@ %patch36 -p1 %patch37 -p1 %patch38 +%patch39 %patch51 %patch55 %patch57 @@ -869,6 +887,9 @@ make STAGE1_CFLAGS="$STAGE1_FLAGS" BOOT_CFLAGS="$RPM_OPT_FLAGS" $PARALLEL %endif make info +%if 0%{?building_libjava:1} +make -C %{GCCDIST}/libstdc++-v3/doc doc-html-doxygen +%endif %if 0%{?run_tests:1} echo "Run testsuite" (make -C %{GCCDIST}/libstdc++-v3 check-abi || true) @@ -896,6 +917,8 @@ make -C gcc java.install-man DESTDIR=$RPM_BUILD_ROOT make -C gcc java.install-common DESTDIR=$RPM_BUILD_ROOT make -C gcc install-common DESTDIR=$RPM_BUILD_ROOT COMPILERS='jc1$(exeext) jvgenmain$(exeext)' +# copy the libstdc++ API reference +cp -r %{GCCDIST}/libstdc++-v3/doc/doxygen/html ../libstdc++-v3/doc/html/api # install-common also installs collect2, gcov and the g++ and gfortran driver %if %{build_cp} rm $RPM_BUILD_ROOT%{_prefix}/bin/g++%{binsuffix} @@ -1331,6 +1354,12 @@ %endif %endif +%if 0%{?building_libjava:1} +%files -n libstdc++48-doc +%defattr(-,root,root) +%doc libstdc++-v3/doc/html +%endif + %if %{build_java} %if 0%{?building_libffi:1} %files -n libffi%{libffi_sover}%{libffi_suffix} ++++++ gcc-4.8.2-r209122.tar.bz2 -> gcc-4.8.3-r210837.tar.bz2 ++++++ /work/SRC/openSUSE:Factory/gcc48/gcc-4.8.2-r209122.tar.bz2 /work/SRC/openSUSE:Factory/.gcc48.new/gcc-4.8.3-r210837.tar.bz2 differ: char 11, line 1 ++++++ gcc.spec.in ++++++ --- /var/tmp/diff_new_pack.2hIpN2/_old 2014-05-26 14:39:53.000000000 +0200 +++ /var/tmp/diff_new_pack.2hIpN2/_new 2014-05-26 14:39:53.000000000 +0200 @@ -162,6 +162,9 @@ %endif %if 0%{?building_libjava:1}%{?building_testsuite:1} BuildRequires: fastjar +# For building the libstdc++ API reference +BuildRequires: doxygen +BuildRequires: graphviz %endif %if 0%{?building_libffi:1} BuildRequires: pkg-config @@ -210,7 +213,7 @@ %define biarch_targets x86_64 s390x powerpc64 powerpc sparc sparc64 URL: http://gcc.gnu.org/ -Version: 4.8.2+r209122 +Version: 4.8.3+r210837 Release: 1 %define gcc_version %(echo %version | sed 's/+.*//') %define gcc_dir_version %(echo %gcc_version | cut -d '.' -f 1-2) @@ -269,6 +272,7 @@ Patch36: stack-protector-aarch64.patch Patch37: function-profiling-aarch64.patch Patch38: gcc48-lto-plugin-short-readwrite.diff +Patch39: gcc48-libstdc++-api-reference.patch # A set of patches from the RH srpm Patch51: gcc41-ia64-stack-protector.patch Patch55: gcc41-java-slow_pthread_self.patch @@ -395,17 +399,6 @@ library. It is needed for compiling C++ code. # PACKAGE-END -%package -n libstdc++@base_ver@-doc -Summary: Documentation for the GNU C++ standard library -License: GPL-3.0+ -Group: Documentation/HTML -%if 0%{?suse_version} >= 1120 -BuildArch: noarch -%endif - -%description -n libstdc++@base_ver@-doc -Extensive HTML documentation for the GNU C++ standard library. - # PACKAGE-BEGIN %package -n libgcc_s%{libgcc_s}%{libgcc_s_suffix}@variant@ @@ -838,6 +831,19 @@ %description -n gcc@base_ver@-gij This package contains the java bytecode interpreter gij and related tools. + +%package -n libstdc++@base_ver@-doc +Summary: Documentation for the GNU C++ standard library +License: GPL-3.0+ +Group: Documentation/HTML +%if 0%{?suse_version} >= 1120 +BuildArch: noarch +%endif + +%description -n libstdc++@base_ver@-doc +Extensive HTML documentation for the GNU C++ standard library. + + # LIBFFI-DELETE-END # PACKAGE-BEGIN %package -n libffi%{libffi_sover}%{libffi_suffix}@variant@ @@ -994,6 +1000,7 @@ %patch36 -p1 %patch37 -p1 %patch38 +%patch39 %patch51 %patch55 %patch57 @@ -1286,6 +1293,9 @@ make STAGE1_CFLAGS="$STAGE1_FLAGS" BOOT_CFLAGS="$RPM_OPT_FLAGS" $PARALLEL %endif make info +%if 0%{?building_libjava:1} +make -C %{GCCDIST}/libstdc++-v3/doc doc-html-doxygen +%endif %if 0%{?run_tests:1} echo "Run testsuite" (make -C %{GCCDIST}/libstdc++-v3 check-abi || true) @@ -1314,6 +1324,8 @@ make -C gcc java.install-man DESTDIR=$RPM_BUILD_ROOT make -C gcc java.install-common DESTDIR=$RPM_BUILD_ROOT make -C gcc install-common DESTDIR=$RPM_BUILD_ROOT COMPILERS='jc1$(exeext) jvgenmain$(exeext)' +# copy the libstdc++ API reference +cp -r %{GCCDIST}/libstdc++-v3/doc/doxygen/html ../libstdc++-v3/doc/html/api # install-common also installs collect2, gcov and the g++ and gfortran driver %if %{build_cp} rm $RPM_BUILD_ROOT%{_prefix}/bin/g++%{binsuffix} @@ -1994,10 +2006,6 @@ %dir %{_datadir}/gdb/auto-load/%{mainlibdirbi} %{_datadir}/gdb/auto-load/%{mainlibdirbi}/libstdc++.so.*-gdb.py %endif - -%files -n libstdc++@base_ver@-doc -%defattr(-,root,root) -%doc libstdc++-v3/doc/html %endif %files -n libgcc_s%{libgcc_s}%{libgcc_s_suffix} @@ -2407,6 +2415,12 @@ %doc %{_mandir}/man1/gtnameserv%{binsuffix}.1.gz %endif %endif + +%if 0%{?building_libjava:1} +%files -n libstdc++@base_ver@-doc +%defattr(-,root,root) +%doc libstdc++-v3/doc/html +%endif # LIBFFI-DELETE-END %if %{build_java} ++++++ gcc48-libstdc++-api-reference.patch ++++++ Index: libstdc++-v3/doc/html/index.html =================================================================== --- libstdc++-v3/doc/html/index.html (revision 210144) +++ libstdc++-v3/doc/html/index.html (working copy) @@ -18,7 +18,7 @@ </p></li><li class="listitem"><p> <a class="link" href="faq.html" title="Frequently Asked Questions">Frequently Asked Questions</a> </p></li><li class="listitem"><p> - <a class="link" href="api.html" title="The GNU C++ Library API Reference">API and Source Documentation</a> + <a class="link" href="api/index.html" title="The GNU C++ Library API Reference">API and Source Documentation</a> </p></li></ul></div><p> </p></div></div></div><hr /></div><div class="toc"><p><strong>Table of Contents</strong></p><dl class="toc"><dt><span class="book"><a href="manual/index.html">The GNU C++ Library Manual</a></span></dt><dd><dl><dt><span class="part"><a href="manual/intro.html">I. Introduction -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0