helpGNU Internationalized Domain Names Library - Support: sr #109442, Provide a new libidn release...

 
 

sr #109442: Provide a new libidn release incorporating the fixes for CVE-2017-14062

Submitted by:  Timo Gurr <tgurr>
Submitted on:  Wed 10 Jan 2018 12:56:18 PM UTC  
Votes:  1  
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Operating System:  GNU/Linux

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 16 Jan 2018 11:10:35 AM UTC, comment #1: 

Additionally, manually applying the patches for CVE-2017-14062 causes some automake problems:

Making all in doc
make[2]: Entering directory '/usr/ports/work/libidn/src/libidn-1.33/doc'
echo '# This file is automatically generated.  DO NOT EDIT!          -*- makefile -*-' > Makefile.gdoc
echo >> Makefile.gdoc
echo 'gdoc_TEXINFOS =' >> Makefile.gdoc
echo 'gdoc_MANS =' >> Makefile.gdoc
echo >> Makefile.gdoc
for file in ../lib/idna.c ../lib/nfkc.c ../lib/pr29.c ../lib/punycode.c ../lib/stringprep.c ../lib/tld.c ../lib/toutf8.c ../lib/version.c ../lib/idn-free.c ../lib/strerror-idna.c ../lib/strerror-pr29.c ../lib/strerror-punycode.c ../lib/strerror-stringprep.c ../lib/strerror-tld.c; do \
  shortfile=`basename $file`; \
  echo "#" >> Makefile.gdoc; \
  echo "### $shortfile" >> Makefile.gdoc; \
  echo "#" >> Makefile.gdoc; \
  echo "gdoc_TEXINFOS += texi/$shortfile.texi" >> Makefile.gdoc; \
  echo "texi/$shortfile.texi: $file" >> Makefile.gdoc; \
  echo 'TABmkdir -p `dirname $@`' | sed "s/TAB/ /" >> Makefile.gdoc; \
  echo 'TAB$(PERL) ./gdoc -texinfo $(GDOC_TEXI_EXTRA_ARGS) $< > $@' | sed "s/TAB/ /" >> Makefile.gdoc; \
  echo >> Makefile.gdoc; \
  functions=`/bin/sh /usr/ports/work/libidn/src/libidn-1.33/build-aux/missing perl ./gdoc -listfunc $file`; \
  for function in $functions; do \
    echo "# $shortfile: $function" >> Makefile.gdoc; \
    echo "gdoc_TEXINFOS += texi/$function.texi" >> Makefile.gdoc; \
    echo "texi/$function.texi: $file" >> Makefile.gdoc; \
    echo 'TABmkdir -p `dirname $@`' | sed "s/TAB/ /" >> Makefile.gdoc; \
    echo 'TAB$(PERL) ./gdoc -texinfo $(GDOC_TEXI_EXTRA_ARGS) -function'" $function"' $< > $@' | sed "s/TAB/ /" >> Makefile.gdoc; \
    echo >> Makefile.gdoc; \
    echo "gdoc_MANS += man/$function.3" >> Makefile.gdoc; \
    echo "man/$function.3: $file" >> Makefile.gdoc; \
    echo 'TABmkdir -p `dirname $@`' | sed "s/TAB/ /" >> Makefile.gdoc; \
    echo 'TAB$(PERL) ./gdoc -man $(GDOC_MAN_EXTRA_ARGS) -function'" $function"' $< > $@' | sed "s/TAB/ /" >> Makefile.gdoc; \
    echo >> Makefile.gdoc; \
  done; \
  echo >> Makefile.gdoc; \
done
make Makefile
make[3]: Entering directory '/usr/ports/work/libidn/src/libidn-1.33/doc'
 cd .. && /bin/sh /usr/ports/work/libidn/src/libidn-1.33/build-aux/missing automake-1.14 --gnu doc/Makefile
/usr/ports/work/libidn/src/libidn-1.33/build-aux/missing: 81: /usr/ports/work/libidn/src/libidn-1.33/build-aux/missing: automake-1.14: not found
WARNING: 'automake-1.14' is missing on your system.
         You should only need it if you modified 'Makefile.am' or
         'configure.ac' or m4 files included by 'configure.ac'.
         The 'automake' program is part of the GNU Automake package:
         <http://www.gnu.org/software/automake>
         It also requires GNU Autoconf, GNU m4 and Perl in order to run:
         <http://www.gnu.org/software/autoconf>
         <http://www.gnu.org/software/m4/>
         <http://www.perl.org/>
make[3]: *** [Makefile:1494: Makefile.in] Error 127
make[3]: Leaving directory '/usr/ports/work/libidn/src/libidn-1.33/doc'
make[2]: *** [Makefile:2205: Makefile.gdoc] Error 2
make[2]: Leaving directory '/usr/ports/work/libidn/src/libidn-1.33/doc'
make[1]: *** [Makefile:1333: all-recursive] Error 1
make[1]: Leaving directory '/usr/ports/work/libidn/src/libidn-1.33'
make: *** [Makefile:1235: all] Error 2

Note that the patch only touches two files; lib/punycode.c & tests/tst_idna.c

A new bootstrapped release would be most welcome!

Fredrik <finnst>
Wed 10 Jan 2018 12:56:18 PM UTC, original submission:  

Mainly for having a released version containing the fixes for CVE-2017-14062:

http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=e9e81b8063b095b02cf104bb992fa9bf9515b9d8

http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=6c8a9375641ca283b50f9680c90dcd57f9c44798

And a new release would be also nice for the GCC7 compatiblity fixes which have been committed to git since the last release.

Timo Gurr <tgurr>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by finnst (Posted a comment)
  • -email is unavailable- added by finnst (Voted in favor of this item)
  • -email is unavailable- added by tgurr (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 1 encouragement so far.

    Only logged-in users can vote.

     

     

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-01-16 finnst Carbon-Copy- => Added finnst

    Back to the top


    Powered by Savane 3.5