Broken dependencies: perl-Dumbbench
by Fedora Koji Build System
perl-Dumbbench has broken dependencies in the rawhide tree:
On armhfp:
perl-Dumbbench-BoxPlot-0.10-2.fc24.noarch requires perl(SOOT)
Please resolve this as soon as possible.
8Â years, 3Â months
psabata pushed to perl-Text-Context (master). "Package cleanup"
by notificationsï¼ fedoraproject.org
From 2a7796a25620ad09ff72493319262281f08b2f3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0abata?= <contyk(a)redhat.com>
Date: Wed, 2 Mar 2016 15:26:20 +0100
Subject: Package cleanup
---
perl-Text-Context.spec | 42 +++++++++++++++++++++---------------------
1 file changed, 21 insertions(+), 21 deletions(-)
diff --git a/perl-Text-Context.spec b/perl-Text-Context.spec
index 8e54116..7b84993 100644
--- a/perl-Text-Context.spec
+++ b/perl-Text-Context.spec
@@ -1,21 +1,28 @@
Name: perl-Text-Context
Version: 3.7
-Release: 16%{?dist}
+Release: 17%{?dist}
Summary: Handle highlighting search result context snippets
License: GPLv2+
-Group: Development/Libraries
URL: http://search.cpan.org/dist/Text-Context/
Source0: http://www.cpan.org/authors/id/T/TM/TMTM/Text-Context-%{version}.tar.gz
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildArch: noarch
-BuildRequires: perl(ExtUtils::MakeMaker)
+# Build
+BuildRequires: make
+BuildRequires: perl
+BuildRequires: perl(ExtUtils::MakeMaker) >= 6.76
+# Runtime
+BuildRequires: perl(constant)
BuildRequires: perl(HTML::Entities)
-BuildRequires: perl(Test::More)
-BuildRequires: perl(Test::Pod)
-BuildRequires: perl(Test::Pod::Coverage)
+BuildRequires: perl(strict)
BuildRequires: perl(Text::Context::EitherSide) >= 1.1
BuildRequires: perl(UNIVERSAL::require) >= 0.03
-Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
+BuildRequires: perl(warnings)
+# Tests only
+BuildRequires: perl(Test::More)
+# Optional tests only
+BuildRequires: perl(Test::Pod) >= 1.00
+BuildRequires: perl(Test::Pod::Coverage) >= 1.09
+Requires: perl(:MODULE_COMPAT_%(eval "$(perl -V:version)"; echo $version))
%description
Given a piece of text and some search terms, produces an object which
@@ -27,32 +34,25 @@ as HTML text with the search terms highlighted in bold.
%setup -q -n Text-Context-%{version}
%build
-%{__perl} Makefile.PL INSTALLDIRS=vendor
+perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1
make %{?_smp_mflags}
%install
-rm -rf $RPM_BUILD_ROOT
-
-make pure_install PERL_INSTALL_ROOT=$RPM_BUILD_ROOT
-
-find $RPM_BUILD_ROOT -type f -name .packlist -exec rm -f {} \;
-find $RPM_BUILD_ROOT -depth -type d -exec rmdir {} 2>/dev/null \;
-
-%{_fixperms} $RPM_BUILD_ROOT/*
+make pure_install DESTDIR=%{buildroot}
+%{_fixperms} %{buildroot}/*
%check
make test
-%clean
-rm -rf $RPM_BUILD_ROOT
-
%files
-%defattr(-,root,root,-)
%doc Changes README
%{perl_vendorlib}/*
%{_mandir}/man3/*
%changelog
+* Wed Mar 02 2016 Petr Å abata <contyk(a)redhat.com> - 3.7-17
+- Package cleanup
+
* Thu Feb 04 2016 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.7-16
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
--
cgit v0.12
http://pkgs.fedoraproject.org/cgit/perl-Text-Context.git/commit/?h=master...
8Â years, 3Â months
psabata pushed to perl-Text-CHM (master). "Package cleanup"
by notificationsï¼ fedoraproject.org
From 39b93c163ba19e88ac2a876a5b4e610a506f5a73 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0abata?= <contyk(a)redhat.com>
Date: Wed, 2 Mar 2016 15:16:52 +0100
Subject: Package cleanup
---
perl-Text-CHM.spec | 42 ++++++++++++++----------------------------
1 file changed, 14 insertions(+), 28 deletions(-)
diff --git a/perl-Text-CHM.spec b/perl-Text-CHM.spec
index 94d4616..4aa2012 100644
--- a/perl-Text-CHM.spec
+++ b/perl-Text-CHM.spec
@@ -1,29 +1,25 @@
Name: perl-Text-CHM
Version: 0.01
-Release: 24%{?dist}
+Release: 25%{?dist}
Summary: Perl extension for handling MS Compiled HtmlHelp Files
-
-Group: Development/Libraries
License: GPL+ or Artistic
URL: http://search.cpan.org/dist/Text-CHM
Source0: http://www.cpan.org/modules/by-module/Text/Text-CHM-%{version}.tar.gz
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-
+# Build
BuildRequires: chmlib-devel
-BuildRequires: coreutils
BuildRequires: findutils
BuildRequires: make
BuildRequires: perl
BuildRequires: perl-devel
-BuildRequires: perl(ExtUtils::MakeMaker)
-# Run-time:
+BuildRequires: perl(ExtUtils::MakeMaker) >= 6.76
+# Runtime
BuildRequires: perl(Exporter)
BuildRequires: perl(strict)
BuildRequires: perl(warnings)
BuildRequires: perl(XSLoader)
-# Tests:
+# Tests
BuildRequires: perl(Test)
-Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
+Requires: perl(:MODULE_COMPAT_%(eval "$(perl -V:version)"; echo $version))
%description
Text::CHM is a module that implements a (partial) support for handling MS
@@ -35,38 +31,28 @@ of each file and close them; at the moment, no write support is available.
%prep
%setup -q -n Text-CHM-%{version}
-
%build
-%{__perl} Makefile.PL INSTALLDIRS=vendor OPTIMIZE="$RPM_OPT_FLAGS"
+perl Makefile.PL INSTALLDIRS=vendor OPTIMIZE="%{optflags}" NO_PACKLIST=1
make %{?_smp_mflags}
-
%install
-rm -rf $RPM_BUILD_ROOT
-make pure_install PERL_INSTALL_ROOT=$RPM_BUILD_ROOT
-find $RPM_BUILD_ROOT -type f -name .packlist -exec rm -f {} ';'
-find $RPM_BUILD_ROOT -type f -name '*.bs' -a -size 0 -exec rm -f {} ';'
-find $RPM_BUILD_ROOT -type d -depth -exec rmdir {} 2>/dev/null ';'
-chmod -R u+w $RPM_BUILD_ROOT/*
-
+make pure_install DESTDIR=%{buildroot}
+find %{buildroot} -type f -name '*.bs' -a -size 0 -delete
+%{_fixperms} %{buildroot}/*
%check
make test
-
-%clean
-rm -rf $RPM_BUILD_ROOT
-
-
%files
-%defattr(-,root,root,-)
%doc README Changes
%{perl_vendorarch}/auto/*
%{perl_vendorarch}/Text/
-%{_mandir}/man3/Text::CHM.3*
-
+%{_mandir}/man3/*
%changelog
+* Wed Mar 02 2016 Petr Å abata <contyk(a)redhat.com> - 0.01-25
+- Package cleanup
+
* Thu Feb 04 2016 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.01-24
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
--
cgit v0.12
http://pkgs.fedoraproject.org/cgit/perl-Text-CHM.git/commit/?h=master&id=...
8Â years, 3Â months
psabata pushed to perl-Test-Assertions (master). "Package cleanup"
by notificationsï¼ fedoraproject.org
From 6d1fb22ba697bb995bc5c094213ce5153c4ef981 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0abata?= <contyk(a)redhat.com>
Date: Wed, 2 Mar 2016 14:58:35 +0100
Subject: Package cleanup
---
perl-Test-Assertions.spec | 57 ++++++++++++++++++++++++++++++-----------------
1 file changed, 36 insertions(+), 21 deletions(-)
diff --git a/perl-Test-Assertions.spec b/perl-Test-Assertions.spec
index 085170b..7a605b8 100644
--- a/perl-Test-Assertions.spec
+++ b/perl-Test-Assertions.spec
@@ -1,18 +1,39 @@
Name: perl-Test-Assertions
Version: 1.054
-Release: 19%{?dist}
+Release: 20%{?dist}
Summary: Simple set of building blocks for both unit and runtime testing
License: GPLv2
-Group: Development/Libraries
URL: http://search.cpan.org/dist/Test-Assertions/
Source0: http://www.cpan.org/authors/id/B/BB/BBC/Test-Assertions-%{version}.tar.gz
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildArch: noarch
-BuildRequires: perl(ExtUtils::MakeMaker)
+# Build
+BuildRequires: make
+BuildRequires: perl
+BuildRequires: perl(ExtUtils::MakeMaker) >= 6.76
+# Runtime
+BuildRequires: perl(Carp)
+BuildRequires: perl(File::Basename)
+BuildRequires: perl(File::Compare)
+BuildRequires: perl(File::Spec)
+BuildRequires: perl(Getopt::Long)
+# XXX: BuildRequires: perl(IO::CaptureOutput)
BuildRequires: perl(Log::Trace)
-BuildRequires: perl(Test::Pod)
-BuildRequires: perl(Test::Pod::Coverage)
-Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
+BuildRequires: perl(strict)
+BuildRequires: perl(Test::More)
+BuildRequires: perl(vars)
+# Tests only
+BuildRequires: perl(File::Spec::Functions)
+BuildRequires: perl(Getopt::Std)
+BuildRequires: perl(lib)
+# Optional tests only
+BuildRequires: perl(Test::Pod) >= 1.00
+BuildRequires: perl(Test::Pod::Coverage) >= 1.00
+Requires: perl(:MODULE_COMPAT_%(eval "$(perl -V:version)"; echo $version))
+Requires: perl(Carp)
+Requires: perl(File::Compare)
+Requires: perl(File::Spec)
+Requires: perl(IO::CaptureOutput)
+Requires: perl(Test::More)
%description
Test::Assertions provides a convenient set of tools for constructing tests,
@@ -27,32 +48,26 @@ unit tests, it generates output in the standard form for CPAN unit testing
%setup -q -n Test-Assertions-%{version}
%build
-%{__perl} Makefile.PL INSTALLDIRS=vendor
+perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1
make %{?_smp_mflags}
%install
-rm -rf $RPM_BUILD_ROOT
-
-make pure_install PERL_INSTALL_ROOT=$RPM_BUILD_ROOT
-
-find $RPM_BUILD_ROOT -type f -name .packlist -exec rm -f {} \;
-find $RPM_BUILD_ROOT -depth -type d -exec rmdir {} 2>/dev/null \;
-
-%{_fixperms} $RPM_BUILD_ROOT/*
+make pure_install DESTDIR=%{buildroot}
+%{_fixperms} %{buildroot}/*
%check
make test
-%clean
-rm -rf $RPM_BUILD_ROOT
-
%files
-%defattr(-,root,root,-)
-%doc Changes COPYING README
+%license COPYING
+%doc Changes README
%{perl_vendorlib}/*
%{_mandir}/man3/*
%changelog
+* Wed Mar 02 2016 Petr Å abata <contyk(a)redhat.com> - 1.054-20
+- Package cleanup
+
* Thu Feb 04 2016 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.054-19
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
--
cgit v0.12
http://pkgs.fedoraproject.org/cgit/perl-Test-Assertions.git/commit/?h=mas...
8Â years, 3Â months
ppisar pushed to perl (f22). "Fix CVE-2016-2381 (ambiguous
environment variables handling)"
by notificationsï¼ fedoraproject.org
From 9f81b5131119b07ed7a8d352cfd5a699e1eea4a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar(a)redhat.com>
Date: Wed, 17 Feb 2016 17:14:50 +0100
Subject: Fix CVE-2016-2381 (ambiguous environment variables handling)
---
...licate-environment-variables-from-environ.patch | 112 +++++++++++++++++++++
perl.spec | 11 +-
2 files changed, 122 insertions(+), 1 deletion(-)
create mode 100644 perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
diff --git a/perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch b/perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
new file mode 100644
index 0000000..c2bd72d
--- /dev/null
+++ b/perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
@@ -0,0 +1,112 @@
+From ae37b791a73a9e78dedb89fb2429d2628cf58076 Mon Sep 17 00:00:00 2001
+From: Tony Cook <tony(a)develop-help.com>
+Date: Wed, 27 Jan 2016 11:52:15 +1100
+Subject: [PATCH] remove duplicate environment variables from environ
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If we see duplicate environment variables while iterating over
+environ[]:
+
+a) make sure we use the same value in %ENV that getenv() returns.
+
+Previously on a duplicate, %ENV would have the last entry for the name
+from environ[], but a typical getenv() would return the first entry.
+
+Rather than assuming all getenv() implementations return the first entry
+explicitly call getenv() to ensure they agree.
+
+b) remove duplicate entries from environ
+
+Previously if there was a duplicate definition for a name in environ[]
+setting that name in %ENV could result in an unsafe value being passed
+to a child process, so ensure environ[] has no duplicates.
+
+CVE-2016-2381
+
+Signed-off-by: Petr PÃsaÅ™ <ppisar(a)redhat.com>
+---
+ perl.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 49 insertions(+), 2 deletions(-)
+
+diff --git a/perl.c b/perl.c
+index 4a324c6..5c71fd0 100644
+--- a/perl.c
++++ b/perl.c
+@@ -4329,23 +4329,70 @@ S_init_postdump_symbols(pTHX_ int argc, char **argv, char **env)
+ }
+ if (env) {
+ char *s, *old_var;
++ STRLEN nlen;
+ SV *sv;
++ HV *dups = newHV();
++
+ for (; *env; env++) {
+ old_var = *env;
+
+ if (!(s = strchr(old_var,'=')) || s == old_var)
+ continue;
++ nlen = s - old_var;
+
+ #if defined(MSDOS) && !defined(DJGPP)
+ *s = '\0';
+ (void)strupr(old_var);
+ *s = '=';
+ #endif
+- sv = newSVpv(s+1, 0);
+- (void)hv_store(hv, old_var, s - old_var, sv, 0);
++ if (hv_exists(hv, old_var, nlen)) {
++ const char *name = savepvn(old_var, nlen);
++
++ /* make sure we use the same value as getenv(), otherwise code that
++ uses getenv() (like setlocale()) might see a different value to %ENV
++ */
++ sv = newSVpv(PerlEnv_getenv(name), 0);
++
++ /* keep a count of the dups of this name so we can de-dup environ later */
++ if (hv_exists(dups, name, nlen))
++ ++SvIVX(*hv_fetch(dups, name, nlen, 0));
++ else
++ (void)hv_store(dups, name, nlen, newSViv(1), 0);
++
++ Safefree(name);
++ }
++ else {
++ sv = newSVpv(s+1, 0);
++ }
++ (void)hv_store(hv, old_var, nlen, sv, 0);
+ if (env_is_not_environ)
+ mg_set(sv);
+ }
++ if (HvKEYS(dups)) {
++ /* environ has some duplicate definitions, remove them */
++ HE *entry;
++ hv_iterinit(dups);
++ while ((entry = hv_iternext_flags(dups, 0))) {
++ STRLEN nlen;
++ const char *name = HePV(entry, nlen);
++ IV count = SvIV(HeVAL(entry));
++ IV i;
++ SV **valp = hv_fetch(hv, name, nlen, 0);
++
++ assert(valp);
++
++ /* try to remove any duplicate names, depending on the
++ * implementation used in my_setenv() the iteration might
++ * not be necessary, but let's be safe.
++ */
++ for (i = 0; i < count; ++i)
++ my_setenv(name, 0);
++
++ /* and set it back to the value we set $ENV{name} to */
++ my_setenv(name, SvPV_nolen(*valp));
++ }
++ }
++ SvREFCNT_dec_NN(dups);
+ }
+ #endif /* USE_ENVIRON_ARRAY */
+ #endif /* !PERL_MICRO */
+--
+2.5.0
+
diff --git a/perl.spec b/perl.spec
index b068ffc..256ca51 100644
--- a/perl.spec
+++ b/perl.spec
@@ -30,7 +30,7 @@
Name: perl
Version: %{perl_version}
# release number must be even higher, because dual-lived modules will be broken otherwise
-Release: 328%{?dist}
+Release: 329%{?dist}
Epoch: %{perl_epoch}
Summary: Practical Extraction and Report Language
Group: Development/Languages
@@ -109,6 +109,10 @@ Patch28: perl-5.21.6-t-op-taint.t-Perform-SHA-256-algorithm-by-crypt-if-d
# riIn upstream after 5.21.3
Patch29: perl-5.21.3-fix-debugger-y-command-scope-level.patch
+# Fix CVE-2016-2381 (ambiguous environment variables handling), bug #1313702,
+# in upstream after 5.23.8
+Patch30: perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
+
# Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048
Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
@@ -2048,6 +2052,7 @@ tarball from perl.org.
%patch27 -p1
%patch28 -p1
%patch29 -p1
+%patch30 -p1
%patch200 -p1
%patch201 -p1
@@ -2070,6 +2075,7 @@ perl -x patchlevel.h \
'Fedora Patch27: Report inaccesible file on failed require (RT#123270)' \
'Fedora Patch28: Use stronger algorithm needed for FIPS in t/op/taint.t (RT#123338)' \
'Fedora Patch29: Fix debugger y command scope level' \
+ 'Fedora Patch30: Fix CVE-2016-2381 (ambiguous environment variables handling)' \
'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \
'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \
%{nil}
@@ -3923,6 +3929,9 @@ sed \
# Old changelog entries are preserved in CVS.
%changelog
+* Wed Mar 02 2016 Petr Pisar <ppisar(a)redhat.com> - 4:5.20.3-329
+- Fix CVE-2016-2381 (ambiguous environment variables handling) (bug #1313702)
+
* Thu Sep 24 2015 Jitka Plesnikova <jplesnik(a)redhat.com> - 4:5.20.3-328
- Fix debugger y command scope level (bug #1129850)
--
cgit v0.12
http://pkgs.fedoraproject.org/cgit/perl.git/commit/?h=f22&id=9f81b5131119...
8Â years, 3Â months
ppisar pushed to perl (f23). "Fix CVE-2016-2381 (ambiguous
environment variables handling)"
by notificationsï¼ fedoraproject.org
From 0c05dbd53cff82c632b875728119de034201eac8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar(a)redhat.com>
Date: Wed, 17 Feb 2016 17:14:50 +0100
Subject: Fix CVE-2016-2381 (ambiguous environment variables handling)
---
...licate-environment-variables-from-environ.patch | 112 +++++++++++++++++++++
perl.spec | 11 +-
2 files changed, 122 insertions(+), 1 deletion(-)
create mode 100644 perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
diff --git a/perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch b/perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
new file mode 100644
index 0000000..c2bd72d
--- /dev/null
+++ b/perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
@@ -0,0 +1,112 @@
+From ae37b791a73a9e78dedb89fb2429d2628cf58076 Mon Sep 17 00:00:00 2001
+From: Tony Cook <tony(a)develop-help.com>
+Date: Wed, 27 Jan 2016 11:52:15 +1100
+Subject: [PATCH] remove duplicate environment variables from environ
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If we see duplicate environment variables while iterating over
+environ[]:
+
+a) make sure we use the same value in %ENV that getenv() returns.
+
+Previously on a duplicate, %ENV would have the last entry for the name
+from environ[], but a typical getenv() would return the first entry.
+
+Rather than assuming all getenv() implementations return the first entry
+explicitly call getenv() to ensure they agree.
+
+b) remove duplicate entries from environ
+
+Previously if there was a duplicate definition for a name in environ[]
+setting that name in %ENV could result in an unsafe value being passed
+to a child process, so ensure environ[] has no duplicates.
+
+CVE-2016-2381
+
+Signed-off-by: Petr PÃsaÅ™ <ppisar(a)redhat.com>
+---
+ perl.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 49 insertions(+), 2 deletions(-)
+
+diff --git a/perl.c b/perl.c
+index 4a324c6..5c71fd0 100644
+--- a/perl.c
++++ b/perl.c
+@@ -4329,23 +4329,70 @@ S_init_postdump_symbols(pTHX_ int argc, char **argv, char **env)
+ }
+ if (env) {
+ char *s, *old_var;
++ STRLEN nlen;
+ SV *sv;
++ HV *dups = newHV();
++
+ for (; *env; env++) {
+ old_var = *env;
+
+ if (!(s = strchr(old_var,'=')) || s == old_var)
+ continue;
++ nlen = s - old_var;
+
+ #if defined(MSDOS) && !defined(DJGPP)
+ *s = '\0';
+ (void)strupr(old_var);
+ *s = '=';
+ #endif
+- sv = newSVpv(s+1, 0);
+- (void)hv_store(hv, old_var, s - old_var, sv, 0);
++ if (hv_exists(hv, old_var, nlen)) {
++ const char *name = savepvn(old_var, nlen);
++
++ /* make sure we use the same value as getenv(), otherwise code that
++ uses getenv() (like setlocale()) might see a different value to %ENV
++ */
++ sv = newSVpv(PerlEnv_getenv(name), 0);
++
++ /* keep a count of the dups of this name so we can de-dup environ later */
++ if (hv_exists(dups, name, nlen))
++ ++SvIVX(*hv_fetch(dups, name, nlen, 0));
++ else
++ (void)hv_store(dups, name, nlen, newSViv(1), 0);
++
++ Safefree(name);
++ }
++ else {
++ sv = newSVpv(s+1, 0);
++ }
++ (void)hv_store(hv, old_var, nlen, sv, 0);
+ if (env_is_not_environ)
+ mg_set(sv);
+ }
++ if (HvKEYS(dups)) {
++ /* environ has some duplicate definitions, remove them */
++ HE *entry;
++ hv_iterinit(dups);
++ while ((entry = hv_iternext_flags(dups, 0))) {
++ STRLEN nlen;
++ const char *name = HePV(entry, nlen);
++ IV count = SvIV(HeVAL(entry));
++ IV i;
++ SV **valp = hv_fetch(hv, name, nlen, 0);
++
++ assert(valp);
++
++ /* try to remove any duplicate names, depending on the
++ * implementation used in my_setenv() the iteration might
++ * not be necessary, but let's be safe.
++ */
++ for (i = 0; i < count; ++i)
++ my_setenv(name, 0);
++
++ /* and set it back to the value we set $ENV{name} to */
++ my_setenv(name, SvPV_nolen(*valp));
++ }
++ }
++ SvREFCNT_dec_NN(dups);
+ }
+ #endif /* USE_ENVIRON_ARRAY */
+ #endif /* !PERL_MICRO */
+--
+2.5.0
+
diff --git a/perl.spec b/perl.spec
index c097dd0..80283f6 100644
--- a/perl.spec
+++ b/perl.spec
@@ -30,7 +30,7 @@
Name: perl
Version: %{perl_version}
# release number must be even higher, because dual-lived modules will be broken otherwise
-Release: 350%{?dist}
+Release: 351%{?dist}
Epoch: %{perl_epoch}
Summary: Practical Extraction and Report Language
Group: Development/Languages
@@ -92,6 +92,10 @@ Patch27: perl-5.22.0-make-PadlistNAMES-lvalue-again.patch
# Workaround for Coro, bug #1231165, CPAN RT#101063. To remove in the future.
Patch28: perl-5.22.0-Revert-const-the-core-magic-vtables.patch
+# Fix CVE-2016-2381 (ambiguous environment variables handling), bug #1313702,
+# in upstream after 5.23.8
+Patch29: perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
+
# Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048
Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
@@ -2133,6 +2137,7 @@ Perl extension for Version Objects
%patch26 -p1
%patch27 -p1
%patch28 -p1
+%patch29 -p1
%patch200 -p1
%patch201 -p1
@@ -2153,6 +2158,7 @@ perl -x patchlevel.h \
'Fedora Patch26: Make *DBM_File desctructors thread-safe (RT#61912)' \
'Fedora Patch27: Make PadlistNAMES() lvalue again (CPAN RT#101063)' \
'Fedora Patch28: Make magic vtable writable as a work-around for Coro (CPAN RT#101063)' \
+ 'Fedora Patch29: Fix CVE-2016-2381 (ambiguous environment variables handling)' \
'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \
'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \
%{nil}
@@ -4166,6 +4172,9 @@ popd
# Old changelog entries are preserved in CVS.
%changelog
+* Wed Mar 02 2016 Petr Pisar <ppisar(a)redhat.com> - 4:5.22.1-351
+- Fix CVE-2016-2381 (ambiguous environment variables handling) (bug #1313702)
+
* Mon Dec 14 2015 Jitka Plesnikova <jplesnik(a)redhat.com> - 5.22.1-350
- 5.22.1 bump (see <http://search.cpan.org/dist/perl-5.22.1/pod/perldelta.pod>
for release notes)
--
cgit v0.12
http://pkgs.fedoraproject.org/cgit/perl.git/commit/?h=f23&id=0c05dbd53cff...
8Â years, 3Â months
ppisar pushed to perl (f23). "Correct changelog entry"
by notificationsï¼ fedoraproject.org
From 314f4a5a991ece597fa10de650eb8bbd0846d334 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar(a)redhat.com>
Date: Wed, 2 Mar 2016 14:14:20 +0100
Subject: Correct changelog entry
---
perl.spec | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/perl.spec b/perl.spec
index 2654c2f..c097dd0 100644
--- a/perl.spec
+++ b/perl.spec
@@ -4166,7 +4166,7 @@ popd
# Old changelog entries are preserved in CVS.
%changelog
-* Mon Dec 14 2015 Jitka Plesnikova <jplesnik(a)redhat.com> - 5.22.1-354
+* Mon Dec 14 2015 Jitka Plesnikova <jplesnik(a)redhat.com> - 5.22.1-350
- 5.22.1 bump (see <http://search.cpan.org/dist/perl-5.22.1/pod/perldelta.pod>
for release notes)
- Provide perl version in perl(:VERSION) dependency symbol
--
cgit v0.12
http://pkgs.fedoraproject.org/cgit/perl.git/commit/?h=f23&id=314f4a5a991e...
8Â years, 3Â months
ppisar pushed to perl (f24). "Fix CVE-2016-2381 (ambiguous
environment variables handling)"
by notificationsï¼ fedoraproject.org
From e55807fcfbeab0114f102fab32d202f1377133e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar(a)redhat.com>
Date: Wed, 17 Feb 2016 17:14:50 +0100
Subject: Fix CVE-2016-2381 (ambiguous environment variables handling)
---
...licate-environment-variables-from-environ.patch | 112 +++++++++++++++++++++
perl.spec | 11 +-
2 files changed, 122 insertions(+), 1 deletion(-)
create mode 100644 perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
diff --git a/perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch b/perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
new file mode 100644
index 0000000..c2bd72d
--- /dev/null
+++ b/perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
@@ -0,0 +1,112 @@
+From ae37b791a73a9e78dedb89fb2429d2628cf58076 Mon Sep 17 00:00:00 2001
+From: Tony Cook <tony(a)develop-help.com>
+Date: Wed, 27 Jan 2016 11:52:15 +1100
+Subject: [PATCH] remove duplicate environment variables from environ
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If we see duplicate environment variables while iterating over
+environ[]:
+
+a) make sure we use the same value in %ENV that getenv() returns.
+
+Previously on a duplicate, %ENV would have the last entry for the name
+from environ[], but a typical getenv() would return the first entry.
+
+Rather than assuming all getenv() implementations return the first entry
+explicitly call getenv() to ensure they agree.
+
+b) remove duplicate entries from environ
+
+Previously if there was a duplicate definition for a name in environ[]
+setting that name in %ENV could result in an unsafe value being passed
+to a child process, so ensure environ[] has no duplicates.
+
+CVE-2016-2381
+
+Signed-off-by: Petr PÃsaÅ™ <ppisar(a)redhat.com>
+---
+ perl.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 49 insertions(+), 2 deletions(-)
+
+diff --git a/perl.c b/perl.c
+index 4a324c6..5c71fd0 100644
+--- a/perl.c
++++ b/perl.c
+@@ -4329,23 +4329,70 @@ S_init_postdump_symbols(pTHX_ int argc, char **argv, char **env)
+ }
+ if (env) {
+ char *s, *old_var;
++ STRLEN nlen;
+ SV *sv;
++ HV *dups = newHV();
++
+ for (; *env; env++) {
+ old_var = *env;
+
+ if (!(s = strchr(old_var,'=')) || s == old_var)
+ continue;
++ nlen = s - old_var;
+
+ #if defined(MSDOS) && !defined(DJGPP)
+ *s = '\0';
+ (void)strupr(old_var);
+ *s = '=';
+ #endif
+- sv = newSVpv(s+1, 0);
+- (void)hv_store(hv, old_var, s - old_var, sv, 0);
++ if (hv_exists(hv, old_var, nlen)) {
++ const char *name = savepvn(old_var, nlen);
++
++ /* make sure we use the same value as getenv(), otherwise code that
++ uses getenv() (like setlocale()) might see a different value to %ENV
++ */
++ sv = newSVpv(PerlEnv_getenv(name), 0);
++
++ /* keep a count of the dups of this name so we can de-dup environ later */
++ if (hv_exists(dups, name, nlen))
++ ++SvIVX(*hv_fetch(dups, name, nlen, 0));
++ else
++ (void)hv_store(dups, name, nlen, newSViv(1), 0);
++
++ Safefree(name);
++ }
++ else {
++ sv = newSVpv(s+1, 0);
++ }
++ (void)hv_store(hv, old_var, nlen, sv, 0);
+ if (env_is_not_environ)
+ mg_set(sv);
+ }
++ if (HvKEYS(dups)) {
++ /* environ has some duplicate definitions, remove them */
++ HE *entry;
++ hv_iterinit(dups);
++ while ((entry = hv_iternext_flags(dups, 0))) {
++ STRLEN nlen;
++ const char *name = HePV(entry, nlen);
++ IV count = SvIV(HeVAL(entry));
++ IV i;
++ SV **valp = hv_fetch(hv, name, nlen, 0);
++
++ assert(valp);
++
++ /* try to remove any duplicate names, depending on the
++ * implementation used in my_setenv() the iteration might
++ * not be necessary, but let's be safe.
++ */
++ for (i = 0; i < count; ++i)
++ my_setenv(name, 0);
++
++ /* and set it back to the value we set $ENV{name} to */
++ my_setenv(name, SvPV_nolen(*valp));
++ }
++ }
++ SvREFCNT_dec_NN(dups);
+ }
+ #endif /* USE_ENVIRON_ARRAY */
+ #endif /* !PERL_MICRO */
+--
+2.5.0
+
diff --git a/perl.spec b/perl.spec
index 61c1f5d..67a0426 100644
--- a/perl.spec
+++ b/perl.spec
@@ -29,7 +29,7 @@
Name: perl
Version: %{perl_version}
# release number must be even higher, because dual-lived modules will be broken otherwise
-Release: 356%{?dist}
+Release: 357%{?dist}
Epoch: %{perl_epoch}
Summary: Practical Extraction and Report Language
Group: Development/Languages
@@ -91,6 +91,10 @@ Patch27: perl-5.22.0-make-PadlistNAMES-lvalue-again.patch
# Workaround for Coro, bug #1231165, CPAN RT#101063. To remove in the future.
Patch28: perl-5.22.0-Revert-const-the-core-magic-vtables.patch
+# Fix CVE-2016-2381 (ambiguous environment variables handling), bug #1313702,
+# in upstream after 5.23.8
+Patch29: perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
+
# Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048
Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
@@ -2358,6 +2362,7 @@ Perl extension for Version Objects
%patch26 -p1
%patch27 -p1
%patch28 -p1
+%patch29 -p1
%patch200 -p1
%patch201 -p1
@@ -2378,6 +2383,7 @@ perl -x patchlevel.h \
'Fedora Patch26: Make *DBM_File desctructors thread-safe (RT#61912)' \
'Fedora Patch27: Make PadlistNAMES() lvalue again (CPAN RT#101063)' \
'Fedora Patch28: Make magic vtable writable as a work-around for Coro (CPAN RT#101063)' \
+ 'Fedora Patch29: Fix CVE-2016-2381 (ambiguous environment variables handling)' \
'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \
'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \
%{nil}
@@ -4628,6 +4634,9 @@ popd
# Old changelog entries are preserved in CVS.
%changelog
+* Wed Mar 02 2016 Petr Pisar <ppisar(a)redhat.com> - 4:5.22.1-357
+- Fix CVE-2016-2381 (ambiguous environment variables handling) (bug #1313702)
+
* Thu Feb 04 2016 Fedora Release Engineering <releng(a)fedoraproject.org> - 4:5.22.1-356
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
--
cgit v0.12
http://pkgs.fedoraproject.org/cgit/perl.git/commit/?h=f24&id=e55807fcfbea...
8Â years, 3Â months
ppisar pushed to perl (master). "Fix CVE-2016-2381 (ambiguous
environment variables handling)"
by notificationsï¼ fedoraproject.org
From e55807fcfbeab0114f102fab32d202f1377133e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar(a)redhat.com>
Date: Wed, 17 Feb 2016 17:14:50 +0100
Subject: Fix CVE-2016-2381 (ambiguous environment variables handling)
---
...licate-environment-variables-from-environ.patch | 112 +++++++++++++++++++++
perl.spec | 11 +-
2 files changed, 122 insertions(+), 1 deletion(-)
create mode 100644 perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
diff --git a/perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch b/perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
new file mode 100644
index 0000000..c2bd72d
--- /dev/null
+++ b/perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
@@ -0,0 +1,112 @@
+From ae37b791a73a9e78dedb89fb2429d2628cf58076 Mon Sep 17 00:00:00 2001
+From: Tony Cook <tony(a)develop-help.com>
+Date: Wed, 27 Jan 2016 11:52:15 +1100
+Subject: [PATCH] remove duplicate environment variables from environ
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If we see duplicate environment variables while iterating over
+environ[]:
+
+a) make sure we use the same value in %ENV that getenv() returns.
+
+Previously on a duplicate, %ENV would have the last entry for the name
+from environ[], but a typical getenv() would return the first entry.
+
+Rather than assuming all getenv() implementations return the first entry
+explicitly call getenv() to ensure they agree.
+
+b) remove duplicate entries from environ
+
+Previously if there was a duplicate definition for a name in environ[]
+setting that name in %ENV could result in an unsafe value being passed
+to a child process, so ensure environ[] has no duplicates.
+
+CVE-2016-2381
+
+Signed-off-by: Petr PÃsaÅ™ <ppisar(a)redhat.com>
+---
+ perl.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 49 insertions(+), 2 deletions(-)
+
+diff --git a/perl.c b/perl.c
+index 4a324c6..5c71fd0 100644
+--- a/perl.c
++++ b/perl.c
+@@ -4329,23 +4329,70 @@ S_init_postdump_symbols(pTHX_ int argc, char **argv, char **env)
+ }
+ if (env) {
+ char *s, *old_var;
++ STRLEN nlen;
+ SV *sv;
++ HV *dups = newHV();
++
+ for (; *env; env++) {
+ old_var = *env;
+
+ if (!(s = strchr(old_var,'=')) || s == old_var)
+ continue;
++ nlen = s - old_var;
+
+ #if defined(MSDOS) && !defined(DJGPP)
+ *s = '\0';
+ (void)strupr(old_var);
+ *s = '=';
+ #endif
+- sv = newSVpv(s+1, 0);
+- (void)hv_store(hv, old_var, s - old_var, sv, 0);
++ if (hv_exists(hv, old_var, nlen)) {
++ const char *name = savepvn(old_var, nlen);
++
++ /* make sure we use the same value as getenv(), otherwise code that
++ uses getenv() (like setlocale()) might see a different value to %ENV
++ */
++ sv = newSVpv(PerlEnv_getenv(name), 0);
++
++ /* keep a count of the dups of this name so we can de-dup environ later */
++ if (hv_exists(dups, name, nlen))
++ ++SvIVX(*hv_fetch(dups, name, nlen, 0));
++ else
++ (void)hv_store(dups, name, nlen, newSViv(1), 0);
++
++ Safefree(name);
++ }
++ else {
++ sv = newSVpv(s+1, 0);
++ }
++ (void)hv_store(hv, old_var, nlen, sv, 0);
+ if (env_is_not_environ)
+ mg_set(sv);
+ }
++ if (HvKEYS(dups)) {
++ /* environ has some duplicate definitions, remove them */
++ HE *entry;
++ hv_iterinit(dups);
++ while ((entry = hv_iternext_flags(dups, 0))) {
++ STRLEN nlen;
++ const char *name = HePV(entry, nlen);
++ IV count = SvIV(HeVAL(entry));
++ IV i;
++ SV **valp = hv_fetch(hv, name, nlen, 0);
++
++ assert(valp);
++
++ /* try to remove any duplicate names, depending on the
++ * implementation used in my_setenv() the iteration might
++ * not be necessary, but let's be safe.
++ */
++ for (i = 0; i < count; ++i)
++ my_setenv(name, 0);
++
++ /* and set it back to the value we set $ENV{name} to */
++ my_setenv(name, SvPV_nolen(*valp));
++ }
++ }
++ SvREFCNT_dec_NN(dups);
+ }
+ #endif /* USE_ENVIRON_ARRAY */
+ #endif /* !PERL_MICRO */
+--
+2.5.0
+
diff --git a/perl.spec b/perl.spec
index 61c1f5d..67a0426 100644
--- a/perl.spec
+++ b/perl.spec
@@ -29,7 +29,7 @@
Name: perl
Version: %{perl_version}
# release number must be even higher, because dual-lived modules will be broken otherwise
-Release: 356%{?dist}
+Release: 357%{?dist}
Epoch: %{perl_epoch}
Summary: Practical Extraction and Report Language
Group: Development/Languages
@@ -91,6 +91,10 @@ Patch27: perl-5.22.0-make-PadlistNAMES-lvalue-again.patch
# Workaround for Coro, bug #1231165, CPAN RT#101063. To remove in the future.
Patch28: perl-5.22.0-Revert-const-the-core-magic-vtables.patch
+# Fix CVE-2016-2381 (ambiguous environment variables handling), bug #1313702,
+# in upstream after 5.23.8
+Patch29: perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch
+
# Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048
Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
@@ -2358,6 +2362,7 @@ Perl extension for Version Objects
%patch26 -p1
%patch27 -p1
%patch28 -p1
+%patch29 -p1
%patch200 -p1
%patch201 -p1
@@ -2378,6 +2383,7 @@ perl -x patchlevel.h \
'Fedora Patch26: Make *DBM_File desctructors thread-safe (RT#61912)' \
'Fedora Patch27: Make PadlistNAMES() lvalue again (CPAN RT#101063)' \
'Fedora Patch28: Make magic vtable writable as a work-around for Coro (CPAN RT#101063)' \
+ 'Fedora Patch29: Fix CVE-2016-2381 (ambiguous environment variables handling)' \
'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \
'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \
%{nil}
@@ -4628,6 +4634,9 @@ popd
# Old changelog entries are preserved in CVS.
%changelog
+* Wed Mar 02 2016 Petr Pisar <ppisar(a)redhat.com> - 4:5.22.1-357
+- Fix CVE-2016-2381 (ambiguous environment variables handling) (bug #1313702)
+
* Thu Feb 04 2016 Fedora Release Engineering <releng(a)fedoraproject.org> - 4:5.22.1-356
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
--
cgit v0.12
http://pkgs.fedoraproject.org/cgit/perl.git/commit/?h=master&id=e55807fcf...
8Â years, 3Â months
psabata pushed to perl-Term-Size-Perl (master). "Package cleanup"
by notificationsï¼ fedoraproject.org
From bb3a01f8dd62bbe571daa5a0c691956c01daab60 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0abata?= <contyk(a)redhat.com>
Date: Wed, 2 Mar 2016 12:37:02 +0100
Subject: Package cleanup
---
perl-Term-Size-Perl.spec | 40 ++++++++++++++++++++--------------------
1 file changed, 20 insertions(+), 20 deletions(-)
diff --git a/perl-Term-Size-Perl.spec b/perl-Term-Size-Perl.spec
index 5a85c6f..66c050d 100644
--- a/perl-Term-Size-Perl.spec
+++ b/perl-Term-Size-Perl.spec
@@ -1,18 +1,25 @@
Name: perl-Term-Size-Perl
Version: 0.029
-Release: 20%{?dist}
+Release: 21%{?dist}
Summary: Perl extension for retrieving terminal size (Perl version)
License: GPL+ or Artistic
-Group: Development/Libraries
URL: http://search.cpan.org/dist/Term-Size-Perl/
Source0: http://www.cpan.org/authors/id/F/FE/FERREIRA/Term-Size-Perl-%{version}.ta...
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+# Build
+BuildRequires: gcc
+BuildRequires: make
+BuildRequires: perl
BuildRequires: perl(ExtUtils::CBuilder)
-BuildRequires: perl(ExtUtils::MakeMaker)
+BuildRequires: perl(ExtUtils::MakeMaker) >= 6.76
+# Runtime
+BuildRequires: perl(Exporter)
+BuildRequires: perl(strict)
+# Tests only
BuildRequires: perl(Test::More)
-BuildRequires: perl(Test::Pod)
-BuildRequires: perl(Test::Pod::Coverage)
-Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
+# Optional tests only
+BuildRequires: perl(Test::Pod) >= 1.18
+BuildRequires: perl(Test::Pod::Coverage) >= 1.04
+Requires: perl(:MODULE_COMPAT_%(eval "$(perl -V:version)"; echo $version))
# although the resulting rpm appears to be noarch, the build is arch-dependent
# and produces different code for ppc and x86
@@ -26,32 +33,25 @@ exception of a C probe run on build time.
%setup -q -n Term-Size-Perl-%{version}
%build
-%{__perl} Makefile.PL INSTALLDIRS=vendor
+perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1
make %{?_smp_mflags}
%install
-rm -rf $RPM_BUILD_ROOT
-
-make pure_install PERL_INSTALL_ROOT=$RPM_BUILD_ROOT
-
-find $RPM_BUILD_ROOT -type f -name .packlist -exec rm -f {} \;
-find $RPM_BUILD_ROOT -depth -type d -exec rmdir {} 2>/dev/null \;
-
-%{_fixperms} $RPM_BUILD_ROOT/*
+make pure_install DESTDIR=%{buildroot}
+%{_fixperms} %{buildroot}/*
%check
make test
-%clean
-rm -rf $RPM_BUILD_ROOT
-
%files
-%defattr(-,root,root,-)
%doc Changes README
%{perl_vendorlib}/*
%{_mandir}/man3/*
%changelog
+* Wed Mar 02 2016 Petr Å abata <contyk(a)redhat.com> - 0.029-21
+- Package cleanup
+
* Thu Feb 04 2016 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.029-20
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
--
cgit v0.12
http://pkgs.fedoraproject.org/cgit/perl-Term-Size-Perl.git/commit/?h=mast...
8Â years, 3Â months