summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthias Maier <tamiko@gentoo.org>2015-11-18 13:25:53 -0600
committerMatthias Maier <tamiko@gentoo.org>2015-11-18 13:25:53 -0600
commitb74805e260664d8d968d65ca63c00c99c31e762d (patch)
tree7e4aa5f6ae98950a0bd68f4c583ac90657ec3990 /app-emulation/spice/files
parentnet-analyzer/openvas-libraries: Update patch to work with ld.bfd (diff)
downloadgentoo-b74805e260664d8d968d65ca63c00c99c31e762d.tar.gz
gentoo-b74805e260664d8d968d65ca63c00c99c31e762d.tar.bz2
gentoo-b74805e260664d8d968d65ca63c00c99c31e762d.zip
app-emulation/spice: drop vulnerable (bug #562890, CVE-2015-{5260,5261})
Drop vulnerable version 0.12.5 Gentoo-Bug: 562890 Package-Manager: portage-2.2.24
Diffstat (limited to 'app-emulation/spice/files')
-rw-r--r--app-emulation/spice/files/spice-0.12.5-fix-assert-in-mjpeg_encoder_adjust_params_to_bit_rate.patch30
-rw-r--r--app-emulation/spice/files/spice-0.12.5-fix-crash-when-clearing-surface-memory.patch31
-rw-r--r--app-emulation/spice/files/spice-0.12.5-server-dont-assert-on-invalid-client-message.patch30
3 files changed, 0 insertions, 91 deletions
diff --git a/app-emulation/spice/files/spice-0.12.5-fix-assert-in-mjpeg_encoder_adjust_params_to_bit_rate.patch b/app-emulation/spice/files/spice-0.12.5-fix-assert-in-mjpeg_encoder_adjust_params_to_bit_rate.patch
deleted file mode 100644
index 0ced72887065..000000000000
--- a/app-emulation/spice/files/spice-0.12.5-fix-assert-in-mjpeg_encoder_adjust_params_to_bit_rate.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 284cca2a5ebc98257275585083321a7100fb89b3 Mon Sep 17 00:00:00 2001
-From: Jonathon Jongsma <jjongsma@redhat.com>
-Date: Fri, 30 May 2014 18:45:02 +0000
-Subject: Fix assert in mjpeg_encoder_adjust_params_to_bit_rate()
-
-If mjpeg_encoder_reset_quality() is called with the same quality as currently
-set, it will not reset last_enc_size but not reset num_recent_enc_frames,
-violating some assumptions in _adjust_params_to_bit_rate(). To avoid aborting
-the server, simply return early from this function.
-
-Resolves: rhbz#1086820
----
-diff --git a/server/mjpeg_encoder.c b/server/mjpeg_encoder.c
-index f465d88..12447da 100644
---- a/server/mjpeg_encoder.c
-+++ b/server/mjpeg_encoder.c
-@@ -625,7 +625,10 @@ static void mjpeg_encoder_adjust_params_to_bit_rate(MJpegEncoder *encoder)
- return;
- }
-
-- spice_assert(rate_control->num_recent_enc_frames);
-+ if (!rate_control->num_recent_enc_frames) {
-+ spice_debug("No recent encoded frames");
-+ return;
-+ }
-
- if (rate_control->num_recent_enc_frames < MJPEG_AVERAGE_SIZE_WINDOW &&
- rate_control->num_recent_enc_frames < rate_control->fps) {
---
-cgit v0.9.0.2-2-gbebe
diff --git a/app-emulation/spice/files/spice-0.12.5-fix-crash-when-clearing-surface-memory.patch b/app-emulation/spice/files/spice-0.12.5-fix-crash-when-clearing-surface-memory.patch
deleted file mode 100644
index b14a56b1d245..000000000000
--- a/app-emulation/spice/files/spice-0.12.5-fix-crash-when-clearing-surface-memory.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 1898f3949cf75422aa1fedba40c429b28d8d6b67 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@gmail.com>
-Date: Wed, 6 Aug 2014 18:34:56 +0200
-Subject: Fix crash when clearing surface memory
-
-The beginning of the surface data needs to be computed correctly if the
-stride is negative, otherwise, it should point already to the beginning
-of the surface data. This bug seems to exists since 4a208b (0.5.2)
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1029646
-
-diff --git a/server/red_worker.c b/server/red_worker.c
-index 6bdad93..35a1a04 100644
---- a/server/red_worker.c
-+++ b/server/red_worker.c
-@@ -9470,7 +9470,11 @@ static inline void red_create_surface(RedWorker *worker, uint32_t surface_id, ui
- surface->context.stride = stride;
- surface->context.line_0 = line_0;
- if (!data_is_valid) {
-- memset((char *)line_0 + (int32_t)(stride * (height - 1)), 0, height*abs(stride));
-+ char *data = line_0;
-+ if (stride < 0) {
-+ data -= abs(stride) * (height - 1);
-+ }
-+ memset(data, 0, height*abs(stride));
- }
- surface->create.info = NULL;
- surface->destroy.info = NULL;
---
-cgit v0.10.2
-
diff --git a/app-emulation/spice/files/spice-0.12.5-server-dont-assert-on-invalid-client-message.patch b/app-emulation/spice/files/spice-0.12.5-server-dont-assert-on-invalid-client-message.patch
deleted file mode 100644
index d9b49a4abb27..000000000000
--- a/app-emulation/spice/files/spice-0.12.5-server-dont-assert-on-invalid-client-message.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 3c25192ee90f843a2f84ff99d119b1cb45979bac Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@gmail.com>
-Date: Wed, 25 Jun 2014 14:36:03 +0200
-Subject: server: don't assert on invalid client message
-
-Some users have been reaching this error:
-snd_receive: ASSERT n failed
-
-A misbehaving client could easily hit that condition by sending too big
-messages. Instead of assert(), replace with a warning. When a message
-too big to fit is received, it will simply disconnect the channel.
-
-https://bugzilla.redhat.com/show_bug.cgi?id=962187
-
-diff --git a/server/snd_worker.c b/server/snd_worker.c
-index 7d52ded..70148b7 100644
---- a/server/snd_worker.c
-+++ b/server/snd_worker.c
-@@ -421,7 +421,7 @@ static void snd_receive(void* data)
- for (;;) {
- ssize_t n;
- n = channel->receive_data.end - channel->receive_data.now;
-- spice_assert(n);
-+ spice_warn_if(n <= 0);
- n = reds_stream_read(channel->stream, channel->receive_data.now, n);
- if (n <= 0) {
- if (n == 0) {
---
-cgit v0.10.2
-