diff options
author | Matthias Maier <tamiko@gentoo.org> | 2015-11-18 13:25:53 -0600 |
---|---|---|
committer | Matthias Maier <tamiko@gentoo.org> | 2015-11-18 13:25:53 -0600 |
commit | b74805e260664d8d968d65ca63c00c99c31e762d (patch) | |
tree | 7e4aa5f6ae98950a0bd68f4c583ac90657ec3990 /app-emulation/spice/files | |
parent | net-analyzer/openvas-libraries: Update patch to work with ld.bfd (diff) | |
download | gentoo-b74805e260664d8d968d65ca63c00c99c31e762d.tar.gz gentoo-b74805e260664d8d968d65ca63c00c99c31e762d.tar.bz2 gentoo-b74805e260664d8d968d65ca63c00c99c31e762d.zip |
app-emulation/spice: drop vulnerable (bug #562890, CVE-2015-{5260,5261})
Drop vulnerable version 0.12.5
Gentoo-Bug: 562890
Package-Manager: portage-2.2.24
Diffstat (limited to 'app-emulation/spice/files')
3 files changed, 0 insertions, 91 deletions
diff --git a/app-emulation/spice/files/spice-0.12.5-fix-assert-in-mjpeg_encoder_adjust_params_to_bit_rate.patch b/app-emulation/spice/files/spice-0.12.5-fix-assert-in-mjpeg_encoder_adjust_params_to_bit_rate.patch deleted file mode 100644 index 0ced72887065..000000000000 --- a/app-emulation/spice/files/spice-0.12.5-fix-assert-in-mjpeg_encoder_adjust_params_to_bit_rate.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 284cca2a5ebc98257275585083321a7100fb89b3 Mon Sep 17 00:00:00 2001 -From: Jonathon Jongsma <jjongsma@redhat.com> -Date: Fri, 30 May 2014 18:45:02 +0000 -Subject: Fix assert in mjpeg_encoder_adjust_params_to_bit_rate() - -If mjpeg_encoder_reset_quality() is called with the same quality as currently -set, it will not reset last_enc_size but not reset num_recent_enc_frames, -violating some assumptions in _adjust_params_to_bit_rate(). To avoid aborting -the server, simply return early from this function. - -Resolves: rhbz#1086820 ---- -diff --git a/server/mjpeg_encoder.c b/server/mjpeg_encoder.c -index f465d88..12447da 100644 ---- a/server/mjpeg_encoder.c -+++ b/server/mjpeg_encoder.c -@@ -625,7 +625,10 @@ static void mjpeg_encoder_adjust_params_to_bit_rate(MJpegEncoder *encoder) - return; - } - -- spice_assert(rate_control->num_recent_enc_frames); -+ if (!rate_control->num_recent_enc_frames) { -+ spice_debug("No recent encoded frames"); -+ return; -+ } - - if (rate_control->num_recent_enc_frames < MJPEG_AVERAGE_SIZE_WINDOW && - rate_control->num_recent_enc_frames < rate_control->fps) { --- -cgit v0.9.0.2-2-gbebe diff --git a/app-emulation/spice/files/spice-0.12.5-fix-crash-when-clearing-surface-memory.patch b/app-emulation/spice/files/spice-0.12.5-fix-crash-when-clearing-surface-memory.patch deleted file mode 100644 index b14a56b1d245..000000000000 --- a/app-emulation/spice/files/spice-0.12.5-fix-crash-when-clearing-surface-memory.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 1898f3949cf75422aa1fedba40c429b28d8d6b67 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@gmail.com> -Date: Wed, 6 Aug 2014 18:34:56 +0200 -Subject: Fix crash when clearing surface memory - -The beginning of the surface data needs to be computed correctly if the -stride is negative, otherwise, it should point already to the beginning -of the surface data. This bug seems to exists since 4a208b (0.5.2) - -https://bugzilla.redhat.com/show_bug.cgi?id=1029646 - -diff --git a/server/red_worker.c b/server/red_worker.c -index 6bdad93..35a1a04 100644 ---- a/server/red_worker.c -+++ b/server/red_worker.c -@@ -9470,7 +9470,11 @@ static inline void red_create_surface(RedWorker *worker, uint32_t surface_id, ui - surface->context.stride = stride; - surface->context.line_0 = line_0; - if (!data_is_valid) { -- memset((char *)line_0 + (int32_t)(stride * (height - 1)), 0, height*abs(stride)); -+ char *data = line_0; -+ if (stride < 0) { -+ data -= abs(stride) * (height - 1); -+ } -+ memset(data, 0, height*abs(stride)); - } - surface->create.info = NULL; - surface->destroy.info = NULL; --- -cgit v0.10.2 - diff --git a/app-emulation/spice/files/spice-0.12.5-server-dont-assert-on-invalid-client-message.patch b/app-emulation/spice/files/spice-0.12.5-server-dont-assert-on-invalid-client-message.patch deleted file mode 100644 index d9b49a4abb27..000000000000 --- a/app-emulation/spice/files/spice-0.12.5-server-dont-assert-on-invalid-client-message.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 3c25192ee90f843a2f84ff99d119b1cb45979bac Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@gmail.com> -Date: Wed, 25 Jun 2014 14:36:03 +0200 -Subject: server: don't assert on invalid client message - -Some users have been reaching this error: -snd_receive: ASSERT n failed - -A misbehaving client could easily hit that condition by sending too big -messages. Instead of assert(), replace with a warning. When a message -too big to fit is received, it will simply disconnect the channel. - -https://bugzilla.redhat.com/show_bug.cgi?id=962187 - -diff --git a/server/snd_worker.c b/server/snd_worker.c -index 7d52ded..70148b7 100644 ---- a/server/snd_worker.c -+++ b/server/snd_worker.c -@@ -421,7 +421,7 @@ static void snd_receive(void* data) - for (;;) { - ssize_t n; - n = channel->receive_data.end - channel->receive_data.now; -- spice_assert(n); -+ spice_warn_if(n <= 0); - n = reds_stream_read(channel->stream, channel->receive_data.now, n); - if (n <= 0) { - if (n == 0) { --- -cgit v0.10.2 - |