public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/gnatcoll] f43: Patched GNATCOLL-CORE-0162 and GNATCOLL-CORE-0164.
@ 2026-09-09 12:06
0 siblings, 0 replies; only message in thread
From: @ 2026-09-09 12:06 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/gnatcoll
Branch : f43
Commit : 0a7cde2990bfa5e18a81ab06d997f0c569b2acb1
Author : Björn Persson <Bjorn@Rombobjörn.se>
Date : 2026-09-09T14:05:00+02:00
Stats : +230/-1 in 3 file(s)
URL : https://src.fedoraproject.org/rpms/gnatcoll/c/0a7cde2990bfa5e18a81ab06d997f0c569b2acb1?branch=f43
Log:
Patched GNATCOLL-CORE-0162 and GNATCOLL-CORE-0164.
---
diff --git a/GNATCOLL-CORE-0162.patch b/GNATCOLL-CORE-0162.patch
new file mode 100644
index 0000000..641e4ef
--- /dev/null
+++ b/GNATCOLL-CORE-0162.patch
@@ -0,0 +1,53 @@
+--- a/projects/src/gnatcoll-projects.adb
++++ b/projects/src/gnatcoll-projects.adb
+@@ -8206,8 +8194,6 @@ package body GNATCOLL.Projects is
+ Errors : Error_Report := null)
+ return Boolean
+ is
+- P : Package_Id;
+- Value : Variable_Value;
+ GNAT_Version : GNAT.Strings.String_Access;
+
+ Shared : constant Shared_Project_Tree_Data_Access :=
+@@ -8335,40 +8321,7 @@ package body GNATCOLL.Projects is
+ end Process_Gnatls;
+
+ begin
+- P := Value_Of
+- (Name_Ide,
+- In_Packages => Project.Decl.Packages,
+- Shared => Shared);
+- if P = No_Package then
+- Trace (Me, "No package IDE, no gnatlist attribute");
+- return Process_Gnatls (Default_Gnatls);
+- else
+- -- Do we have a gnatlist attribute ?
+- Value := Value_Of
+- (Get_String ("gnatlist"),
+- Tree.Data.View.Shared.Packages.Table (P).Decl.Attributes, Shared);
+-
+- if Value = Nil_Variable_Value then
+- Trace (Me, "No attribute IDE'gnatlist");
+- return Process_Gnatls (Default_Gnatls);
+- else
+- declare
+- Gnatls : constant String := Get_Name_String (Value.Value);
+- begin
+- if Gnatls = "" then
+- return Process_Gnatls (Default_Gnatls);
+- else
+- if Runtime /= Unset or else Target /= Unset then
+- Trace (Me, "Error, IDE'Gnatlist attribute cannot be set"
+- & " when Runtime or Target is also set");
+- return Process_Gnatls (Default_Gnatls);
+- end if;
+-
+- return Process_Gnatls (Gnatls);
+- end if;
+- end;
+- end if;
+- end if;
++ return Process_Gnatls (Default_Gnatls);
+ end Set_Path_From_Gnatls_Attribute;
+
+ ------------------
diff --git a/GNATCOLL-CORE-0164.patch b/GNATCOLL-CORE-0164.patch
new file mode 100644
index 0000000..948ed76
--- /dev/null
+++ b/GNATCOLL-CORE-0164.patch
@@ -0,0 +1,169 @@
+--- a/core/src/gnatcoll-email.adb
++++ b/core/src/gnatcoll-email.adb
+@@ -148,6 +148,27 @@
+ end if;
+ end Identify_Header;
+
++ ----------------
++ -- Strip_Forbidden --
++ ----------------
++
++ function Strip_Forbidden (S : String) return String is
++ Result : String (1 .. S'Length);
++ Last : Natural := 0;
++ begin
++ for J in S'Range loop
++ -- Take only the good characters and put them in Result
++ if S (J) /= ASCII.CR
++ and then S (J) /= ASCII.LF
++ and then S (J) /= ASCII.NUL
++ then
++ Last := Last + 1;
++ Result (Last) := S (J);
++ end if;
++ end loop;
++ return Result (1 .. Last);
++ end Strip_Forbidden;
++
+ -------------------
+ -- Is_Whitespace --
+ -------------------
+@@ -471,7 +492,7 @@
+
+ procedure Set_Envelope_From (Msg : in out Message'Class; From : String) is
+ begin
+- Msg.Contents.Envelope_From := To_Unbounded_String (From);
++ Msg.Contents.Envelope_From := To_Unbounded_String (Strip_Forbidden(From));
+ end Set_Envelope_From;
+
+ -----------------------
+@@ -485,7 +506,7 @@
+ is
+ begin
+ Msg.Contents.Envelope_From := To_Unbounded_String
+- ("From " & Email & " " & Format_Date (Local_Date, From_Line => True));
++ ("From " & Strip_Forbidden(Email) & " " & Format_Date (Local_Date, From_Line => True));
+ end Set_Envelope_From;
+
+ -----------------------
+@@ -555,7 +576,7 @@
+ is
+ V : Charset_String_List.List;
+ begin
+- Decode_Header (Value,
++ Decode_Header (Strip_Forbidden(Value),
+ Default_Charset => Charset,
+ Result => V,
+ Where => Identify_Header (Name));
+@@ -586,7 +607,7 @@
+ is
+ L : Charset_String_List.List;
+ begin
+- Decode_Header (Value,
++ Decode_Header (Strip_Forbidden(Value),
+ Default_Charset => Charset,
+ Result => L,
+ Where => Identify_Header (To_String (H.Contents.Name)));
+@@ -672,42 +693,27 @@
+ -- Fold continuation lines
+
+ declare
+- Str : String := To_String (Encoded);
+- Last : Natural;
++ -- Strip CR, LF and NUL as a safety net for content from parsing.
++ Str : constant String :=
++ Strip_Forbidden (To_String (Encoded));
+ Index, Index2 : Integer;
+
+- Offset : Integer := 0;
+- -- Count of LF characters skipped so far
+-
+ begin
+- -- Flatten the header on a single line, eliminating newline
+- -- characters.
+-
+- for J in Str'Range loop
+- if Str (J) = ASCII.LF then
+- Offset := Offset + 1;
+- elsif Offset > 0 then
+- Str (J - Offset) := Str (J);
+- end if;
+- end loop;
+-
+- Last := Str'Last - Offset;
+-
+- if Show_Header_Name and then Last <= Max then
+- if Last = 0 then -- Empty header
++ if Show_Header_Name and then Str'Length <= Max then
++ if Str'Length = 0 then -- Empty header
+ Result := To_Unbounded_String (N & ": ");
+- elsif Element (Encoded, 1) = ' ' then
+- Result := To_Unbounded_String (N & ':' & Str (1 .. Last));
++ elsif Str (Str'First) = ' ' then
++ Result := To_Unbounded_String (N & ':' & Str);
+ else
+- Result := To_Unbounded_String (N & ": " & Str (1 .. Last));
++ Result := To_Unbounded_String (N & ": " & Str);
+ end if;
+ return;
+
+- elsif not Show_Header_Name and then Last <= Max_Line_Len then
+- if Offset = 0 then
+- Result := Encoded; -- Save a string copy
++ elsif not Show_Header_Name and then Str'Length <= Max_Line_Len then
++ if Str'Length = Length (Encoded) then
++ Result := Encoded; -- Save a string copy (nothing stripped)
+ else
+- Result := To_Unbounded_String (Str (1 .. Last));
++ Result := To_Unbounded_String (Str);
+ end if;
+ return;
+ end if;
+@@ -715,15 +721,15 @@
+ Result := Null_Unbounded_String;
+ Index := Str'First;
+
+- while Index <= Last loop
++ while Index <= Str'Last loop
+ -- Only split on spaces. To keep Content-Type headers as much
+ -- as possible on a single line, we split on the first blank
+ -- space after the theoretical split point.
+
+- Index2 := Integer'Min (Index + Max - 1, Last);
++ Index2 := Integer'Min (Index + Max - 1, Str'Last);
+ loop
+ Index2 := Index2 + 1;
+- exit when Index2 > Last or else Str (Index2) = ' ';
++ exit when Index2 > Str'Last or else Str (Index2) = ' ';
+ end loop;
+
+ -- Index2 points right after last non-blank character
+@@ -733,7 +739,7 @@
+ -- Do not print a last line containing only white spaces, this
+ -- might confuse mailers.
+
+- if Index2 < Last then
++ if Index2 < Str'Last then
+ Append (Result, ASCII.LF & ' ');
+ end if;
+
+@@ -1902,7 +1908,7 @@
+ is
+ C : Charset_String_List.Cursor := First (H.Contents.Value);
+ Semicolon, Name_Start, Name_End, Val_End : Integer;
+- Str : constant String := "; " & Param_Name & "=""" & Param_Value & '"';
++ Str : constant String := "; " & Param_Name & "=""" & Strip_Forbidden(Param_Value) & '"';
+ begin
+ Get_Param_Index
+ (H, Param_Name, C, Semicolon, Name_Start, Name_End, Val_End);
+--- a/core/src/gnatcoll-email-parser.adb
++++ b/core/src/gnatcoll-email-parser.adb
+@@ -166,7 +166,7 @@
+ and then Str (Index .. Index + 4) = "From "
+ then
+ Eol := Next_Occurrence (Str (Index .. Stop), ASCII.LF);
+- Set_Envelope_From (Msg, Str (Index .. Eol - 1));
++ Set_Envelope_From (Msg, RTrim_CR (Str (Index .. Eol - 1)));
+ Index := Eol + 1;
+ end if;
+
diff --git a/gnatcoll.spec b/gnatcoll.spec
index 0425be7..63fef93 100644
--- a/gnatcoll.spec
+++ b/gnatcoll.spec
@@ -7,7 +7,7 @@
Name: gnatcoll
Epoch: 2
Version: %{upstream_version}
-Release: 5%{?dist}
+Release: 6%{?dist}
Summary: The GNAT Components Collection
Summary(sv): GNAT Components Collection
@@ -31,6 +31,9 @@ Patch: %{name}-core-doc-examples-dir.patch
Patch: %{name}-core-refine-dependencies-gnatcoll.patch
# [GCC 14.2.1] Fix unsupported use of the Access attribute.
Patch: %{name}-core-fix-base64-coder-example.patch
+# security patches, backported and modified to avoid interface changes:
+Patch: GNATCOLL-CORE-0162.patch
+Patch: GNATCOLL-CORE-0164.patch
BuildRequires: gcc-gnat gprbuild make sed
# A fedora-gnat-project-common that contains the new GPRinstall macro.
@@ -422,6 +425,10 @@ done
###############
%changelog
+* Wed Sep 09 2026 Björn Persson <Bjorn@Rombobjörn.se> - 2:25.0.0-6
+- Patched the vulnerabilities GNATCOLL-CORE-0162 and GNATCOLL-CORE-0164 in a way
+ that avoids interface changes.
+
* Sun Aug 10 2025 Björn Persson <Bjorn@Rombobjörn.se> - 2:25.0.0-5
- Rebuilt because the ALI of System.OS_Constants changed.
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-09 12:06 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-09 12:06 [rpms/gnatcoll] f43: Patched GNATCOLL-CORE-0162 and GNATCOLL-CORE-0164
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox