diff --git a/README.debrand b/README.debrand deleted file mode 100644 index 01c46d2..0000000 --- a/README.debrand +++ /dev/null @@ -1,2 +0,0 @@ -Warning: This package was configured for automatic debranding, but the changes -failed to apply. diff --git a/SOURCES/D158770.diff b/SOURCES/D158770.diff new file mode 100644 index 0000000..1d76995 --- /dev/null +++ b/SOURCES/D158770.diff @@ -0,0 +1,25 @@ +diff --git a/parser/expat/lib/xmlparse.c b/parser/expat/lib/xmlparse.c +--- a/parser/expat/lib/xmlparse.c ++++ b/parser/expat/lib/xmlparse.c +@@ -5652,12 +5652,18 @@ + else + #endif /* XML_DTD */ + { + processor = contentProcessor; + /* see externalEntityContentProcessor vs contentProcessor */ +- return doContent(parser, parentParser ? 1 : 0, encoding, s, end, +- nextPtr, (XML_Bool)!ps_finalBuffer); ++ result = doContent(parser, parser->m_parentParser ? 1 : 0, ++ parser->m_encoding, s, end, nextPtr, ++ (XML_Bool)! parser->m_parsingStatus.finalBuffer); ++ if (result == XML_ERROR_NONE) { ++ if (! storeRawNames(parser)) ++ return XML_ERROR_NO_MEMORY; ++ } ++ return result; + } + } + + static enum XML_Error PTRCALL + errorProcessor(XML_Parser parser, + diff --git a/SOURCES/webrtc-nss-fix.patch b/SOURCES/webrtc-nss-fix.patch new file mode 100644 index 0000000..78b458d --- /dev/null +++ b/SOURCES/webrtc-nss-fix.patch @@ -0,0 +1,25 @@ +diff -up firefox-102.3.0/third_party/libsrtp/src/crypto/cipher/aes_gcm_nss.c.webrtc-fix firefox-102.3.0/third_party/libsrtp/src/crypto/cipher/aes_gcm_nss.c +--- firefox-102.3.0/third_party/libsrtp/src/crypto/cipher/aes_gcm_nss.c.webrtc-fix 2022-10-04 18:58:30.563683229 +0200 ++++ firefox-102.3.0/third_party/libsrtp/src/crypto/cipher/aes_gcm_nss.c 2022-10-04 18:58:44.583652963 +0200 +@@ -293,7 +293,7 @@ static srtp_err_status_t srtp_aes_gcm_ns + + int rv; + SECItem param = { siBuffer, (unsigned char *)&c->params, +- sizeof(CK_GCM_PARAMS) }; ++ sizeof(CK_NSS_GCM_PARAMS) }; + if (encrypt) { + rv = PK11_Encrypt(c->key, CKM_AES_GCM, ¶m, buf, enc_len, + *enc_len + 16, buf, *enc_len); +diff -up firefox-102.3.0/third_party/libsrtp/src/crypto/include/aes_gcm.h.webrtc-fix firefox-102.3.0/third_party/libsrtp/src/crypto/include/aes_gcm.h +--- firefox-102.3.0/third_party/libsrtp/src/crypto/include/aes_gcm.h.webrtc-fix 2022-10-04 18:59:16.635583764 +0200 ++++ firefox-102.3.0/third_party/libsrtp/src/crypto/include/aes_gcm.h 2022-10-04 18:59:31.848550924 +0200 +@@ -101,7 +101,7 @@ typedef struct { + uint8_t iv[12]; + uint8_t aad[MAX_AD_SIZE]; + int aad_size; +- CK_GCM_PARAMS params; ++ CK_NSS_GCM_PARAMS params; + uint8_t tag[16]; + } srtp_aes_gcm_ctx_t; + +diff -up firefox-102.3.0/third_party/prio/prio/encrypt.c.webrtc-fix firefox-102.3.0/third_party/prio/prio/encrypt.c diff --git a/SPECS/firefox.spec b/SPECS/firefox.spec index 2fa485e..18f4d4c 100644 --- a/SPECS/firefox.spec +++ b/SPECS/firefox.spec @@ -201,7 +201,7 @@ end} Summary: Mozilla Firefox Web browser Name: firefox Version: 102.3.0 -Release: 6%{?dist} +Release: 7%{?dist} URL: https://www.mozilla.org/firefox/ License: MPLv1.1 or GPLv2+ or LGPLv2+ @@ -289,6 +289,7 @@ Patch226: rhbz-1354671.patch Patch228: disable-openh264-download.patch Patch229: firefox-nss-addon-hack.patch Patch230: D110204-fscreen.diff +Patch231: webrtc-nss-fix.patch # Upstream patches Patch415: mozilla-1670333.patch @@ -300,6 +301,7 @@ Patch420: mozilla-bmo998749.patch Patch421: mozilla-s390x-skia-gradient.patch Patch422: one_swizzle_to_rule_them_all.patch Patch423: svg-rendering.patch +Patch424: D158770.diff # PGO/LTO patches Patch600: pgo.patch @@ -513,50 +515,66 @@ BuildRequires: gcc-toolset-12-annobin-plugin-gcc # Bundled libraries Provides: bundled(angle) +Provides: bundled(audioipc-2) +Provides: bundled(brotli) Provides: bundled(cairo) +Provides: bundled(cfworker) +Provides: bundled(d3.js) +Provides: bundled(double-conversion) +Provides: bundled(expat) +Provides: bundled(fdlibm) +Provides: bundled(ffvpx) +Provides: bundled(freetype2) Provides: bundled(graphite2) Provides: bundled(harfbuzz) -Provides: bundled(ots) -Provides: bundled(sfntly) -Provides: bundled(skia) -Provides: bundled(thebes) -Provides: bundled(WebRender) -Provides: bundled(audioipc-2) -Provides: bundled(ffvpx) +Provides: bundled(highway) +Provides: bundled(intgemm) Provides: bundled(kissfft) Provides: bundled(libaom) Provides: bundled(libcubeb) Provides: bundled(libdav1d) Provides: bundled(libjpeg) +Provides: bundled(libjxl) +Provides: bundled(libjxl) +Provides: bundled(libmar) Provides: bundled(libmkv) Provides: bundled(libnestegg) Provides: bundled(libogg) Provides: bundled(libopus) Provides: bundled(libpng) +Provides: bundled(libprio) Provides: bundled(libsoundtouch) Provides: bundled(libspeex_resampler) +Provides: bundled(libsrtp) Provides: bundled(libtheora) Provides: bundled(libtremor) Provides: bundled(libvorbis) Provides: bundled(libvpx) Provides: bundled(libwebp) +Provides: bundled(libwebrtc) Provides: bundled(libyuv) Provides: bundled(mp4parse-rust) +Provides: bundled(mp4parse-rust) +Provides: bundled(msgpack-c) +Provides: bundled(msgpack-c) Provides: bundled(mtransport) Provides: bundled(openmax_dl) -Provides: bundled(double-conversion) -Provides: bundled(brotli) -Provides: bundled(fdlibm) -Provides: bundled(freetype2) -Provides: bundled(libmar) +Provides: bundled(openmax_il) +Provides: bundled(openmax_il) +Provides: bundled(ots) +Provides: bundled(qcms) +Provides: bundled(rlbox_sandboxing_api) +Provides: bundled(sfntly) +Provides: bundled(sipcc) +Provides: bundled(skia) +Provides: bundled(sqlite3) +Provides: bundled(thebes) +Provides: bundled(wasm2c) +Provides: bundled(WebRender) Provides: bundled(woff2) Provides: bundled(xz-embedded) +Provides: bundled(ycbcr) Provides: bundled(zlib) -Provides: bundled(expat) -Provides: bundled(msgpack-c) -Provides: bundled(libprio) -Provides: bundled(rlbox_sandboxing_api) -Provides: bundled(sqlite3) %if 0%{?bundle_nss} Provides: bundled(nss) = 3.79.0 @@ -633,6 +651,7 @@ echo "use_rustts %{?use_rustts}" %patch228 -p1 -b .disable-openh264-download %patch229 -p1 -b .firefox-nss-addon-hack %patch230 -p1 -b .D110204-fscreen.diff +%patch231 -p1 -b .webrtc-nss-fix %patch415 -p1 -b .1670333 %patch416 -p1 -b .mozilla-bmo1005535 @@ -643,6 +662,7 @@ echo "use_rustts %{?use_rustts}" %patch421 -p1 -b .mozilla-s390x-skia-gradient %patch422 -p1 -b .one_swizzle_to_rule_them_all %patch423 -p1 -b .svg-rendering +%patch424 -p1 -b .D158770.diff # PGO patches %if %{build_with_pgo} @@ -1401,6 +1421,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || : #--------------------------------------------------------------------- %changelog +* Tue Oct 11 2022 Jan Horak - 102.3.0-7 +- Fix for expat CVE-2022-40674 and non functional webrtc + * Tue Sep 13 2022 Jan Horak - 102.3.0-6 - Update to 102.3.0 build1