diff --git a/SOURCES/0001-Make-sure-that-targeted-updates-dont-do-reinstalls.patch b/SOURCES/0001-Make-sure-that-targeted-updates-dont-do-reinstalls.patch new file mode 100644 index 0000000..1cd418a --- /dev/null +++ b/SOURCES/0001-Make-sure-that-targeted-updates-dont-do-reinstalls.patch @@ -0,0 +1,61 @@ +From 0e29e1188c19609e117478a0df1cb995a2f9e745 Mon Sep 17 00:00:00 2001 +From: Michael Schroeder +Date: Fri, 28 Sep 2018 14:48:14 +0200 +Subject: [PATCH] Make sure that targeted updates don't do reinstalls + +--- + src/solver.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/src/solver.c b/src/solver.c +index 6405f4a..a4e0c4b 100644 +--- a/src/solver.c ++++ b/src/solver.c +@@ -2957,7 +2957,9 @@ add_update_target(Solver *solv, Id p, Id how) + Pool *pool = solv->pool; + Solvable *s = pool->solvables + p; + Repo *installed = solv->installed; +- Id pi, pip; ++ Id pi, pip, identicalp; ++ int startcnt, endcnt; ++ + if (!solv->update_targets) + { + solv->update_targets = solv_calloc(1, sizeof(Queue)); +@@ -2968,6 +2970,8 @@ add_update_target(Solver *solv, Id p, Id how) + queue_push2(solv->update_targets, p, p); + return; + } ++ identicalp = 0; ++ startcnt = solv->update_targets->count; + FOR_PROVIDES(pi, pip, s->name) + { + Solvable *si = pool->solvables + pi; +@@ -2982,9 +2986,9 @@ add_update_target(Solver *solv, Id p, Id how) + if (how & SOLVER_CLEANDEPS) + add_cleandeps_updatepkg(solv, pi); + queue_push2(solv->update_targets, pi, p); +- /* check if it's ok to keep the installed package */ ++ /* remember an installed package that is identical to p */ + if (s->evr == si->evr && solvable_identical(s, si)) +- queue_push2(solv->update_targets, pi, pi); ++ identicalp = pi; + } + if (s->obsoletes) + { +@@ -3014,6 +3018,12 @@ add_update_target(Solver *solv, Id p, Id how) + } + } + } ++ /* also allow upgrading to an identical installed package */ ++ if (identicalp) ++ { ++ for (endcnt = solv->update_targets->count; startcnt < endcnt; startcnt += 2) ++ queue_push2(solv->update_targets, solv->update_targets->elements[startcnt], identicalp); ++ } + } + + static int +-- +libgit2 0.26.6 + diff --git a/SOURCES/0002-Fix-testsolv-segfault.patch b/SOURCES/0002-Fix-testsolv-segfault.patch new file mode 100644 index 0000000..9a21506 --- /dev/null +++ b/SOURCES/0002-Fix-testsolv-segfault.patch @@ -0,0 +1,25 @@ +From 95c3d1b3aad7a003d129b957cf449d11edaca67b Mon Sep 17 00:00:00 2001 +From: Jaroslav Rohel +Date: Tue, 11 Dec 2018 10:22:09 +0100 +Subject: [PATCH] Fix: testsolv segfault + +--- + ext/testcase.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/ext/testcase.c b/ext/testcase.c +index 33998d4..fe2636c 100644 +--- a/ext/testcase.c ++++ b/ext/testcase.c +@@ -576,6 +576,8 @@ testcase_str2dep_complex(Pool *pool, const char **sp, int relop) + Id flags, id, id2, namespaceid = 0; + struct oplist *op; + ++ if (!s) ++ return 0; + while (*s == ' ' || *s == '\t') + s++; + if (!strncmp(s, "namespace:", 10)) +-- +libgit2 0.27.7 + diff --git a/SOURCES/0003-Fix-testsolv-segfaults.patch b/SOURCES/0003-Fix-testsolv-segfaults.patch new file mode 100644 index 0000000..fabc04f --- /dev/null +++ b/SOURCES/0003-Fix-testsolv-segfaults.patch @@ -0,0 +1,25 @@ +From 6de825c4d27022e48570824f0be77132c5b6d45a Mon Sep 17 00:00:00 2001 +From: Jaroslav Rohel +Date: Tue, 11 Dec 2018 10:27:15 +0100 +Subject: [PATCH] Fix: testsolv segfaults + +--- + ext/testcase.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ext/testcase.c b/ext/testcase.c +index fe2636c..c8dd14e 100644 +--- a/ext/testcase.c ++++ b/ext/testcase.c +@@ -2795,7 +2795,7 @@ testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **res + { + int i = strlen(pieces[1]); + s = strchr(pieces[1], '('); +- if (!s && pieces[1][i - 1] != ')') ++ if (!s || pieces[1][i - 1] != ')') + { + pool_error(pool, 0, "testcase_read: bad namespace '%s'", pieces[1]); + } +-- +libgit2 0.27.7 + diff --git a/SPECS/libsolv.spec b/SPECS/libsolv.spec index a61536a..9f4b24a 100644 --- a/SPECS/libsolv.spec +++ b/SPECS/libsolv.spec @@ -34,12 +34,15 @@ Name: lib%{libname} Version: 0.6.34 -Release: 2%{?dist} +Release: 4%{?dist} Summary: Package dependency solver License: BSD URL: https://github.com/openSUSE/libsolv Source0: %{url}/archive/%{version}/%{name}-%{version}.tar.gz +Patch0001: 0001-Make-sure-that-targeted-updates-dont-do-reinstalls.patch +Patch0002: 0002-Fix-testsolv-segfault.patch +Patch0003: 0003-Fix-testsolv-segfaults.patch BuildRequires: cmake BuildRequires: gcc-c++ @@ -273,6 +276,18 @@ mv %{buildroot}%{_bindir}/repo2solv{.sh,} %endif %changelog +* Wed Mar 27 2019 Michal Domonkos - 0.6.34-4 +- Polish the changelog + +* Thu Mar 21 2019 Jaroslav Mracek - 0.6.34-3 +- Make sure that targeted updates don't do reinstalls +- Resolves: bug#1668256 +- Fix NULL pointer dereference (CVE-2018-20532, CVE-2018-20533) +- Resolves: bug#1669562 +- Resolves: bug#1669576 +- Fix illegal address access in pool_whatprovides (CVE-2018-20534) +- Resolves: bug#1670453 + * Wed Jun 20 2018 Igor Gnatenko - 0.6.34-2 - Add changelog