From 29e3c26a948a0438fdaa13d1d0bd73e83ef2a908 Mon Sep 17 00:00:00 2001 From: CentOS Buildsys Date: Mar 18 2014 15:54:49 +0000 Subject: import numpy-1.7.1-10.el7.src.rpm --- diff --git a/SOURCES/CVE-2014-1858-CVE-2014-1859.patch b/SOURCES/CVE-2014-1858-CVE-2014-1859.patch new file mode 100644 index 0000000..f9b15a1 --- /dev/null +++ b/SOURCES/CVE-2014-1858-CVE-2014-1859.patch @@ -0,0 +1,156 @@ +diff --git a/numpy/core/tests/test_memmap.py b/numpy/core/tests/test_memmap.py +index ea9d061..a1fba95 100644 +--- a/numpy/core/tests/test_memmap.py ++++ b/numpy/core/tests/test_memmap.py +@@ -1,5 +1,5 @@ + import sys +-from tempfile import NamedTemporaryFile, mktemp ++from tempfile import NamedTemporaryFile + import os + + from numpy import memmap +@@ -31,12 +31,11 @@ class TestMemmap(TestCase): + assert_array_equal(self.data, newfp) + + def test_open_with_filename(self): +- tmpname = mktemp('','mmap') +- fp = memmap(tmpname, dtype=self.dtype, mode='w+', +- shape=self.shape) +- fp[:] = self.data[:] +- del fp +- os.unlink(tmpname) ++ with NamedTemporaryFile() as tmp: ++ fp = memmap(tmp.name, dtype=self.dtype, mode='w+', ++ shape=self.shape) ++ fp[:] = self.data[:] ++ del fp + + def test_attributes(self): + offset = 1 +@@ -48,17 +47,16 @@ class TestMemmap(TestCase): + del fp + + def test_filename(self): +- tmpname = mktemp('','mmap') +- fp = memmap(tmpname, dtype=self.dtype, mode='w+', +- shape=self.shape) +- abspath = os.path.abspath(tmpname) +- fp[:] = self.data[:] +- self.assertEqual(abspath, fp.filename) +- b = fp[:1] +- self.assertEqual(abspath, b.filename) +- del b +- del fp +- os.unlink(tmpname) ++ with NamedTemporaryFile() as tmp: ++ fp = memmap(tmp.name, dtype=self.dtype, mode='w+', ++ shape=self.shape) ++ abspath = os.path.abspath(tmp.name) ++ fp[:] = self.data[:] ++ self.assertEqual(abspath, fp.filename) ++ b = fp[:1] ++ self.assertEqual(abspath, b.filename) ++ del b ++ del fp + + def test_filename_fileobj(self): + fp = memmap(self.tmpfp, dtype=self.dtype, mode="w+", +diff --git a/numpy/core/tests/test_multiarray.py b/numpy/core/tests/test_multiarray.py +index db220ec..e845c07 100644 +--- a/numpy/core/tests/test_multiarray.py ++++ b/numpy/core/tests/test_multiarray.py +@@ -1587,12 +1587,11 @@ class TestIO(object): + self.x = rand(shape) + rand(shape).astype(np.complex)*1j + self.x[0,:,1] = [nan, inf, -inf, nan] + self.dtype = self.x.dtype +- self.filename = tempfile.mktemp() ++ self.file = tempfile.NamedTemporaryFile() ++ self.filename = self.file.name + + def tearDown(self): +- if os.path.isfile(self.filename): +- os.unlink(self.filename) +- #tmp_file.close() ++ self.file.close() + + def test_bool_fromstring(self): + v = np.array([True,False,True,False], dtype=np.bool_) +@@ -1620,7 +1619,6 @@ class TestIO(object): + y = np.fromfile(f, dtype=self.dtype) + f.close() + assert_array_equal(y, self.x.flat) +- os.unlink(self.filename) + + def test_roundtrip_filename(self): + self.x.tofile(self.filename) +@@ -1753,7 +1751,6 @@ class TestIO(object): + s = f.read() + f.close() + assert_equal(s, '1.51,2.0,3.51,4.0') +- os.unlink(self.filename) + + def test_tofile_format(self): + x = np.array([1.51, 2, 3.51, 4], dtype=float) +diff --git a/numpy/f2py/__init__.py b/numpy/f2py/__init__.py +index 220cb3d..d580332 100644 +--- a/numpy/f2py/__init__.py ++++ b/numpy/f2py/__init__.py +@@ -27,20 +27,20 @@ def compile(source, + from numpy.distutils.exec_command import exec_command + import tempfile + if source_fn is None: +- fname = os.path.join(tempfile.mktemp()+'.f') ++ f = tempfile.NamedTemporaryFile(suffix='.f') + else: +- fname = source_fn +- +- f = open(fname,'w') +- f.write(source) +- f.close() +- +- args = ' -c -m %s %s %s'%(modulename,fname,extra_args) +- c = '%s -c "import numpy.f2py as f2py2e;f2py2e.main()" %s' %(sys.executable,args) +- s,o = exec_command(c) +- if source_fn is None: +- try: os.remove(fname) +- except OSError: pass ++ f = open(source_fn, 'w') ++ ++ try: ++ f.write(source) ++ f.flush() ++ ++ args = ' -c -m %s %s %s'%(modulename, f.name, extra_args) ++ c = '%s -c "import numpy.f2py as f2py2e;f2py2e.main()" %s' % \ ++ (sys.executable, args) ++ s, o = exec_command(c) ++ finally: ++ f.close() + return s + + from numpy.testing import Tester +diff --git a/numpy/f2py/f2py2e.py b/numpy/f2py/f2py2e.py +index 4e6d258..b9b955a 100755 +--- a/numpy/f2py/f2py2e.py ++++ b/numpy/f2py/f2py2e.py +@@ -91,7 +91,7 @@ Options: + --lower is assumed with -h key, and --no-lower without -h key. + + --build-dir All f2py generated files are created in . +- Default is tempfile.mktemp(). ++ Default is tempfile.mkstemp(). + + --overwrite-signature Overwrite existing signature file. + +@@ -428,7 +428,7 @@ def run_compile(): + del sys.argv[i] + else: + remove_build_dir = 1 +- build_dir = os.path.join(tempfile.mktemp()) ++ build_dir = tempfile.mkdtemp() + + sysinfo_flags = filter(re.compile(r'[-][-]link[-]').match,sys.argv[1:]) + sys.argv = filter(lambda a,flags=sysinfo_flags:a not in flags,sys.argv) +-- +1.8.5.3 + diff --git a/SPECS/numpy.spec b/SPECS/numpy.spec index 8ca9ea8..532c8b4 100644 --- a/SPECS/numpy.spec +++ b/SPECS/numpy.spec @@ -6,7 +6,7 @@ Name: numpy Version: 1.7.1 -Release: 5%{?dist} +Release: 10%{?dist} Epoch: 1 Summary: A fast multidimensional array facility for Python @@ -16,6 +16,13 @@ License: BSD and Python URL: http://www.numpy.org/ Source0: http://downloads.sourceforge.net/numpy/%{name}-%{version}%{?relc}.tar.gz +# Fix of CVE-2014-1858, CVE-2014-1859: #1062009 +# Modified version of 3 upstream commits, so they apply to current version: +# - 8296aa0b911c036c984e23665ee0f7ddca579b91 +# - 524b9eaa33ec67e34eb31a208e02bb934f778096 +# - 0bb46c1448b0d3f5453d5182a17ea7ac5854ee15 +Patch0: CVE-2014-1858-CVE-2014-1859.patch + BuildRequires: python2-devel lapack-devel python-setuptools gcc-gfortran atlas-devel python-nose Requires: python-nose %if 0%{?with_python3} @@ -80,6 +87,7 @@ This package includes a version of f2py that works properly with NumPy. %prep %setup -q -n %{name}-%{version}%{?relc} +%patch0 -p1 # workaround for rhbz#849713 # http://mail.scipy.org/pipermail/numpy-discussion/2012-July/063530.html @@ -148,7 +156,8 @@ env ATLAS=%{_libdir} FFTW=%{_libdir} BLAS=%{_libdir} \ %{__python} setup.py install --root %{buildroot} rm -rf docs-f2py ; mv %{buildroot}%{python_sitearch}/%{name}/f2py/docs docs-f2py mv -f %{buildroot}%{python_sitearch}/%{name}/f2py/f2py.1 f2py.1 -rm -rf doc ; mv -f %{buildroot}%{python_sitearch}/%{name}/doc . +# remove sphinx docs, save dir for tests +rm -rf doc/* install -D -p -m 0644 f2py.1 %{buildroot}%{_mandir}/man1/f2py.1 pushd %{buildroot}%{_bindir} &> /dev/null @@ -173,10 +182,6 @@ rm -f %{buildroot}%{python_sitearch}/%{name}/THANKS.txt rm -f %{buildroot}%{python_sitearch}/%{name}/site.cfg.example %check -# doc/io.py conflicts with the regular io module causing -# AttributeError: 'module' object has no attribute 'BufferedIOBase' in tests -rm doc/io.py* - pushd doc &> /dev/null PYTHONPATH="%{buildroot}%{python_sitearch}" %{__python} -c "import pkg_resources, numpy ; numpy.test(verbose=3)" \ %ifarch s390 s390x @@ -199,11 +204,12 @@ popd &> /dev/null %files -%doc docs-f2py doc/* LICENSE.txt README.txt THANKS.txt DEV_README.txt COMPATIBILITY site.cfg.example +%doc docs-f2py LICENSE.txt README.txt THANKS.txt DEV_README.txt COMPATIBILITY site.cfg.example %dir %{python_sitearch}/%{name} %{python_sitearch}/%{name}/*.py* %{python_sitearch}/%{name}/core %{python_sitearch}/%{name}/distutils +%{python_sitearch}/%{name}/doc %{python_sitearch}/%{name}/fft %{python_sitearch}/%{name}/lib %{python_sitearch}/%{name}/linalg @@ -254,6 +260,21 @@ popd &> /dev/null %changelog +* Tue Mar 18 2014 Tomas Tomecek - 1:1.7.1-10 +- fix changelog entry below + +* Mon Feb 10 2014 Tomas Tomecek - 1:1.7.1-9 +- Fix CVE-2014-1858, CVE-2014-1859: #1062009 + +* Fri Jan 24 2014 Daniel Mach - 1:1.7.1-8 +- Mass rebuild 2014-01-24 + +* Fri Dec 27 2013 Daniel Mach - 1:1.7.1-7 +- Mass rebuild 2013-12-27 + +* Mon Nov 25 2013 Tomas Tomecek - 1:1.7.1-6 +- keep numpy.doc in site_arch + * Wed Sep 25 2013 Tomas Tomecek - 1:1.7.1-5 - rebuilt with atlas 3.10, rhbz#1009069