debian/0000775000000000000000000000000013124454374007177 5ustar debian/TODO0000664000000000000000000000253211732147356007673 0ustar ------------------------------------------------------------------------------ To do list for expat ------------------------------------------------------------------------------ IMPORTANT: Transition must be made for the removal of the libexpat.so.0 symlink (post-lenny, for the moment in experimental?). BUGS: ------------------------------------------------------------------------------ Number Description ------------------------------------------------------------------------------ 245840 incorrect pointer adjustments on buffer reallocation ------------------------------------------------------------------------------ WISHLIST: ------------------------------------------------------------------------------ Number Description Adressed ------------------------------------------------------------------------------ 230856 please build libexpat1-pic package for library reduction wontfix 277133 Request for XML_UNICODE support 2.0.1-1 429175 New upstream version 2.0.1 2.0.1-1 - add pkgconfig support wontfix? - add expat.m4 to /usr/share/aclocal instead 2.0.1-1 - build -Os ------------------------------------------------------------------------------ debian/control0000664000000000000000000000676612570061430010610 0ustar Source: expat Section: text Priority: optional Maintainer: Ubuntu Developers XSBC-Original-Maintainer: Laszlo Boszormenyi (GCS) Standards-Version: 3.9.4 Build-Depends: debhelper (>= 8.1.3), docbook-to-man, dh-autoreconf, dpkg-dev (>= 1.16.0), gcc-multilib [i386 powerpc sparc s390] Homepage: http://expat.sourceforge.net Vcs-Browser: http://svn.debian.org/wsvn/debian-xml-sgml/packages/expat/trunk/ Vcs-Svn: svn://svn.debian.org/svn/debian-xml-sgml/packages/expat/trunk/ Package: lib64expat1-dev Section: libdevel Architecture: i386 powerpc sparc s390 Depends: ${misc:Depends}, lib64expat1 (= ${binary:Version}), libexpat1-dev, gcc-multilib Description: XML parsing C library - development kit (64bit) This package contains the header file and development libraries of expat, the C library for parsing XML. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parsed. A start tag is an example of the kind of structures for which you may register handlers. . This package includes the development support files for building 64 bit applications. Package: lib64expat1 Section: libs Architecture: i386 powerpc sparc s390 Depends: ${shlibs:Depends}, ${misc:Depends} Description: XML parsing C library - runtime library (64bit) This package contains the runtime, shared library of expat, the C library for parsing XML. Expat is a stream-oriented parser in which an application registers handlers for things the parser might find in the XML document (like start tags). . This package includes the 64 bit version of the shared library. Package: libexpat1-dev Section: libdevel Architecture: any Multi-Arch: same Provides: libexpat-dev Conflicts: libexpat-dev Depends: ${misc:Depends}, libexpat1 (= ${binary:Version}), libc6-dev | libc-dev Description: XML parsing C library - development kit This package contains the header file and development libraries of expat, the C library for parsing XML. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parsed. A start tag is an example of the kind of structures for which you may register handlers. Package: libexpat1 Section: libs Architecture: any Conflicts: wink (<= 1.5.1060-4) Depends: ${shlibs:Depends}, ${misc:Depends} Multi-Arch: same Pre-Depends: ${misc:Pre-Depends} Description: XML parsing C library - runtime library This package contains the runtime, shared library of expat, the C library for parsing XML. Expat is a stream-oriented parser in which an application registers handlers for things the parser might find in the XML document (like start tags). Package: libexpat1-udeb XC-Package-Type: udeb Section: debian-installer Priority: extra Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Description: XML parsing C library - runtime library This package contains the runtime, shared library of expat, the C library for parsing XML. Package: expat Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Description: XML parsing C library - example application This package contains xmlwf, an example application of expat, the C library for parsing XML. The arguments to xmlwf are one or more files which are each to be checked for XML well-formedness. debian/lib64expat1.install0000664000000000000000000000002111732147356012625 0ustar usr/lib64/*.so.* debian/libexpat1-dev.install0000664000000000000000000000026511732156255013237 0ustar usr/include usr/lib/*/*.a usr/lib/*/*.la usr/lib/*/*.so usr/lib/*/pkgconfig/expat.pc ../../doc/* usr/share/doc/libexpat1-dev/expat.html/ ../../conftools/expat.m4 usr/share/aclocal/ debian/changelog0000664000000000000000000005003213124454067011050 0ustar expat (2.1.0-4ubuntu1.4) trusty-security; urgency=medium * SECURITY UPDATE: external entity infinite loop - debian/patches/CVE-2017-9233.patch: add check to lib/xmlparse.c. - CVE-2017-9233 -- Marc Deslauriers Tue, 27 Jun 2017 09:05:59 -0400 expat (2.1.0-4ubuntu1.3) trusty-security; urgency=medium * SECURITY UPDATE: unanticipated internal calls to srand - debian/patches/CVE-2012-6702-1.patch: remove srand, use more entropy in lib/xmlparse.c. - debian/patches/CVE-2012-6702-2.patch: use a prime that fits 32bits on 32bit platforms in lib/xmlparse.c. - CVE-2012-6702 * SECURITY UPDATE: use of too little entropy - debian/patches/CVE-2016-5300-1.patch: extract method gather_time_entropy in lib/xmlparse.c. - debian/patches/CVE-2016-5300-2.patch: extract entropy from XML_Parser address in lib/xmlparse.c. - CVE-2016-5300 -- Marc Deslauriers Fri, 10 Jun 2016 08:50:53 -0400 expat (2.1.0-4ubuntu1.2) trusty-security; urgency=medium * SECURITY UPDATE: denial of service and possible code execution via malformed documents - debian/patches/CVE-2016-0718.patch: fix out of bounds memory access and integer overflow in lib/xmlparse.c, lib/xmltok.c, lib/xmltok.h, lib/xmltok_impl.c. - CVE-2016-0718 * SECURITY UPDATE: integer overflows in XML_GetBuffer - debian/patches/CVE-2015-1283-refix.patch: improved existing fix in lib/xmlparse.c. - CVE-2015-1283 -- Marc Deslauriers Mon, 16 May 2016 12:51:23 -0400 expat (2.1.0-4ubuntu1.1) trusty-security; urgency=medium * SECURITY UPDATE: integer overflows in XML_GetBuffer - debian/patches/CVE-2015-1283.patch: add checks to lib/xmlparse.c. - CVE-2015-1283 -- Marc Deslauriers Fri, 28 Aug 2015 09:33:01 -0400 expat (2.1.0-4ubuntu1) trusty; urgency=low * Use dh-autoreconf. * Enable parallel builds. -- Matthias Klose Tue, 03 Dec 2013 14:42:15 +0100 expat (2.1.0-4) unstable; urgency=low * New maintainer (closes: #660681). * Update to Standards-Version 3.9.4 , no changes needed. * Move to compat level 8 . -- Laszlo Boszormenyi (GCS) Sun, 07 Jul 2013 12:43:10 +0200 expat (2.1.0-3) unstable; urgency=low * QA upload, set maintainer address to the QA team. * Move expat_config.h into the multiarch include location. * Make libexpat1-dev Multi-Arch: same. * Update config.{guess,sub} for aarch64 (Wookey). Closes: #689619. * Don't ship the pkgconfig file in lib64expat1-dev. Closes: #706932. -- Matthias Klose Wed, 08 May 2013 11:13:47 +0200 expat (2.1.0-1) unstable; urgency=low * QA upload. * expat 2.1.0 release. -- Matthias Klose Wed, 04 Apr 2012 10:22:55 +0200 expat (2.1.0~beta3-2) unstable; urgency=medium * Fix symbol version for XML_SetHashSalt. Addresses #665362. -- Matthias Klose Fri, 23 Mar 2012 17:33:01 +0100 expat (2.1.0~beta3-1) unstable; urgency=low * QA upload. * Beta release 2.1.0 beta3. Closes: #663579. - CVE-2012-1147 - Resource leak in readfilemap.c. - CVE-2012-1148 - Memory leak in poolGrow. - CVE-2012-0876 - Hash DOS attack. - Remove patches applied upstream. * Remove Daniel from uploaders (orphaned package). * Update package format to 3.0. * Enable hardened build. Closes: #653526. * Add a symbols file. * Install expat pkgconfig file. -- Matthias Klose Tue, 20 Mar 2012 22:37:22 +0100 expat (2.0.1-7.2ubuntu1) precise; urgency=low * CVE-2012-0876: Randomize hashes of xml attributes in the expat library to avoid a denial of service due to hash collisions. Patch by David Malcolm with some modifications by the expat project. -- Matthias Klose Thu, 15 Mar 2012 02:13:54 +0100 expat (2.0.1-7.2) unstable; urgency=low * Non-maintainer upload. * Fix symlink breakage introduced with my last upload. (Closes: #647340) -- Robert Millan Wed, 02 Nov 2011 09:42:21 +0000 expat (2.0.1-7.1) unstable; urgency=low * Non-maintainer upload. * Multi-arch support (patch from Steve Langaseck). (Closes: #632261) * Move libexpat.so.1 to /lib. (Closes: #637101) -- Robert Millan Sat, 22 Oct 2011 10:09:29 +0000 expat (2.0.1-7) unstable; urgency=low * debian/control (Depends): Fixed debhelper-but-no-misc-depends. * debian/patches/560901_CVE_2009_3560.dpatch: Adjusted. - lib/xmlparse.c (doProlog): Revised patch for CVE-2009-3560 after regressions have been detected (closes: #561658). Many thanks to Niko Tyni and Karl Waclawek for their help and the fix. -- Daniel Leidert (dale) Tue, 29 Dec 2009 22:18:35 +0100 expat (2.0.1-6) unstable; urgency=medium * debian/patches/560901_CVE_2009_3560.dpatch: Added. - lib/xmlparse.c (doProlog): Fix DoS vulnerability CVE-2009-3560 (closes: #560901). * debian/patches/00list: Adjusted. -- Daniel Leidert (dale) Sun, 13 Dec 2009 12:06:07 +0100 expat (2.0.1-5) unstable; urgency=medium * debian/control (Standards-Version): Bumped to 3.8.3. (Priority, Section): Fixed binary-control-field-duplicates-source. (Description): Fixed extended-description-is-probably-too-short and duplicate-long-description. * debian/rules (CFLAGS): Drop useless '-pthread -D_REENTRANT' from version 1.95-8-1 (closes: #551079). * debian/README.source: Added for policy compliance. * debian/patches/551936_CVE_2009_2625.dpatch: Added. - lib/xmltok_impl.c (updatePosition): Fix DoS vulnerability CVE-2009-2625 and CVE-2009-3720 (closes: #551936). * debian/patches/00list: Adjusted. -- Daniel Leidert (dale) Tue, 03 Nov 2009 22:41:38 +0100 expat (2.0.1-4) unstable; urgency=low * debian/libexpat1-dev.install: Install the libtool .la files again and drop them after Lenny (closes: #485460). -- Daniel Leidert (dale) Mon, 09 Jun 2008 20:48:30 +0200 expat (2.0.1-3) unstable; urgency=low * debian/patches/485129_fix_underquotation_in_m4.dpatch: Added. - conftools/expat.m4: Fixed underquotation in AC_DEFUN (closes: #485129). * debian/patches/00list: Adjusted. -- Daniel Leidert (dale) Sun, 08 Jun 2008 20:15:58 +0200 expat (2.0.1-2) unstable; urgency=low * debian/rules: Set correct host flags to prevent FTBFS on architectures, where we build the lib64expat* packages. (build-stamp, install): Fixed a stupid mistake leading to an FTBFS on the architectures, where we don't build the lib64expat* packages. -- Daniel Leidert (dale) Sat, 07 Jun 2008 20:35:04 +0200 expat (2.0.1-1) unstable; urgency=low * New upstream release 2.0.1 (closes: #429175). [ Matthias Klose ] * debian/control: Added 64bit libraries. (Build-Depends): Added gcc-multilib. * debian/lib64expat1-dev.install: Added. * debian/lib64expat1.install: Ditto. * debian/lib64expat1.shlibs: Ditto. * debian/libexpat1.links: Remove the old libexpat.so.0 symlink. * debian/libexpat1-udeb.links: Ditto. * debian/libexpat1.shlibs: Removed libexpat.so.0. [ Daniel Leidert ] * Removed Debian-written autotools stuff. * debian/control: Added Homepage and Vcs* fields. Added conflicts with wink package version, relying on the compat symlink. (Standards-Version): Increased to 3.7.3. (Build-Depends): Added dpatch and docbook-to-man. (Uploaders): Added myself. (Depends): lib64expat1-dev should depend on libexpat1-dev. * debian/copyright: Added missing copyright of the last years. * debian/expat.install: Do not copy the upstream manpage (see debian/rules). * debian/libexpat1-dev.install: Install the expat.m4 macro file. Do not install the libtool .la files. * debian/lib64expat1-dev.install: Do not install the libtool .la files either. * debian/libexpat1-dev.examples: Only install the C sources. * debian/libexpat1-udeb.install: Make sure, only libexpat is installed (for the moment). * debian/libexpat1.shlibs: Adjusted for libexpatw. * debian/lib64expat1.shlibs: Ditto. * debian/rules: Rewritten to make it shorter (yeah sorry, I removed the comments too). - Added dpatch stuff. - Create the manpage xmlwf.1 on-the-fly (there is doc/xmlwf.1, but it has issues and gets patched, so we recreate it). - Build and install libexpatw with XML_UNICODE support enabled (closes: #277133). * debian/patches/82763_xmlwf_error_out_2.dpatch: Added (#82763). * debian/patches/302191_install_expat_config_h.dpatch: Added (#302191). * debian/patches/342684_libtoolize.dpatch: Added (#342684). - Further update configure (closes: #439127). * debian/patches/412786_xmlwf_man_standard_fix.dpatch: Added (#412786). * debian/patches/00list: Added. -- Daniel Leidert (dale) Sat, 07 Jun 2008 14:54:30 +0200 expat (2.0.1-0ubuntu1) hardy; urgency=low * New upstream version. LP: #133808. * Remove the old libexpat.so.0 symlink; this bug predates Ubuntu (was fixed in version 1.95.5-1). * Drop the extra build files in bcb5/. -- Matthias Klose Wed, 05 Dec 2007 17:37:50 +0100 expat (1.95.8-4ubuntu1) gutsy; urgency=low * Build 64bit packages. -- Matthias Klose Sat, 22 Sep 2007 10:00:04 +0200 expat (1.95.8-4) unstable; urgency=low * Acknowledged NMUs 1.95.8-3.1 - 1.95.8-3.4 ( closes: Bug#355937, Bug#354244, Bug#342684) * lib/expat.h: removed trailing comma from enum XML_Status (closes: Bug#344298) * debian/control: removed 'Provides' from libexpat1-udeb stanza (closes: Bug#419606) * xmlwf/xmlwf.1: removed incorrect statement on well-formedness (closes: Bug#412786 * debian/TODO: updated * debian/control: upgraded to Debian Policy 3.7.2 (no changes) (thanks Bryan Donlan !) * debian/rules: replaced $(PWD) by $(CURDIR) * debian/control: replaced ${Source-Version} by ${Source-Version} (thanks Bryan Donlan !) -- Ardo van Rangelrooij Sun, 22 Jul 2007 17:59:57 -0500 expat (1.95.8-3.4) unstable; urgency=low * Porter NMU. * Libtool update (closes: bug#342684). -- Aurelien Jarno Sun, 10 Dec 2006 20:04:23 +0100 expat (1.95.8-3.3) unstable; urgency=low * NMU * Use fixed watch file from Bart Martens. closes: #354244. -- Clint Adams Thu, 7 Sep 2006 22:04:05 -0400 expat (1.95.8-3.2) unstable; urgency=low * Non Maintainer Upload * Correct mistake in patch for #355937 so that udeb: lines in shlibs file actually refer to the udeb package -- Frans Pop Tue, 28 Mar 2006 22:09:52 +0200 expat (1.95.8-3.1) unstable; urgency=low * Non Maintainer Upload (closes: #355937) * Add support for udeb dependency resolution in shlibs file * Simplify debian/rules by making use of udeb support in debhelper * Update debhelper compatibility to level 5 -- Frans Pop Sat, 18 Mar 2006 01:21:09 +0100 expat (1.95.8-3) unstable; urgency=low * Makefile.in: added $(srcdir)/expat_config.h to APIHEADER (closes: Bug#302191) * rebuild against latest libtool for kfreebsd-gnu (closes: Bug#295825) -- Ardo van Rangelrooij Tue, 19 Apr 2005 21:50:50 -0500 expat (1.95.8-2) unstable; urgency=low * rebuild against latest libtool for kfreebsd-gnu -- Ardo van Rangelrooij Sat, 19 Feb 2005 13:45:36 -0600 expat (1.95.8-1) unstable; urgency=low * New upstream release (closes: Bug#263858) * debian/rules: added '-pthread -D_REENTRANT' to 'CFLAGS' * Added debian/watch -- Ardo van Rangelrooij Tue, 19 Oct 2004 19:31:03 -0500 expat (1.95.6-8) unstable; urgency=low * debian/control: fixed typo in maintainer's email address -- Ardo van Rangelrooij Sun, 29 Feb 2004 11:01:15 -0600 expat (1.95.6-7) unstable; urgency=low * debian/control: upgraded to Debian Policy 3.6.1 (no changes) * debian/control: changed 'Maintainer' to 'Debian XML/SGML Group ' and added current maintainer as 'Uploader' -- Ardo van Rangelrooij Sun, 29 Feb 2004 10:51:47 -0600 expat (1.95.6-6) unstable; urgency=low * debian/control: changed section of 'libexpat1-dev' from 'devel' to 'libdevel' to align with override * debian/control: changed priority of 'libexpat1-udeb' from 'optional' to 'extra' to aliagn with override -- Ardo van Rangelrooij Tue, 29 Jul 2003 19:53:02 -0500 expat (1.95.6-5) unstable; urgency=low * debian/control: changed build dependency on 'debhelper' to '(>= 4.1)' * debian/control: upgraded to Debian Policy 3.6.0 (no changes) -- Ardo van Rangelrooij Mon, 28 Jul 2003 22:45:43 -0500 expat (1.95.6-4) unstable; urgency=low * Added support to generate a 'libexpat1-udeb' package for the upcoming gtk frontend for the new debian installer (closes: Bug#183830) * debian/rules: moved debhelper compatibility level setting to 'debian/compat' per latest debhelper best practices -- Ardo van Rangelrooij Sun, 9 Mar 2003 20:42:31 -0600 expat (1.95.6-3) unstable; urgency=low * lib/expat.h: moved declaration of 'enum XML_Status' up (closes: Bug#179914) -- Ardo van Rangelrooij Mon, 17 Feb 2003 19:28:14 -0600 expat (1.95.6-2) unstable; urgency=low * debian/libexpat1.shlibs: changed to 1.95.6 (oops!) -- Ardo van Rangelrooij Sun, 2 Feb 2003 18:24:54 -0600 expat (1.95.6-1) unstable; urgency=low * New upstream release - fixes frequent segfault on nontrivial documents using namespaces (closes: Bug#179462) -- Ardo van Rangelrooij Sun, 2 Feb 2003 14:53:04 -0600 expat (1.95.5-1) unstable; urgency=low * New upstream release (closes: Bug#164202) * debian/control: changed dependency for package 'libexpat1-dev' on the C library from 'libc6-dev' to 'libc6-dev | libc-dev' * debian/libexpat1.shlibs: added to provide info about libexpat.so.0 (which is a symlink to libexpat.so.1 due to an NMU mishap, see below) (closes: Bug#147751) -- Ardo van Rangelrooij Wed, 25 Dec 2002 14:46:32 -0600 expat (1.95.2-10) unstable; urgency=low * autogen.sh: upgraded to 'automake1.7' * debian/rules: removed 'autotools' target as its function is now handled by 'autogen.sh' * debian/control: removed obsolete build dependency on 'autotools-dev' * debian/control: added 'Provides' and 'Conflicts' with 'libexpat-dev' for package 'libexpat1-dev' * debian/control: upgraded to Debian Policy 3.5.8 -- Ardo van Rangelrooij Sat, 21 Dec 2002 23:33:34 -0600 expat (1.95.2-9) unstable; urgency=low * debian/rules: migrated documentation installation handling to debhelper -- Ardo van Rangelrooij Sun, 6 Oct 2002 22:52:54 -0500 expat (1.95.2-8) unstable; urgency=low * debian/rules: migrated to autoconf 2.52 and above -- Ardo van Rangelrooij Sun, 6 Oct 2002 15:37:04 -0500 expat (1.95.2-7) unstable; urgency=low * debian/rules: upgraded to debhelper v4 * debian/control: changed build dependency on debhelper accordingly * debian/rules: migrated from 'dh_movefiles' to 'dh_install' * debian/rules: split off 'install' target from 'binary-arch' target -- Ardo van Rangelrooij Sat, 10 Aug 2002 11:02:25 -0500 expat (1.95.2-6) unstable; urgency=low * debian/control: removed unnecessary build dependency on 'autoconf' -- Ardo van Rangelrooij Sun, 9 Dec 2001 12:19:40 -0600 expat (1.95.2-5) unstable; urgency=low * Added man page for 'xmlwf' (closes: Bug#39461) * Converted to autotools-dev * debian/control: added build dependency on 'autotools-dev' * debian/control: removed build dependency on 'automake' and 'libtool' -- Ardo van Rangelrooij Fri, 7 Dec 2001 23:35:47 -0600 expat (1.95.2-4) unstable; urgency=low * Removed explicit 'dhelp' support since 'doc-base' now takes care of this * debian/control: upgraded to Debian Policy 3.5.6 -- Ardo van Rangelrooij Sun, 4 Nov 2001 11:22:19 -0600 expat (1.95.2-3) unstable; urgency=high * Includes NMU 1.95.2-2.1 (closes: Bug#111957) * Added symlink from libexpat.so.0 to libexpat.so.1 to handle the problems caused by the library soname change introduced by this NMU (closes: Bug#116724, Bug#116727) -- Ardo van Rangelrooij Wed, 31 Oct 2001 11:09:47 -0600 expat (1.95.2-2.1) unstable; urgency=low * NMU. * Added call to aclocal before call to autoconf in Makefile.in. Closes: #111957. * Ran 'libtoolize --force --copy' to update libtool info. This works around problem with libtool version skew during build. Should this be done in Makefile.in? -- Jeff Licquia Wed, 17 Oct 2001 10:35:46 -0600 expat (1.95.2-2) unstable; urgency=low * debian/control: added build dependency on 'libtool' (closes: Bug#111693) -- Ardo van Rangelrooij Sat, 8 Sep 2001 14:29:55 -0500 expat (1.95.2-1) unstable; urgency=low * New upstream release * debian/copyright: updated -- Ardo van Rangelrooij Thu, 6 Sep 2001 20:26:55 -0500 expat (1.95.1-6) unstable; urgency=low * debian/rules: fixed doc directory handling (closes: Bug#104460) * debian/control: upgraded to Debian Policy 3.5.5 * xmlwf/xmlwf.c: changed to return error code 2 upon the first processing error (closes: Bug#82763) -- Ardo van Rangelrooij Sun, 15 Jul 2001 10:10:05 -0500 expat (1.95.1-5) unstable; urgency=low * conftools/config.*: updated to latest version (closes: Bug#94772) -- Ardo van Rangelrooij Tue, 1 May 2001 21:49:55 -0500 expat (1.95.1-4) unstable; urgency=low * debian/control: added build dependency on 'autoconf' and 'automake' (closes: Bug#95296) -- Ardo van Rangelrooij Thu, 26 Apr 2001 11:25:16 -0500 expat (1.95.1-3) unstable; urgency=low * debian/control: updated debhelper dependency to remove 'dh_testversion' * debian/control: upgraded to Debian Policy 3.5.2 -- Ardo van Rangelrooij Tue, 24 Apr 2001 20:56:35 -0500 expat (1.95.1-2) unstable; urgency=low * debian/control: fixed section override disparity -- Ardo van Rangelrooij Mon, 29 Jan 2001 19:31:30 -0600 expat (1.95.1-1) unstable; urgency=low * New upstream release (closes: Bug#74383, Bug#81866) * Added doc-base and dhelp support -- Ardo van Rangelrooij Sun, 28 Jan 2001 09:02:53 -0600 expat (1.1-3) unstable; urgency=low * New maintainer -- Ardo van Rangelrooij Sat, 7 Oct 2000 13:40:57 -0500 expat (1.1-2) unstable; urgency=low * debian/rules: more debhelperification and use more FHS stuff * debian/control: standards bumped to 3.2.1 (closes: Bug#70336) -- Adam Di Carlo Wed, 27 Sep 2000 00:56:10 -0400 expat (1.1-1) unstable; urgency=low * new upstream version * debian/rules: aesthetic cleanups, use a bit more debhelper stuff to reduce complexity -- Adam Di Carlo Tue, 1 Jun 1999 22:36:29 -0400 expat (1.0.2-1) unstable; urgency=low * new upstream version * maintainer name change * standards-version: bumped to 2.5.0 (no changes required) -- Adam Di Carlo Wed, 13 Jan 1999 18:35:53 -0500 expat (1.0-2) unstable; urgency=low * debian/rules: fix symlink for docdir of libxmltok1-dev -- Adam P. Harris Sun, 23 Aug 1998 15:51:43 -0400 expat (1.0-1) unstable; urgency=low * Initial release. * Makefile: added MPL notice as required by license, modifications to enable building of xmltok and xmlparse as shared and static libraries. * xmltok/Makefile: created to enable building libxmltok.a and libxmltok.so * xmlparse/Makefile: created to enable building libxmlparse.a and and libxmlparse.so * debian/*: Debian-specific files -- Adam P. Harris Mon, 17 Aug 1998 01:12:09 -0400 debian/libexpat1-dev.docs0000664000000000000000000000000711732147356012515 0ustar README debian/source/0000775000000000000000000000000012166243665010503 5ustar debian/source/format0000664000000000000000000000001411732151532011676 0ustar 3.0 (quilt) debian/compat0000664000000000000000000000000212166243655010400 0ustar 8 debian/libexpat1.symbols0000664000000000000000000001312111733122665012477 0ustar libexpat.so.1 libexpat1 #MINVER# XML_DefaultCurrent@Base 2.0.1 XML_ErrorString@Base 2.0.1 XML_ExpatVersion@Base 2.0.1 XML_ExpatVersionInfo@Base 2.0.1 XML_ExternalEntityParserCreate@Base 2.0.1 XML_FreeContentModel@Base 2.0.1 XML_GetBase@Base 2.0.1 XML_GetBuffer@Base 2.0.1 XML_GetCurrentByteCount@Base 2.0.1 XML_GetCurrentByteIndex@Base 2.0.1 XML_GetCurrentColumnNumber@Base 2.0.1 XML_GetCurrentLineNumber@Base 2.0.1 XML_GetErrorCode@Base 2.0.1 XML_GetFeatureList@Base 2.0.1 XML_GetIdAttributeIndex@Base 2.0.1 XML_GetInputContext@Base 2.0.1 XML_GetParsingStatus@Base 2.0.1 XML_GetSpecifiedAttributeCount@Base 2.0.1 XML_MemFree@Base 2.0.1 XML_MemMalloc@Base 2.0.1 XML_MemRealloc@Base 2.0.1 XML_Parse@Base 2.0.1 XML_ParseBuffer@Base 2.0.1 XML_ParserCreate@Base 2.0.1 XML_ParserCreateNS@Base 2.0.1 XML_ParserCreate_MM@Base 2.0.1 XML_ParserFree@Base 2.0.1 XML_ParserReset@Base 2.0.1 XML_ResumeParser@Base 2.0.1 XML_SetAttlistDeclHandler@Base 2.0.1 XML_SetBase@Base 2.0.1 XML_SetCdataSectionHandler@Base 2.0.1 XML_SetCharacterDataHandler@Base 2.0.1 XML_SetCommentHandler@Base 2.0.1 XML_SetDefaultHandler@Base 2.0.1 XML_SetDefaultHandlerExpand@Base 2.0.1 XML_SetDoctypeDeclHandler@Base 2.0.1 XML_SetElementDeclHandler@Base 2.0.1 XML_SetElementHandler@Base 2.0.1 XML_SetEncoding@Base 2.0.1 XML_SetEndCdataSectionHandler@Base 2.0.1 XML_SetEndDoctypeDeclHandler@Base 2.0.1 XML_SetEndElementHandler@Base 2.0.1 XML_SetEndNamespaceDeclHandler@Base 2.0.1 XML_SetEntityDeclHandler@Base 2.0.1 XML_SetExternalEntityRefHandler@Base 2.0.1 XML_SetExternalEntityRefHandlerArg@Base 2.0.1 XML_SetHashSalt@Base 2.1~beta3 XML_SetNamespaceDeclHandler@Base 2.0.1 XML_SetNotStandaloneHandler@Base 2.0.1 XML_SetNotationDeclHandler@Base 2.0.1 XML_SetParamEntityParsing@Base 2.0.1 XML_SetProcessingInstructionHandler@Base 2.0.1 XML_SetReturnNSTriplet@Base 2.0.1 XML_SetSkippedEntityHandler@Base 2.0.1 XML_SetStartCdataSectionHandler@Base 2.0.1 XML_SetStartDoctypeDeclHandler@Base 2.0.1 XML_SetStartElementHandler@Base 2.0.1 XML_SetStartNamespaceDeclHandler@Base 2.0.1 XML_SetUnknownEncodingHandler@Base 2.0.1 XML_SetUnparsedEntityDeclHandler@Base 2.0.1 XML_SetUserData@Base 2.0.1 XML_SetXmlDeclHandler@Base 2.0.1 XML_StopParser@Base 2.0.1 XML_UseForeignDTD@Base 2.0.1 XML_UseParserAsHandlerArg@Base 2.0.1 XmlGetUtf16InternalEncoding@Base 2.0.1 XmlGetUtf16InternalEncodingNS@Base 2.0.1 XmlGetUtf8InternalEncoding@Base 2.0.1 XmlGetUtf8InternalEncodingNS@Base 2.0.1 XmlInitEncoding@Base 2.0.1 XmlInitEncodingNS@Base 2.0.1 XmlInitUnknownEncoding@Base 2.0.1 XmlInitUnknownEncodingNS@Base 2.0.1 XmlParseXmlDecl@Base 2.0.1 XmlParseXmlDeclNS@Base 2.0.1 XmlPrologStateInit@Base 2.0.1 XmlPrologStateInitExternalEntity@Base 2.0.1 XmlSizeOfUnknownEncoding@Base 2.0.1 XmlUtf16Encode@Base 2.0.1 XmlUtf8Encode@Base 2.0.1 libexpatw.so.1 libexpat1 #MINVER# XML_DefaultCurrent@Base 2.0.1 XML_ErrorString@Base 2.0.1 XML_ExpatVersion@Base 2.0.1 XML_ExpatVersionInfo@Base 2.0.1 XML_ExternalEntityParserCreate@Base 2.0.1 XML_FreeContentModel@Base 2.0.1 XML_GetBase@Base 2.0.1 XML_GetBuffer@Base 2.0.1 XML_GetCurrentByteCount@Base 2.0.1 XML_GetCurrentByteIndex@Base 2.0.1 XML_GetCurrentColumnNumber@Base 2.0.1 XML_GetCurrentLineNumber@Base 2.0.1 XML_GetErrorCode@Base 2.0.1 XML_GetFeatureList@Base 2.0.1 XML_GetIdAttributeIndex@Base 2.0.1 XML_GetInputContext@Base 2.0.1 XML_GetParsingStatus@Base 2.0.1 XML_GetSpecifiedAttributeCount@Base 2.0.1 XML_MemFree@Base 2.0.1 XML_MemMalloc@Base 2.0.1 XML_MemRealloc@Base 2.0.1 XML_Parse@Base 2.0.1 XML_ParseBuffer@Base 2.0.1 XML_ParserCreate@Base 2.0.1 XML_ParserCreateNS@Base 2.0.1 XML_ParserCreate_MM@Base 2.0.1 XML_ParserFree@Base 2.0.1 XML_ParserReset@Base 2.0.1 XML_ResumeParser@Base 2.0.1 XML_SetAttlistDeclHandler@Base 2.0.1 XML_SetBase@Base 2.0.1 XML_SetCdataSectionHandler@Base 2.0.1 XML_SetCharacterDataHandler@Base 2.0.1 XML_SetCommentHandler@Base 2.0.1 XML_SetDefaultHandler@Base 2.0.1 XML_SetDefaultHandlerExpand@Base 2.0.1 XML_SetDoctypeDeclHandler@Base 2.0.1 XML_SetElementDeclHandler@Base 2.0.1 XML_SetElementHandler@Base 2.0.1 XML_SetEncoding@Base 2.0.1 XML_SetEndCdataSectionHandler@Base 2.0.1 XML_SetEndDoctypeDeclHandler@Base 2.0.1 XML_SetEndElementHandler@Base 2.0.1 XML_SetEndNamespaceDeclHandler@Base 2.0.1 XML_SetEntityDeclHandler@Base 2.0.1 XML_SetExternalEntityRefHandler@Base 2.0.1 XML_SetExternalEntityRefHandlerArg@Base 2.0.1 XML_SetHashSalt@Base 2.1~beta3 XML_SetNamespaceDeclHandler@Base 2.0.1 XML_SetNotStandaloneHandler@Base 2.0.1 XML_SetNotationDeclHandler@Base 2.0.1 XML_SetParamEntityParsing@Base 2.0.1 XML_SetProcessingInstructionHandler@Base 2.0.1 XML_SetReturnNSTriplet@Base 2.0.1 XML_SetSkippedEntityHandler@Base 2.0.1 XML_SetStartCdataSectionHandler@Base 2.0.1 XML_SetStartDoctypeDeclHandler@Base 2.0.1 XML_SetStartElementHandler@Base 2.0.1 XML_SetStartNamespaceDeclHandler@Base 2.0.1 XML_SetUnknownEncodingHandler@Base 2.0.1 XML_SetUnparsedEntityDeclHandler@Base 2.0.1 XML_SetUserData@Base 2.0.1 XML_SetXmlDeclHandler@Base 2.0.1 XML_StopParser@Base 2.0.1 XML_UseForeignDTD@Base 2.0.1 XML_UseParserAsHandlerArg@Base 2.0.1 XmlGetUtf16InternalEncoding@Base 2.0.1 XmlGetUtf16InternalEncodingNS@Base 2.0.1 XmlGetUtf8InternalEncoding@Base 2.0.1 XmlGetUtf8InternalEncodingNS@Base 2.0.1 XmlInitEncoding@Base 2.0.1 XmlInitEncodingNS@Base 2.0.1 XmlInitUnknownEncoding@Base 2.0.1 XmlInitUnknownEncodingNS@Base 2.0.1 XmlParseXmlDecl@Base 2.0.1 XmlParseXmlDeclNS@Base 2.0.1 XmlPrologStateInit@Base 2.0.1 XmlPrologStateInitExternalEntity@Base 2.0.1 XmlSizeOfUnknownEncoding@Base 2.0.1 XmlUtf16Encode@Base 2.0.1 XmlUtf8Encode@Base 2.0.1 debian/expat.install0000664000000000000000000000001011732147356011701 0ustar usr/bin debian/libexpat1-udeb.install0000664000000000000000000000003411732147356013374 0ustar lib/*/libexpat.so.* usr/lib debian/libexpat1.install0000664000000000000000000000003611732147356012461 0ustar usr/lib/*/*.so.* lib/*/*.so.* debian/patches/0000775000000000000000000000000013124454063010621 5ustar debian/patches/CVE-2016-5300-2.patch0000664000000000000000000000330212726533645013402 0ustar commit ca523deca47303436fe522d030dbd9af3635be60 Author: Sebastian Pipping Date: Mon Mar 21 19:56:05 2016 +0100 Extract entropy from XML_Parser address Idea by Yann Droneaud, thanks! https://bugzilla.redhat.com/show_bug.cgi?id=1197087#c21 diff --git a/lib/xmlparse.c b/lib/xmlparse.c index 998def3..a2744b1 100644 --- a/lib/xmlparse.c +++ b/lib/xmlparse.c @@ -434,7 +434,7 @@ static ELEMENT_TYPE * getElementType(XML_Parser parser, const ENCODING *enc, const char *ptr, const char *end); -static unsigned long generate_hash_secret_salt(void); +static unsigned long generate_hash_secret_salt(XML_Parser parser); static XML_Bool startParsing(XML_Parser parser); static XML_Parser @@ -706,11 +706,12 @@ gather_time_entropy(void) } static unsigned long -generate_hash_secret_salt(void) +generate_hash_secret_salt(XML_Parser parser) { /* Process ID is 0 bits entropy if attacker has local access + * XML_Parser address is few bits of entropy if attacker has local access * Factor is 2^61-1 (Mersenne prime M61) */ - return (gather_time_entropy() ^ getpid()) * 2305843009213693951; + return (gather_time_entropy() ^ getpid() ^ (unsigned long)parser) * 2305843009213693951; } static XML_Bool /* only valid for root parser */ @@ -718,7 +719,7 @@ startParsing(XML_Parser parser) { /* hash functions must be initialized before setContext() is called */ if (hash_secret_salt == 0) - hash_secret_salt = generate_hash_secret_salt(); + hash_secret_salt = generate_hash_secret_salt(parser); if (ns) { /* implicit context only set for root parser, since child parsers (i.e. external entity parsers) will inherit it debian/patches/CVE-2015-1283.patch0000664000000000000000000000520512570061411013234 0ustar Description: fix multiple integer overflows in the XML_GetBuffer function Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716. Origin: Mozilla, https://hg.mozilla.org/releases/mozilla-esr31/rev/2f3e78643f5c Author: Eric Rahm Forwarded: not-needed Last-Update: 2015-07-24 diff --git a/lib/xmlparse.c b/lib/xmlparse.c --- a/lib/xmlparse.c +++ b/lib/xmlparse.c @@ -1673,29 +1673,40 @@ XML_ParseBuffer(XML_Parser parser, int l XmlUpdatePosition(encoding, positionPtr, bufferPtr, &position); positionPtr = bufferPtr; return result; } void * XMLCALL XML_GetBuffer(XML_Parser parser, int len) { +/* BEGIN MOZILLA CHANGE (sanity check len) */ + if (len < 0) { + errorCode = XML_ERROR_NO_MEMORY; + return NULL; + } +/* END MOZILLA CHANGE */ switch (ps_parsing) { case XML_SUSPENDED: errorCode = XML_ERROR_SUSPENDED; return NULL; case XML_FINISHED: errorCode = XML_ERROR_FINISHED; return NULL; default: ; } if (len > bufferLim - bufferEnd) { - /* FIXME avoid integer overflow */ int neededSize = len + (int)(bufferEnd - bufferPtr); +/* BEGIN MOZILLA CHANGE (sanity check neededSize) */ + if (neededSize < 0) { + errorCode = XML_ERROR_NO_MEMORY; + return NULL; + } +/* END MOZILLA CHANGE */ #ifdef XML_CONTEXT_BYTES int keep = (int)(bufferPtr - buffer); if (keep > XML_CONTEXT_BYTES) keep = XML_CONTEXT_BYTES; neededSize += keep; #endif /* defined XML_CONTEXT_BYTES */ if (neededSize <= bufferLim - buffer) { @@ -1714,17 +1725,25 @@ XML_GetBuffer(XML_Parser parser, int len } else { char *newBuf; int bufferSize = (int)(bufferLim - bufferPtr); if (bufferSize == 0) bufferSize = INIT_BUFFER_SIZE; do { bufferSize *= 2; - } while (bufferSize < neededSize); +/* BEGIN MOZILLA CHANGE (prevent infinite loop on overflow) */ + } while (bufferSize < neededSize && bufferSize > 0); +/* END MOZILLA CHANGE */ +/* BEGIN MOZILLA CHANGE (sanity check bufferSize) */ + if (bufferSize <= 0) { + errorCode = XML_ERROR_NO_MEMORY; + return NULL; + } +/* END MOZILLA CHANGE */ newBuf = (char *)MALLOC(bufferSize); if (newBuf == 0) { errorCode = XML_ERROR_NO_MEMORY; return NULL; } bufferLim = newBuf + bufferSize; #ifdef XML_CONTEXT_BYTES if (bufferPtr) { debian/patches/CVE-2016-0718.patch0000664000000000000000000005566412716375207013272 0ustar From cdfcb1b5c95e93b00ae9e9d25708b4a3bee72c15 Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Mon, 2 May 2016 00:02:44 +0200 Subject: [PATCH] Address CVE-2016-0718 (/patch/ version 2.2.1) * Out of bounds memory access when doing text conversion on malformed input * Integer overflow related to memory allocation Reported by Gustavo Grieco Patch credits go to * Christian Heimes * Karl Waclawek * Gustavo Grieco * Sebastian Pipping * Pascal Cuoq --- expat/lib/xmlparse.c | 34 +++++++++----- expat/lib/xmltok.c | 115 +++++++++++++++++++++++++++++++++++------------- expat/lib/xmltok.h | 10 ++++- expat/lib/xmltok_impl.c | 62 +++++++++++++------------- 4 files changed, 146 insertions(+), 75 deletions(-) Index: expat-2.1.0/lib/xmlparse.c =================================================================== --- expat-2.1.0.orig/lib/xmlparse.c 2016-05-16 12:47:01.774852444 -0400 +++ expat-2.1.0/lib/xmlparse.c 2016-05-16 12:47:01.770852392 -0400 @@ -2436,11 +2436,11 @@ for (;;) { int bufSize; int convLen; - XmlConvert(enc, + const enum XML_Convert_Result convert_res = XmlConvert(enc, &fromPtr, rawNameEnd, (ICHAR **)&toPtr, (ICHAR *)tag->bufEnd - 1); convLen = (int)(toPtr - (XML_Char *)tag->buf); - if (fromPtr == rawNameEnd) { + if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) { tag->name.strLen = convLen; break; } @@ -2661,11 +2661,11 @@ if (MUST_CONVERT(enc, s)) { for (;;) { ICHAR *dataPtr = (ICHAR *)dataBuf; - XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd); + const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd); *eventEndPP = s; charDataHandler(handlerArg, dataBuf, (int)(dataPtr - (ICHAR *)dataBuf)); - if (s == next) + if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) break; *eventPP = s; } @@ -3269,11 +3269,11 @@ if (MUST_CONVERT(enc, s)) { for (;;) { ICHAR *dataPtr = (ICHAR *)dataBuf; - XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd); + const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd); *eventEndPP = next; charDataHandler(handlerArg, dataBuf, (int)(dataPtr - (ICHAR *)dataBuf)); - if (s == next) + if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) break; *eventPP = s; } @@ -5350,6 +5350,7 @@ const char *s, const char *end) { if (MUST_CONVERT(enc, s)) { + enum XML_Convert_Result convert_res; const char **eventPP; const char **eventEndPP; if (enc == encoding) { @@ -5362,11 +5363,11 @@ } do { ICHAR *dataPtr = (ICHAR *)dataBuf; - XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd); + convert_res = XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd); *eventEndPP = s; defaultHandler(handlerArg, dataBuf, (int)(dataPtr - (ICHAR *)dataBuf)); *eventPP = s; - } while (s != end); + } while ((convert_res != XML_CONVERT_COMPLETED) && (convert_res != XML_CONVERT_INPUT_INCOMPLETE)); } else defaultHandler(handlerArg, (XML_Char *)s, (int)((XML_Char *)end - (XML_Char *)s)); @@ -6169,8 +6170,8 @@ if (!pool->ptr && !poolGrow(pool)) return NULL; for (;;) { - XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end); - if (ptr == end) + const enum XML_Convert_Result convert_res = XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end); + if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) break; if (!poolGrow(pool)) return NULL; @@ -6254,8 +6255,13 @@ } } if (pool->blocks && pool->start == pool->blocks->s) { - int blockSize = (int)(pool->end - pool->start)*2; - BLOCK *temp = (BLOCK *) + BLOCK *temp; + int blockSize = (int)((unsigned)(pool->end - pool->start)*2U); + + if (blockSize < 0) + return XML_FALSE; + + temp = (BLOCK *) pool->mem->realloc_fcn(pool->blocks, (offsetof(BLOCK, s) + blockSize * sizeof(XML_Char))); @@ -6270,6 +6276,10 @@ else { BLOCK *tem; int blockSize = (int)(pool->end - pool->start); + + if (blockSize < 0) + return XML_FALSE; + if (blockSize < INIT_BLOCK_SIZE) blockSize = INIT_BLOCK_SIZE; else Index: expat-2.1.0/lib/xmltok.c =================================================================== --- expat-2.1.0.orig/lib/xmltok.c 2016-05-16 12:47:01.774852444 -0400 +++ expat-2.1.0/lib/xmltok.c 2016-05-16 12:47:01.770852392 -0400 @@ -318,39 +318,55 @@ UTF8_cval4 = 0xf0 }; -static void PTRCALL +static enum XML_Convert_Result PTRCALL utf8_toUtf8(const ENCODING *enc, const char **fromP, const char *fromLim, char **toP, const char *toLim) { + enum XML_Convert_Result res = XML_CONVERT_COMPLETED; char *to; const char *from; if (fromLim - *fromP > toLim - *toP) { /* Avoid copying partial characters. */ + res = XML_CONVERT_OUTPUT_EXHAUSTED; for (fromLim = *fromP + (toLim - *toP); fromLim > *fromP; fromLim--) if (((unsigned char)fromLim[-1] & 0xc0) != 0x80) break; } - for (to = *toP, from = *fromP; from != fromLim; from++, to++) + for (to = *toP, from = *fromP; (from < fromLim) && (to < toLim); from++, to++) *to = *from; *fromP = from; *toP = to; + + if ((to == toLim) && (from < fromLim)) + return XML_CONVERT_OUTPUT_EXHAUSTED; + else + return res; } -static void PTRCALL +static enum XML_Convert_Result PTRCALL utf8_toUtf16(const ENCODING *enc, const char **fromP, const char *fromLim, unsigned short **toP, const unsigned short *toLim) { + enum XML_Convert_Result res = XML_CONVERT_COMPLETED; unsigned short *to = *toP; const char *from = *fromP; - while (from != fromLim && to != toLim) { + while (from < fromLim && to < toLim) { switch (((struct normal_encoding *)enc)->type[(unsigned char)*from]) { case BT_LEAD2: + if (fromLim - from < 2) { + res = XML_CONVERT_INPUT_INCOMPLETE; + break; + } *to++ = (unsigned short)(((from[0] & 0x1f) << 6) | (from[1] & 0x3f)); from += 2; break; case BT_LEAD3: + if (fromLim - from < 3) { + res = XML_CONVERT_INPUT_INCOMPLETE; + break; + } *to++ = (unsigned short)(((from[0] & 0xf) << 12) | ((from[1] & 0x3f) << 6) | (from[2] & 0x3f)); from += 3; @@ -358,8 +374,14 @@ case BT_LEAD4: { unsigned long n; - if (to + 1 == toLim) + if (toLim - to < 2) { + res = XML_CONVERT_OUTPUT_EXHAUSTED; goto after; + } + if (fromLim - from < 4) { + res = XML_CONVERT_INPUT_INCOMPLETE; + goto after; + } n = ((from[0] & 0x7) << 18) | ((from[1] & 0x3f) << 12) | ((from[2] & 0x3f) << 6) | (from[3] & 0x3f); n -= 0x10000; @@ -377,6 +399,7 @@ after: *fromP = from; *toP = to; + return res; } #ifdef XML_NS @@ -425,7 +448,7 @@ STANDARD_VTABLE(sb_) NORMAL_VTABLE(utf8_) }; -static void PTRCALL +static enum XML_Convert_Result PTRCALL latin1_toUtf8(const ENCODING *enc, const char **fromP, const char *fromLim, char **toP, const char *toLim) @@ -433,30 +456,35 @@ for (;;) { unsigned char c; if (*fromP == fromLim) - break; + return XML_CONVERT_COMPLETED; c = (unsigned char)**fromP; if (c & 0x80) { if (toLim - *toP < 2) - break; + return XML_CONVERT_OUTPUT_EXHAUSTED; *(*toP)++ = (char)((c >> 6) | UTF8_cval2); *(*toP)++ = (char)((c & 0x3f) | 0x80); (*fromP)++; } else { if (*toP == toLim) - break; + return XML_CONVERT_OUTPUT_EXHAUSTED; *(*toP)++ = *(*fromP)++; } } } -static void PTRCALL +static enum XML_Convert_Result PTRCALL latin1_toUtf16(const ENCODING *enc, const char **fromP, const char *fromLim, unsigned short **toP, const unsigned short *toLim) { - while (*fromP != fromLim && *toP != toLim) + while (*fromP < fromLim && *toP < toLim) *(*toP)++ = (unsigned char)*(*fromP)++; + + if ((*toP == toLim) && (*fromP < fromLim)) + return XML_CONVERT_OUTPUT_EXHAUSTED; + else + return XML_CONVERT_COMPLETED; } #ifdef XML_NS @@ -483,13 +511,18 @@ STANDARD_VTABLE(sb_) }; -static void PTRCALL +static enum XML_Convert_Result PTRCALL ascii_toUtf8(const ENCODING *enc, const char **fromP, const char *fromLim, char **toP, const char *toLim) { - while (*fromP != fromLim && *toP != toLim) + while (*fromP < fromLim && *toP < toLim) *(*toP)++ = *(*fromP)++; + + if ((*toP == toLim) && (*fromP < fromLim)) + return XML_CONVERT_OUTPUT_EXHAUSTED; + else + return XML_CONVERT_COMPLETED; } #ifdef XML_NS @@ -536,13 +569,14 @@ } #define DEFINE_UTF16_TO_UTF8(E) \ -static void PTRCALL \ +static enum XML_Convert_Result PTRCALL \ E ## toUtf8(const ENCODING *enc, \ const char **fromP, const char *fromLim, \ char **toP, const char *toLim) \ { \ - const char *from; \ - for (from = *fromP; from != fromLim; from += 2) { \ + const char *from = *fromP; \ + fromLim = from + (((fromLim - from) >> 1) << 1); /* shrink to even */ \ + for (; from < fromLim; from += 2) { \ int plane; \ unsigned char lo2; \ unsigned char lo = GET_LO(from); \ @@ -552,7 +586,7 @@ if (lo < 0x80) { \ if (*toP == toLim) { \ *fromP = from; \ - return; \ + return XML_CONVERT_OUTPUT_EXHAUSTED; \ } \ *(*toP)++ = lo; \ break; \ @@ -562,7 +596,7 @@ case 0x4: case 0x5: case 0x6: case 0x7: \ if (toLim - *toP < 2) { \ *fromP = from; \ - return; \ + return XML_CONVERT_OUTPUT_EXHAUSTED; \ } \ *(*toP)++ = ((lo >> 6) | (hi << 2) | UTF8_cval2); \ *(*toP)++ = ((lo & 0x3f) | 0x80); \ @@ -570,7 +604,7 @@ default: \ if (toLim - *toP < 3) { \ *fromP = from; \ - return; \ + return XML_CONVERT_OUTPUT_EXHAUSTED; \ } \ /* 16 bits divided 4, 6, 6 amongst 3 bytes */ \ *(*toP)++ = ((hi >> 4) | UTF8_cval3); \ @@ -580,7 +614,11 @@ case 0xD8: case 0xD9: case 0xDA: case 0xDB: \ if (toLim - *toP < 4) { \ *fromP = from; \ - return; \ + return XML_CONVERT_OUTPUT_EXHAUSTED; \ + } \ + if (fromLim - from < 4) { \ + *fromP = from; \ + return XML_CONVERT_INPUT_INCOMPLETE; \ } \ plane = (((hi & 0x3) << 2) | ((lo >> 6) & 0x3)) + 1; \ *(*toP)++ = ((plane >> 2) | UTF8_cval4); \ @@ -596,20 +634,32 @@ } \ } \ *fromP = from; \ + if (from < fromLim) \ + return XML_CONVERT_INPUT_INCOMPLETE; \ + else \ + return XML_CONVERT_COMPLETED; \ } #define DEFINE_UTF16_TO_UTF16(E) \ -static void PTRCALL \ +static enum XML_Convert_Result PTRCALL \ E ## toUtf16(const ENCODING *enc, \ const char **fromP, const char *fromLim, \ unsigned short **toP, const unsigned short *toLim) \ { \ + enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \ + fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1); /* shrink to even */ \ /* Avoid copying first half only of surrogate */ \ if (fromLim - *fromP > ((toLim - *toP) << 1) \ - && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) \ + && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \ fromLim -= 2; \ - for (; *fromP != fromLim && *toP != toLim; *fromP += 2) \ + res = XML_CONVERT_INPUT_INCOMPLETE; \ + } \ + for (; *fromP < fromLim && *toP < toLim; *fromP += 2) \ *(*toP)++ = (GET_HI(*fromP) << 8) | GET_LO(*fromP); \ + if ((*toP == toLim) && (*fromP < fromLim)) \ + return XML_CONVERT_OUTPUT_EXHAUSTED; \ + else \ + return res; \ } #define SET2(ptr, ch) \ @@ -1288,7 +1338,7 @@ return (c & ~0xFFFF) || checkCharRefNumber(c) < 0; } -static void PTRCALL +static enum XML_Convert_Result PTRCALL unknown_toUtf8(const ENCODING *enc, const char **fromP, const char *fromLim, char **toP, const char *toLim) @@ -1299,21 +1349,21 @@ const char *utf8; int n; if (*fromP == fromLim) - break; + return XML_CONVERT_COMPLETED; utf8 = uenc->utf8[(unsigned char)**fromP]; n = *utf8++; if (n == 0) { int c = uenc->convert(uenc->userData, *fromP); n = XmlUtf8Encode(c, buf); if (n > toLim - *toP) - break; + return XML_CONVERT_OUTPUT_EXHAUSTED; utf8 = buf; *fromP += (AS_NORMAL_ENCODING(enc)->type[(unsigned char)**fromP] - (BT_LEAD2 - 2)); } else { if (n > toLim - *toP) - break; + return XML_CONVERT_OUTPUT_EXHAUSTED; (*fromP)++; } do { @@ -1322,13 +1372,13 @@ } } -static void PTRCALL +static enum XML_Convert_Result PTRCALL unknown_toUtf16(const ENCODING *enc, const char **fromP, const char *fromLim, unsigned short **toP, const unsigned short *toLim) { const struct unknown_encoding *uenc = AS_UNKNOWN_ENCODING(enc); - while (*fromP != fromLim && *toP != toLim) { + while (*fromP < fromLim && *toP < toLim) { unsigned short c = uenc->utf16[(unsigned char)**fromP]; if (c == 0) { c = (unsigned short) @@ -1340,6 +1390,11 @@ (*fromP)++; *(*toP)++ = c; } + + if ((*toP == toLim) && (*fromP < fromLim)) + return XML_CONVERT_OUTPUT_EXHAUSTED; + else + return XML_CONVERT_COMPLETED; } ENCODING * @@ -1503,7 +1558,7 @@ { const ENCODING **encPtr; - if (ptr == end) + if (ptr >= end) return XML_TOK_NONE; encPtr = enc->encPtr; if (ptr + 1 == end) { Index: expat-2.1.0/lib/xmltok.h =================================================================== --- expat-2.1.0.orig/lib/xmltok.h 2016-05-16 12:47:01.774852444 -0400 +++ expat-2.1.0/lib/xmltok.h 2016-05-16 12:47:01.770852392 -0400 @@ -130,6 +130,12 @@ const char *, const char **); +enum XML_Convert_Result { + XML_CONVERT_COMPLETED = 0, + XML_CONVERT_INPUT_INCOMPLETE = 1, + XML_CONVERT_OUTPUT_EXHAUSTED = 2 /* and therefore potentially input remaining as well */ +}; + struct encoding { SCANNER scanners[XML_N_STATES]; SCANNER literalScanners[XML_N_LITERAL_TYPES]; @@ -158,12 +164,12 @@ const char *ptr, const char *end, const char **badPtr); - void (PTRCALL *utf8Convert)(const ENCODING *enc, + enum XML_Convert_Result (PTRCALL *utf8Convert)(const ENCODING *enc, const char **fromP, const char *fromLim, char **toP, const char *toLim); - void (PTRCALL *utf16Convert)(const ENCODING *enc, + enum XML_Convert_Result (PTRCALL *utf16Convert)(const ENCODING *enc, const char **fromP, const char *fromLim, unsigned short **toP, Index: expat-2.1.0/lib/xmltok_impl.c =================================================================== --- expat-2.1.0.orig/lib/xmltok_impl.c 2016-05-16 12:47:01.774852444 -0400 +++ expat-2.1.0/lib/xmltok_impl.c 2016-05-16 12:47:01.770852392 -0400 @@ -93,13 +93,13 @@ PREFIX(scanComment)(const ENCODING *enc, const char *ptr, const char *end, const char **nextTokPtr) { - if (ptr != end) { + if (ptr < end) { if (!CHAR_MATCHES(enc, ptr, ASCII_MINUS)) { *nextTokPtr = ptr; return XML_TOK_INVALID; } ptr += MINBPC(enc); - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { INVALID_CASES(ptr, nextTokPtr) case BT_MINUS: @@ -147,7 +147,7 @@ *nextTokPtr = ptr; return XML_TOK_INVALID; } - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { case BT_PERCNT: if (ptr + MINBPC(enc) == end) @@ -233,7 +233,7 @@ *nextTokPtr = ptr; return XML_TOK_INVALID; } - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) case BT_S: case BT_CR: case BT_LF: @@ -242,7 +242,7 @@ return XML_TOK_INVALID; } ptr += MINBPC(enc); - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { INVALID_CASES(ptr, nextTokPtr) case BT_QUEST: @@ -305,7 +305,7 @@ PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr, const char *end, const char **nextTokPtr) { - if (ptr == end) + if (ptr >= end) return XML_TOK_NONE; if (MINBPC(enc) > 1) { size_t n = end - ptr; @@ -348,7 +348,7 @@ ptr += MINBPC(enc); break; } - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { #define LEAD_CASE(n) \ case BT_LEAD ## n: \ @@ -391,11 +391,11 @@ *nextTokPtr = ptr; return XML_TOK_INVALID; } - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) case BT_S: case BT_CR: case BT_LF: - for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) { + for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) { switch (BYTE_TYPE(enc, ptr)) { case BT_S: case BT_CR: case BT_LF: break; @@ -432,7 +432,7 @@ PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr, const char *end, const char **nextTokPtr) { - if (ptr != end) { + if (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { case BT_DIGIT: case BT_HEX: @@ -441,7 +441,7 @@ *nextTokPtr = ptr; return XML_TOK_INVALID; } - for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) { + for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) { switch (BYTE_TYPE(enc, ptr)) { case BT_DIGIT: case BT_HEX: @@ -464,7 +464,7 @@ PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr, const char *end, const char **nextTokPtr) { - if (ptr != end) { + if (ptr < end) { if (CHAR_MATCHES(enc, ptr, ASCII_x)) return PREFIX(scanHexCharRef)(enc, ptr + MINBPC(enc), end, nextTokPtr); switch (BYTE_TYPE(enc, ptr)) { @@ -474,7 +474,7 @@ *nextTokPtr = ptr; return XML_TOK_INVALID; } - for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) { + for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) { switch (BYTE_TYPE(enc, ptr)) { case BT_DIGIT: break; @@ -506,7 +506,7 @@ *nextTokPtr = ptr; return XML_TOK_INVALID; } - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) case BT_SEMI: @@ -529,7 +529,7 @@ #ifdef XML_NS int hadColon = 0; #endif - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) #ifdef XML_NS @@ -716,7 +716,7 @@ hadColon = 0; #endif /* we have a start-tag */ - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) #ifdef XML_NS @@ -740,7 +740,7 @@ case BT_S: case BT_CR: case BT_LF: { ptr += MINBPC(enc); - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr) case BT_GT: @@ -785,7 +785,7 @@ PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end, const char **nextTokPtr) { - if (ptr == end) + if (ptr >= end) return XML_TOK_NONE; if (MINBPC(enc) > 1) { size_t n = end - ptr; @@ -832,7 +832,7 @@ ptr += MINBPC(enc); break; } - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { #define LEAD_CASE(n) \ case BT_LEAD ## n: \ @@ -895,7 +895,7 @@ *nextTokPtr = ptr; return XML_TOK_INVALID; } - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) case BT_SEMI: @@ -921,7 +921,7 @@ *nextTokPtr = ptr; return XML_TOK_INVALID; } - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) case BT_CR: case BT_LF: case BT_S: @@ -941,7 +941,7 @@ const char *ptr, const char *end, const char **nextTokPtr) { - while (ptr != end) { + while (ptr < end) { int t = BYTE_TYPE(enc, ptr); switch (t) { INVALID_CASES(ptr, nextTokPtr) @@ -973,7 +973,7 @@ const char **nextTokPtr) { int tok; - if (ptr == end) + if (ptr >= end) return XML_TOK_NONE; if (MINBPC(enc) > 1) { size_t n = end - ptr; @@ -1141,7 +1141,7 @@ *nextTokPtr = ptr; return XML_TOK_INVALID; } - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) case BT_GT: case BT_RPAR: case BT_COMMA: @@ -1204,10 +1204,10 @@ const char *end, const char **nextTokPtr) { const char *start; - if (ptr == end) + if (ptr >= end) return XML_TOK_NONE; start = ptr; - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { #define LEAD_CASE(n) \ case BT_LEAD ## n: ptr += n; break; @@ -1262,10 +1262,10 @@ const char *end, const char **nextTokPtr) { const char *start; - if (ptr == end) + if (ptr >= end) return XML_TOK_NONE; start = ptr; - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { #define LEAD_CASE(n) \ case BT_LEAD ## n: ptr += n; break; @@ -1326,7 +1326,7 @@ end = ptr + n; } } - while (ptr != end) { + while (ptr < end) { switch (BYTE_TYPE(enc, ptr)) { INVALID_CASES(ptr, nextTokPtr) case BT_LT: @@ -1373,7 +1373,7 @@ { ptr += MINBPC(enc); end -= MINBPC(enc); - for (; ptr != end; ptr += MINBPC(enc)) { + for (; ptr < end; ptr += MINBPC(enc)) { switch (BYTE_TYPE(enc, ptr)) { case BT_DIGIT: case BT_HEX: @@ -1760,7 +1760,7 @@ case BT_CR: pos->lineNumber++; ptr += MINBPC(enc); - if (ptr != end && BYTE_TYPE(enc, ptr) == BT_LF) + if (ptr < end && BYTE_TYPE(enc, ptr) == BT_LF) ptr += MINBPC(enc); pos->columnNumber = (XML_Size)-1; break; debian/patches/CVE-2017-9233.patch0000664000000000000000000000200513124454063013241 0ustar From c4bf96bb51dd2a1b0e185374362ee136fe2c9d7f Mon Sep 17 00:00:00 2001 From: Rhodri James Date: Wed, 14 Jun 2017 23:45:07 +0200 Subject: [PATCH] xmlparse.c: Fix external entity infinite loop bug (CVE-2017-9233) --- expat/lib/xmlparse.c | 8 ++++++++ 1 file changed, 8 insertions(+) Index: expat-2.1.0/lib/xmlparse.c =================================================================== --- expat-2.1.0.orig/lib/xmlparse.c 2017-06-27 09:05:28.479265064 -0400 +++ expat-2.1.0/lib/xmlparse.c 2017-06-27 09:05:28.459264814 -0400 @@ -3688,6 +3688,14 @@ entityValueInitProcessor(XML_Parser pars *nextPtr = next; return XML_ERROR_NONE; } + /* If we get this token, we have the start of what might be a + normal tag, but not a declaration (i.e. it doesn't begin with + ". # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a @@ -76,8 +74,8 @@ version="\ GNU config.sub ($timestamp) Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, -2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free -Software Foundation, Inc. +2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 +Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." @@ -132,6 +130,10 @@ case $maybe_os in os=-$maybe_os basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'` ;; + android-linux) + os=-linux-android + basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown + ;; *) basic_machine=`echo $1 | sed 's/-[^-]*$//'` if [ $basic_machine != $1 ] @@ -223,6 +225,12 @@ case $os in -isc*) basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; + -lynx*178) + os=-lynxos178 + ;; + -lynx*5) + os=-lynxos5 + ;; -lynx*) os=-lynxos ;; @@ -247,17 +255,22 @@ case $basic_machine in # Some are omitted here because they have special meanings below. 1750a | 580 \ | a29k \ + | aarch64 | aarch64_be \ | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \ | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \ | am33_2.0 \ | arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr | avr32 \ + | be32 | be64 \ | bfin \ | c4x | clipper \ | d10v | d30v | dlx | dsp16xx \ + | epiphany \ | fido | fr30 | frv \ | h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \ + | hexagon \ | i370 | i860 | i960 | ia64 \ | ip2k | iq2000 \ + | le32 | le64 \ | lm32 \ | m32c | m32r | m32rle | m68000 | m68k | m88k \ | maxq | mb | microblaze | mcore | mep | metag \ @@ -291,7 +304,7 @@ case $basic_machine in | pdp10 | pdp11 | pj | pjl \ | powerpc | powerpc64 | powerpc64le | powerpcle \ | pyramid \ - | rx \ + | rl78 | rx \ | score \ | sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \ | sh64 | sh64le \ @@ -300,7 +313,7 @@ case $basic_machine in | spu \ | tahoe | tic4x | tic54x | tic55x | tic6x | tic80 | tron \ | ubicom32 \ - | v850 | v850e \ + | v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \ | we32k \ | x86 | xc16x | xstormy16 | xtensa \ | z8k | z80) @@ -315,8 +328,7 @@ case $basic_machine in c6x) basic_machine=tic6x-unknown ;; - m6811 | m68hc11 | m6812 | m68hc12 | picochip) - # Motorola 68HC11/12. + m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | picochip) basic_machine=$basic_machine-unknown os=-none ;; @@ -329,7 +341,10 @@ case $basic_machine in strongarm | thumb | xscale) basic_machine=arm-unknown ;; - + xgate) + basic_machine=$basic_machine-unknown + os=-none + ;; xscaleeb) basic_machine=armeb-unknown ;; @@ -352,11 +367,13 @@ case $basic_machine in # Recognize the basic CPU types with company name. 580-* \ | a29k-* \ + | aarch64-* | aarch64_be-* \ | alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \ | alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \ | alphapca5[67]-* | alpha64pca5[67]-* | arc-* \ | arm-* | armbe-* | armle-* | armeb-* | armv*-* \ | avr-* | avr32-* \ + | be32-* | be64-* \ | bfin-* | bs2000-* \ | c[123]* | c30-* | [cjt]90-* | c4x-* \ | clipper-* | craynv-* | cydra-* \ @@ -365,8 +382,10 @@ case $basic_machine in | f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \ | h8300-* | h8500-* \ | hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \ + | hexagon-* \ | i*86-* | i860-* | i960-* | ia64-* \ | ip2k-* | iq2000-* \ + | le32-* | le64-* \ | lm32-* \ | m32c-* | m32r-* | m32rle-* \ | m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \ @@ -400,7 +419,7 @@ case $basic_machine in | pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \ | powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \ | pyramid-* \ - | romp-* | rs6000-* | rx-* \ + | rl78-* | romp-* | rs6000-* | rx-* \ | sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \ | shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \ | sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \ @@ -408,10 +427,11 @@ case $basic_machine in | sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx?-* \ | tahoe-* \ | tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \ - | tile-* | tilegx-* \ + | tile*-* \ | tron-* \ | ubicom32-* \ - | v850-* | v850e-* | vax-* \ + | v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \ + | vax-* \ | we32k-* \ | x86-* | x86_64-* | xc16x-* | xps100-* \ | xstormy16-* | xtensa*-* \ @@ -711,7 +731,6 @@ case $basic_machine in i370-ibm* | ibm*) basic_machine=i370-ibm ;; -# I'm not sure what "Sysv32" means. Should this be sysv3.2? i*86v32) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv32 @@ -808,10 +827,18 @@ case $basic_machine in ms1-*) basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'` ;; + msys) + basic_machine=i386-pc + os=-msys + ;; mvs) basic_machine=i370-ibm os=-mvs ;; + nacl) + basic_machine=le32-unknown + os=-nacl + ;; ncr3000) basic_machine=i486-ncr os=-sysv4 @@ -1120,13 +1147,8 @@ case $basic_machine in basic_machine=t90-cray os=-unicos ;; - # This must be matched before tile*. - tilegx*) - basic_machine=tilegx-unknown - os=-linux-gnu - ;; tile*) - basic_machine=tile-unknown + basic_machine=$basic_machine-unknown os=-linux-gnu ;; tx39) @@ -1336,7 +1358,7 @@ case $os in | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \ | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \ | -chorusos* | -chorusrdb* | -cegcc* \ - | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \ + | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \ | -mingw32* | -linux-gnu* | -linux-android* \ | -linux-newlib* | -linux-uclibc* \ | -uxpv* | -beos* | -mpeix* | -udk* \ @@ -1521,6 +1543,9 @@ case $basic_machine in c4x-* | tic4x-*) os=-coff ;; + hexagon-*) + os=-elf + ;; tic54x-*) os=-coff ;; @@ -1548,9 +1573,6 @@ case $basic_machine in ;; m68000-sun) os=-sunos3 - # This also exists in the configure program, but was not the - # default. - # os=-sunos4 ;; m68*-cisco) os=-aout --- expat-2.1.0.orig/conftools/config.guess +++ expat-2.1.0/conftools/config.guess @@ -2,9 +2,9 @@ # Attempt to guess a canonical system name. # Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, # 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, -# 2011 Free Software Foundation, Inc. +# 2011, 2012 Free Software Foundation, Inc. -timestamp='2011-05-11' +timestamp='2012-02-10' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by @@ -17,9 +17,7 @@ timestamp='2011-05-11' # General Public License for more details. # # You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA -# 02110-1301, USA. +# along with this program; if not, see . # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a @@ -57,8 +55,8 @@ GNU config.guess ($timestamp) Originally written by Per Bothner. Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, -2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free -Software Foundation, Inc. +2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 +Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." @@ -145,7 +143,7 @@ UNAME_VERSION=`(uname -v) 2>/dev/null` | case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in *:NetBSD:*:*) # NetBSD (nbsd) targets should (where applicable) match one or - # more of the tupples: *-*-netbsdelf*, *-*-netbsdaout*, + # more of the tuples: *-*-netbsdelf*, *-*-netbsdaout*, # *-*-netbsdecoff* and *-*-netbsd*. For targets that recently # switched to ELF, *-*-netbsd* would select the old # object file format. This provides both forward @@ -792,13 +790,12 @@ EOF echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE} exit ;; *:FreeBSD:*:*) - case ${UNAME_MACHINE} in - pc98) - echo i386-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; + UNAME_PROCESSOR=`/usr/bin/uname -p` + case ${UNAME_PROCESSOR} in amd64) echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; *) - echo ${UNAME_MACHINE}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; + echo ${UNAME_PROCESSOR}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; esac exit ;; i*:CYGWIN*:*) @@ -807,6 +804,9 @@ EOF *:MINGW*:*) echo ${UNAME_MACHINE}-pc-mingw32 exit ;; + i*:MSYS*:*) + echo ${UNAME_MACHINE}-pc-msys + exit ;; i*:windows32*:*) # uname -m includes "-pc" on this system. echo ${UNAME_MACHINE}-mingw32 @@ -861,6 +861,13 @@ EOF i*86:Minix:*:*) echo ${UNAME_MACHINE}-pc-minix exit ;; + aarch64:Linux:*:*) + echo ${UNAME_MACHINE}-unknown-linux-gnu + exit ;; + aarch64_be:Linux:*:*) + UNAME_MACHINE=aarch64_be + echo ${UNAME_MACHINE}-unknown-linux-gnu + exit ;; alpha:Linux:*:*) case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in EV5) UNAME_MACHINE=alphaev5 ;; @@ -895,13 +902,16 @@ EOF echo ${UNAME_MACHINE}-unknown-linux-gnu exit ;; cris:Linux:*:*) - echo cris-axis-linux-gnu + echo ${UNAME_MACHINE}-axis-linux-gnu exit ;; crisv32:Linux:*:*) - echo crisv32-axis-linux-gnu + echo ${UNAME_MACHINE}-axis-linux-gnu exit ;; frv:Linux:*:*) - echo frv-unknown-linux-gnu + echo ${UNAME_MACHINE}-unknown-linux-gnu + exit ;; + hexagon:Linux:*:*) + echo ${UNAME_MACHINE}-unknown-linux-gnu exit ;; i*86:Linux:*:*) LIBC=gnu @@ -943,7 +953,7 @@ EOF test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; } ;; or32:Linux:*:*) - echo or32-unknown-linux-gnu + echo ${UNAME_MACHINE}-unknown-linux-gnu exit ;; padre:Linux:*:*) echo sparc-unknown-linux-gnu @@ -978,13 +988,13 @@ EOF echo ${UNAME_MACHINE}-unknown-linux-gnu exit ;; tile*:Linux:*:*) - echo ${UNAME_MACHINE}-tilera-linux-gnu + echo ${UNAME_MACHINE}-unknown-linux-gnu exit ;; vax:Linux:*:*) echo ${UNAME_MACHINE}-dec-linux-gnu exit ;; x86_64:Linux:*:*) - echo x86_64-unknown-linux-gnu + echo ${UNAME_MACHINE}-unknown-linux-gnu exit ;; xtensa*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-gnu @@ -1315,6 +1325,9 @@ EOF i*86:AROS:*:*) echo ${UNAME_MACHINE}-pc-aros exit ;; + x86_64:VMkernel:*:*) + echo ${UNAME_MACHINE}-unknown-esx + exit ;; esac #echo '(No uname command or uname output not recognized.)' 1>&2 debian/patches/302191_install_expat_config_h.diff0000664000000000000000000000177311732151632017004 0ustar ## 302191_install_expat_config_h.dpatch by Raphael Bossek ## and Arno van Rangelrooij ## ## All lines beginning with `## DP:' are a description of the patch. ## DP: To get information about the expat library and how it was build the ## DP: expat_config.h file is mandatory. Without this file other applications ## DP: may fail to build. This is the case for the latest python-4suite packages ## DP: where the expat_config.h is refered. ## DP: ## DP: diff -urNad expat-2.0.1~/Makefile.in expat-2.0.1/Makefile.in --- expat-2.0.1~/Makefile.in 2007-05-09 20:38:50.000000000 +0200 +++ expat-2.0.1/Makefile.in 2008-05-07 02:23:11.000000000 +0200 @@ -41,7 +41,7 @@ mkinstalldirs = $(SHELL) $(top_srcdir)/conftools/mkinstalldirs MANFILE = $(srcdir)/doc/xmlwf.1 -APIHEADER = $(srcdir)/lib/expat.h $(srcdir)/lib/expat_external.h +APIHEADER = $(srcdir)/lib/expat.h $(srcdir)/lib/expat_external.h expat_config.h LIBRARY = libexpat.la DESTDIR = $(INSTALL_ROOT) debian/patches/CVE-2012-6702-1.patch0000664000000000000000000000456112726533634013412 0ustar commit 6acb0a47372a9079cc6ff70c384f015a47f2c34a Author: Sebastian Pipping Date: Wed Mar 16 15:30:12 2016 +0100 Resolve call to srand, use more entropy Since commit e3e81a6d9f0885ea02d3979151c358f314bf3d6d (released with Expat 2.1.0) Expat called srand by itself from inside generate_hash_secret_salt for an instance of XML_Parser if XML_SetHashSalt was either (a) not called for that instance or if (b) salt 0 was passed to XML_SetHashSalt prior to parsing. That call to srand passed (rather litle) entropy extracted from the current time as a seed for srand. That call to srand (1) broke repeatability for code calling srand with a non-random seed prior to parsing with Expat, and (2) resulted in a rather small set of hashing salts in Expat in total. For a short- to mid-term fix, the new approach avoids calling srand altogether, extracts more entropy out of the clock and adds some additional entropy from the process ID, too. For a long term fix, we may want to read sizeof(long) bytes from a source like getrandom(..) on Linux, and from similar sources on other supported architectures. https://bugzilla.redhat.com/show_bug.cgi?id=1197087 diff --git a/lib/xmlparse.c b/lib/xmlparse.c index 2d0bd3b..41299da 100644 --- a/lib/xmlparse.c +++ b/lib/xmlparse.c @@ -6,7 +6,9 @@ #include /* memset(), memcpy() */ #include #include /* UINT_MAX */ -#include /* time() */ +#include /* gettimeofday() */ +#include /* getpid() */ +#include /* getpid() */ #define XML_BUILDING_EXPAT 1 @@ -693,9 +695,16 @@ static const XML_Char implicitContext[] = { static unsigned long generate_hash_secret_salt(void) { - unsigned int seed = time(NULL) % UINT_MAX; - srand(seed); - return rand(); + struct timeval tv; + int gettimeofday_res; + + gettimeofday_res = gettimeofday(&tv, NULL); + assert (gettimeofday_res == 0); + + /* Microseconds time is <20 bits entropy + * Process ID is 0 bits entropy if attacker has local access + * Factor is 2^61-1 (Mersenne prime M61) */ + return (tv.tv_usec ^ getpid()) * 2305843009213693951; } static XML_Bool /* only valid for root parser */ debian/patches/412786_xmlwf_man_standard_fix.diff0000664000000000000000000000201511732152247017024 0ustar ## 412786_xmlwf_man_standard_fix.dpatch by Cameron McCormack and ## Ardo van Rangelrooij ## ## All lines beginning with `## DP:' are a description of the patch. ## DP: GROFF expects a macro name after a leading point. So remove ## DP: the linebreak and avoid the warning. ## DP: ## DP: There is no well-formedness constraint in XML ## DP: that requires the XML declaration. ## DP: ## DP: diff -urNad expat-2.0.1~/doc/xmlwf.sgml expat-2.0.1/doc/xmlwf.sgml --- expat-2.0.1~/doc/xmlwf.sgml 2003-01-24 19:34:03.000000000 +0100 +++ expat-2.0.1/doc/xmlwf.sgml 2008-05-07 04:06:39.000000000 +0200 @@ -286,8 +286,7 @@ This gives a fairly accurate idea of the raw speed of Expat itself without client overhead. turns off most of the output options - (, , , - ...). + (, , , ...). debian/patches/CVE-2015-1283-refix.patch0000664000000000000000000000255012716375203014360 0ustar From 29a11774d8ebbafe8418b4a5ffb4cc1160b194a1 Mon Sep 17 00:00:00 2001 From: Pascal Cuoq Date: Sun, 15 May 2016 09:05:46 +0200 Subject: [PATCH] Avoid relying on undefined behavior in CVE-2015-1283 fix. It does not really work: https://godbolt.org/g/Zl8gdF --- expat/lib/xmlparse.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) Index: expat-2.1.0/lib/xmlparse.c =================================================================== --- expat-2.1.0.orig/lib/xmlparse.c 2016-05-16 12:45:54.133977031 -0400 +++ expat-2.1.0/lib/xmlparse.c 2016-05-16 12:46:42.590604199 -0400 @@ -1695,7 +1695,8 @@ } if (len > bufferLim - bufferEnd) { - int neededSize = len + (int)(bufferEnd - bufferPtr); + /* Do not invoke signed arithmetic overflow: */ + int neededSize = (int) ((unsigned)len + (unsigned)(bufferEnd - bufferPtr)); /* BEGIN MOZILLA CHANGE (sanity check neededSize) */ if (neededSize < 0) { errorCode = XML_ERROR_NO_MEMORY; @@ -1729,7 +1730,8 @@ if (bufferSize == 0) bufferSize = INIT_BUFFER_SIZE; do { - bufferSize *= 2; + /* Do not invoke signed arithmetic overflow: */ + bufferSize = (int) (2U * (unsigned) bufferSize); /* BEGIN MOZILLA CHANGE (prevent infinite loop on overflow) */ } while (bufferSize < neededSize && bufferSize > 0); /* END MOZILLA CHANGE */ debian/patches/CVE-2016-5300-1.patch0000664000000000000000000000221712726533641013401 0ustar commit a5f2d0406056d384cdd4b9955384703137a4d19a Author: Sebastian Pipping Date: Sun Mar 20 20:26:27 2016 +0100 Extract method gather_time_entropy diff --git a/lib/xmlparse.c b/lib/xmlparse.c index 41299da..998def3 100644 --- a/lib/xmlparse.c +++ b/lib/xmlparse.c @@ -693,7 +693,7 @@ static const XML_Char implicitContext[] = { }; static unsigned long -generate_hash_secret_salt(void) +gather_time_entropy(void) { struct timeval tv; int gettimeofday_res; @@ -701,10 +701,16 @@ generate_hash_secret_salt(void) gettimeofday_res = gettimeofday(&tv, NULL); assert (gettimeofday_res == 0); - /* Microseconds time is <20 bits entropy - * Process ID is 0 bits entropy if attacker has local access + /* Microseconds time is <20 bits entropy */ + return tv.tv_usec; +} + +static unsigned long +generate_hash_secret_salt(void) +{ + /* Process ID is 0 bits entropy if attacker has local access * Factor is 2^61-1 (Mersenne prime M61) */ - return (tv.tv_usec ^ getpid()) * 2305843009213693951; + return (gather_time_entropy() ^ getpid()) * 2305843009213693951; } static XML_Bool /* only valid for root parser */ debian/patches/CVE-2012-6702-2.patch0000664000000000000000000000230712726533652013407 0ustar commit f627ff74d631f4548f924ca5bd27ddad6cae07ab Author: Sebastian Pipping Date: Mon Mar 21 20:05:27 2016 +0100 Use a prime that fits 32bits on 32bit platforms Bug reported by Yann Droneaud, thanks! https://bugzilla.redhat.com/show_bug.cgi?id=1197087#c21 diff --git a/lib/xmlparse.c b/lib/xmlparse.c index a2744b1..c9c7a9b 100644 --- a/lib/xmlparse.c +++ b/lib/xmlparse.c @@ -709,9 +709,16 @@ static unsigned long generate_hash_secret_salt(XML_Parser parser) { /* Process ID is 0 bits entropy if attacker has local access - * XML_Parser address is few bits of entropy if attacker has local access - * Factor is 2^61-1 (Mersenne prime M61) */ - return (gather_time_entropy() ^ getpid() ^ (unsigned long)parser) * 2305843009213693951; + * XML_Parser address is few bits of entropy if attacker has local access */ + const unsigned long entropy = + gather_time_entropy() ^ getpid() ^ (unsigned long)parser; + + /* Factors are 2^31-1 and 2^61-1 (Mersenne primes M31 and M61) */ + if (sizeof(unsigned long) == 4) { + return entropy * 2147483647; + } else { + return entropy * 2305843009213693951; + } } static XML_Bool /* only valid for root parser */ debian/copyright0000664000000000000000000000271011732147356011134 0ustar This is the Debian package of expat, the C library for parsing XML. The source package was downloaded from . The original packager is Adam Di Carlo . The current maintainer is Ardo van Rangelrooij . Copyright (c) 1998, 1999, 2000 Thai Open Source Software Center Ltd and Clark Cooper Copyright (c) 2001, 2002, 2003, 2004, 2005, 2006 Expat maintainers. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. debian/watch0000664000000000000000000000012012142420303010201 0ustar version=3 http://sf.net/expat/expat-(\d.*)\.(?:tgz|tbz2|txz|tar\.(?:gz|bz2|xz)) debian/lib64expat1.shlibs0000664000000000000000000000010511732147356012446 0ustar libexpat 1 lib64expat1 (>= 2.0.1) libexpatw 1 lib64expat1 (>= 2.0.1) debian/libexpat1.shlibs0000664000000000000000000000015611732147356012302 0ustar libexpat 1 libexpat1 (>= 1.95.8) libexpatw 1 libexpat1 (>= 2.0.1) udeb: libexpat 1 libexpat1-udeb (>= 1.95.8) debian/libexpat1-dev.examples0000664000000000000000000000001511732147356013402 0ustar examples/*.c debian/lib64expat1-dev.install0000664000000000000000000000003512142414602013371 0ustar usr/lib64/*.a usr/lib64/*.so debian/libexpat1-dev.doc-base0000664000000000000000000000044011732147356013243 0ustar Document: expat Title: Expat XML Parser Author: Clark Cooper Abstract: This manual describes the Expat XML Parser library. Section: Text Format: HTML Index: /usr/share/doc/libexpat1-dev/expat.html/index.html Files: /usr/share/doc/libexpat1-dev/expat.html/*.html debian/libexpat1-dev.links0000664000000000000000000000015011732147356012704 0ustar usr/share/doc/libexpat1-dev/expat.html/reference.html usr/share/doc/libexpat1-dev/expat.html/index.html debian/rules0000775000000000000000000001171012247360104010247 0ustar #!/usr/bin/make -f ## ---------------------------------------------------------------------- ## debian/rules : package script for expat ## ---------------------------------------------------------------------- ## uncomment this to turn on verbose mode #export DH_VERBOSE=1 DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE) DEB_HOST_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE) DEB_HOST_ARCH ?= $(shell dpkg-architecture -qDEB_HOST_ARCH) DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH) BUILD64 = $(filter $(DEB_HOST_ARCH), i386 powerpc sparc s390) ifeq ($(DEB_BUILD_GNU_TYPE), $(DEB_HOST_GNU_TYPE)) CONFFLAGS = --build=$(DEB_HOST_GNU_TYPE) else CONFFLAGS = --build=$(DEB_BUILD_GNU_TYPE) --host=$(DEB_HOST_GNU_TYPE) endif ifeq ($(DEB_HOST_ARCH),i386) HOST64FLAG = --host=x86_64-linux-gnu endif ifeq ($(DEB_HOST_ARCH),powerpc) HOST64FLAG = --host=ppc64-linux-gnu endif ifeq ($(DEB_HOST_ARCH),sparc) HOST64FLAG = --host=sparc64-linux-gnu endif ifeq ($(DEB_HOST_ARCH),s390) HOST64FLAG = --host=s390x-linux-gnu endif # -pthread -D_REENTRANT #551079 CFLAGS = `dpkg-buildflags --get CFLAGS` CFLAGS += -Wall LDFLAGS = -Wl,-Bsymbolic-functions LDFLAGS += `dpkg-buildflags --get LDFLAGS` CPPFLAGS = `dpkg-buildflags --get CPPFLAGS` UPACKAGE = $(shell dh_listpackages | grep -- -udeb$$) COMMA = , ifneq (,$(filter parallel=%,$(subst $(COMMA), ,$(DEB_BUILD_OPTIONS)))) NJOBS := -j $(subst parallel=,,$(filter parallel=%,$(subst $(COMMA), ,$(DEB_BUILD_OPTIONS)))) endif config-common-stamp: dh_testdir dh_autoreconf touch $@ build/config.status: config-common-stamp dh_testdir (mkdir -p $(@D); cd $(@D); CFLAGS="$(CFLAGS)" CPPFLAGS="$(CPPFLAGS)" LDFLAGS="$(LDFLAGS)" \ ../configure $(CONFFLAGS) --prefix=/usr --mandir=\$${prefix}/share/man --libdir=\$${prefix}/lib/$(DEB_HOST_MULTIARCH)) buildw/config.status: config-common-stamp dh_testdir (mkdir -p $(@D); cd $(@D); CFLAGS="$(CFLAGS) -DXML_UNICODE" CPPFLAGS="$(CPPFLAGS)" LDFLAGS="$(LDFLAGS)" \ ../configure $(CONFFLAGS) --prefix=/usr --mandir=\$${prefix}/share/man --libdir=\$${prefix}/lib/$(DEB_HOST_MULTIARCH)) build64/config.status: config-common-stamp dh_testdir (mkdir -p $(@D); cd $(@D); CFLAGS="-m64 $(CFLAGS)" CPPFLAGS="$(CPPFLAGS)" LDFLAGS="$(LDFLAGS)" \ ../configure $(CONFFLAGS) $(HOST64FLAG) --prefix=/usr --mandir=\$${prefix}/share/man \ --libdir=\$${prefix}/lib64) buildw64/config.status: config-common-stamp dh_testdir (mkdir -p $(@D); cd $(@D); CFLAGS="-m64 $(CFLAGS) -DXML_UNICODE" CPPFLAGS="$(CPPFLAGS)" LDFLAGS="$(LDFLAGS)" \ ../configure $(CONFFLAGS) $(HOST64FLAG) --prefix=/usr --mandir=\$${prefix}/share/man \ --libdir=\$${prefix}/lib64) clean: dh_testdir dh_testroot rm -rf build/ build64/ buildw/ buildw64/ rm -rf debian/tmp/ dh_autoreconf_clean dh_clean config-common-stamp build-stamp debian/xmlwf.1 build: build-stamp build-arch: build-stamp build-indep: build-stamp build-stamp: build/config.status buildw/config.status $(if $(BUILD64), build64/config.status buildw64/config.status) dh_testdir $(MAKE) $(NJOBS) -C build/ $(MAKE) $(NJOBS) -C buildw/ buildlib LIBRARY=libexpatw.la ifneq ($(BUILD64),) $(MAKE) $(NJOBS) -C build64/ buildlib $(MAKE) $(NJOBS) -C buildw64/ buildlib LIBRARY=libexpatw.la endif docbook-to-man doc/xmlwf.sgml > debian/xmlwf.1 touch $@ install: build dh_testdir dh_testroot dh_prep dh_installdirs $(MAKE) -C build/ install DESTDIR=$(CURDIR)/debian/tmp $(MAKE) -C buildw/ installlib LIBRARY=libexpatw.la DESTDIR=$(CURDIR)/debian/tmp APIHEADER= ifneq ($(BUILD64),) $(MAKE) -C build64/ installlib DESTDIR=$(CURDIR)/debian/tmp $(MAKE) -C buildw64/ installlib LIBRARY=libexpatw.la DESTDIR=$(CURDIR)/debian/tmp APIHEADER= endif # Move libexpat.so.* to /lib so that zfsutils can use it. mkdir -p $(CURDIR)/debian/tmp/lib/$(DEB_HOST_MULTIARCH) mv $(CURDIR)/debian/tmp/usr/lib/$(DEB_HOST_MULTIARCH)/libexpat.so.* \ $(CURDIR)/debian/tmp/lib/$(DEB_HOST_MULTIARCH)/ for i in $(CURDIR)/debian/tmp/usr/lib/$(DEB_HOST_MULTIARCH)/libexpat.so ; do \ dest=$$(readlink $$i) ; \ rm -f $$i ; \ ln -s /lib/$(DEB_HOST_MULTIARCH)/$$dest $$i ; \ done mkdir -p debian/tmp/usr/include/$(DEB_HOST_MULTIARCH) mv debian/tmp/usr/include/expat_config.h debian/tmp/usr/include/$(DEB_HOST_MULTIARCH)/. binary-indep: build install binary-arch: build install dh_testdir dh_testroot dh_install -s --sourcedir=debian/tmp dh_installdocs -s dh_installman -pexpat debian/xmlwf.1 dh_installexamples -s dh_installchangelogs -s Changes dh_link -s dh_strip -s dh_compress -s dh_fixperms -s chmod 644 $(CURDIR)/debian/libexpat1-dev/usr/share/doc/libexpat1-dev/examples/* \ $(CURDIR)/debian/libexpat1-dev/usr/share/aclocal/* dh_makeshlibs -s -V --add-udeb=$(UPACKAGE) dh_installdeb -s dh_shlibdeps -s -l $(CURDIR)/debian/libexpat1/usr/lib/$(DEB_HOST_MULTIARCH):$(CURDIR)/debian/lib64expat1/usr/lib64 dh_gencontrol -s dh_md5sums -s dh_builddeb -s binary: binary-indep binary-arch .PHONY: clean build install binary-indep binary-arch binary