08/08: gnu: libcroco: Update to 0.6.13.

[guix-commits]

mbakke pushed a commit to branch core-updates
in repository guix.

commit 8bdacad26b1209dd4d95f5ca093a9178feb12f5b
Author: Marius Bakke <address@hidden>
Date:   Fri Jun 21 14:45:14 2019 +0200

    gnu: libcroco: Update to 0.6.13.
    
    * gnu/packages/patches/libcroco-CVE-2017-7960.patch,
    gnu/packages/patches/libcroco-CVE-2017-7961.patch: Delete files.
    * gnu/local.mk (dist_patch_DATA): Adjust accordingly.
    * gnu/packages/gnome.scm (libcroco): Update to 0.6.13.
    [source](patches): Remove.
---
 gnu/local.mk                                      |  2 -
 gnu/packages/gnome.scm                            |  7 +--
 gnu/packages/patches/libcroco-CVE-2017-7960.patch | 66 -----------------------
 gnu/packages/patches/libcroco-CVE-2017-7961.patch | 50 -----------------
 4 files changed, 2 insertions(+), 123 deletions(-)

diff --git a/gnu/local.mk b/gnu/local.mk
index 2051df8..d375b8c 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -989,8 +989,6 @@ dist_patch_DATA =                                           
\
   %D%/packages/patches/libbase-use-own-logging.patch           \
   %D%/packages/patches/libbonobo-activation-test-race.patch    \
   %D%/packages/patches/libcanberra-sound-theme-freedesktop.patch \
-  %D%/packages/patches/libcroco-CVE-2017-7960.patch            \
-  %D%/packages/patches/libcroco-CVE-2017-7961.patch            \
   %D%/packages/patches/libdrm-symbol-check.patch               \
   %D%/packages/patches/libexif-CVE-2016-6328.patch             \
   %D%/packages/patches/libexif-CVE-2017-7544.patch             \
diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 5537ca6..f8a6a77 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -1256,18 +1256,15 @@ the GNOME desktop environment.")
 (define-public libcroco
   (package
     (name "libcroco")
-    (version "0.6.12")
+    (version "0.6.13")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
                                   (version-major+minor version)  "/"
                                   name "-" version ".tar.xz"))
-              (patches
-                (search-patches "libcroco-CVE-2017-7960.patch"
-                                "libcroco-CVE-2017-7961.patch"))
               (sha256
                (base32
-                "0q7qhi7z64i26zabg9dbs5706fa8pmzp1qhpa052id4zdiabbi6x"))))
+                "1m110rbj5d2raxcdp4iz0qp172284945awrsbdlq99ksmqsc4zkn"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
diff --git a/gnu/packages/patches/libcroco-CVE-2017-7960.patch 
b/gnu/packages/patches/libcroco-CVE-2017-7960.patch
deleted file mode 100644
index 0319c73..0000000
--- a/gnu/packages/patches/libcroco-CVE-2017-7960.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-Fix CVE-2017-7960:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7960
-
-Patch copied from upstream source repository:
-
-https://git.gnome.org/browse/libcroco/commit/?id=898e3a8c8c0314d2e6b106809a8e3e93cf9d4394
-
-From 898e3a8c8c0314d2e6b106809a8e3e93cf9d4394 Mon Sep 17 00:00:00 2001
-From: Ignacio Casal Quinteiro <address@hidden>
-Date: Sun, 16 Apr 2017 13:13:43 +0200
-Subject: input: check end of input before reading a byte
-
-When reading bytes we weren't check that the index wasn't
-out of bound and this could produce an invalid read which
-could deal to a security bug.
----
- src/cr-input.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/src/cr-input.c b/src/cr-input.c
-index 49000b1..3b63a88 100644
---- a/src/cr-input.c
-+++ b/src/cr-input.c
-@@ -256,7 +256,7 @@ cr_input_new_from_uri (const gchar * a_file_uri, enum 
CREncoding a_enc)
-                  *we should  free buf here because it's own by CRInput.
-                  *(see the last parameter of cr_input_new_from_buf().
-                  */
--                buf = NULL ;
-+                buf = NULL;
-         }
- 
-  cleanup:
-@@ -404,6 +404,8 @@ cr_input_get_nb_bytes_left (CRInput const * a_this)
- enum CRStatus
- cr_input_read_byte (CRInput * a_this, guchar * a_byte)
- {
-+        gulong nb_bytes_left = 0;
-+
-         g_return_val_if_fail (a_this && PRIVATE (a_this)
-                               && a_byte, CR_BAD_PARAM_ERROR);
- 
-@@ -413,6 +415,12 @@ cr_input_read_byte (CRInput * a_this, guchar * a_byte)
-         if (PRIVATE (a_this)->end_of_input == TRUE)
-                 return CR_END_OF_INPUT_ERROR;
- 
-+        nb_bytes_left = cr_input_get_nb_bytes_left (a_this);
-+
-+        if (nb_bytes_left < 1) {
-+                return CR_END_OF_INPUT_ERROR;
-+        }
-+
-         *a_byte = PRIVATE (a_this)->in_buf[PRIVATE (a_this)->next_byte_index];
- 
-         if (PRIVATE (a_this)->nb_bytes -
-@@ -477,7 +485,6 @@ cr_input_read_char (CRInput * a_this, guint32 * a_char)
-                 if (*a_char == '\n') {
-                         PRIVATE (a_this)->end_of_line = TRUE;
-                 }
--
-         }
- 
-         return status;
--- 
-cgit v0.12
-
diff --git a/gnu/packages/patches/libcroco-CVE-2017-7961.patch 
b/gnu/packages/patches/libcroco-CVE-2017-7961.patch
deleted file mode 100644
index 675dbe4..0000000
--- a/gnu/packages/patches/libcroco-CVE-2017-7961.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-Fix CVE-2017-7961:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7961
-
-Patch copied from upstream source repository:
-
-https://git.gnome.org/browse/libcroco/commit/?id=9ad72875e9f08e4c519ef63d44cdbd94aa9504f7
-
-From 9ad72875e9f08e4c519ef63d44cdbd94aa9504f7 Mon Sep 17 00:00:00 2001
-From: Ignacio Casal Quinteiro <address@hidden>
-Date: Sun, 16 Apr 2017 13:56:09 +0200
-Subject: tknzr: support only max long rgb values
-
-This fixes a possible out of bound when reading rgbs which
-are longer than the support MAXLONG
----
- src/cr-tknzr.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/src/cr-tknzr.c b/src/cr-tknzr.c
-index 1a7cfeb..1548c35 100644
---- a/src/cr-tknzr.c
-+++ b/src/cr-tknzr.c
-@@ -1279,6 +1279,11 @@ cr_tknzr_parse_rgb (CRTknzr * a_this, CRRgb ** a_rgb)
-         status = cr_tknzr_parse_num (a_this, &num);
-         ENSURE_PARSING_COND ((status == CR_OK) && (num != NULL));
- 
-+        if (num->val > G_MAXLONG) {
-+                status = CR_PARSING_ERROR;
-+                goto error;
-+        }
-+
-         red = num->val;
-         cr_num_destroy (num);
-         num = NULL;
-@@ -1298,6 +1303,11 @@ cr_tknzr_parse_rgb (CRTknzr * a_this, CRRgb ** a_rgb)
-                 status = cr_tknzr_parse_num (a_this, &num);
-                 ENSURE_PARSING_COND ((status == CR_OK) && (num != NULL));
- 
-+                if (num->val > G_MAXLONG) {
-+                        status = CR_PARSING_ERROR;
-+                        goto error;
-+                }
-+
-                 PEEK_BYTE (a_this, 1, &next_bytes[0]);
-                 if (next_bytes[0] == '%') {
-                         SKIP_CHARS (a_this, 1);
--- 
-cgit v0.12
-