Author: truckman
Date: Thu Jul 28 21:29:05 2016
New Revision: 1754469
URL: http://svn.apache.org/viewvc?rev=1754469&view=rev
Log:
#i126896#: bundled curl version 7.19.7 has many vulnerabilities
Upgrade bundled curl to version 7.49.1.
Delete most of the curl patches since they are no longer necessary.
The only needed patch is to produce a library with the expected name
when building on Windows.
Update the curl copyright info in LICENSE.
These curl CVEs have been fixed since 7.19.7:
CVE-2010-0734
CVE-2011-2192
CVE-2013-2174
CVE-2014-3143
CVE-2014-3144
CVE-2014-3145
CVE-2014-3148
CVE-2014-8150
CVE-2015-3153
CVE-2016-0755
Whether any of these affect the OpenOffice usage of curl is not known.
OpenOffice only uses curl to access ftp:// URLs, which is likely to be
only rarely done.
Added:
openoffice/trunk/main/curl/curl-7.49.1_win.patch
Removed:
openoffice/trunk/main/curl/curl-7.19.7.patch
openoffice/trunk/main/curl/curl-7.19.7_win.patch
Modified:
openoffice/trunk/main/LICENSE
openoffice/trunk/main/curl/makefile.mk
openoffice/trunk/main/curl/prj/d.lst
openoffice/trunk/main/external_deps.lst
Modified: openoffice/trunk/main/LICENSE
URL:
http://svn.apache.org/viewvc/openoffice/trunk/main/LICENSE?rev=1754469&r1=1754468&r2=1754469&view=diff
==============================================================================
--- openoffice/trunk/main/LICENSE (original)
+++ openoffice/trunk/main/LICENSE Thu Jul 28 21:29:05 2016
@@ -1003,14 +1003,15 @@ ____
For integration of the library curl - built in main/curl/
- license like MIT license
-Copyright (c) 1996 - 2011, Daniel Stenberg, <dan...@haxx.se>.
-
+Copyright (c) 1996 - 2016, Daniel Stenberg, <dan...@haxx.se>, and many
+contributors, see the THANKS file.
+
All rights reserved.
-
+
Permission to use, copy, modify, and distribute this software for any purpose
with or without fee is hereby granted, provided that the above copyright
notice and this permission notice appear in all copies.
-
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN
@@ -1018,7 +1019,7 @@ NO EVENT SHALL THE AUTHORS OR COPYRIGHT
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
OR OTHER DEALINGS IN THE SOFTWARE.
-
+
Except as contained in this notice, the name of a copyright holder shall not
be used in advertising or otherwise to promote the sale, use or other dealings
in this Software without prior written authorization of the copyright holder.
Added: openoffice/trunk/main/curl/curl-7.49.1_win.patch
URL:
http://svn.apache.org/viewvc/openoffice/trunk/main/curl/curl-7.49.1_win.patch?rev=1754469&view=auto
==============================================================================
--- openoffice/trunk/main/curl/curl-7.49.1_win.patch (added)
+++ openoffice/trunk/main/curl/curl-7.49.1_win.patch Thu Jul 28 21:29:05 2016
@@ -0,0 +1,35 @@
+diff -ur misc/curl-7.49.1/winbuild/Makefile.msvc.names
misc/build/curl-7.49.1/winbuild/Makefile.msvc.names
+--- misc/curl-7.49.1/winbuild/Makefile.msvc.names 2016-03-22
00:15:38.000000000 -0700
++++ misc/build/curl-7.49.1/winbuild/Makefile.msvc.names 2016-07-19
15:35:28.465823000 -0700
+@@ -43,7 +43,7 @@
+ !ENDIF
+
+ !IF !DEFINED(LIB_NAME_STA_DBG) || "$(LIB_NAME_STA_DBG)" == ""
+-LIB_NAME_STA_DBG = $(LIB_NAME_STA_REL)d
++LIB_NAME_STA_DBG = $(LIB_NAME_STA_REL)
+ !ENDIF
+
+ !IF !DEFINED(LIB_NAME_DYN_REL) || "$(LIB_NAME_DYN_REL)" == ""
+@@ -51,7 +51,7 @@
+ !ENDIF
+
+ !IF !DEFINED(LIB_NAME_DYN_DBG) || "$(LIB_NAME_DYN_DBG)" == ""
+-LIB_NAME_DYN_DBG = $(LIB_NAME_DYN_REL)d
++LIB_NAME_DYN_DBG = $(LIB_NAME_DYN_REL)
+ !ENDIF
+
+ # --------------------------------------------
+@@ -59,11 +59,11 @@
+ # --------------------------------------------
+
+ !IF !DEFINED(LIB_NAME_IMP_REL) || "$(LIB_NAME_IMP_REL)" == ""
+-LIB_NAME_IMP_REL = $(LIB_NAME_DYN_REL)_imp
++LIB_NAME_IMP_REL = $(LIB_NAME_DYN_REL)
+ !ENDIF
+
+ !IF !DEFINED(LIB_NAME_IMP_DBG) || "$(LIB_NAME_IMP_DBG)" == ""
+-LIB_NAME_IMP_DBG = $(LIB_NAME_DYN_DBG)_imp
++LIB_NAME_IMP_DBG = $(LIB_NAME_DYN_DBG)
+ !ENDIF
+
+ # --------------------------------------
Modified: openoffice/trunk/main/curl/makefile.mk
URL:
http://svn.apache.org/viewvc/openoffice/trunk/main/curl/makefile.mk?rev=1754469&r1=1754468&r2=1754469&view=diff
==============================================================================
--- openoffice/trunk/main/curl/makefile.mk (original)
+++ openoffice/trunk/main/curl/makefile.mk Thu Jul 28 21:29:05 2016
@@ -37,15 +37,15 @@ all:
# --- Files --------------------------------------------------------
-TARFILE_NAME=curl-7.19.7
-TARFILE_MD5=ecb2e37e45c9933e2a963cabe03670ab
-PATCH_FILES=curl-7.19.7.patch
+TARFILE_NAME=curl-7.49.1
+TARFILE_MD5=2feb3767b958add6a177c6602ff21e8c
+PATCH_FILES=
.IF "$(GUI)"=="WNT"
- PATCH_FILES+=curl-7.19.7_win.patch
- .IF "$(COM)"=="GCC"
- PATCH_FILES+=curl-7.19.7_mingw.patch
- .ENDIF
+ PATCH_FILES+=curl-7.49.1_win.patch
+# .IF "$(COM)"=="GCC"
+# PATCH_FILES+=curl-7.19.7_mingw.patch
+# .ENDIF
.ENDIF
@@ -141,7 +141,7 @@ OUT2INC= \
include$/curl$/multi.h \
include$/curl$/curl.h \
include$/curl$/curlver.h \
- include$/curl$/types.h \
+ include$/curl$/typecheck-gcc.h \
include$/curl$/stdcheaders.h \
include$/curl$/mprintf.h \
include$/curl$/curlbuild.h \
Modified: openoffice/trunk/main/curl/prj/d.lst
URL:
http://svn.apache.org/viewvc/openoffice/trunk/main/curl/prj/d.lst?rev=1754469&r1=1754468&r2=1754469&view=diff
==============================================================================
--- openoffice/trunk/main/curl/prj/d.lst (original)
+++ openoffice/trunk/main/curl/prj/d.lst Thu Jul 28 21:29:05 2016
@@ -5,11 +5,11 @@ mkdir: %_DEST%\inc%_EXT%\external\curl
..\%__SRC%\inc\mprintf.h %_DEST%\inc%_EXT%\external\curl\mprintf.h
..\%__SRC%\inc\multi.h %_DEST%\inc%_EXT%\external\curl\multi.h
..\%__SRC%\inc\stdcheaders.h %_DEST%\inc%_EXT%\external\curl\stdcheaders.h
-..\%__SRC%\inc\types.h %_DEST%\inc%_EXT%\external\curl\types.h
+..\%__SRC%\inc\typecheck-gcc.h %_DEST%\inc%_EXT%\external\curl\typecheck-gcc.h
..\%__SRC%\inc\curlbuild.h %_DEST%\inc%_EXT%\external\curl\curlbuild.h
..\%__SRC%\inc\curlrules.h %_DEST%\inc%_EXT%\external\curl\curlrules.h
..\%__SRC%\bin\libcurl*.dll %_DEST%\bin%_EXT%\*.dll
..\%__SRC%\lib\libcurl.* %_DEST%\lib%_EXT%\libcurl.*
-linklib: libcurl.*.*
\ No newline at end of file
+linklib: libcurl.*.*
Modified: openoffice/trunk/main/external_deps.lst
URL:
http://svn.apache.org/viewvc/openoffice/trunk/main/external_deps.lst?rev=1754469&r1=1754468&r2=1754469&view=diff
==============================================================================
--- openoffice/trunk/main/external_deps.lst (original)
+++ openoffice/trunk/main/external_deps.lst Thu Jul 28 21:29:05 2016
@@ -227,9 +227,9 @@ if (SYSTEM_EXPAT != YES)
URL2 = $(OOO_EXTRAS)$(MD5)-$(name)
if (SYSTEM_CURL != YES)
- MD5 = ecb2e37e45c9933e2a963cabe03670ab
- name = curl-7.19.7.tar.gz
- URL1 = http://curl.haxx.se/download/curl-7.19.7.tar.gz
+ MD5 = 2feb3767b958add6a177c6602ff21e8c
+ name = curl-7.49.1.tar.gz
+ URL1 = http://curl.haxx.se/download/curl-7.49.1.tar.gz
URL2 = $(OOO_EXTRAS)$(MD5)-$(name)
if (WITH_CATA_FONTS == YES)
