Hi,
besides the upload to unstable, I've backported the upstream patch for
#368202. See attachment.
Feel free to upload if appropriate.
Thanks,
Roland
diff -ruN dia-0.94.0.orig/app/app_procs.c dia-0.94.0/app/app_procs.c
--- dia-0.94.0.orig/app/app_procs.c 2006-06-04 15:33:05.000000000 +0200
+++ dia-0.94.0/app/app_procs.c 2006-06-04 15:33:56.000000000 +0200
@@ -879,22 +879,22 @@
g_print(_("The original author of Dia was:\n\n"));
for (i = 0; i < NUMBER_OF_ORIG_AUTHORS; i++) {
- g_print(authors[i]); g_print("\n");
+ g_print("%s\n", authors[i]);
}
g_print(_("\nThe current maintainers of Dia are:\n\n"));
for (i = NUMBER_OF_ORIG_AUTHORS; i < NUMBER_OF_ORIG_AUTHORS + NUMBER_OF_MAINTAINERS; i++) {
- g_print(authors[i]); g_print("\n");
+ g_print("%s\n", authors[i]);
}
g_print(_("\nOther authors are:\n\n"));
for (i = NUMBER_OF_ORIG_AUTHORS + NUMBER_OF_MAINTAINERS; i < nauthors; i++) {
- g_print(authors[i]); g_print("\n");
+ g_print("%s\n", authors[i]);
}
g_print(_("\nDia is documented by:\n\n"));
for (i = 0; i < ndocumentors; i++) {
- g_print(documentors[i]); g_print("\n");
+ g_print("%s\n", documentors[i]);
}
exit(0);
diff -ruN dia-0.94.0.orig/app/display.c dia-0.94.0/app/display.c
--- dia-0.94.0.orig/app/display.c 2004-08-16 09:56:03.000000000 +0200
+++ dia-0.94.0/app/display.c 2006-06-04 15:51:00.000000000 +0200
@@ -968,7 +968,6 @@
Diagram *dia;
GtkWidget *dialog, *button;
gchar *fname;
- gchar *msg;
dia = ddisp->diagram;
@@ -981,18 +980,16 @@
fname = dia->filename;
if (!fname)
fname = _("<unnamed>");
- msg = g_strdup_printf (
- _("The diagram '%s'\n"
- "has not been saved. Save changes now?"),
- fname);
dialog = gtk_message_dialog_new(GTK_WINDOW (ddisp->shell),
GTK_DIALOG_MODAL,
GTK_MESSAGE_QUESTION,
GTK_BUTTONS_NONE, /* no standard buttons */
- msg,
+ _("Closing diagram without saving"),
NULL);
- g_free (msg);
+ gtk_message_dialog_format_secondary_text(GTK_MESSAGE_DIALOG(dialog),
+ _("The diagram '%s'\n"
+ "has not been saved. Save changes now?"), fname);
gtk_window_set_title (GTK_WINDOW(dialog), _("Close Diagram"));
button = gtk_button_new_from_stock (GTK_STOCK_CANCEL);
diff -ruN dia-0.94.0.orig/app/filedlg.c dia-0.94.0/app/filedlg.c
--- dia-0.94.0.orig/app/filedlg.c 2004-08-16 09:56:03.000000000 +0200
+++ dia-0.94.0/app/filedlg.c 2006-06-04 16:04:10.000000000 +0200
@@ -251,7 +251,6 @@
if (stat(filename, &stat_struct) == 0) {
GtkWidget *dialog = NULL;
- char buffer[300];
char *utf8filename = NULL;
if (!g_utf8_validate(filename, -1, NULL)) {
utf8filename = g_filename_to_utf8(filename, -1, NULL, NULL, NULL);
@@ -261,16 +260,14 @@
}
if (utf8filename == NULL) utf8filename = g_strdup(filename);
- g_snprintf(buffer, 300,
- _("The file '%s' already exists.\n"
- "Do you want to overwrite it?"), utf8filename);
- g_free(utf8filename);
-
dialog = gtk_message_dialog_new (GTK_WINDOW(fs),
GTK_DIALOG_MODAL, GTK_MESSAGE_QUESTION,
GTK_BUTTONS_YES_NO,
- buffer);
- gtk_window_set_title (GTK_WINDOW (dialog), _("File already exists"));
+ _("File already exists"));
+ gtk_message_dialog_format_secondary_text(GTK_MESSAGE_DIALOG(dialog),
+ _("The file '%s' already exists.\n"
+ "Do you want to overwrite it?"), utf8filename);
+ g_free(utf8filename);
gtk_dialog_set_default_response (GTK_DIALOG (dialog), GTK_RESPONSE_YES);
if (gtk_dialog_run (GTK_DIALOG (dialog)) != GTK_RESPONSE_YES) {
@@ -442,17 +439,15 @@
if (stat(filename, &statbuf) == 0) {
GtkWidget *dialog = NULL;
- char buffer[300];
- g_snprintf(buffer, 300,
- _("The file '%s' already exists.\n"
- "Do you want to overwrite it?"), filename);
dialog = gtk_message_dialog_new (GTK_WINDOW(fs),
GTK_DIALOG_MODAL | GTK_DIALOG_DESTROY_WITH_PARENT,
GTK_MESSAGE_QUESTION,
GTK_BUTTONS_YES_NO,
- buffer);
- gtk_window_set_title (GTK_WINDOW (dialog), _("File already exists"));
+ _("File already exists"));
+ gtk_message_dialog_format_secondary_text(GTK_MESSAGE_DIALOG(dialog),
+ _("The file '%s' already exists.\n"
+ "Do you want to overwrite it?"), filename);
gtk_dialog_set_default_response (GTK_DIALOG (dialog), GTK_RESPONSE_YES);
if (gtk_dialog_run (GTK_DIALOG (dialog)) != GTK_RESPONSE_YES) {
diff -ruN dia-0.94.0.orig/app/load_save.c dia-0.94.0/app/load_save.c
--- dia-0.94.0.orig/app/load_save.c 2004-08-16 09:56:03.000000000 +0200
+++ dia-0.94.0/app/load_save.c 2006-06-04 15:33:56.000000000 +0200
@@ -199,7 +199,7 @@
g_hash_table_foreach(unknown_hash,
GHFuncUnknownObjects,
unknown_str);
- message_error(unknown_str->str);
+ message_error("%s", unknown_str->str);
}
g_hash_table_destroy(unknown_hash);
g_string_free(unknown_str, TRUE);
diff -ruN dia-0.94.0.orig/app/sheets.c dia-0.94.0/app/sheets.c
--- dia-0.94.0.orig/app/sheets.c 2004-08-16 09:56:03.000000000 +0200
+++ dia-0.94.0/app/sheets.c 2006-06-04 16:07:45.000000000 +0200
@@ -338,7 +338,7 @@
gdk_pixbuf_render_pixmap_and_mask(pixbuf, pixmap, mask, 1.0);
gdk_pixbuf_unref(pixbuf);
} else {
- g_warning (error->message);
+ g_warning ("%s", error->message);
g_error_free (error);
}
}
diff -ruN dia-0.94.0.orig/debian/changelog dia-0.94.0/debian/changelog
--- dia-0.94.0.orig/debian/changelog 2006-06-04 15:33:05.000000000 +0200
+++ dia-0.94.0/debian/changelog 2006-06-04 16:15:31.000000000 +0200
@@ -1,3 +1,10 @@
+dia (0.94.0-7sarge4) stable-security; urgency=high
+
+ * Applied upstream format string fixes: CVE-2006-2480 and CVE-2006-2453
+ (Closes: #368202)
+
+ -- Roland Stigge <[EMAIL PROTECTED]> Sun, 4 Jun 2006 16:14:35 +0200
+
dia (0.94.0-7sarge3) stable-security; urgency=medium
* Non-maintainer upload by the Security Team
diff -ruN dia-0.94.0.orig/lib/message.c dia-0.94.0/lib/message.c
--- dia-0.94.0.orig/lib/message.c 2004-08-16 09:56:07.000000000 +0200
+++ dia-0.94.0/lib/message.c 2006-06-04 15:33:56.000000000 +0200
@@ -86,7 +86,7 @@
0, /* GtkDialogFlags */
type,
GTK_BUTTONS_CLOSE,
- buf);
+ "%s", buf);
if (title) {
gchar *real_title;
diff -ruN dia-0.94.0.orig/plug-ins/python/diamodule.c dia-0.94.0/plug-ins/python/diamodule.c
--- dia-0.94.0.orig/plug-ins/python/diamodule.c 2004-08-16 09:56:20.000000000 +0200
+++ dia-0.94.0/plug-ins/python/diamodule.c 2006-06-04 15:33:56.000000000 +0200
@@ -377,11 +377,11 @@
return NULL;
if (0 == type)
- message_notice (text);
+ message_notice ("%s", text);
else if (1 == type)
- message_warning (text);
+ message_warning ("%s", text);
else
- message_error (text);
+ message_error ("%s", text);
Py_INCREF(Py_None);
return Py_None;
diff -ruN dia-0.94.0.orig/plug-ins/wmf/wmf.cpp dia-0.94.0/plug-ins/wmf/wmf.cpp
--- dia-0.94.0.orig/plug-ins/wmf/wmf.cpp 2004-08-16 09:56:21.000000000 +0200
+++ dia-0.94.0/plug-ins/wmf/wmf.cpp 2006-06-04 15:33:56.000000000 +0200
@@ -223,7 +223,7 @@
va_end (args);
//fprintf(renderer->file, string);
- g_print(string);
+ g_print("%s", string);
g_free(string);
}
