Package: release.debian.org
Severity: normal
Tags: buster
User: release.debian....@packages.debian.org
Usertags: pu
A recent security fix to ibus (CVE-2019-14822, #940267, DSA-4525-1)
exposed an interoperability bug between GLib's implementation of D-Bus
and the reference implementation libdbus (#941018). The practical impact
is that Qt clients cannot use the updated ibus input method until GLib
is fixed.
This has been fixed in the upstream master and 2.62.x branches and
in unstable, and I've prepared backports for buster (this bug)
and stretch (I'll open a separate bug when I have a successful
build/autopkgtest/piuparts pipeline).
This proposed patch includes a backport of the regression test that I wrote,
which has only been included in upstream git master so far. If the diffstat
is too big, I can drop the test and keep only the functional changes:
> patches/GDBus-prefer-getsockopt-style-credentials-passing-APIs.patch |
> 167 +++
> patches/credentials-Invalid-Linux-struct-ucred-means-no-informati.patch |
> 117 ++
These are the bug fix.
> control |
> 1
> control.in |
> 1
> patches/Add-a-test-for-GDBusServer-authentication.patch |
> 536 ++++++++++
> patches/gdbus-server-auth-test-Create-temporary-directory-for-Uni.patch |
> 191 +++
> patches/gdbus-server-auth-test-Include-gcredentialsprivate.h.patch |
> 41
These are for build-time and autopkgtest test coverage, and can be dropped
if they are too big. They give libglib2.0-tests a new dependency on
libdbus-1-3, but the shared library etc. do not gain a similar dependency.
So far I've only tested this with build/autopkgtest/piuparts, but I'll try
it on a real buster machine before upload. OK to continue?
Thanks,
smcv
