On Sat, Nov 26, 2016 at 09:51:30AM +0100, Marius Bakke wrote: > Leo Famulari <l...@famulari.name> writes: > > > This patch should fix the bugs named here: > > > > http://seclists.org/oss-sec/2016/q4/517 > > > > I copied Debian's approach, which is to take all the recent patches for > > the vulnerable component (the FLIC decoder). > > > > My understanding is that the first two patches fix the CVEs, the 3rd > > fixes an unrelated bug, and the 4th is a total rewrite of the component, > > because "code is terrible, it should be entirely re-written" [0]. > > > > The CVE bug fixes are not split into discrete patches, so it doesn't > > work to make patches for each CVE ID, like we normally do. > > > > Is this approach (concatenating the patches) okay? > > I prefer having them separately, so the upstream commit can be clearly > referenced in the patch header; and they can be reviewed and modified > independently. > > In this instance it's okay, since I just checked out the 1.10 branch and > concatenated the four commits and ended up with the same patch :-) > > That's not to say it should not be allowed. I think this approach is > fine for long patch series, but at only four patches it's not the best > precedent. > > Anyway, thanks for taking care of this, and LGTM! Please push! :-)
I split them up and (hopefully) annotated them well enough that readers can follow along. Pushed as 9e46245b89e0f30397f69391a2219a29caa336a2
signature.asc
Description: PGP signature
