cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Security fix for CVE-2014-9157, graphviz: format string vulnerability in yyerror()

Browse Source 
ok edd@ (MAINTAINER)
This commit is contained in:
jasper 2015-08-21 16:06:06 +00:00
parent e677d41ca4
commit dd7a73f156
2 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
math/graphviz/Makefile
View File

@ -1,9 +1,9 @@
# $OpenBSD: Makefile,v 1.60 2015/06/10 21:42:26 sthen Exp $
# $OpenBSD: Makefile,v 1.61 2015/08/21 16:06:06 jasper Exp $
COMMENT-main= graph drawing software
DISTNAME= graphviz-2.36.0
REVISION= 3
REVISION= 4
PKGNAME-main= ${DISTNAME}
CATEGORIES= math devel graphics

16
math/graphviz/patches/patch-lib_cgraph_scan_l Normal file
View File

@ -0,0 +1,16 @@
$OpenBSD: patch-lib_cgraph_scan_l,v 1.2 2015/08/21 16:06:06 jasper Exp $
Security fix for CVE-2014-9157, graphviz: format string vulnerability in yyerror()
https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081.patch
--- lib/cgraph/scan.l.orig2 Fri Aug 21 10:25:19 2015
+++ lib/cgraph/scan.l Fri Aug 21 10:25:42 2015
@@ -223,7 +223,7 @@ void yyerror(char *str)
agxbput (&xb, buf);
agxbput (&xb, yytext);
agxbput (&xb,"'\n");
- agerr(AGWARN,agxbuse(&xb));
+ agerr(AGWARN, "%s", agxbuse(&xb));
agxbfree(&xb);
}
/* must be here to see flex's macro defns */