# # spec file for package libmspack # # Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed # upon. The license for this file, and modifications and additions to the # file, is the same license as for the pristine package itself (unless the # license for the pristine package is not an Open Source License, in which # case the license is the MIT License). An "Open Source License" is a # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. # Please submit bugfixes or comments via https://bugs.opensuse.org/ # # "alpha" in the version string just says that it is an alpha version. %define _version %{version}alpha Name: libmspack Version: 0.10.1 Release: 1.11 Summary: Library That Implements Different Microsoft Compressions License: LGPL-2.1-only Group: Development/Libraries/C and C++ URL: https://www.cabextract.org.uk/libmspack/ Source: https://www.cabextract.org.uk/libmspack/%{name}-%{_version}.tar.gz Source2: baselibs.conf BuildRequires: pkgconfig %description The purpose of libmspack is to provide both compression and decompression of some loosely related file formats used by Microsoft. Currently the most common formats are implemented. %package -n libmspack0 Summary: Library That Implements Different Microsoft Compressions Group: System/Libraries %description -n libmspack0 The purpose of libmspack is to provide both compression and decompression of some loosely related file formats used by Microsoft. Currently the most common formats are implemented. %package devel Summary: Static libraries, header files and documentation for libmspack Group: Development/Libraries/C and C++ Requires: libmspack0 = %{version} %description devel The libmspack-devel package contains the header files and static libraries necessary for developing programs using libmspack. %package -n mspack-examples Summary: Library That Implements Different Microsoft Compressions # Name up to 0.9 (SLE 15 *, Leap 15 *): Group: Productivity/File utilities Provides: mspack-tools = %{version} Obsoletes: mspack-tools < %{version} %description -n mspack-examples The purpose of libmspack is to provide both compression and decompression of some loosely related file formats used by Microsoft. Currently the most common formats are implemented. This subpacke provides useful programs that make use of libmspack. * cabd_memory - An implementation of the mspack_system interface using only memory * cabrip - Extracts any CAB files embedded in another file. * chmextract - Extracts all files in a CHM file to disk. * msexpand - Expands an SZDD or KWAJ file. * multifh - An implementation of the mspack_system interface which can access many things: regular disk files, already opened stdio FILE* file pointers, open file descriptors, blocks of memory * oabextract - Extracts an Exchange Offline Address Book (.LZX) file. %prep %setup -q -n %{name}-%{_version} %build %configure\ --disable-static make %{?_smp_mflags} %install %make_install cd examples install -d %{buildroot}%{_bindir} ../libtool --mode=install /usr/bin/install -c cabd_memory cabrip chmextract msexpand multifh oabextract %{buildroot}%{_bindir} rm %{buildroot}%{_libdir}/*.*a %check make %{?_smp_mflags} check %post -n libmspack0 -p /sbin/ldconfig %postun -n libmspack0 -p /sbin/ldconfig %files -n mspack-examples %{_bindir}/cabd_memory %{_bindir}/cabrip %{_bindir}/chmextract %{_bindir}/msexpand %{_bindir}/multifh %{_bindir}/oabextract %files -n libmspack0 %license COPYING.LIB # NEWS is empty %doc AUTHORS ChangeLog README TODO %{_libdir}/*.so.* %files devel %{_libdir}/*.so %{_libdir}/pkgconfig/*.pc %{_includedir}/* %changelog * Wed Mar 6 2019 Martin Hauke - Update to version 0.10.1 * Bugfix release, no functional changes * Mon Mar 4 2019 Martin Hauke - Update to version 0.10: * Fix Heap buffer overflow in chmd_read_headers() * Fix memory exhausted in chmd_read_headers() * Fix memory exhausted in oabd_decompress() * Wed Nov 7 2018 sbrabec@suse.com - Update to version 0.9.1: * Fix bug in decompressing data to get to the correct folder offset when the folder is LZX compressed (0.8 regression). * Build system cleanup * Testsuite available * Does not install testing tools and examples by default. - Rename mspack-tools to mspack-examples to follow upstream change. * Tue Oct 23 2018 sbrabec@suse.com - Update to version 0.8: * New parameter MSCABD_PARAM_SALVAGE which permits salvaging badly damaged files rather than rejecting them outright. * Fix the above 38912-byte Quantum CAB block bug. * Reject blank CHM filenames that are blank because they have embedded null bytes. * chmextract: Protect from absolute/relative pathnames in CHM files. * Mon Jul 30 2018 sbrabec@suse.com - Update to version 0.7 (bsc#1103032): * Fix 1 or 2 byte overwrite by bad KWAJ file header extensions (CVE-2018-14681). * Fix 1 byte overread by character U+0100 in a CHM filename (CVE-2018-14682). * Reject blank CHM filenames (CVE-2018-14680). * Fix off-by-1 in CHM PMGI/PMGL chunk number validity checks, which could cause a crash (CVE-2018-14679). * Fri Jan 19 2018 adam.majer@suse.de - Correct mspack-tools group to Productivity/File utilities * Tue Jan 16 2018 jengelh@inai.de - Correct SRPM group. * Tue Jan 16 2018 mardnh@gmx.de - Fix typo * Mon Jan 15 2018 mardnh@gmx.de - Update to version 0.6 * read_spaninfo(): a CHM file can have no ResetTable and have a negative length in SpanInfo, which then feeds a negative output length to lzxd_init(), which then sets frame_size to a value of your choosing, the lower 32 bits of output length, larger than LZX_FRAME_SIZE. If the first LZX block is uncompressed, this writes data beyond the end of the window. This issue was raised by ClamAV as CVE-2017-6419. * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the issue mentioned above, these functions now reject negative lengths * cabd_read_string(): add missing error check on result of read(). If an mspack_system implementation returns an error, it's interpreted as a huge positive integer, which leads to reading past the end of the stack-based buffer. This issue was raised by ClamAV as CVE-2017-11423 - Add subpackage for helper tools - Run spec-cleaner * Fri Feb 27 2015 sbrabec@suse.cz - Remove problematic libmspack-qtmd_decompress-loop.patch (bnc#912214#c10). Version 0.5 has a correct fix dated 2015-01-05. * Wed Feb 11 2015 p.drouand@gmail.com - Update to version 0.5 * Please read the changelog; too many things to list * Tue Jan 20 2015 sbrabec@suse.cz - Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556, libmspack-qtmd_decompress-loop.patch). * Fri Apr 4 2014 jengelh@inai.de - Add baselibs.conf: wxWidgets-32bit depends on libmspack0-32bit * Mon Jun 24 2013 werner@suse.de - Avoid Source URL for http://www.cabextract.org.uk/ as this does not work * Sat Jun 22 2013 dimstar@opensuse.org - Update to version 0.4alpha: + This release adds support for the Microsoft Exchange Offline Address Book (OAB) format, both compressed and incremental variants. * Wed Jul 18 2012 aj@suse.de - Remove autoreconf call and libtool buildrequires, they are not needed anymore. * Wed Jul 18 2012 sbrabec@suse.cz - Update to version 0.3alpha: * code cleanup and build system update * handle corrupted cabinet files better * handle special cases of cabinet files - License update: LGPL-2.1 only. * Mon Feb 27 2012 cfarrell@suse.com - license update: LGPL-2.1+ No indication of GPL-2.0+ code in the package * Mon Feb 13 2012 coolo@suse.com - patch license to follow spdx.org standard * Sun Nov 20 2011 jengelh@medozas.de - Remove redundant/unwanted tags/section (cf. specfile guidelines) - Use %%_smp_mflags for parallel building * Sat Nov 19 2011 coolo@suse.com - add libtool as buildrequire to avoid implicit dependency * Wed Dec 22 2010 andreas.hanke@gmx-topmail.de - update to version 0.2alpha (#660942): * matches cabextract-1.3, fixing CVE-2010-2800 and CVE-2010-2801 * adds pkg-config support * obsoletes half of libmspack-warnings.patch - remove self-obsoletion - drop -D_POSIX_SOURCE as it breaks the build with this version - drop empty NEWS file * Tue Jan 15 2008 sbrabec@suse.cz - Applied shared library packaging policy. - Removed unneeded static library and .la file. * Fri Oct 20 2006 sbrabec@suse.cz - Updated to version 0.0.20060920alpha: * Bug fixes. * Write an mspack_system implementation that can handle normal disk files, open file handles, open file descriptors and raw memory all at the same time. * Added a program for dumping useful data from CHM files. * Added a new test example which shows an mspack_system implementation that reads and writes from memory only. * Wed Jan 25 2006 mls@suse.de - converted neededforbuild to BuildRequires * Mon Nov 22 2004 ro@suse.de - "sed -i" does not work on older distributions * Wed Apr 14 2004 mcihar@suse.cz - include some documentation * Wed Apr 14 2004 mcihar@suse.cz - initial packaging