[pve-devel] [PATCH pve-libspice-server 1/4] upgrade to 0.14.1

[Dominik Csapak]

drop applied upstream fixes, rebase patches, fix download path

Signed-off-by: Dominik Csapak <d.csapak at proxmox.com>
---
 Makefile                                           |  4 +-
 .../patches/CVE-2016-9577-and-CVE-2016-9578.patch  | 54 ----------------------
 debian/patches/allow-to-set-sasl-callbacks.patch   | 10 ++--
 debian/patches/series                              |  1 -
 debian/rules                                       |  2 +-
 5 files changed, 8 insertions(+), 63 deletions(-)
 delete mode 100644 debian/patches/CVE-2016-9577-and-CVE-2016-9578.patch

diff --git a/Makefile b/Makefile
index 3841740..aa942b8 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 RELEASE=4.0
 
 PACKAGE=pve-libspice-server1
-PKGVERSION=0.12.8
+PKGVERSION=0.14.1
 PKGRELEASE=3
 
 PKGDIR=spice-${PKGVERSION}
@@ -40,7 +40,7 @@ $(DEB): ${PKGSRC}
 .PHONY: download
 download:
 	rm -f ${PKGSRC} 
-	wget http://spice-space.org/download/releases/spice-${PKGVERSION}.tar.bz2
+	wget http://spice-space.org/download/releases/spice-server/spice-${PKGVERSION}.tar.bz2
 
 .PHONY: upload
 upload: ${DEBS}
diff --git a/debian/patches/CVE-2016-9577-and-CVE-2016-9578.patch b/debian/patches/CVE-2016-9577-and-CVE-2016-9578.patch
deleted file mode 100644
index 343e67a..0000000
--- a/debian/patches/CVE-2016-9577-and-CVE-2016-9578.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From: Markus Koschany <apo at debian.org>
-Date: Mon, 13 Feb 2017 21:38:02 +0100
-Subject: CVE-2016-9577 and CVE-2016-9578
-
-Bug-Debian: https://bugs.debian.org/854336
-Origin: http://pkgs.fedoraproject.org/cgit/rpms/spice.git/commit/?id=d919d639ae5f83a9735a04d843eed675f9357c0d
----
- server/main_channel.c |  3 +++
- server/reds.c         | 11 ++++++++++-
- 2 files changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/server/main_channel.c b/server/main_channel.c
-index 0ecc9df..1fc3915 100644
---- a/server/main_channel.c
-+++ b/server/main_channel.c
-@@ -1026,6 +1026,9 @@ static uint8_t *main_channel_alloc_msg_rcv_buf(RedChannelClient *rcc,
- 
-     if (type == SPICE_MSGC_MAIN_AGENT_DATA) {
-         return reds_get_agent_data_buffer(mcc, size);
-+    } else if (size > sizeof(main_chan->recv_buf)) {
-+        /* message too large, caller will log a message and close the connection */
-+        return NULL;
-     } else {
-         return main_chan->recv_buf;
-     }
-diff --git a/server/reds.c b/server/reds.c
-index 61bf735..4c60f58 100644
---- a/server/reds.c
-+++ b/server/reds.c
-@@ -2110,6 +2110,14 @@ static void reds_handle_read_link_done(void *opaque)
-     link_mess->num_channel_caps = GUINT32_FROM_LE(link_mess->num_channel_caps);
-     link_mess->num_common_caps = GUINT32_FROM_LE(link_mess->num_common_caps);
- 
-+    /* Prevent DoS. Currently we defined only 13 capabilities,
-+     * I expect 1024 to be valid for quite a lot time */
-+    if (link_mess->num_channel_caps > 1024 || link_mess->num_common_caps > 1024) {
-+        reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
-+        reds_link_free(link);
-+        return;
-+    }
-+
-     num_caps = link_mess->num_common_caps + link_mess->num_channel_caps;
-     caps = (uint32_t *)((uint8_t *)link_mess + link_mess->caps_offset);
- 
-@@ -2202,7 +2210,8 @@ static void reds_handle_read_header_done(void *opaque)
- 
-     reds->peer_minor_version = header->minor_version;
- 
--    if (header->size < sizeof(SpiceLinkMess)) {
-+    /* the check for 4096 is to avoid clients to cause arbitrary big memory allocations */
-+    if (header->size < sizeof(SpiceLinkMess) || header->size > 4096) {
-         reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
-         spice_warning("bad size %u", header->size);
-         reds_link_free(link);
diff --git a/debian/patches/allow-to-set-sasl-callbacks.patch b/debian/patches/allow-to-set-sasl-callbacks.patch
index 46d0a89..167f621 100644
--- a/debian/patches/allow-to-set-sasl-callbacks.patch
+++ b/debian/patches/allow-to-set-sasl-callbacks.patch
@@ -22,10 +22,10 @@ Index: new/server/spice-server.h
  int spice_server_set_ticket(SpiceServer *s, const char *passwd, int lifetime,
                              int fail_if_connected, int disconnect_if_connected);
  int spice_server_set_tls(SpiceServer *s, int port,
-Index: new/server/reds_stream.c
+Index: new/server/red-stream.c
 ===================================================================
---- new.orig/server/reds_stream.c
-+++ new/server/reds_stream.c
+--- new.orig/server/red-stream.c
++++ new/server/red-stream.c
 @@ -48,6 +48,18 @@ extern SpiceCoreInterface *core;
  #if HAVE_SASL
  #include <sasl/sasl.h>
@@ -42,10 +42,10 @@ Index: new/server/reds_stream.c
 +#endif
 +}
 +
- typedef struct RedsSASL {
+ typedef struct RedSASL {
      sasl_conn_t *conn;
  
-@@ -976,7 +988,7 @@ bool reds_sasl_start_auth(RedsStream *st
+@@ -976,7 +988,7 @@ bool red_sasl_start_auth(RedsStream *st
                            NULL, /* User realm */
                            localAddr,
                            remoteAddr,
diff --git a/debian/patches/series b/debian/patches/series
index 27122e5..247f05d 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1 @@
 allow-to-set-sasl-callbacks.patch
-CVE-2016-9577-and-CVE-2016-9578.patch
diff --git a/debian/rules b/debian/rules
index 6aaa5e4..4d95b45 100755
--- a/debian/rules
+++ b/debian/rules
@@ -4,7 +4,7 @@
 #export DH_VERBOSE=1
 
 override_dh_auto_configure:
-	CELT051_CFLAGS="-I$(CURDIR)"  CELT051_LIBS="-L$(CURDIR)/celt051/.libs -lcelt051 -lm" ./configure --prefix=/usr --with-sasl --disable-smartcard
+	CELT051_CFLAGS="-I$(CURDIR)"  CELT051_LIBS="-L$(CURDIR)/celt051/.libs -lcelt051 -lm" ./configure --prefix=/usr --with-sasl --disable-smartcard --enable-celt051
 
 %:
 	dh $@  -with quilt --with autotools-dev
-- 
2.11.0