debian/changelog

+gdal (3.0.1+dfsg-1~exp4) experimental; urgency=medium
+
+  * Update symbols for 3.0.1.
+  * Bump Standards-Version to 4.4.1, no changes.
+  * Add upstream patch to fix CVE-2019-17545.
+  * Update lintian overrides for file-references-package-build-path.
+
+ -- Bas Couwenberg <sebastic@debian.org>  Tue, 15 Oct 2019 07:03:04 +0200
+
 gdal (3.0.1+dfsg-1~exp3) experimental; urgency=medium
 
   * Drop Python 2 support.

debian/control

@@ -61,7 +61,7 @@ Build-Depends: debhelper (>= 9.20160114),
                unixodbc-dev (>= 2.2.11),
                zlib1g-dev
 Build-Conflicts: automake1.11
-Standards-Version: 4.4.0
+Standards-Version: 4.4.1
 Vcs-Browser: https://salsa.debian.org/debian-gis-team/gdal
 Vcs-Git: https://salsa.debian.org/debian-gis-team/gdal.git -b experimental
 Homepage: http://www.gdal.org/

debian/libgdal-dev.lintian-overrides

@@ -7,3 +7,6 @@ copyright-year-in-future 3131 *
 # GDAL doesn't use Multi-Arch, it breaks too many rdeps
 pkg-config-unavailable-for-cross-compilation usr/lib/pkgconfig/gdal.pc
 
+# Cannot easily be fixed
+file-references-package-build-path *
+

debian/libgdal-java.lintian-overrides

 # False positive on: "(319) 369-3131"
 copyright-year-in-future 3131 *
 
-# Cannot easily be fixed
-file-references-package-build-path *
-

debian/libgdal-perl.lintian-overrides

 # False positive on: "(319) 369-3131"
 copyright-year-in-future 3131 *
 
-# Cannot easily be fixed
-file-references-package-build-path *
-

debian/libgdal26.lintian-overrides

@@ -10,6 +10,3 @@ spelling-error-in-binary * increaS increase
 # False positive on: "(319) 369-3131"
 copyright-year-in-future 3131 *
 
-# Cannot easily be fixed
-file-references-package-build-path *
-

debian/patches/CVE-2019-17545.patch

+Description: OGRExpatRealloc(): fix double-free when size to allocate is above
+ the default 10MB threshold.
+ Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16178.
+ Credit to OSS Fuzz
+Author: Even Rouault <even.rouault@spatialys.com>
+Origin: https://github.com/OSGeo/gdal/commit/148115fcc40f1651a5d15fa34c9a8c528e7147bb
+
+--- a/ogr/ogr_expat.cpp
++++ b/ogr/ogr_expat.cpp
+@@ -89,7 +89,6 @@ static void* OGRExpatRealloc( void *ptr,
+     if( CanAlloc(size) )
+         return realloc(ptr, size);
+ 
+-    free(ptr);
+     return nullptr;
+ }
+ 

debian/patches/series

@@ -9,3 +9,4 @@ perl-vendor
 privacy-breach-logo.patch
 privacy-breach-generic.patch
 perl-doxyfile
+CVE-2019-17545.patch