Skip to content
Commits on Source (4)
Show whitespace changes
Inline Side-by-side
debian/changelog
View file @ fcc96501
igraph (0.7.1-3) UNRELEASED; urgency=medium
igraph (0.7.1-3) unstable; urgency=medium
[ Mathieu Malaterre ]
* Remove self from Uploaders.
......@@ -9,13 +9,16 @@ igraph (0.7.1-3) UNRELEASED; urgency=medium
* Standards-Version: 4.2.1
* Versioned Build-Depends: libarpack2-dev (>= 3.6.2-1~) and
Fixing issues with ARPACK 3.6, related to igraph issue #1107
Closes: #902760
Partly deals with bug #902760
* Exclude tests requiring remote access
* Secure URI in copyright format
* Drop useless get-orig-source target
* Remove trailing whitespace in debian/changelog
* Apply fix for CVE-2018-20349
Closes: #917211
* Ignore remaining build time errors to get fix for CVE-2018-20349 out
-- Andreas Tille <tille@debian.org> Fri, 14 Sep 2018 14:34:51 +0200
-- Andreas Tille <tille@debian.org> Mon, 24 Dec 2018 15:25:53 +0100
igraph (0.7.1-2.1) unstable; urgency=medium
......
debian/copyright
View file @ fcc96501
......@@ -3,15 +3,14 @@ Upstream-Name: igraph
Source: https://github.com/igraph/igraph/releases
Files: *
Copyright:
Copyright © 2005-2008 Gabor Csardi, Tamas Nepusz
Copyright: 2005-2008 Gabor Csardi, Tamas Nepusz
License: GPL-2+
The Debian packaging is licensed under the GPL-2 or any later version,
see `/usr/share/common-licenses/GPL-2'
Files: debian/*
Copyright:
Copyright 2009-2012, Mathieu Malaterre <malat@debian.org>
Copyright: 2009-2012 Mathieu Malaterre <malat@debian.org>
2013-2018 Andreas Tille <tille@debian.org>
License: GPL-2+
License: GPL-2+
The Debian packaging is licensed under the GPL-2 or any later version,
see `/usr/share/common-licenses/GPL-2'
debian/patches/fix_broken_graph_ml.patch 0 → 100644
View file @ fcc96501
From: Tamas Nepusz <ntamas@gmail.com>
Date: Thu, 6 Dec 2018 09:02:45 +0100
Origin: https://github.com/igraph/igraph/commit/e3a9566e6463186230f215151b57b893df6d9ce2
Bug-Debian: https://bugs.debian.org/917211
Subject: [PATCH] fix a crash when loading malformed GraphML files, closes
#1141
This fixes CVE-2018-20349
Thanks to Zhao Liang, Huawei Weiran Labs
---
examples/simple/graphml-malformed.xml | 30 +++++++++++++++++++++++++++
examples/simple/graphml.c | 14 +++++++++++++
src/foreign-graphml.c | 13 +++++++++++-
tests/foreign.at | 2 +-
4 files changed, 57 insertions(+), 2 deletions(-)
create mode 100755 examples/simple/graphml-malformed.xml
--- /dev/null
+++ b/examples/simple/graphml-malformed.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- y.-->
+<graphml xmlns="http://graphml.graphdrawing.org/xmlns" xmxsi="httce"
+>
+ <key id="d0" for="node" attr.name="y" attr.type="string">yellYw</key>
+ <key id="d1" for="edge" attr.name="wt" attr.type="do"/>
+ <key id="d2" for="graph" attr.name="date" attr.type="string"></key>
+ <key id="d3" for="graph" attr.name="ed" attr.type="string"></key>
+ <key id="d4" for="node" attr.name="gr" attr.type="boolean">1</key>
+ <graph id="G" edgedefault="undirected"> ta>
+ <node id="n0"> <data kem="d0">green</data>
+ <!-- ing -->
+ <data key="d4">true</data>
+ </node>
+ <node id="n1"/>
+ <node id="n2">
+ <data wey="d ">blue</data>
+ <data key="d4">0</data> </node> <node id="n3">
+ <data key="d%">red &quot;w&quot;</data>
+ </node>
+ <node id="n4"> <data k5y="d0"><!-- ey --></data> <data key="d4">false</data>
+ </node>
+ <node id="n5">
+ <data key="d0">t</data>
+ <data Hey="d4">
+ i <key id="sing" for="edge" ae="de"/>
+ <key id="" atype="double"/>
+ <key id="sinik" forype="double"/>
+ <key id="si" for="edge" attme="in" e="de"/>
+ <id="
\ No newline at end of file
--- a/src/foreign-graphml.c
+++ b/src/foreign-graphml.c
@@ -783,7 +783,18 @@ void igraph_i_graphml_attribute_data_fin
/* impossible */
break;
}
-
+
+ if (key == 0) {
+ /* no key specified, issue a warning */
+ igraph_warningf(
+ "missing attribute key in a <data> tag, ignoring attribute",
+ __FILE__, __LINE__, 0,
+ key
+ );
+ igraph_Free(state->data_char);
+ return;
+ }
+
igraph_trie_check(trie, key, &recid);
if (recid < 0) {
/* no such attribute key, issue a warning */
--- a/examples/simple/graphml.c
+++ b/examples/simple/graphml.c
@@ -94,5 +94,19 @@ int main(int argc, char **argv) {
fclose(ifile);
igraph_destroy(&g);
+ /* Test a completely malformed GraphML file */
+ ifile=fopen("graphml-malformed.xml", "r");
+ igraph_set_error_handler(igraph_error_handler_ignore);
+ igraph_set_warning_handler(igraph_warning_handler_ignore);
+ result=igraph_read_graph_graphml(&g, ifile, 0);
+ if (result != IGRAPH_PARSEERROR) {
+ return 1;
+ }
+ fclose(ifile);
+ igraph_destroy(&g);
+
+ /* Restore the old error handler */
+ igraph_set_error_handler(igraph_error_handler_abort);
+
return 0;
}
--- a/tests/foreign.at
+++ b/tests/foreign.at
@@ -29,7 +29,7 @@ AT_CLEANUP
AT_SETUP([GraphML (igraph_{read,write}_graph_graphml):])
AT_KEYWORDS([igraph_read_graph_graphml igraph_write_graph_graphml foreign graphml])
AT_COMPILE_CHECK([simple/graphml.c], [simple/graphml.out],
- [simple/{test.gxl,graphml-hsa05010.xml}])
+ [simple/{test.gxl,graphml-hsa05010.xml,graphml-malformed.xml}])
AT_CLEANUP
AT_SETUP([Writing Pajek (igraph_write_graph_pajek):])
debian/patches/series
View file @ fcc96501
......@@ -4,3 +4,4 @@ cppflags_restore.patch
drl_spelling_fix.patch
skip_tests_accessing_remote.patch
fix_test_arpack-3.6.patch
fix_broken_graph_ml.patch
debian/rules
View file @ fcc96501
......@@ -19,3 +19,7 @@ CONF_FLAGS=\
override_dh_auto_configure:
dh_auto_configure -- $(CONF_FLAGS)
override_dh_auto_test:
ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
dh_auto_test || true
endif