Re: Sufficient patch for CVE-2006-0082

On Wed, 1 Mar 2006, Daniel Kobras wrote:

> On Wed, Mar 01, 2006 at 09:57:59AM -0600, Albert Chin wrote:
>> Is the attached patch ok for CVE-2006-0082? It is taken from Gentoo:
>>   http://www.gentoo.org/security/en/glsa/glsa-200602-13.xml
>
> This patch breaks multi-frame support, and misses a number of similar
> code paths. The attached patch is applied to the Debian package of
> 1.1.7. I can check in a version for CVS HEAD if someone tells me how
> to provide proper changelog entries. Are they autogenerated from the
> commit message? Is the HTML version generated from plaintext or vice
> versa?

All you need to do is to edit the ChangeLog file. Emacs works quite 
nicely for this.  The build automatically maintains the other files 
depending on available tools and if --enable-maintainer-mode is 
applied.  If you simply edit ChangeLog, my own build will take care of 
the rest.

I expect that there will be a 1.1.8 so any important fixes should be 
applied there as well.  Just keep in mind that 1.1.X can't use 
strlcpy/strlcat while 1.2 development can.

Bob
======================================
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/


-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642