Commit: fb847973b3aa66fb15796f44575c754afa62628c - dia (git)

作図ソフト dia の改良版

Commit MetaInfo

• Revision: fb847973b3aa66fb15796f44575c754afa62628c (tree)
• Time: 2006-05-27 05:54:32
• Author: Lars Clausen <lclausen@src....>
• Commiter: Lars Clausen

Log Message

0.95-1 release: Security fixes, ungroup, ...

Change Summary

• modified: ChangeLog
• modified: NEWS
• modified: RELEASE-PROCESS
• modified: app/app_procs.c
• modified: app/display.c
• modified: app/filedlg.c
• modified: app/interface.c
• modified: app/load_save.c
• modified: app/sheets.c
• modified: config.h.win32
• modified: configure.in
• modified: doc/en/dia.xml
• modified: doc/eu/dia.xml
• modified: doc/pl/dia.xml
• modified: lib/dia_image.c
• modified: lib/message.c
• modified: plug-ins/python/diamodule.c
• modified: plug-ins/python/pydia-error.c
• modified: plug-ins/wmf/wmf.cpp

Incremental Difference

--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,24 @@
[phone]  Lars Clausen  <[e-mail]>
+
+	* RELEASE-PROCESS: 
+	* doc/{en,pl,eu}/dia.xml: 
+	* config.h.win32: 
+	* configure.in: 
+	Update to version 0.95-1.
+
+	* app/app_procs.c: 
+	* app/filedlg.c
+	* app/display.c: 
+	* app/interface.c:
+	* app/load_save.c:
+	* app/sheets.c:
+	* lib/dia_image.c:
+	* lib/message.c:
+	* plug-ins/python/pydia-error.c:
+	* plug-ins/python/diamodule.c:
+	* plug-ins/wmf/wmf.cpp: Patch from Hans de Goede: Fix bug #342111,
+	security vulnerabilities from string format errors.
+	
 2006-05-21  Hans Breuer  <[e-mail]>
 
 	* app/pagesetup.c app/diapagelayout.c : restrict every page margin

--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,8 @@
+dia-0.95-1: 25-May-2006
+
+* Fix of bug #339562 (page margins restriction), #338336 ("query" in 
+  umloperation_offsets), and #334771 (ungroup crashes)
+
 dia-0.95: 19-Apr-2006
 
 * Update of Gane/Sarson sheets.

--- a/RELEASE-PROCESS
+++ b/RELEASE-PROCESS
@@ -102,7 +102,7 @@ How to make a tarball
 
 Script to update version:
 
-find . -name configure.in -o -name config.h.win32 -o -name dia.xml  | xargs sed -i 's/0\.95-pre[0-9]*/0.95-pre5/;'
+find . -name configure.in -o -name config.h.win32 -o -name dia.xml  | xargs sed -i 's/0\.95*/0.95-1/;'
 
 Issues to solve
 ---------------

--- a/app/app_procs.c
+++ b/app/app_procs.c
@@ -1175,7 +1175,7 @@ process_opts(int argc, char **argv,
 #  endif
       if (!g_option_context_parse (context, &argc, &argv, &error)) {
         if (error) { /* IMO !error here is a bug upstream, triggered with --gdk-debug=updates */
-	g_print (error->message);
+	g_print ("%s", error->message);
 	  g_error_free (error);
 	} else {
 	  g_print ("Invalid option?");
@@ -1273,22 +1273,22 @@ print_credits(gboolean credits)
 
       g_print(_("The original author of Dia was:\n\n"));
       for (i = 0; i < NUMBER_OF_ORIG_AUTHORS; i++) {
-          g_print(authors[i]); g_print("\n");
+          g_print("%s\n", authors[i]);
       }
 
       g_print(_("\nThe current maintainers of Dia are:\n\n"));
       for (i = NUMBER_OF_ORIG_AUTHORS; i < NUMBER_OF_ORIG_AUTHORS + NUMBER_OF_MAINTAINERS; i++) {
-	  g_print(authors[i]); g_print("\n");
+	  g_print("%s\n", authors[i]);
       }
 
       g_print(_("\nOther authors are:\n\n"));
       for (i = NUMBER_OF_ORIG_AUTHORS + NUMBER_OF_MAINTAINERS; i < nauthors; i++) {
-          g_print(authors[i]); g_print("\n");
+          g_print("%s\n", authors[i]);
       }
 
       g_print(_("\nDia is documented by:\n\n"));
       for (i = 0; i < ndocumentors; i++) {
-          g_print(documentors[i]); g_print("\n");
+          g_print("%s\n", documentors[i]);
       }
 
       exit(0);

--- a/app/display.c
+++ b/app/display.c
@@ -1119,7 +1119,6 @@ ddisplay_close(DDisplay *ddisp)
   Diagram *dia;
   GtkWidget *dialog, *button;
   gchar *fname;
-  gchar *msg;
 
   g_return_if_fail(ddisp != NULL);
 
@@ -1134,10 +1133,6 @@ ddisplay_close(DDisplay *ddisp)
   fname = dia->filename;
   if (!fname)
     fname = _("<unnamed>");
-  msg = g_strdup_printf (
-          _("The diagram '%s'\n"
-            "has not been saved. Save changes now?"),
-	  fname);
 
   dialog = gtk_message_dialog_new(GTK_WINDOW (ddisp->shell), 
                                   GTK_DIALOG_MODAL,
@@ -1145,8 +1140,9 @@ ddisplay_close(DDisplay *ddisp)
                                   GTK_BUTTONS_NONE, /* no standard buttons */
 				  _("Closing diagram without saving"),
 				  NULL);
-  gtk_message_dialog_format_secondary_text(GTK_MESSAGE_DIALOG(dialog), msg);
-  g_free (msg);
+  gtk_message_dialog_format_secondary_text(GTK_MESSAGE_DIALOG(dialog),
+    _("The diagram '%s'\n"
+      "has not been saved. Save changes now?"), fname);
   gtk_window_set_title (GTK_WINDOW(dialog), _("Close Diagram"));
 
   button = gtk_button_new_from_stock (GTK_STOCK_CANCEL);

--- a/app/filedlg.c
+++ b/app/filedlg.c
@@ -299,7 +299,6 @@ file_save_as_response_callback(GtkWidget *fs,
 
     if (stat(filename, &stat_struct) == 0) {
       GtkWidget *dialog = NULL;
-      char buffer[300];
       char *utf8filename = NULL;
       if (!g_utf8_validate(filename, -1, NULL)) {
 	utf8filename = g_filename_to_utf8(filename, -1, NULL, NULL, NULL);
@@ -310,16 +309,15 @@ file_save_as_response_callback(GtkWidget *fs,
       }
       if (utf8filename == NULL) utf8filename = g_strdup(filename);
 
-      g_snprintf(buffer, 300,
-		 _("The file '%s' already exists.\n"
-		   "Do you want to overwrite it?"), utf8filename);
-      g_free(utf8filename);
 
       dialog = gtk_message_dialog_new (GTK_WINDOW(fs),
 				       GTK_DIALOG_MODAL, GTK_MESSAGE_QUESTION,
 				       GTK_BUTTONS_YES_NO,
 				       _("File already exists"));
-      gtk_message_dialog_format_secondary_text(GTK_MESSAGE_DIALOG(dialog), buffer);
+      gtk_message_dialog_format_secondary_text(GTK_MESSAGE_DIALOG(dialog),
+        _("The file '%s' already exists.\n"
+          "Do you want to overwrite it?"), utf8filename);
+      g_free(utf8filename);
       gtk_dialog_set_default_response (GTK_DIALOG (dialog), GTK_RESPONSE_YES);
 
       if (gtk_dialog_run (GTK_DIALOG (dialog)) != GTK_RESPONSE_YES) {
@@ -552,17 +550,15 @@ file_export_response_callback(GtkWidget *fs,
 
     if (stat(filename, &statbuf) == 0) {
       GtkWidget *dialog = NULL;
-      char buffer[300];
 
-      g_snprintf(buffer, 300,
-		 _("The file '%s' already exists.\n"
-		   "Do you want to overwrite it?"), dia_message_filename(filename));
       dialog = gtk_message_dialog_new (GTK_WINDOW(fs),
 				       GTK_DIALOG_MODAL | GTK_DIALOG_DESTROY_WITH_PARENT, 
 				       GTK_MESSAGE_QUESTION,
 				       GTK_BUTTONS_YES_NO,
 				       _("File already exists"));
-      gtk_message_dialog_format_secondary_text(GTK_MESSAGE_DIALOG(dialog), buffer);
+      gtk_message_dialog_format_secondary_text(GTK_MESSAGE_DIALOG(dialog),
+        _("The file '%s' already exists.\n"
+        "Do you want to overwrite it?"), dia_message_filename(filename));
       gtk_dialog_set_default_response (GTK_DIALOG (dialog), GTK_RESPONSE_YES);
 
       if (gtk_dialog_run (GTK_DIALOG (dialog)) != GTK_RESPONSE_YES) {

--- a/app/interface.c
+++ b/app/interface.c
@@ -902,7 +902,7 @@ sheet_menu_callback(DiaDynamicMenu *menu, const gchar *string, void *user_data)
 {
   Sheet *sheet = get_sheet_by_name(string);
   if (sheet == NULL) {
-    message_warning(g_strdup_printf(_("No sheet named %s"), string));
+    message_warning(_("No sheet named %s"), string);
   } else {
     persistence_set_string("last-sheet-selected", string);
     fill_sheet_wbox(sheet);

--- a/app/load_save.c
+++ b/app/load_save.c
@@ -200,7 +200,7 @@ read_objects(xmlNodePtr objects,
     g_hash_table_foreach(unknown_hash,
 			 GHFuncUnknownObjects,
 			 unknown_str);
-    message_error(unknown_str->str);
+    message_error("%s", unknown_str->str);
   }
   g_hash_table_destroy(unknown_hash);
   g_string_free(unknown_str, TRUE);

--- a/app/sheets.c
+++ b/app/sheets.c
@@ -340,7 +340,7 @@ create_object_pixmap(SheetObject *so, GtkWidget *parent,
         gdk_pixbuf_render_pixmap_and_mask(pixbuf, pixmap, mask, 1.0);
         gdk_pixbuf_unref(pixbuf);
       } else {
-        message_warning (error->message);
+        message_warning ("%s", error->message);
         g_error_free (error);
 	*pixmap = gdk_pixmap_colormap_create_from_xpm_d
 	  (NULL,

--- a/config.h.win32
+++ b/config.h.win32
@@ -18,7 +18,7 @@
 #undef LOCALEDIR /* needs to be calculated at runtime */
 /* NOT: #define LOCALEDIR "../lib/locale" */
 
-#define VERSION "0.95"
+#define VERSION "0.95-1"
 
 /*
  * We are linking libxml as DLL with either msvc or mingw, but this

--- a/configure.in
+++ b/configure.in
@@ -1,6 +1,6 @@
 dnl Process this -*- autoconf -*- file with autoconf to produce a 
 dnl configure script.
-AC_INIT(dia, 0.95, http://bugzilla.gnome.org/enter_bug.cgi?product=dia)
+AC_INIT(dia, 0.95-1, http://bugzilla.gnome.org/enter_bug.cgi?product=dia)
 AC_CONFIG_SRCDIR(app/diagram.c)
 AM_INIT_AUTOMAKE(AC_PACKAGE_NAME,AC_PACKAGE_VERSION)
 
@@ -67,10 +67,10 @@ if test "$have_pangoft2" = "true"; then
   have_freetype=false
   AC_CHECK_LIB(freetype,FT_Init_FreeType,have_freetype=true,have_freetype=false,`freetype-config --libs`)
   if test "$have_freetype" = "true"; then
-    dnl Need 2.0.9, as a bug was fixed for us there.
+    dnl Need 2.0.95-1, as a bug was fixed for us there.
     dnl However, freetype-config doesn't give a meaningful version, so we must
     dnl do it like this.
-    AC_MSG_CHECKING([if FreeType version is 2.0.9 or higher])
+    AC_MSG_CHECKING([if FreeType version is 2.0.95-1 or higher])
     old_CPPFLAGS="$CPPFLAGS"
     CPPFLAGS="$CPPFLAGS `freetype-config --cflags`"
     AC_TRY_CPP([#include <ft2build.h>
@@ -87,7 +87,7 @@ if test "$have_pangoft2" = "true"; then
 	 GTK_MODULES="$GTK_MODULES pangoft2"
 	 AC_DEFINE(HAVE_FREETYPE,1,[Define if you have the FreeType2 library])]
     ,
-	[AC_MSG_ERROR([Need FreeType library version 2.0.9 or higher])])
+	[AC_MSG_ERROR([Need FreeType library version 2.0.95-1 or higher])])
     CPPFLAGS="$old_CPPFLAGS"
   else
    AC_MSG_ERROR(Can't find FreeType library)

--- a/doc/en/dia.xml
+++ b/doc/en/dia.xml
@@ -8,7 +8,7 @@
 
   [
 
-    <!ENTITY VERSION "0.95">
+    <!ENTITY VERSION "0.95-1">
 
     <!ENTITY INTRODUCTION SYSTEM "intro.xml">
 

--- a/doc/eu/dia.xml
+++ b/doc/eu/dia.xml
@@ -4,7 +4,7 @@
 
 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" "../../dtd/docbookx.dtd" [
 
-    <!ENTITY VERSION "0.95">
+    <!ENTITY VERSION "0.95-1">
 
     <!ENTITY INTRODUCTION SYSTEM "intro.xml">
 

--- a/doc/pl/dia.xml
+++ b/doc/pl/dia.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="iso-8859-1"?>
 
 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" "../../dtd/docbookx.dtd"[
-<!ENTITY VERSION "0.95">
+<!ENTITY VERSION "0.95-1">
 <!ENTITY INTRODUCTION SYSTEM "intro.xml">
 <!ENTITY QUICKSTART SYSTEM "usage-quickstart.xml">
 <!ENTITY CANVAS SYSTEM "usage-canvas.xml">

--- a/lib/dia_image.c
+++ b/lib/dia_image.c
@@ -92,7 +92,7 @@ dia_image_load(gchar *filename)
      * only if there is something else wrong while loading it.
      */
     if (g_file_test(filename, G_FILE_TEST_EXISTS))
-      g_warning (error->message);
+      g_warning ("%s", error->message);
     g_error_free (error);
     return NULL;
   }

--- a/lib/message.c
+++ b/lib/message.c
@@ -86,7 +86,7 @@ message_create_dialog(const gchar *title, DiaMessageInfo *msginfo, gchar *buf)
 				   0,    /* GtkDialogFlags */
 				   type,
 				   GTK_BUTTONS_CLOSE,
-				   buf);
+				   "%s", buf);
   if (title) {
     gchar *real_title;
 

--- a/plug-ins/python/diamodule.c
+++ b/plug-ins/python/diamodule.c
@@ -393,11 +393,11 @@ PyDia_Message (PyObject *self, PyObject *args)
 	return NULL;
 
     if (0 == type)
-	message_notice (text);
+	message_notice ("%s", text);
     else if (1 == type)
-	message_warning (text);
+	message_warning ("%s", text);
     else
-	message_error (text);
+	message_error ("%s", text);
 
     Py_INCREF(Py_None);
     return Py_None;

--- a/plug-ins/python/pydia-error.c
+++ b/plug-ins/python/pydia-error.c
@@ -46,7 +46,7 @@ _pyerror_report_last (gboolean popup, const char* fn, const char* file, int line
   PyFile_WriteObject (v, ef, 0);
   PyTraceBack_Print(tb, ef);
   if (((PyDiaError*)ef)->str && popup) 
-    message_error (((PyDiaError*)ef)->str->str);
+    message_error ("%s", ((PyDiaError*)ef)->str->str);
   g_free (sLoc);
   Py_DECREF (ef);
   Py_XDECREF(exc);

--- a/plug-ins/wmf/wmf.cpp
+++ b/plug-ins/wmf/wmf.cpp
@@ -223,7 +223,7 @@ my_log(WmfRenderer* renderer, char* format, ...)
     va_end (args);
 
     //fprintf(renderer->file, string);
-    g_print(string);
+    g_print("%s", string);
 
     g_free(string);
 }