diff -Nru apngopt-1.2/debian/changelog apngopt-1.2/debian/changelog --- apngopt-1.2/debian/changelog 2016-05-26 10:28:45.000000000 +0000 +++ apngopt-1.2/debian/changelog 2021-09-22 00:04:05.000000000 +0000 @@ -1,3 +1,20 @@ +apngopt (1.2-3) unstable; urgency=medium + + * QA upload. + * debian/patches/0001-use-autotools.patch: Use autotools as + package buildsystem. + + Fixes FTCBFS. (Closes: #966843) + * Refresh packaging: + + Bump Standards-Version to 4.6.0. + + Bump debhelper compat to v13. + + Update Vcs-* fields with git packaging repo on Salsa GitLab. + * debian/rules: Refresh instruction. + * debian/patches/0002-strcpy-avoid-stack-buffer-overflow.patch: + Add patch to avoid stack buffer overflow with long filename. + (Closes: #959141) + + -- Boyuan Yang Tue, 21 Sep 2021 20:04:05 -0400 + apngopt (1.2-2) unstable; urgency=medium * QA upload. diff -Nru apngopt-1.2/debian/compat apngopt-1.2/debian/compat --- apngopt-1.2/debian/compat 2013-06-04 11:03:07.000000000 +0000 +++ apngopt-1.2/debian/compat 1970-01-01 00:00:00.000000000 +0000 @@ -1 +0,0 @@ -9 diff -Nru apngopt-1.2/debian/control apngopt-1.2/debian/control --- apngopt-1.2/debian/control 2016-05-26 10:26:21.000000000 +0000 +++ apngopt-1.2/debian/control 2021-09-21 23:40:35.000000000 +0000 @@ -2,11 +2,11 @@ Section: graphics Priority: optional Maintainer: Debian QA Group -Build-Depends: debhelper (>= 9), libz-dev -Standards-Version: 3.9.8 +Build-Depends: debhelper-compat (= 13), zlib1g-dev +Standards-Version: 4.6.0 Homepage: http://apng.sourceforge.net -Vcs-Git: https://anonscm.debian.org/git/collab-maint/apngopt.git -Vcs-Browser: https://anonscm.debian.org/cgit/collab-maint/apngopt.git/ +Vcs-Git: https://salsa.debian.org/debian/apngopt.git +Vcs-Browser: https://salsa.debian.org/debian/apngopt Package: apngopt Architecture: any diff -Nru apngopt-1.2/debian/patches/0001-use-autotools.patch apngopt-1.2/debian/patches/0001-use-autotools.patch --- apngopt-1.2/debian/patches/0001-use-autotools.patch 1970-01-01 00:00:00.000000000 +0000 +++ apngopt-1.2/debian/patches/0001-use-autotools.patch 2021-09-22 00:01:12.000000000 +0000 @@ -0,0 +1,53 @@ +From: Boyuan Yang +Date: Tue, 21 Sep 2021 19:46:53 -0400 +Subject: use autotools + +--- + Makefile.am | 4 ++++ + configure.ac | 26 ++++++++++++++++++++++++++ + 2 files changed, 30 insertions(+) + create mode 100644 Makefile.am + create mode 100644 configure.ac + +diff --git a/Makefile.am b/Makefile.am +new file mode 100644 +index 0000000..2ac33f2 +--- /dev/null ++++ b/Makefile.am +@@ -0,0 +1,4 @@ ++bin_PROGRAMS = apngopt ++ ++apngopt_SOURCES = apngopt.c ++apngopt_LDADD = -lz +diff --git a/configure.ac b/configure.ac +new file mode 100644 +index 0000000..c95a6a2 +--- /dev/null ++++ b/configure.ac +@@ -0,0 +1,26 @@ ++# -*- Autoconf -*- ++# Process this file with autoconf to produce a configure script. ++ ++AC_PREREQ([2.69]) ++AC_INIT([apngopt], [1.2]) ++AC_CONFIG_SRCDIR([apngopt.c]) ++AC_CONFIG_HEADERS([config.h]) ++AM_INIT_AUTOMAKE([foreign]) ++ ++# Checks for programs. ++AC_PROG_AWK ++AC_PROG_CC ++ ++# Checks for libraries. ++AC_CHECK_LIB([z], [deflateReset]) ++ ++# Checks for header files. ++ ++# Checks for typedefs, structures, and compiler characteristics. ++ ++# Checks for library functions. ++AC_FUNC_MALLOC ++AC_CHECK_FUNCS([memset strrchr]) ++ ++AC_CONFIG_FILES([Makefile]) ++AC_OUTPUT diff -Nru apngopt-1.2/debian/patches/0002-strcpy-avoid-stack-buffer-overflow.patch apngopt-1.2/debian/patches/0002-strcpy-avoid-stack-buffer-overflow.patch --- apngopt-1.2/debian/patches/0002-strcpy-avoid-stack-buffer-overflow.patch 1970-01-01 00:00:00.000000000 +0000 +++ apngopt-1.2/debian/patches/0002-strcpy-avoid-stack-buffer-overflow.patch 2021-09-22 00:01:12.000000000 +0000 @@ -0,0 +1,34 @@ +From: David Petek +Date: Wed, 29 Apr 2020 22:29:20 +0200 +Subject: strcpy avoid stack buffer overflow + +apngopt crashes with stack buffer overflow when calling with command line +argument longer than 247 bytes. + +Suggested fix: use strncpy or verify szIn length before copying. + +Proposed patch: +``` +2372c2372 +< strcpy(szOut, szIn); +--- +> strncpy(szOut, szIn, 247); + +Bug-Debian: https://bugs.debian.org/959141 +--- + apngopt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/apngopt.c b/apngopt.c +index e21042e..78bbde7 100644 +--- a/apngopt.c ++++ b/apngopt.c +@@ -2369,7 +2369,7 @@ int main(int argc, char** argv) + } + else + { +- strcpy(szOut, szIn); ++ strncpy(szOut, szIn, 247); // truncate str, avoid buf overflow + if ((szExt = strrchr(szOut, '.')) != NULL) *szExt = 0; + strcat(szOut, ".opt.png"); + } diff -Nru apngopt-1.2/debian/patches/series apngopt-1.2/debian/patches/series --- apngopt-1.2/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ apngopt-1.2/debian/patches/series 2021-09-22 00:01:12.000000000 +0000 @@ -0,0 +1,2 @@ +0001-use-autotools.patch +0002-strcpy-avoid-stack-buffer-overflow.patch diff -Nru apngopt-1.2/debian/rules apngopt-1.2/debian/rules --- apngopt-1.2/debian/rules 2013-06-04 11:03:07.000000000 +0000 +++ apngopt-1.2/debian/rules 2021-09-21 23:53:58.000000000 +0000 @@ -1,25 +1,27 @@ #!/usr/bin/make -f +# -*- makefile -*- +# Uncomment this to turn on verbose mode. +# export DH_VERBOSE=1 -PACKAGE = apngopt -BIN = $(PACKAGE) -CC ?= gcc - +# see FEATURE AREAS in dpkg-buildflags(1) export DEB_BUILD_MAINT_OPTIONS = hardening=+all -CFLAGS += -Wall -std=c99 -LDFLAGS += -Wl,--as-needed +# see ENVIRONMENT in dpkg-buildflags(1) +# package maintainers to append CFLAGS +#export DEB_CFLAGS_MAINT_APPEND = -Wall -pedantic +# package maintainers to append LDFLAGS +export DEB_LDFLAGS_MAINT_APPEND = + +include /usr/share/dpkg/default.mk include debian/pod2man.mk man: - $(MAKE) -C debian -f pod2man.mk PACKAGE=$(PACKAGE) makeman + $(MAKE) -C debian -f pod2man.mk PACKAGE=$(DEB_SOURCE) makeman -override_dh_auto_build: man - $(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) $(PACKAGE).c -o $(BIN) -lz +execute_before_dh_auto_build: man override_dh_installchangelogs: dh_installchangelogs readme.txt %: dh $@ - -# End of file