Bug 121750

Oops, I was such happy, that I wasn't forced to do patch merging, so 
I didn't saw the bad makefile solution...

I wrote a patch (attached), that works for me perfect, that are my 
changes in the spec file:

--- libpng.spec         2004-03-02 22:41:43.000000000 +0100
+++ libpng.spec.rsc     2004-04-27 19:49:26.000000000 +0200
@@ -1,12 +1,11 @@
 Summary: A library of functions for manipulating PNG image format files.
 Name: libpng
-Version: 1.2.2
-Release: 19.1
+Version: 1.2.5
+Release: 1
 License: OSI certified
 Group: System Environment/Libraries
 Source: ftp://swrinde.nde.swri.edu/pub/png/src/libpng-%{version}.tar.bz2
-Source2: ftp://swrinde.nde.swri.edu/pub/png/src/libpng-1.2.2patch03-makefiles.tar.gz
-Patch0: libpng-1.2.2-rhconf.patch
+Patch0: libpng-1.2.5-rhconf.patch
 Patch1: libpng-1.0.9-badchunks.patch
 Patch2: libpng-1.2.2-libdirfix.patch
 Buildroot: %{_tmppath}/%{name}-%{version}-root
@@ -43,8 +41,6 @@

 %prep
 %setup -q
-## dump in the fixed makefiles (remove this with 1.2.3, presumably)
-(cd scripts && tar zxf %{SOURCE2})

 ln -s scripts/makefile.linux Makefile
 %patch0 -p1 -b .rhconf
@@ -58,15 +54,6 @@
 rm -rf $RPM_BUILD_ROOT

 make install prefix=$RPM_BUILD_ROOT/usr LIBPATH=$RPM_BUILD_ROOT%{_libdir}
-mkdir -p $RPM_BUILD_ROOT%{_mandir}/man{3,5}
-install -c -m 644 *.3 $RPM_BUILD_ROOT%{_mandir}/man3
-install -c -m 644 *.5 $RPM_BUILD_ROOT%{_mandir}/man5
-
-ln -s libpng12/png.h $RPM_BUILD_ROOT%{_includedir}
-ln -s libpng12/pngconf.h $RPM_BUILD_ROOT%{_includedir}
-
-# I don't know what this is doing here.
-rm -f $RPM_BUILD_ROOT%{_mandir}/man5/libpng.so*

 %post -p /sbin/ldconfig

@@ -80,6 +67,7 @@

 %files devel
 %defattr(-,root,root)
+%{_bindir}/*
 %{_includedir}/*
 %{_libdir}/libpng*.a
 %{_libdir}/libpng*.so

Created attachment 99719 [details]
libpng-1.2.5-rhconf.patch

Marking as enhancement as its too close to FC2 to go changing packages now

Here's a fix for CVE CAN-2004-0421 for libpng 1.2.5 that can be
applied to the patch above.

--- libpng.spec.rsc     2004-05-03 11:16:25.000000000 +0200
+++ libpng.spec.rsc2    2004-05-03 12:56:27.000000000 +0200
@@ -8,6 +8,7 @@
 Patch0: libpng-1.2.5-rhconf.patch
 Patch1: libpng-1.0.9-badchunks.patch
 Patch2: libpng-1.2.2-libdirfix.patch
+Patch3: libpng-1.2.5-oob_error_message.patch
 Buildroot: %{_tmppath}/%{name}-%{version}-root
 BuildPrereq: zlib-devel
 Provides: libpng.so.3
@@ -46,6 +47,7 @@
 %patch0 -p1 -b .rhconf
 %patch1 -p1 -b .badchunk
 %patch2 -p1 -b .libdirfix
+%patch3 -p1 -b .oob_error_message

 %build
 make ZLIBLIB=%{_libdir} RPM_OPT_FLAGS="$RPM_OPT_FLAGS" LIBPATH=%{_libdir}

Created attachment 99904 [details]
libpng-1.2.5-oob_error_message.patch

Oh...I saw at current, that there is no fix for CVE CAN-2004-0421 for 
libpng 1.2.2 in the Fedora Development tree/Rawhide. So please solve
this security issue either with a rebuild of the latest libpng from 
RH9/RHEL or use this solution.

*** Bug 122329 has been marked as a duplicate of this bug. ***

Created attachment 100245 [details]
libpng-1.2.5-rhconf.patch

Yeah, we've got to link against zlib using -lz

Created attachment 100246 [details]
libpng-1.2.5-oob_error_message.patch

Okay, we use the reworked patch also in 1.2.5

*** Bug 99052 has been marked as a duplicate of this bug. ***