Bug 589990 - pango: rebuild against newer glib2
Summary: pango: rebuild against newer glib2
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: pango
Version: 6.0
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Behdad Esfahbod
QA Contact: desktop-bugs@redhat.com
Depends On: 573966
Blocks: CVE-2009-4012
TreeView+ depends on / blocked
Reported: 2010-05-07 13:10 UTC by Tomas Hoger
Modified: 2010-07-23 14:00 UTC (History)
3 users (show)

Fixed In Version: pango-1.28.1-1.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2010-07-23 13:39:16 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description Tomas Hoger 2010-05-07 13:10:44 UTC
Description of problem:
pango should be rebuilt against new glib2 package version (>= glib2-2.22.5-2.el6) that have g_new version with guards against integer overflows.

This is needed for:

Protections to g_new were added via:

Additional info:
Rebuild should address existing blocker bug #573883 too.

Comment 1 Tomas Pelka 2010-05-27 14:30:51 UTC
 - check dependency tree (see description).

Giving qa_ack.

Comment 2 Behdad Esfahbod 2010-06-15 17:38:48 UTC
Built pango-1.28.1-1.el6.

Comment 3 Tomas Pelka 2010-06-16 09:05:26 UTC
# rpm -qpR pango-1.28.1-1.el6.x86_64.rpm | grep glib2
glib2 >= 2.17.3-1

Shouldn't be this switched for glib2 >= 2.22 or so?

My system have glib2-2.22.5-3.el6, new pango is successfully installable and works fine.

Is this sufficient reproducer? If yes we could move to verified.

Comment 4 Vladimir Benes 2010-07-15 11:12:59 UTC
please update glib dependency to >=glib2-2.22.5-2.el6 as (according to bug 573966) the wanted behaviour was added into that version.

Comment 5 Matthias Clasen 2010-07-15 11:28:56 UTC
There will be no older glib2 than that in RHEL6. So, while it may be more correct to bump it, it is not as if that would prevent anything bad from happening.

Comment 9 Vladimir Benes 2010-07-23 13:39:16 UTC
closing this as not a bug see previous comments. reopen if you think we should do anything more about it

Comment 10 Tomas Hoger 2010-07-23 13:50:11 UTC
I'd say resolution is not correct, as requested rebuild was done.

Comment 11 Vladimir Benes 2010-07-23 14:00:10 UTC
the require from pango-1.28.1-3.el6 is glib2 >= 2.17.3-1 not 2.22 so it wasn't fixed as expected

Note You need to log in before you can comment on or make changes to this bug.