Re: tiff / CVE-2018-7456

2018-03-15 Thread Hugo Lefeuvre
Hi Brian, > I attempted to fix CVE-2018-7456 issue in tiff, for the version in > stretch. My patch is below. But curiously my patch only works if I > enable the commented out call to fprintf or use -O0 instead of the > default -O2 (-O1 also fails). Otherwise the if condition never gets > executed,

debian-security-support migrated to Salsa

2018-03-15 Thread Santiago Ruano Rincón
Hi, FYI, I've moved the debian-security-support repo to Salsa: https://salsa.debian.org/debian/debian-security-support Cheers, Santiago signature.asc Description: PGP signature

Re: debian-security-support migrated to Salsa

2018-03-15 Thread Chris Lamb
Hi Santiago, > FYI, I've moved the debian-security-support repo to Salsa: > https://salsa.debian.org/debian/debian-security-support Thanks! I've updated the bin/unsupported_packages.py script to match: https://salsa.debian.org/security-tracker-team/security-tracker/commit/b0cd5ed5b282af6bd773

Re: tiff / CVE-2018-7456

2018-03-15 Thread Hugo Lefeuvre
Hi Brian, I've had a look at your patch, here are some comments. > I attempted to fix CVE-2018-7456 issue in tiff, for the version in > stretch. My patch is below. But curiously my patch only works if I > enable the commented out call to fprintf or use -O0 instead of the > default -O2 (-O1 also f

Re: tiff / CVE-2018-7456

2018-03-15 Thread Ben Hutchings
On Thu, 2018-03-15 at 16:55 +0100, Hugo Lefeuvre wrote: [...] > * My understanding of the problem: > > Under certain conditions, the td->td_transferfunction table might not > have the excepted size, that is it may not have the excepted number of > samples per pixel (td->td_samplesperpixel). In thi

LTS report for February

2018-03-15 Thread Emilio Pozuelo Monfort
Hi, Last month I only managed to work 2 hours on LTS for lack of time due to personal reasons. I spent that time on: - tzdata update - libdatetime-timezone-perl update - openjdk-7 upstream status investigation, filed Debian bug I am returning all my unused hours to the pool. Cheers, Emilio

Re: tiff / CVE-2018-7456

2018-03-15 Thread Brian May
Hugo Lefeuvre writes: > Under certain conditions, the td->td_transferfunction table might not > have the excepted size, that is it may not have the excepted number of > samples per pixel (td->td_samplesperpixel). In this case for example, > the table is only 3 rows large while td->td_samplesperpi