init package

0001-Replace-all-instances-of-sprintf-with-snprintf-and-a.patch

@@ -0,0 +1,203 @@
+From 0f8c89a42fd87ca8c17660c50f114a5f68a1e21e Mon Sep 17 00:00:00 2001
+From: Jean-Francois Dockes <jf@dockes.org>
+Date: Fri, 8 Jun 2018 13:48:40 -0600
+Subject: [PATCH] Replace all instances of sprintf with snprintf and adjust
+ size of integer field in some cases
+
+Rebased on 0.21.9 by Ken Dreyer <ktdreyer@ktdreyer.com>
+
+Resolves: CVE-2016-10091
+---
+ src/attr.c    |  4 ++--
+ src/convert.c | 44 ++++++++++++++++++++++----------------------
+ src/output.c  |  4 ++--
+ 3 files changed, 26 insertions(+), 26 deletions(-)
+
+diff --git a/src/attr.c b/src/attr.c
+index 02b5c81..e2951ea 100644
+--- a/src/attr.c
++++ b/src/attr.c
+@@ -746,7 +746,7 @@ char *
+ assemble_string(char *string, int nr)
+ {
+ 
+-	char *s, tmp[12];/* Number of characters that can be in int type (including '\0') - AF */
++	char *s, tmp[20];
+ 	int i = 0, j = 0;
+ 
+ 	if (string == NULL)
+@@ -762,7 +762,7 @@ assemble_string(char *string, int nr)
+ 		}
+ 
+ 		if (string[i] != '\0') {
+-			sprintf(tmp, "%d", nr);
++			snprintf(tmp, 20, "%d", nr);
+ 			strcpy(&s[j], tmp);
+ 			j = j + strlen(tmp);
+ 		}
+diff --git a/src/convert.c b/src/convert.c
+index c76d7d6..6979365 100644
+--- a/src/convert.c
++++ b/src/convert.c
+@@ -472,7 +472,7 @@ static const int fcharsetparmtocp(int parm)
+ }
+ 
+ // Translate code page to encoding name hopefully suitable as iconv input
+-static char *cptoencoding(parm)
++static char *cptoencoding(int parm)
+ {
+     // Note that CP0 is supposed to mean current system default, which does
+     // not make any sense as a stored value, we don't handle it.
+@@ -964,10 +964,10 @@ cmd_cf (Word *w, int align, char has_param, int num)
+ 	}
+ 	else
+ 	{
+-		sprintf(str,"#%02x%02x%02x",
+-			color_table[num].r,
+-			color_table[num].g,
+-			color_table[num].b);
++		snprintf(str, 40, "#%02x%02x%02x",
++				color_table[num].r,
++				color_table[num].g,
++				color_table[num].b);
+ 		attr_push(ATTR_FOREGROUND,str);
+ 	}
+ 	return FALSE;
+@@ -993,10 +993,10 @@ cmd_cb (Word *w, int align, char has_param, int num)
+ 	}
+ 	else
+ 	{
+-		sprintf(str,"#%02x%02x%02x",
+-			color_table[num].r,
+-			color_table[num].g,
+-			color_table[num].b);
++		snprintf(str, 40, "#%02x%02x%02x",
++				color_table[num].r,
++				color_table[num].g,
++				color_table[num].b);
+ 		attr_push(ATTR_BACKGROUND,str);
+ 	}
+ 	return FALSE;
+@@ -1018,7 +1018,7 @@ cmd_fs (Word *w, int align, char has_param, int points) {
+ 	/* Note, fs20 means 10pt */
+ 	points /= 2;
+ 
+-	sprintf(str,"%d",points);
++	snprintf(str, 20, "%d", points);
+ 	attr_push(ATTR_FONTSIZE,str);
+ 
+ 	return FALSE;
+@@ -1166,7 +1166,7 @@ cmd_f (Word *w, int align, char has_param, int num)
+         {
+             // TOBEDONE: WHAT'S THIS ???
+             name = my_malloc(12);
+-            sprintf(name, "%d", num);
++            snprintf(name, 12, "%d", num);
+         }
+ 
+         /* we are going to output entities, so should not output font */
+@@ -1218,7 +1218,7 @@ cmd_highlight (Word *w, int align, char has_param, int num)
+ 	}
+ 	else
+ 	{
+-		sprintf(str,"#%02x%02x%02x",
++		snprintf(str, 40, "#%02x%02x%02x",
+ 			color_table[num].r,
+ 			color_table[num].g,
+ 			color_table[num].b);
+@@ -1373,9 +1373,9 @@ cmd_ftech (Word *w, int align, char has_param, int param) {
+ 
+ static int 
+ cmd_expand (Word *w, int align, char has_param, int param) {
+-	char str[10];
++	char str[20];
+ 	if (has_param) {
+-		sprintf(str, "%d", param/4);
++		snprintf(str, 20, "%d", param / 4);
+ 		if (!param) 
+ 			attr_pop(ATTR_EXPAND);
+ 		else 
+@@ -1394,7 +1394,7 @@ cmd_expand (Word *w, int align, char has_param, int param) {
+ 
+ static int 
+ cmd_emboss (Word *w, int align, char has_param, int param) {
+-	char str[10];
++	char str[20];
+ 	if (has_param && !param)
+ #ifdef SUPPORT_UNNESTED
+ 		attr_find_pop(ATTR_EMBOSS);
+@@ -1403,7 +1403,7 @@ cmd_emboss (Word *w, int align, char has_param, int param) {
+ #endif
+ 	else
+ 	{
+-		sprintf(str, "%d", param);
++		snprintf(str, 20, "%d", param);
+ 		attr_push(ATTR_EMBOSS, str);
+ 	}
+ 	return FALSE;
+@@ -1419,12 +1419,12 @@ cmd_emboss (Word *w, int align, char has_param, int param) {
+ 
+ static int 
+ cmd_engrave (Word *w, int align, char has_param, int param) {
+-	char str[10];
++	char str[20];
+ 	if (has_param && !param) 
+ 		attr_pop(ATTR_ENGRAVE);
+ 	else
+ 	{
+-		sprintf(str, "%d", param);
++		snprintf(str, 20, "%d", param);
+ 		attr_push(ATTR_ENGRAVE, str);
+ 	}
+ 	return FALSE;
+@@ -1976,7 +1976,7 @@ static int cmd_u (Word *w, int align, char has_param, int param) {
+ 
+ 	short	done=0;
+ 	long unicode_number = (long) param; /* On 16bit architectures int is too small to store unicode characters. - AF */
+-	char tmp[12]; /* Number of characters that can be in int type (including '\0'). If int size is greater than 4 bytes change this value. - AF */
++	char tmp[20]; /* Number of characters that can be in int type (including '\0'). If int size is greater than 4 bytes change this value. - AF */
+ 	const char *alias;
+ #define DEBUG 0
+ #if DEBUG
+@@ -2006,7 +2006,7 @@ static int cmd_u (Word *w, int align, char has_param, int param) {
+                             /* RTF spec: Unicode values beyond 32767 are represented by negative numbers */
+ 				unicode_number += 65536;
+ 			}
+-			sprintf(tmp, "%ld", unicode_number);
++			snprintf(tmp, 20, "%ld", unicode_number);
+ 
+ 			if (safe_printf(1, op->unisymbol_print, tmp)) fprintf(stderr, TOO_MANY_ARGS, "unisymbol_print");
+ 			done++;
+@@ -3369,8 +3369,8 @@ word_print_core (Word *w, int groupdepth)
+ 						case PICT_PM: ext="pmm"; break; /* OS/2 metafile=??? */
+ 						case PICT_EMF: ext="emf"; break;  /* Enhanced MetaFile */
+ 						}
+-						sprintf(picture_path, "pict%03d.%s", 
+-							picture_file_number++,ext);
++						snprintf(picture_path, 255, "pict%03d.%s",
++							picture_file_number++, ext);
+ 						pictfile=fopen(picture_path,"wb");
+ 					}
+ 
+diff --git a/src/output.c b/src/output.c
+index 86d8b5c..4cdbfa6 100644
+--- a/src/output.c
++++ b/src/output.c
+@@ -320,7 +320,7 @@ op_begin_std_fontsize (OutputPersonality *op, int size)
+ 	if (!found_std_expr) {
+ 		if (op->fontsize_begin) {
+ 			char expr[16];
+-			sprintf (expr, "%d", size);
++			snprintf(expr, 16, "%d", size);
+ 			if (safe_printf (1, op->fontsize_begin, expr)) fprintf(stderr, TOO_MANY_ARGS, "fontsize_begin");
+ 		} else {
+ 			/* If we cannot write out a change for the exact
+@@ -440,7 +440,7 @@ op_end_std_fontsize (OutputPersonality *op, int size)
+ 	if (!found_std_expr) {
+ 		if (op->fontsize_end) {
+ 			char expr[16];
+-			sprintf (expr, "%d", size);
++			snprintf(expr, 16, "%d", size);
+ 			if (safe_printf(1, op->fontsize_end, expr)) fprintf(stderr, TOO_MANY_ARGS, "fontsize_end");
+ 		} else {
+ 			/* If we cannot write out a change for the exact

unrtf.spec

@@ -0,0 +1,46 @@
+Name:       unrtf
+Summary:    RTF (Rich Text Format) to other formats converter
+Version:    0.21.9
+Release:    1
+License:    GPLv3+
+URL:        https://www.gnu.org/software/unrtf/unrtf.html
+Source0:    http://ftp.gnu.org/gnu/unrtf/unrtf-%{version}.tar.gz
+# http://hg.savannah.gnu.org/hgweb/unrtf/rev/3b16893a6406
+Patch0001:           0001-Replace-all-instances-of-sprintf-with-snprintf-and-a.patch
+BuildRequires:       gcc   automake
+%description
+UnRTF is a command-line program written in C which converts documents in
+Rich Text Format (.rtf) to HTML, LaTeX, troff macros, and RTF itself.
+Converting to HTML, it supports a number of features of Rich Text Format:
+    * Changes in the text's font, size, weight (bold), and slant (italic)
+    * Underlines and strikethroughs
+    * Partial support for text shadowing, outlining, embossing, or engraving
+    * Capitalizations
+    * Superscripts and subscripts
+    * Expanded and condensed text
+    * Changes in the foreground and background colors
+    * Conversion of special characters to HTML entities
+
+%prep
+%autosetup -p1
+
+%build
+./bootstrap
+%configure
+make %{?_smp_mflags}
+
+%install
+%make_install
+
+%check
+make check
+
+%files
+%doc README ChangeLog COPYING AUTHORS NEWS
+%{_bindir}/%{name}
+%{_mandir}/man1/*
+%{_datadir}/%{name}/
+
+%changelog
+* Mon Aug 3 2020 fanjiachen <fanjiachen3@huawei.com> - 0.21.9-1
+- package init

unrtf.yaml

@@ -0,0 +1,4 @@
+version_control: hg
+src_repo: http://hg.savannah.gnu.org/hgweb/unrtf
+tag_prefix: "release_"
+separator: "."