code:
Fix CVE-2018-14044 and CVE-2018-14045:

https://gitlab.com/soundtouch/soundtouch/issues/7
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14044
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14045

Patch copied from upstream source repository:

https://gitlab.com/soundtouch/soundtouch/commit/107f2c5d201a4dfea1b7f15c5957ff2ac9e5f260

From 107f2c5d201a4dfea1b7f15c5957ff2ac9e5f260 Mon Sep 17 00:00:00 2001
From: oparviainen <oparviai@iki.fi>
Date: Sun, 12 Aug 2018 20:00:56 +0300
Subject: [PATCH] Replaced illegal-number-of-channel assertions with run-time
 exception

---
 include/FIFOSamplePipe.h               | 12 ++++++++++++
 include/STTypes.h                      |  3 +++
 source/SoundTouch/FIFOSampleBuffer.cpp |  3 ++-
 source/SoundTouch/RateTransposer.cpp   |  5 ++---
 source/SoundTouch/SoundTouch.cpp       |  8 ++------
 source/SoundTouch/TDStretch.cpp        |  5 ++---
 6 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/include/FIFOSamplePipe.h b/include/FIFOSamplePipe.h
index 4ec9275..b08f836 100644
--- a/include/FIFOSamplePipe.h
+++ b/include/FIFOSamplePipe.h
@@ -51,6 +51,18 @@ namespace soundtouch
 /// Abstract base class for FIFO (first-in-first-out) sample processing classes.
 class FIFOSamplePipe
 {
+protected:
+
+    bool verifyNumberOfChannels(int nChannels) const
+    {
+        if ((nChannels > 0) && (nChannels <= SOUNDTOUCH_MAX_CHANNELS))
+        {
+            return true;
+        }
+        ST_THROW_RT_ERROR("Error: Illegal number of channels");
+        return false;
+    }
+
 public:
     // virtual default destructor
     virtual ~FIFOSamplePipe() {}
diff --git a/include/STTypes.h b/include/STTypes.h
index 03e7e07..862505e 100644
--- a/include/STTypes.h
+++ b/include/STTypes.h
@@ -56,6 +56,9 @@ typedef unsigned long   ulong;

 namespace soundtouch
 {
+    /// Max allowed number of channels
+    #define SOUNDTOUCH_MAX_CHANNELS     16
+
     /// Activate these undef's to overrule the possible sampletype
     /// setting inherited from some other header file:
     //#undef SOUNDTOUCH_INTEGER_SAMPLES
diff --git a/source/SoundTouch/FIFOSampleBuffer.cpp b/source/SoundTouch/FIFOSampleBuffer.cpp
index f0d5e42..706e869 100644
--- a/source/SoundTouch/FIFOSampleBuffer.cpp
+++ b/source/SoundTouch/FIFOSampleBuffer.cpp
@@ -73,7 +73,8 @@ void FIFOSampleBuffer::setChannels(int numChannels)
 {
     uint usedBytes;

-    assert(numChannels > 0);
+    if (!verifyNumberOfChannels(numChannels)) return;
+
     usedBytes = channels * samplesInBuffer;
     channels = (uint)numChannels;
     samplesInBuffer = usedBytes / channels;
diff --git a/source/SoundTouch/RateTransposer.cpp b/source/SoundTouch/RateTransposer.cpp
index 8b66be3..d115a4c 100644
--- a/source/SoundTouch/RateTransposer.cpp
+++ b/source/SoundTouch/RateTransposer.cpp
@@ -179,11 +179,10 @@ void RateTransposer::processSamples(const SAMPLETYPE *src, uint nSamples)
 // Sets the number of channels, 1 = mono, 2 = stereo
 void RateTransposer::setChannels(int nChannels)
 {
-    assert(nChannels > 0);
+    if (!verifyNumberOfChannels(nChannels) ||
+        (pTransposer->numChannels == nChannels)) return;

-    if (pTransposer->numChannels == nChannels) return;
     pTransposer->setChannels(nChannels);
-
     inputBuffer.setChannels(nChannels);
     midBuffer.setChannels(nChannels);
     outputBuffer.setChannels(nChannels);
diff --git a/source/SoundTouch/SoundTouch.cpp b/source/SoundTouch/SoundTouch.cpp
index 7b6756b..06bdd56 100644
--- a/source/SoundTouch/SoundTouch.cpp
+++ b/source/SoundTouch/SoundTouch.cpp
@@ -139,18 +139,14 @@ uint SoundTouch::getVersionId()
 // Sets the number of channels, 1 = mono, 2 = stereo
 void SoundTouch::setChannels(uint numChannels)
 {
-    /*if (numChannels != 1 && numChannels != 2)
-    {
-        //ST_THROW_RT_ERROR("Illegal number of channels");
-        return;
-    }*/
+    if (!verifyNumberOfChannels(numChannels)) return;
+
     channels = numChannels;
     pRateTransposer->setChannels((int)numChannels);
     pTDStretch->setChannels((int)numChannels);
 }

-
 // Sets new rate control value. Normal rate = 1.0, smaller values
 // represent slower rate, larger faster rates.
 void SoundTouch::setRate(double newRate)
diff --git a/source/SoundTouch/TDStretch.cpp b/source/SoundTouch/TDStretch.cpp
index 149cdb9..be2dc88 100644
--- a/source/SoundTouch/TDStretch.cpp
+++ b/source/SoundTouch/TDStretch.cpp
@@ -588,9 +588,8 @@ void TDStretch::setTempo(double newTempo)
 // Sets the number of channels, 1 = mono, 2 = stereo
 void TDStretch::setChannels(int numChannels)
 {
-    assert(numChannels > 0);
-    if (channels == numChannels) return;
-//    assert(numChannels == 1 || numChannels == 2);
+    if (!verifyNumberOfChannels(numChannels) ||
+        (channels == numChannels)) return;

     channels = numChannels;
     inputBuffer.setChannels(channels);
--
2.18.0


code:
--- steghide-0.5.1/src/AuData.h
+++ steghide-0.5.1/src/AuData.h
@@ -26,22 +26,22 @@

 // AuMuLawAudioData
 typedef AudioDataImpl<AuMuLaw,BYTE> AuMuLawAudioData ;
-inline BYTE AuMuLawAudioData::readValue (BinaryIO* io) const { return (io->read8()) ; }
-inline void AuMuLawAudioData::writeValue (BinaryIO* io, BYTE v) const { io->write8(v) ; }
+template<> inline BYTE AuMuLawAudioData::readValue (BinaryIO* io) const { return (io->read8()) ; }
+template<> inline void AuMuLawAudioData::writeValue (BinaryIO* io, BYTE v) const { io->write8(v) ; }

 // AuPCM8AudioData
 typedef AudioDataImpl<AuPCM8,SBYTE> AuPCM8AudioData ;
-inline SBYTE AuPCM8AudioData::readValue (BinaryIO* io) const { return ((SBYTE) io->read8()) ; }
-inline void AuPCM8AudioData::writeValue (BinaryIO* io, SBYTE v) const { io->write8((BYTE) v) ; }
+template<> inline SBYTE AuPCM8AudioData::readValue (BinaryIO* io) const { return ((SBYTE) io->read8()) ; }
+template<> inline void AuPCM8AudioData::writeValue (BinaryIO* io, SBYTE v) const { io->write8((BYTE) v) ; }

 // AuPCM16AudioData
 typedef AudioDataImpl<AuPCM16,SWORD16> AuPCM16AudioData ;
-inline SWORD16 AuPCM16AudioData::readValue (BinaryIO* io) const { return ((SWORD16) io->read16_be()) ; }
-inline void AuPCM16AudioData::writeValue (BinaryIO* io, SWORD16 v) const { io->write16_be((UWORD16) v) ; }
+template<> inline SWORD16 AuPCM16AudioData::readValue (BinaryIO* io) const { return ((SWORD16) io->read16_be()) ; }
+template<> inline void AuPCM16AudioData::writeValue (BinaryIO* io, SWORD16 v) const { io->write16_be((UWORD16) v) ; }

 // AuPCM32AudioData
 typedef AudioDataImpl<AuPCM32,SWORD32> AuPCM32AudioData ;
-inline SWORD32 AuPCM32AudioData::readValue (BinaryIO* io) const { return ((SWORD32) io->read32_be()) ; }
-inline void AuPCM32AudioData::writeValue (BinaryIO* io, SWORD32 v) const { io->write32_be((UWORD32) v) ; }
+template<> inline SWORD32 AuPCM32AudioData::readValue (BinaryIO* io) const { return ((SWORD32) io->read32_be()) ; }
+template<> inline void AuPCM32AudioData::writeValue (BinaryIO* io, SWORD32 v) const { io->write32_be((UWORD32) v) ; }

 #endif // ndef SH_AUDATA_H
--- steghide-0.5.1/src/AuSampleValues.cc
+++ steghide-0.5.1/src/AuSampleValues.cc
@@ -21,17 +21,17 @@
 #include "AuSampleValues.h"

 // AuMuLawSampleValue
-const BYTE AuMuLawSampleValue::MinValue = 0 ;
-const BYTE AuMuLawSampleValue::MaxValue = BYTE_MAX ;
+template<> const BYTE AuMuLawSampleValue::MinValue = 0 ;
+template<> const BYTE AuMuLawSampleValue::MaxValue = BYTE_MAX ;

 // AuPCM8SampleValue
-const SBYTE AuPCM8SampleValue::MinValue = SBYTE_MIN ;
-const SBYTE AuPCM8SampleValue::MaxValue = SBYTE_MAX ;
+template<> const SBYTE AuPCM8SampleValue::MinValue = SBYTE_MIN ;
+template<> const SBYTE AuPCM8SampleValue::MaxValue = SBYTE_MAX ;

 // AuPCM16SampleValue
-const SWORD16 AuPCM16SampleValue::MinValue = SWORD16_MIN ;
-const SWORD16 AuPCM16SampleValue::MaxValue = SWORD16_MAX ;
+template<> const SWORD16 AuPCM16SampleValue::MinValue = SWORD16_MIN ;
+template<> const SWORD16 AuPCM16SampleValue::MaxValue = SWORD16_MAX ;

 // AuPCM32SampleValue
-const SWORD32 AuPCM32SampleValue::MinValue = SWORD32_MIN ;
-const SWORD32 AuPCM32SampleValue::MaxValue = SWORD32_MAX ;
+template<> const SWORD32 AuPCM32SampleValue::MinValue = SWORD32_MIN ;
+template<> const SWORD32 AuPCM32SampleValue::MaxValue = SWORD32_MAX ;
--- steghide-0.5.1/src/Graph.cc
+++ steghide-0.5.1/src/Graph.cc
@@ -18,6 +18,7 @@
  *
  */

+#include <climits>
 #include <ctime>
 #include <list>
 #include <map>

license: mit


code:
The METIS interface from Scotch may segfault if passed NULL to indicate a
default parameter, so use the older calling style.

--- a/SRC/get_perm_c.c	2014-05-16 23:38:30.070835316 -0500
+++ b/SRC/get_perm_c.c	2014-05-16 23:39:04.582836211 -0500
@@ -70,11 +70,13 @@
 #else

     /* Earlier version 3.x.x */
-    /* METIS_NodeND(&nm, b_colptr, b_rowind, &numflag, metis_options,
-       perm, iperm);*/
+    METIS_NodeND(&nm, b_colptr, b_rowind, &numflag, metis_options,
+                 perm, iperm);

     /* Latest version 4.x.x */
+#if 0
     METIS_NodeND(&nm, b_colptr, b_rowind, NULL, NULL, perm, iperm);
+#endif

     /*check_perm_dist("metis perm",  n, perm);*/
 #endif


code:
Borrowed from Debian.

--- swish-e-2.4.7/src/parser.c	2009-04-05 03:58:32.000000000 +0200
+++ swish-e-2.4.7/src/parser.c	2013-06-11 13:53:08.196559035 +0200
@@ -1760,7 +1760,7 @@
     va_start(args, msg);
     vsnprintf(str, 1000, msg, args );
     va_end(args);
-    xmlParserError(parse_data->ctxt, str);
+    xmlParserError(parse_data->ctxt, "%s", str);
 }

 static void warning(void *data, const char *msg, ...)
@@ -1772,7 +1772,7 @@
     va_start(args, msg);
     vsnprintf(str, 1000, msg, args );
     va_end(args);
-    xmlParserWarning(parse_data->ctxt, str);
+    xmlParserWarning(parse_data->ctxt, "%s", str);
 }

--- swish-e-2.4.7/src/result_output.c	2009-04-05 03:58:32.000000000 +0200
+++ swish-e-2.4.7/src/result_output.c	2013-06-11 13:53:38.593550825 +0200
@@ -752,7 +752,7 @@
             s = (char *) emalloc(MAXWORDLEN + 1);
             n = strftime(s, (size_t) MAXWORDLEN, fmt, localtime(&(pv->value.v_date)));
             if (n && f)
-                fprintf(f, s);
+                fprintf(f, "%s", s);
             efree(s);
         }
         break;


code:
From http://swish-e.org/archive/2015-09/13295.html

--- a/src/compress.c
+++ a/src/compress.c
@@ -995,7 +995,7 @@ void    remove_worddata_longs(unsigned char *worddata,int *sz_worddata)
             progerr("Internal error in remove_worddata_longs");

         /* dst may be smaller than src. So move the data */
-        memcpy(dst,src,data_len);
+        memmove(dst,src,data_len);

         /* Increase pointers */
         src += data_len;
--- a/src/headers.c
+++ a/src/headers.c
@@ -280,7 +280,7 @@ static SWISH_HEADER_VALUE fetch_single_header( IndexFILE *indexf, HEADER_MAP *he

         case SWISH_NUMBER:
         case SWISH_BOOL:
-            value.number = *(unsigned long *) data_pointer;
+            value.number = *(unsigned int *) data_pointer;

             /* $$$ Ugly hack alert! */
             /* correct for removed files */
--- a/src/swishspider
+++ a/src/swishspider
@@ -27,6 +27,7 @@ use LWP::UserAgent;
 use HTTP::Status;
 use HTML::Parser 3.00;
 use HTML::LinkExtor;
+use Encode;

     if (scalar(@ARGV) != 2) {
         print STDERR "Usage: $0 localpath url\n";
@@ -94,7 +95,7 @@ use HTML::LinkExtor;
     # Don't allow links above the base
     $URI::ABS_REMOTE_LEADING_DOTS = 1;

-    $p->parse( $$content_ref );
+    $p->parse( decode_utf8 $$content_ref );
     close( LINKS );

     exit;


code:
Downloaded from
https://github.com/synfig/synfig/commit/b9c3b73ee35b83c4d9183c800809040cef98b2f2.patch

Without this patch the UI of Synfig Studio (when built with the latest version
of GTK) displays very large buttons in the header of every frame.

This patch can be removed with the next release.

From b9c3b73ee35b83c4d9183c800809040cef98b2f2 Mon Sep 17 00:00:00 2001
From: caryoscelus <caryoscelus@gmx.com>
Date: Wed, 25 Jan 2017 18:34:39 +0300
Subject: [PATCH] Fix dock drop area size

Fixes #227

By using Frame instead of Button we avoid intrusive Gtk themes
from forcing huge drop area size.
---
 synfig-studio/src/gui/docks/dockdroparea.cpp | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/gui/docks/dockdroparea.cpp b/synfig-studio/src/gui/docks/dockdroparea.cpp
index 0f8936fdb..e012282f0 100644
--- a/src/gui/docks/dockdroparea.cpp
+++ b/src/gui/docks/dockdroparea.cpp
@@ -35,7 +35,7 @@
 #include "app.h"
 #include "docks/dockdroparea.h"
 #include "docks/dockmanager.h"
-#include <gtkmm/button.h>
+#include <gtkmm/frame.h>

 #endif

@@ -61,10 +61,15 @@ DockDropArea::DockDropArea(Gtk::Widget *target):
 	std::vector<Gtk::TargetEntry> listTargets;
 	listTargets.push_back( Gtk::TargetEntry("SYNFIG_DOCK") );

-	Gtk::Button *button_left   = manage(new Gtk::Button());
-	Gtk::Button *button_right  = manage(new Gtk::Button());
-	Gtk::Button *button_top    = manage(new Gtk::Button());
-	Gtk::Button *button_bottom = manage(new Gtk::Button());
+	Gtk::Frame *button_left   = manage(new Gtk::Frame());
+	Gtk::Frame *button_right  = manage(new Gtk::Frame());
+	Gtk::Frame *button_top    = manage(new Gtk::Frame());
+	Gtk::Frame *button_bottom = manage(new Gtk::Frame());
+
+	button_left->set_size_request(20, 10);
+	button_right->set_size_request(20, 10);
+	button_top->set_size_request(20, 10);
+	button_bottom->set_size_request(20, 10);

 	button_left->drag_dest_set(listTargets);
 	button_right->drag_dest_set(listTargets);


code:
diff --git a/lib/t1lib/parseAFM.c b/lib/t1lib/parseAFM.c
index 6a31d7f..ba64541 100644
--- a/lib/t1lib/parseAFM.c
+++ b/lib/t1lib/parseAFM.c
@@ -199,7 +199,9 @@ static char *token(stream)
     idx = 0;

     while (ch != EOF && ch != ' ' && ch != CR  && ch != LF &&
-	   ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'){
+	   ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'
+     && idx < (MAX_NAME -1))
+    {
       ident[idx++] = ch;
       ch = fgetc(stream);
     } /* while */
@@ -235,7 +237,7 @@ static char *linetoken(stream)
     while ((ch = fgetc(stream)) == ' ' || ch == '\t' );

     idx = 0;
-    while (ch != EOF && ch != CR  && ch != LF && ch != CTRL_Z)
+    while (ch != EOF && ch != CR  && ch != LF && ch != CTRL_Z && idx < (MAX_NAME - 1))
     {
         ident[idx++] = ch;
         ch = fgetc(stream);


code:
Description: Don't lookup previous point if there isn't any
Author: Marc Deslauriers <marc.deslauriers@canonical.com>
Forwarded: no

Index: t1lib-5.1.2/lib/type1/type1.c
===================================================================
--- t1lib-5.1.2.orig/lib/type1/type1.c	2011-12-13 14:24:14.280965637 -0600
+++ t1lib-5.1.2/lib/type1/type1.c	2011-12-13 14:25:25.893320747 -0600
@@ -1700,6 +1700,7 @@
   long pindex = 0;

   /* compute hinting for previous segment! */
+  if (ppoints == NULL) Error0i("RLineTo: No previous point!\n");
   FindStems( currx, curry, currx-ppoints[numppoints-2].x, curry-ppoints[numppoints-2].y, dx, dy);

   /* Allocate a new path point and pre-setup data */
@@ -1728,6 +1729,7 @@
   long pindex = 0;

   /* compute hinting for previous point! */
+  if (ppoints == NULL) Error0i("RRCurveTo: No previous point!\n");
   FindStems( currx, curry, currx-ppoints[numppoints-2].x, curry-ppoints[numppoints-2].y, dx1, dy1);

   /* Allocate three new path points and pre-setup data */
@@ -1903,6 +1905,7 @@
     FindStems( currx, curry, 0, 0, dx, dy);
   }
   else {
+    if (ppoints == NULL) Error0i("RMoveTo: No previous point!\n");
     FindStems( currx, curry, ppoints[numppoints-2].x, ppoints[numppoints-2].y, dx, dy);
   }


code:
This patch is needed in order to build Guix on a Btrfs file system.

From da922703282b0d3b8837a99a9c7fdd32f1d20d49 Mon Sep 17 00:00:00 2001
From: Mark H Weaver <mhw@netris.org>
Date: Tue, 9 Jan 2018 20:16:14 -0500
Subject: [PATCH] Remove nonportable check for files containing only zeroes.

This check benefitted only one unlikely case (large files containing
only zeroes, on systems that do not support SEEK_HOLE) and was based
on an assumption about file system behavior that is not mandated by
POSIX and no longer holds in practice, namely that for sufficiently
large files, (st_blocks == 0) implies that the file contains only
zeroes.  Examples of file systems that violate this assumption include
Linux's /proc file system and Btrfs.

* src/sparse.c (sparse_scan_file_wholesparse): Remove this function.
(sparse_scan_file_seek): Remove the initial check for files containing
only zeroes.
---
 src/sparse.c | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/src/sparse.c b/src/sparse.c
index d41c0ea..3de6560 100644
--- a/src/sparse.c
+++ b/src/sparse.c
@@ -261,26 +261,6 @@ sparse_scan_file_raw (struct tar_sparse_file *file)
   return tar_sparse_scan (file, scan_end, NULL);
 }

-static bool
-sparse_scan_file_wholesparse (struct tar_sparse_file *file)
-{
-  struct tar_stat_info *st = file->stat_info;
-  struct sp_array sp = {0, 0};
-
-  /* Note that this function is called only for truly sparse files of size >= 1
-     block size (checked via ST_IS_SPARSE before).  See the thread
-     http://www.mail-archive.com/bug-tar@gnu.org/msg04209.html for more info */
-  if (ST_NBLOCKS (st->stat) == 0)
-    {
-      st->archive_file_size = 0;
-      sp.offset = st->stat.st_size;
-      sparse_add_map (st, &sp);
-      return true;
-    }
-
-  return false;
-}
-
 #ifdef SEEK_HOLE
 /* Try to engage SEEK_HOLE/SEEK_DATA feature. */
 static bool
@@ -343,10 +323,6 @@ sparse_scan_file_seek (struct tar_sparse_file *file)
 static bool
 sparse_scan_file (struct tar_sparse_file *file)
 {
-  /* always check for completely sparse files */
-  if (sparse_scan_file_wholesparse (file))
-    return true;
-
   switch (hole_detection)
     {
     case HOLE_DETECTION_DEFAULT:
--
2.15.1


code:
Skip tests that rely on unlinkat(2) behavior that varies between
kernel versions and is unspecified.

See <http://bugs.gnu.org/20597>
and <http://lists.gnu.org/archive/html/bug-tar/2015-06/msg00000.html>.

--- tar-1.28/tests/testsuite	2014-07-27 22:35:27.000000000 +0200
+++ tar-1.28/tests/testsuite	2015-06-16 00:21:16.906380739 +0200
@@ -34680,6 +34680,7 @@ find .
 )"
 at_fn_check_prepare_notrace 'an embedded newline' "remfiles08a.at:31"
 ( $at_check_trace;
+exit 77
 mkdir gnu
 (cd gnu
 TEST_TAR_FORMAT=gnu
@@ -34762,6 +34763,7 @@ find .
 )"
 at_fn_check_prepare_notrace 'an embedded newline' "remfiles08b.at:36"
 ( $at_check_trace;
+exit 77
 mkdir gnu
 (cd gnu
 TEST_TAR_FORMAT=gnu
@@ -34850,6 +34852,7 @@ find .
 )"
 at_fn_check_prepare_notrace 'a `...` command substitution' "remfiles08c.at:31"
 ( $at_check_trace;
+exit 77
 mkdir gnu
 (cd gnu
 TEST_TAR_FORMAT=gnu


code:
Install everything in PREFIX, set EXTRA_PATH to find it there.

--- ./Makefile.in~	2016-02-06 01:29:16.595090365 +0100
+++ ./Makefile.in	2016-02-06 09:29:04.286008931 +0100
@@ -133,9 +133,9 @@
 # require for testing here (like TCLX_LIBRARY).
 #========================================================================

-EXTRA_PATH	= $(top_builddir):$(TCL_BIN_DIR)
+EXTRA_PATH	= $(top_builddir):$(TCL_BIN_DIR):$(libdir)
 #EXTRA_PATH     = $(top_builddir):$(TCL_BIN_DIR):$(TK_BIN_DIR)
-TCLLIBPATH      = $(top_builddir)
+TCLLIBPATH      = $(pkglibdir)
 TCLSH_ENV	= TCL_LIBRARY=`@CYGPATH@ $(TCL_SRC_DIR)/library` \
 		  @LD_LIBRARY_PATH_VAR@="$(EXTRA_PATH):$(@LD_LIBRARY_PATH_VAR@)" \
 		  PATH="$(EXTRA_PATH):$(PATH)" \


code:
--- tests/commands.at
+++ tests/commands.at
@@ -921,26 +921,27 @@ AT_CLEANUP
 TCSH_UNTESTED([notify])

-AT_SETUP([onintr])
-
-AT_DATA([onintr.csh],
-[[onintr label
-kill -INT $$
-echo fail
-label:
-echo caught
-onintr -
-kill -INT $$
-echo OK
-onintr -
-kill -INT $$
-]])
-AT_CHECK([tcsh -f onintr.csh], ,
-[caught
-OK
-])
-
-AT_CLEANUP
+# XXX This test does not work: "fail" is printed on stdout.
+#AT_SETUP([onintr])
+#
+#AT_DATA([onintr.csh],
+#[[onintr label
+#kill -INT $$
+#echo fail
+#label:
+#echo caught
+#onintr -
+#kill -INT $$
+#echo OK
+#onintr -
+#kill -INT $$
+#]])
+#AT_CHECK([tcsh -f onintr.csh], ,
+#[caught
+#OK
+#])
+#
+#AT_CLEANUP

 AT_SETUP([popd])
--- tests/lexical.at
+++ tests/lexical.at
@@ -35,9 +35,9 @@ AT_CHECK([if [ ! -t 0 ]; then exit 77; fi],, [Skipping comment tests])
 AT_CHECK([echo 'echo OK@%:@comment' | tcsh -f], , [OK
 ])

-AT_CHECK([tcsh -f -c 'echo @%:@no comment'], ,
-[@%:@no comment
-])
+#AT_CHECK([tcsh -f -c 'echo @%:@no comment'], ,
+#[@%:@no comment
+#])

 AT_DATA([comment2.csh],
 [[echo testing...@%:@\
@@ -567,10 +567,10 @@ run=3
# Adapt to changes in sed 4.3:
# https://github.com/tcsh-org/tcsh/commit/2ad4fc1705893207598ed5cd21713ddf3f17bba0
 ]])
 AT_DATA([uniformity_test.csh],
 [[
-set SERVICE_NAME_LOG = `cat batchsystem.properties | grep '^jdbc_url' | sed -ne 's/^[^=]*=[^@]*@[:blank:]*\([^$]*\)$/\1/p' | perl -pe 's/\s//g'  |  perl -pe 's/\)/\\\)/g' | perl -pe 's/\(/\\\(/g'`
+set SERVICE_NAME_LOG = `cat batchsystem.properties | grep '^jdbc_url' | sed -ne 's/^[^=]*=[^@]*@[[:blank:]]*\([^$]*\)$/\1/p' | perl -pe 's/\s//g'  |  perl -pe 's/\)/\\\)/g' | perl -pe 's/\(/\\\(/g'`
 echo -n "$SERVICE_NAME_LOG" > ./output1

-cat batchsystem.properties | grep '^jdbc_url' | sed -ne 's/^[^=]*=[^@]*@[:blank:]*\([^$]*\)$/\1/p' | perl -pe 's/\s//g'  |  perl -pe 's/\)/\\\)/g' | perl -pe 's/\(/\\\(/g' > ./output2
+cat batchsystem.properties | grep '^jdbc_url' | sed -ne 's/^[^=]*=[^@]*@[[:blank:]]*\([^$]*\)$/\1/p' | perl -pe 's/\s//g'  |  perl -pe 's/\)/\\\)/g' | perl -pe 's/\(/\\\(/g' > ./output2

 diff -uprN ./output1 ./output2 >& /dev/null

@@ -587,7 +587,7 @@ AT_DATA([quoting_result_test.csh],
 echo "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP\)(HOST=db\)(PORT=1521\)\)(CONNECT_DATA=(SERVER=DEDICATED\)(SERVICE_NAME=bns03\)\)\)" > ./expected_result

 set string = "jdbc_url=jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=db)(PORT=1521))(CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=bns03)))"
-set SERVICE_NAME_LOG  = `echo "$string" | grep '^jdbc_url' | sed -ne 's/^[^=]*=[^@]*@[:blank:]*\([^$]*\)$/\1/p' | perl -pe 's/\)/\\\)/g'`
+set SERVICE_NAME_LOG  = `echo "$string" | grep '^jdbc_url' | sed -ne 's/^[^=]*=[^@]*@[[:blank:]]*\([^$]*\)$/\1/p' | perl -pe 's/\)/\\\)/g'`

 echo "$SERVICE_NAME_LOG" > ./actual_result

--- tests/subst.at
+++ tests/subst.at
@@ -54,7 +54,7 @@ AT_CHECK([echo 'echo ~; echo "$HOME"' | tcsh -f | uniq | wc -l | tr -d ' \t'],
 , [1
 ])

-AT_CHECK([echo "echo ~$(id -un)/foo; echo \"$HOME/foo\"" | tcsh -f | uniq dnl
+AT_CHECK([echo "echo ~$(id -un)/foo; echo \"$HOME/foo\"" | tcsh -f | grep -v "/homeless-shelter" | uniq dnl
 	  | wc -l | tr -d ' \t'], , [1
 ])

--- tests/variables.at
+++ tests/variables.at
@@ -666,7 +666,8 @@ set listflags=(-xA $cwd/args.sh)
 ls-F -something .
 ]])
 AT_DATA([args.sh],
-[[echo "$@"
+[[#!/bin/sh
+echo "$@"
 ]])
 chmod a+x args.sh
 AT_CHECK([tcsh -f listflags.csh], ,
@@ -704,9 +705,9 @@ AT_CHECK([tcsh -f mail.csh], ,
# This test fails by trying to change to the build user's home
# directory, which does not exist.
 AT_CLEANUP

-AT_SETUP([$ cdtohome])
-AT_CHECK([tcsh -f -c 'cd'], 0)
-AT_CLEANUP
+#AT_SETUP([$ cdtohome])
+#AT_CHECK([tcsh -f -c 'cd'], 0)
+#AT_CLEANUP
 AT_SETUP([$ noimplicithome])
 AT_CHECK([tcsh -f -c 'unset cdtohome; cd'], 1, , [cd: Too few arguments.
 ])
@@ -728,55 +729,57 @@ TCSH_UNTESTED([$ oid])
 AT_SETUP([$ owd])

 AT_DATA([owd.csh],
-[[echo $owd
-cd /
+[[mkdir -p a/b/
 echo $owd
-pushd /bin
+cd a
+echo $owd
+pushd b
 echo $owd
 popd
 echo $owd
 ]])
-AT_CHECK([tcsh -f owd.csh | sed "s,$PWD,CWD,"], ,
+AT_CHECK([tcsh -f owd.csh | sed "s,$PWD,CWD,g"], ,
 [
 CWD
-/bin / @&t@
-/
-/ @&t@
-/bin
+CWD/a/b CWD/a @&t@
+CWD/a
+CWD/a @&t@
+CWD/a/b
 ])

 AT_CLEANUP

-AT_SETUP([$ path])
-
-mkdir subdir
-AT_DATA([script.sh],
-[[echo home
-]])
-AT_DATA([subdir/script.sh],
-[[echo subdir
-]])
-chmod a+x script.sh subdir/script.sh
-AT_DATA([path.csh],
-[[echo $?path
-set path=(. subdir)
-script.sh
-set path=(subdir .)
-script.sh
-printenv PATH
-setenv PATH :foo::bar:
-echo $path
-]])
-AT_CHECK([tcsh -f path.csh], ,
-[1
-home
-subdir
-subdir:.
-. foo . bar .
-])
-
-AT_CLEANUP
+# XXX Not sure why this does not work. "home" is printed out twice on stdout.
+#AT_SETUP([$ path])
+#
+#mkdir subdir
+#AT_DATA([script.sh],
+#[[echo home
+#]])
+#AT_DATA([subdir/script.sh],
+#[[echo subdir
+#]])
+#chmod a+x script.sh subdir/script.sh
+#AT_DATA([path.csh],
+#[[echo $?path
+#set path=(. subdir)
+#script.sh
+#set path=(subdir .)
+#script.sh
+#printenv PATH
+#setenv PATH :foo::bar:
+#echo $path
+#]])
+#AT_CHECK([tcsh -f path.csh], ,
+#[1
+#home
+#subdir
+#subdir:.
+#. foo . bar .
+#])
+#
+#AT_CLEANUP

 AT_SETUP([$ printexitvalue])


code:
Fix out-of-bounds read in c_substitute():

http://seclists.org/oss-sec/2016/q4/612

Patch copied from upstream source repository:

https://github.com/tcsh-org/tcsh/commit/6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596

From 6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596 Mon Sep 17 00:00:00 2001
From: christos <christos>
Date: Fri, 2 Dec 2016 16:59:28 +0000
Subject: [PATCH] Fix out of bounds read (Brooks Davis) (reproduce by starting
 tcsh and hitting tab at the prompt)

---
 ed.chared.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ed.chared.c b/ed.chared.c
index 1277e53..310393e 100644
--- ed.chared.c
+++ ed.chared.c
@@ -750,7 +750,7 @@ c_substitute(void)
     /*
      * If we found a history character, go expand it.
      */
-    if (HIST != '\0' && *p == HIST)
+    if (p >= InputBuf && HIST != '\0' && *p == HIST)
 	nr_exp = c_excl(p);
     else
         nr_exp = 0;


code:
Add support for '-h' (help).

https://github.com/PaulStoffregen/teensy_loader_cli/pull/26

---
 teensy_loader_cli.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/teensy_loader_cli.c b/teensy_loader_cli.c
index d4a6cc5..0a06209 100644
--- a/teensy_loader_cli.c
+++ b/teensy_loader_cli.c
@@ -37,7 +37,8 @@ void usage(const char *err)
 {
 	if(err != NULL) fprintf(stderr, "%s\n\n", err);
 	fprintf(stderr,
-		"Usage: teensy_loader_cli --mcu=<MCU> [-w] [-h] [-n] [-b] [-v] <file.hex>\n"
+		"Usage: teensy_loader_cli --mcu=<MCU> [-h] [-w] [-n] [-b] [-v] <file.hex>\n"
+		"\t-h : Print this help message\n"
 		"\t-w : Wait for device to appear\n"
 		"\t-r : Use hard reboot if device not online\n"
 		"\t-s : Use soft reboot if device not online (Teensy3.x only)\n"
@@ -1081,6 +1082,7 @@ void parse_flag(char *arg)
 	int i;
 	for(i=1; arg[i]; i++) {
 		switch(arg[i]) {
+			case 'h': usage(NULL); break;
 			case 'w': wait_for_device_to_appear = 1; break;
 			case 'r': hard_reboot_device = 1; break;
 			case 's': soft_reboot_device = 1; break;
--
2.7.4


code:
Downloaded from https://anonscm.debian.org/cgit/pkg-games/teeworlds.git/plain/debian/patches/new-wavpack.patch.

This patch lets us build teeworlds with wavpack 5.1.0.

--- a/src/engine/client/sound.cpp
+++ b/src/engine/client/sound.cpp
@@ -328,17 +328,14 @@ void CSound::RateConvert(int SampleID)
 	pSample->m_NumFrames = NumFrames;
 }

-int CSound::ReadData(void *pBuffer, int Size)
-{
-	return io_read(ms_File, pBuffer, Size);
-}
-
 int CSound::LoadWV(const char *pFilename)
 {
 	CSample *pSample;
 	int SampleID = -1;
 	char aError[100];
 	WavpackContext *pContext;
+	char aWholePath[1024];
+	IOHANDLE File;

 	// don't waste memory on sound when we are stress testing
 	if(g_Config.m_DbgStress)
@@ -351,19 +348,23 @@ int CSound::LoadWV(const char *pFilename
 	if(!m_pStorage)
 		return -1;

-	ms_File = m_pStorage->OpenFile(pFilename, IOFLAG_READ, IStorage::TYPE_ALL);
-	if(!ms_File)
+	File = m_pStorage->OpenFile(pFilename, IOFLAG_READ, IStorage::TYPE_ALL, aWholePath, sizeof(aWholePath));
+	if(!File)
 	{
 		dbg_msg("sound/wv", "failed to open file. filename='%s'", pFilename);
 		return -1;
 	}
+	else
+	{
+		io_close(File);
+	}

 	SampleID = AllocID();
 	if(SampleID < 0)
 		return -1;
 	pSample = &m_aSamples[SampleID];

-	pContext = WavpackOpenFileInput(ReadData, aError);
+	pContext = WavpackOpenFileInput(aWholePath, aError, OPEN_2CH_MAX, 0);
 	if (pContext)
 	{
 		int m_aSamples = WavpackGetNumSamples(pContext);
@@ -419,9 +420,6 @@ int CSound::LoadWV(const char *pFilename
 		dbg_msg("sound/wv", "failed to open %s: %s", pFilename, aError);
 	}

-	io_close(ms_File);
-	ms_File = NULL;
-
 	if(g_Config.m_Debug)
 		dbg_msg("sound/wv", "loaded %s", pFilename);

@@ -527,7 +525,5 @@ void CSound::StopAll()
 	lock_unlock(m_SoundLock);
 }

-IOHANDLE CSound::ms_File = 0;
-
 IEngineSound *CreateEngineSound() { return new CSound; }

--- a/src/engine/client/sound.h
+++ b/src/engine/client/sound.h
@@ -21,10 +21,6 @@ public:

 	static void RateConvert(int SampleID);

-	// TODO: Refactor: clean this mess up
-	static IOHANDLE ms_File;
-	static int ReadData(void *pBuffer, int Size);
-
 	virtual bool IsSoundEnabled() { return m_SoundEnabled != 0; }

 	virtual int LoadWV(const char *pFilename);


code:
Patch derived from discussion at https://savannah.nongnu.org/bugs/?37503

--- texi2html-5.0/texi2html.pl	2010-06-30 17:01:27.000000000 -0500
+++ texi2html-5.0/texi2html.pl	2014-07-09 01:17:57.062990582 -0500
@@ -2589,7 +2589,12 @@
     my $state = shift;

     # FIXME this should be done only once, for @documentencoding
-    my $encoding = lc(Texi2HTML::Config::get_conf('DOCUMENT_ENCODING'));
+    my $encoding;
+    my $input_encoding = Texi2HTML::Config::get_conf('documentencoding');
+    if (defined($input_encoding))
+    {
+      $encoding = lc($input_encoding);
+    }
     if (defined($encoding) and $encoding ne '' and exists($Texi2HTML::Config::t2h_encoding_aliases{$encoding}))
     {
        $encoding = $Texi2HTML::Config::t2h_encoding_aliases{$encoding};

Fix failures in test/encodings.

--- texi2html-5.0/texi2html.pl	2014-07-09 01:22:06.000000000 -0500
+++ texi2html-5.0/texi2html.pl	2014-07-10 23:23:47.182097602 -0500
@@ -53,6 +53,7 @@
 # for translations
 #use encoding 'utf8';
 #use utf8;
+binmode STDERR, ':encoding(utf8)';

 #
 # According to


code:
Do not try to regenerate po files; use the reference files that are packaged
in the tarball.

--- a/Makefile.in	2010-06-30 17:02:28.000000000 -0500
+++ b/Makefile.in	2014-08-16 00:22:38.447050269 -0500
@@ -1022,15 +1022,7 @@

 i18n/en.thl i18n/: $(po_document_dir)/po_document/$(PACKAGE)_document.pot
 	$(MKDIR_P) i18n
-	if test '$(USE_NLS)' = 'yes'; then \
-	  for file in "$(srcdir)/$(po_document_dir)/po_document/"*".po"; do lang=`basename "$$file" .po | sed 's/\..*//'`; \
-		test "$$lang" = 'en' && continue; \
-		msgexec -i "$$file" "$(srcdir)/gettext_to_separated.pl" | "$(srcdir)/separated_to_hash.pl" $$lang > i18n/$$lang.thl; \
-	  done; \
-	  msgexec -i $< "$(srcdir)/gettext_to_separated.pl" | "$(srcdir)/separated_to_hash.pl" en > i18n/en.thl; \
-	else \
-	  cp -p i18n_ref/*.thl i18n; \
-	fi
+	cp -p i18n_ref/*.thl i18n

 i18n_ref:
 	$(MKDIR_P) i18n_ref

Have install-sh install .mo files locally for in-source tests, so that msgfmt
is not needed.

--- a/Makefile.in	2010-06-30 17:02:28.000000000 -0500
+++ b/Makefile.in	2014-08-16 00:22:38.447050269 -0500
@@ -1052,19 +1044,8 @@
 # update the po files, and install locally the .mo files for the in
 # source tests
 check-local: makeinfo.pl texi2any.pl
-	if test '$(USE_NLS)' = 'yes'; then \
-	  cd $(po_document_dir)/po_document && $(MAKE) $(AM_MAKEFLAGS) update-po; \
-	fi
-	rm -rf locales
-	for file in "$(srcdir)/$(po_document_dir)/po_document/"*.po; do \
-	  basename=`basename "$$file" .po` ; \
-	  $(MKDIR_P) "locales/$$basename/LC_MESSAGES/" ; \
-	  if test '$(USE_NLS)' = 'yes'; then \
-	    $(MSGFMT) "$$file" -o "locales/$$basename/LC_MESSAGES/texi2html_document.mo" ; \
-	  else \
-	    cp -p "$(srcdir)/$(po_document_dir)/po_document/$$basename.mo" "locales/$$basename/LC_MESSAGES/texi2html_document.mo" ; \
-	  fi; \
-	done
+	$(MAKE) -C po_document localedir="$(abs_srcdir)/locales" install-data
+	$(MAKE) -C po_messages localedir="$(abs_srcdir)/locales" install-data

 makeinfo.pl texi2any.pl:
 	-$(LN_S) $(srcdir)/texi2html.pl $@


code:
Retain environment setting of "HOME" for tests that need os.path.expanduser()
to return a readable directory in the build chroot.

--- thefuck-3.25/tests/conftest.py
+++ thefuck-3.25/tests/conftest.py
@@ -64,6 +64,7 @@ def set_shell(monkeypatch):

 @pytest.fixture(autouse=True)
 def os_environ(monkeypatch):
-    env = {'PATH': os.environ['PATH']}
+    env = {'PATH': os.environ['PATH'],
+           'HOME': os.environ['HOME']}
     monkeypatch.setattr('os.environ', env)
     return env


code:
Copied from Debian.

From c18f27a58792f7fbd0b30a0ff50d6b40a82f940d Mon Sep 17 00:00:00 2001
From: Geoff McLane <ubuntu@geoffair.info>
Date: Wed, 3 Jun 2015 20:26:03 +0200
Subject: [PATCH] Issue #217 - avoid len going negative, ever...

---
 src/lexer.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/lexer.c b/src/lexer.c
index 376a3d8..664f806 100644
--- a/src/lexer.c
+++ b/src/lexer.c
@@ -3739,16 +3740,17 @@ static tmbstr ParseValue( TidyDocImpl* doc, ctmbstr name,
         /* and prompts attributes unless --literal-attributes is set to yes      */
         /* #994841 - Whitespace is removed from value attributes                 */

-        if (munge &&
+        /* Issue #217 - Also only if/while (len > 0) - MUST NEVER GO NEGATIVE! */
+        if ((len > 0) && munge &&
             TY_(tmbstrcasecmp)(name, "alt") &&
             TY_(tmbstrcasecmp)(name, "title") &&
             TY_(tmbstrcasecmp)(name, "value") &&
             TY_(tmbstrcasecmp)(name, "prompt"))
         {
-            while (TY_(IsWhite)(lexer->lexbuf[start+len-1]))
+            while (TY_(IsWhite)(lexer->lexbuf[start+len-1]) && (len > 0))
                 --len;

-            while (TY_(IsWhite)(lexer->lexbuf[start]) && start < len)
+            while (TY_(IsWhite)(lexer->lexbuf[start]) && (start < len) && (len > 0))
             {
                 ++start;
                 --len;


code:
From a53b6ee4519a7657164610ac14a82c57b1273bf6 Mon Sep 17 00:00:00 2001
From: David Thompson <dthompson2@worcester.edu>
Date: Mon, 23 Nov 2015 06:54:36 -0500
Subject: [PATCH] Use STL.

Software that uses the shared library, such as Kodi, assume that TinyXML was
compiled with STL activated.

---
 tinyxml.h   | 2 ++
 xmltest.cpp | 1 +
 2 files changed, 3 insertions(+)

diff --git a/tinyxml.h b/tinyxml.h
index a3589e5..6cbfc7d 100644
--- a/tinyxml.h
+++ b/tinyxml.h
@@ -43,6 +43,8 @@ distribution.
 #define DEBUG
 #endif

+#define TIXML_USE_STL 1
+
 #ifdef TIXML_USE_STL
 	#include <string>
  	#include <iostream>
diff --git a/xmltest.cpp b/xmltest.cpp
index 663c157..057dbfe 100644
--- a/xmltest.cpp
+++ b/xmltest.cpp
@@ -2,6 +2,7 @@
    Test program for TinyXML.
 */

+#define TIXML_USE_STL 1

 #ifdef TIXML_USE_STL
 	#include <iostream>
--
2.5.0


code:
Description: Debian patches to make tipp10 compile
Author: Christoph Martin <chrism@debian.org>
Last-Update: 2016-07-20

https://sources.debian.net/data/main/t/tipp10/2.1.0-2/debian/patches/0001-FixCompiling

--- a/widget/tickerboard.cpp
+++ b/widget/tickerboard.cpp
@@ -97,7 +97,8 @@ void TickerBoard::startTicker(bool wasPa

 		if (tickerSpeed == 50) {
 			scrollOffset = 290;
-			scroll(-290, 0, QRect::QRect(10, 15, 590, 35)); //contentsRect());
+			const QRect qr = QRect(10, 15, 590, 35);
+			scroll(-290, 0, qr); //contentsRect());
 		}

 		startFlag = true;
@@ -153,7 +154,8 @@ void TickerBoard::changeChar() {
 			scrollOffset = 0;
 		} else {
 			scrollOffset = 290;
-			scroll(-290, 0, QRect::QRect(10, 15, 590, 35)); //contentsRect());
+			const QRect qr = QRect(10, 15, 590, 35);
+			scroll(-290, 0, qr); //contentsRect());
 		}
 		splitLesson();
 	}
@@ -242,7 +244,8 @@ void TickerBoard::progress() {

 				// Move ticker 1 pixel to left
 				scrollOffset++;
-				scroll(-1, 0, QRect::QRect(10, 15, 590, 35)); //contentsRect());
+				const QRect qr = QRect(10, 15, 590, 35);
+				scroll(-1, 0, qr); //contentsRect());

 				if ((lessonOffset - scrollOffset) <= 30) {
 					setSpeed(tickerSpeed);
@@ -265,14 +268,16 @@ void TickerBoard::progress() {
 			// 160 pixels overage (because the user must see at least the next word)
 			if ((lessonOffset - scrollOffset) > 200) {
 				scrollOffset += (lessonOffset - scrollOffset) - 200;
-				scroll(-((lessonOffset - scrollOffset) - 200), 0, QRect::QRect(10, 15, 590, 35)); //contentsRect());
+				const QRect qr = QRect(10, 15, 590, 35);
+				scroll(-((lessonOffset - scrollOffset) - 200), 0, qr); //contentsRect());
 			}
 		} else {
 			// If the user types faster than the ticker, move ticker faster after
 			// 160 pixels overage (because the user must see at least the next word)
 			if ((lessonOffset - scrollOffset) > 280) {
 				scrollOffset += 570;
-				scroll(-570, 0, QRect::QRect(10, 15, 590, 35)); //contentsRect());
+				const QRect qr = QRect(10, 15, 590, 35);
+				scroll(-570, 0, qr); //contentsRect());
 			}

 		}
--- a/widget/settingspages.cpp
+++ b/widget/settingspages.cpp
@@ -501,7 +501,7 @@ void DatabasePage::writeSettings() {
 	QSettings settings;
 	#endif
 	settings.beginGroup("database");
-	settings.setValue("pathpro", lineDatabasePath->text() + "/" + QString::QString(APP_USER_DB));
+	settings.setValue("pathpro", lineDatabasePath->text() + "/" + QString(APP_USER_DB));
 	settings.endGroup();
 }

--- a/widget/lessondialog.cpp
+++ b/widget/lessondialog.cpp
@@ -89,7 +89,7 @@ void LessonDialog::updateContent() {
 			*lessonData = lineLessonContent->toPlainText().split("\n", QString::SkipEmptyParts);
 			// Delete empty lines
 			for (int i = 0; i < lessonData->size(); i++) {
-				if (QString::QString(lessonData->at(i).toLocal8Bit().constData()).simplified() == "") {
+				if (QString(lessonData->at(i).toLocal8Bit().constData()).simplified() == "") {
 					lessonData->removeAt(i);
 				}
 			}
@@ -259,7 +259,7 @@ void LessonDialog::clickSave() {
 	contentList = lineLessonContent->toPlainText().split("\n", QString::SkipEmptyParts);
 	// Delete empty lines
 	for (i = 0; i < contentList.size(); i++) {
-		if (QString::QString(contentList.at(i).toLocal8Bit().constData()).simplified() == "") {
+		if (QString(contentList.at(i).toLocal8Bit().constData()).simplified() == "") {
 			contentList.removeAt(i);
 		}
 	}
--- a/sql/chartablesql.cpp
+++ b/sql/chartablesql.cpp
@@ -57,7 +57,7 @@ QVariant CharSqlModel::data(const QModel
 			// Read the unicode value
 			unicode = value.toInt();
 			// Convert unicode to a char
-			unicodeToChar = QString::QString(QChar(unicode)); //"\'" + QString::QString(QChar(unicode)) + "\'";
+			unicodeToChar = QString(QChar(unicode)); //"\'" + QString::QString(QChar(unicode)) + "\'";
 			return unicodeToChar;
 		} else {
 			// Last column (error weight)
--- a/sql/startsql.cpp
+++ b/sql/startsql.cpp
@@ -344,7 +344,7 @@ bool StartSql::updateOwnLesson(QString l
 		for (i = 0; i < content.size(); i++) {
 			//simplifiedContent = QString::QString(
 			//	content.at(i)).replace(QChar(0x27), "''", Qt::CaseSensitive).simplified();
-			simplifiedContent = trim(QString::QString(
+			simplifiedContent = trim(QString(
 				content.at(i)).replace(QChar(0x27), "''", Qt::CaseSensitive));

 			if (!query.exec("INSERT INTO own_content VALUES(NULL,'" +
--- a/def/defines.h
+++ b/def/defines.h
@@ -27,9 +27,9 @@ Foundation, Inc., 51 Franklin Street, Fi
 #define DEFINES_H

 // OS constants
-#define APP_WIN						true
+#define APP_WIN						false
 #define APP_MAC						false
-#define APP_X11						false
+#define APP_X11						true
 #define APP_PORTABLE				false //at least one of the 3 OS must be true too!

 // Languages
@@ -47,6 +47,7 @@ Foundation, Inc., 51 Franklin Street, Fi
 #define APP_URL 					"http://www.tipp10.com"
 #define APP_DB 						"tipp10v2.template"
 #define APP_USER_DB					"tipp10v2.db"
+#define APP_SHARE_DIR					"/usr/share/tipp10"

 // Update constants
 #define UPDATE_URL 					"www.tipp10.com"
--- a/tipp10.pro
+++ b/tipp10.pro
@@ -88,3 +88,15 @@ SOURCES         += 	main.cpp \
                     sql/startsql.cpp \
                     games/abcrainwidget.cpp \
                     games/charball.cpp
+
+target.path = /usr/bin/
+INSTALLS += target
+share.path = /usr/share/tipp10/
+share.files = release/* *wav
+INSTALLS += share
+desktop.path = /usr/share/applications/
+desktop.files = tipp10.desktop
+INSTALLS += desktop
+pixmap.path = /usr/share/pixmaps/
+pixmap.files = tipp10.png
+INSTALLS += pixmap
--- a/sql/connection.h
+++ b/sql/connection.h
@@ -179,11 +179,13 @@ static bool createConnection() {
 				CANCEL_NO, "Betroffener Pfad:\n" + dbPath);*/
 			// Try to create new databae in user path
 			// Exist a database in the program dir?
-			if (QFile::exists(QCoreApplication::applicationDirPath() + "/" + dbNameTemplate)) {
+			// if (QFile::exists(QCoreApplication::applicationDirPath() + "/" + dbNameTemplate)) {
+		  	if (QFile::exists(QString(APP_SHARE_DIR) + "/" + dbNameTemplate)) {
 			//if (QFile::exists(":/" + dbNameTemplate)) {
 				// A database exist in the program dir
 				// -> copy database to user home dir
-				QFile file(QCoreApplication::applicationDirPath() + "/" + dbNameTemplate);
+				// QFile file(QCoreApplication::applicationDirPath() + "/" + dbNameTemplate);
+			  	QFile file(QString(APP_SHARE_DIR) + "/" + dbNameTemplate);
 				//QFile file(":/" + dbNameTemplate);
 				if (file.copy(dbPath)) {
 					QFile::setPermissions(dbPath, QFile::permissions(dbPath) | QFile::WriteUser);
@@ -229,7 +231,8 @@ static bool createConnection() {
 		// Exist a database in user's home dir?
 		if (!QFile::exists(dbPath)) {
 			// Exist a database template in the program dir?
-			dbPath = QCoreApplication::applicationDirPath() + "/" + dbNameTemplate;
+			// dbPath = QCoreApplication::applicationDirPath() + "/" + dbNameTemplate;
+		  	dbPath = QString(APP_SHARE_DIR) + "/" + dbNameTemplate;
 			//dbPath = ":/" + dbNameTemplate;
 			if (QFile::exists(dbPath)) {
 				// A database template exist in the program dir
--- a/widget/helpbrowser.cpp
+++ b/widget/helpbrowser.cpp
@@ -52,13 +52,15 @@ HelpBrowser::HelpBrowser(QString link, Q
     textBrowser->setOpenExternalLinks(true);

     textBrowser->setSource(QString("file:///") +
-    	QCoreApplication::applicationDirPath() +
+	// QCoreApplication::applicationDirPath() +
+    	APP_SHARE_DIR +
     	QString("/help/") + language + QString("/index.html"));

     if (link != "") {

 		textBrowser->setSource(QString("file:///") +
-			QCoreApplication::applicationDirPath() +
+			// QCoreApplication::applicationDirPath() +
+			APP_SHARE_DIR +
 			QString("/help/") + language + QString("/content/") + link);

 	}
--- a/tipp10.desktop
+++ b/tipp10.desktop
@@ -1,10 +1,10 @@
 [Desktop Entry]
-Encoding=UTF-8
 Name=TIPP10
 Comment=Touch Typing Tutor
 Comment[de]=10-Finger-Schreibtrainer
-Exec=tipp10
+Exec=/usr/bin/tipp10
 Icon=tipp10.png
 Terminal=false
 Type=Application
 Categories=Education;
+Keywords=learning;touchtyping


code:
Description: Remove license dialog and license key checking

https://sources.debian.net/data/main/t/tipp10/2.1.0-2/debian/patches/0002-RemoveLicenseCode

--- a/main.cpp
+++ b/main.cpp
@@ -33,7 +33,6 @@ Foundation, Inc., 51 Franklin Street, Fi
 #include "def/defines.h"
 #include "sql/connection.h"
 #include "widget/mainwindow.h"
-#include "widget/licensedialog.h"
 #include "widget/illustrationdialog.h"

 int main(int argc, char *argv[]) {
@@ -59,7 +58,7 @@ int main(int argc, char *argv[]) {
 	QSettings settings;
 	#endif

-	// Read/write language, license key and show illustration flag
+	// Read/write language and show illustration flag
 	settings.beginGroup("general");
 	QString languageGui = settings.value("language_gui",
 		QLocale::system().name()).toString();
@@ -101,7 +100,6 @@ int main(int argc, char *argv[]) {
 	QString languageLesson = settings.value("language_lesson",
 		"").toString();

-	QString licenseKey = settings.value("licensekey", "").toString();
 	bool showIllustration = settings.value("check_illustration", true).toBool();
 	bool useNativeStyle = settings.value("check_native_style", false).toBool();
 	settings.endGroup();
--- a/tipp10.pro
+++ b/tipp10.pro
@@ -43,7 +43,6 @@ HEADERS         += 	def/defines.h \
                     widget/helpbrowser.h \
                     widget/companylogo.h \
                     widget/errormessage.h \
-                    widget/licensedialog.h \
                     widget/txtmessagedialog.h \
                     widget/checkversion.h \
                     sql/connection.h \
@@ -78,7 +77,6 @@ SOURCES         += 	main.cpp \
                     widget/helpbrowser.cpp \
                     widget/companylogo.cpp \
                     widget/errormessage.cpp \
-                    widget/licensedialog.cpp \
                     widget/txtmessagedialog.cpp \
                     widget/checkversion.cpp \
                     sql/lessontablesql.cpp \
--- a/widget/licensedialog.cpp
+++ /dev/null
@@ -1,168 +0,0 @@
-/*
-Copyright (c) 2006-2009, Tom Thielicke IT Solutions
-
-This program is free software; you can redistribute it and/or
-modify it under the terms of the GNU General Public License
-as published by the Free Software Foundation; either version 2
-of the License.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program; if not, write to the Free Software
-Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
-02110-1301, USA.
-*/
-
-/****************************************************************
-**
-** Implementation of the LicenseDialog class
-** File name: licensedialog.cpp
-**
-****************************************************************/
-
-#include <QHBoxLayout>
-#include <QVBoxLayout>
-#include <QMessageBox>
-#include <QSettings>
-#include <QCoreApplication>
-
-#include "licensedialog.h"
-#include "def/defines.h"
-
-LicenseDialog::LicenseDialog(QWidget *parent) : QDialog(parent) {
-
-	setWindowFlags(windowFlags() ^ Qt::WindowContextHelpButtonHint);
-
-	setWindowTitle(tr("Lizenznummer"));
-	setWindowIcon(QIcon(":/img/" + QString(ICON_FILENAME)));
-
-	// Create texbox
-    createLineEdit();
-
-	// Create buttons
-    createButtons();
-
-	// Set the layout of all widgets created above
-	createLayout();
-
-	lineLicensing->setFocus();
-}
-
-void LicenseDialog::createButtons() {
-	//Buttons
-	buttonOk = new QPushButton(this);
-	buttonDemo = new QPushButton(this);
-
-	buttonOk->setText(tr("&Ok"));
-	buttonDemo->setText(tr("&Demo starten"));
-	buttonDemo->setToolTip(tr("Im Demo-Modus koennen pro Lektion nur\n"
-		"10 Schriftzeichen eingegeben werden"));
-
-	buttonOk->setDefault(true);
-	// Widget connections
-    connect(buttonOk, SIGNAL(clicked()), this, SLOT(clickOk()));
-    connect(buttonDemo, SIGNAL(clicked()), this, SLOT(clickDemo()));
-}
-
-void LicenseDialog::createLineEdit() {
-
-	lineLicensing = new QLineEdit();
-	lineLicensing->setInputMask(">NNNNNNNNNNNNNN");
-
-	labelLicensing = new QLabel(tr("Bitte geben Sie Ihre Lizenznummer "
-		"(ohne Leerzeichen) ein, "
-		"die Sie im Arbeitsbuch (Schulbuch) auf Seite 3 finden:"));
-
-	labelLicensing->setWordWrap(true);
-}
-
-void LicenseDialog::createLayout() {
-	// Button layout horizontal
-	QHBoxLayout *buttonLayoutHorizontal = new QHBoxLayout;
-    buttonLayoutHorizontal->addStretch(1);
-    buttonLayoutHorizontal->addWidget(buttonDemo);
-    buttonLayoutHorizontal->addWidget(buttonOk);
-	// Full layout of all widgets vertical
-	QVBoxLayout *mainLayout = new QVBoxLayout;
-    mainLayout->addSpacing(1);
-    mainLayout->addWidget(labelLicensing);
-    mainLayout->addSpacing(1);
-    mainLayout->addWidget(lineLicensing);
-    mainLayout->addSpacing(1);
-    mainLayout->addLayout(buttonLayoutHorizontal);
-    mainLayout->setMargin(15);
-    mainLayout->setSpacing(15);
-    // Pass layout to parent widget (this)
-	this->setLayout(mainLayout);
-}
-
-void LicenseDialog::clickOk() {
-
-	// Check license key
-	if (!checkLicenseKey(lineLicensing->text())) {
-
-		// License key is wrong
-
-		// Message to the user
-		QMessageBox::information(0, APP_NAME,
-			tr("Die eingegebene Lizenznummer ist leider nicht "
-			"korrekt.\nBitte ueberpruefen Sie die Schreibweise."));
-
-		lineLicensing->setFocus();
-
-	} else {
-
-		// License key is ok
-		writeSettings();
-		accept();
-	}
-}
-
-void LicenseDialog::clickDemo() {
-	accept();
-}
-
-bool LicenseDialog::checkLicenseKey(QString licenseKey) {
-	if (licenseKey.size() == 14 &&
-		licenseKey[0].isLetter() &&
-		licenseKey[1].isLetter() &&
-		(licenseKey.mid(2, 2) == "39" ||
-		licenseKey.mid(2, 2) == "41" ||
-		licenseKey.mid(2, 2) == "43" ||
-		licenseKey.mid(2, 2) == "49" ||
-		licenseKey.mid(2, 2) == "99") &&
-		licenseKey[4].isDigit() &&
-		licenseKey[5].isDigit() &&
-		licenseKey[6].isDigit() &&
-		licenseKey[7].isLetter() &&
-		licenseKey[8].isDigit() &&
-		licenseKey[9].isDigit() &&
-		licenseKey[10].isDigit() &&
-		licenseKey[11].isDigit() &&
-		licenseKey[12].isLetter() &&
-		licenseKey[13].isLetter()) {
-
-		return true;
-	}
-	return false;
-}
-
-void LicenseDialog::writeSettings() {
-	// Saves settings of the startwiget
-	// (uses the default constructor of QSettings, passing
-	// the application and company name see main function)
-	#if APP_PORTABLE
-	QSettings settings(QCoreApplication::applicationDirPath() +
-    	"/portable/settings.ini", QSettings::IniFormat);
-    #else
-	QSettings settings;
-	#endif
-
-	settings.beginGroup("general");
-	settings.setValue("licensekey", lineLicensing->text());
-	settings.endGroup();
-}
--- a/widget/licensedialog.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
-Copyright (c) 2006-2009, Tom Thielicke IT Solutions
-
-This program is free software; you can redistribute it and/or
-modify it under the terms of the GNU General Public License
-as published by the Free Software Foundation; either version 2
-of the License.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program; if not, write to the Free Software
-Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
-02110-1301, USA.
-*/
-
-/****************************************************************
-**
-** Definition of the LicenseDialog class
-** File name: licensedialog.h
-**
-****************************************************************/
-
-#ifndef LICENSEDIALOG_H
-#define LICENSEDIALOG_H
-
-#include <QDialog>
-#include <QWidget>
-#include <QPushButton>
-#include <QLabel>
-#include <QLineEdit>
-#include <QString>
-
-//! The LicenseDialog class provides a license input widget.
-/*!
-	The LicenseDialog class shows a dialog to enter a license key.
-
-	@author Tom Thielicke, s712715
-	@version 0.0.1
-	@date 09.09.2008
-*/
-class LicenseDialog : public QDialog {
-	Q_OBJECT
-
-	public:
-
-		//! Constructor, creates two table objects and provide it in two tabs.
-		LicenseDialog(QWidget *parent = 0);
-
-		bool checkLicenseKey(QString licenseKey);
-
-	public slots:
-
-	private slots:
-
-		//! Start button pressed
-		void clickOk();
-
-		//! Demo button pressed
-		void clickDemo();
-
-	private:
-
-		//! Creates a cancel and a ok button.
-		void createButtons();
-
-		//! Creates a textbox.
-		void createLineEdit();
-
-		//! Creates the layout of the complete class.
-		void createLayout();
-
-		//! Writes user settings
-		void writeSettings();
-
-		QPushButton *buttonOk;
-		QPushButton *buttonDemo;
-		QLabel *labelLicensing;
-		QLineEdit *lineLicensing;
-};
-
-#endif //LICENSEDIALOG_H
--- a/widget/mainwindow.cpp
+++ b/widget/mainwindow.cpp
@@ -116,11 +116,6 @@ void MainWindow::closeEvent(QCloseEvent
 	}
 }

-bool MainWindow::checkLicenseKey(QString licenseKey) {
-
-    return false;
-}
-
 void MainWindow::createMenu() {
 	//Mac-Version:
 	//-----------
--- a/widget/mainwindow.h
+++ b/widget/mainwindow.h
@@ -39,7 +39,6 @@ Foundation, Inc., 51 Franklin Street, Fi
 #include "trainingwidget.h"
 #include "evaluationwidget.h"
 #include "illustrationdialog.h"
-#include "licensedialog.h"
 #include "games/abcrainwidget.h"
 #include "helpbrowser.h"


code:
This patch hard-codes the Tk library directory during package initialization.

See <http://core.tcl.tk/tk/tktview/765642ffffffffffffff>.

diff --git a/generic/tkWindow.c b/generic/tkWindow.c
index b5cbbab..96b5501 100644
--- a/generic/tkWindow.c
+++ b/generic/tkWindow.c
@@ -988,6 +988,7 @@ TkCreateMainWindow(

     Tcl_SetVar2(interp, "tk_patchLevel", NULL, TK_PATCH_LEVEL, TCL_GLOBAL_ONLY);
     Tcl_SetVar2(interp, "tk_version",    NULL, TK_VERSION,     TCL_GLOBAL_ONLY);
+    Tcl_SetVar2(interp, "tk_library",    NULL, TK_LIBRARY,     TCL_GLOBAL_ONLY);

     tsdPtr->numMainWindows++;
     return tkwin;
diff --git a/unix/Makefile.in b/unix/Makefile.in
index f21fdbb..c61b0df 100644
--- a/unix/Makefile.in
+++ b/unix/Makefile.in
@@ -1029,7 +1029,7 @@ tkVisual.o: $(GENERIC_DIR)/tkVisual.c
 	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkVisual.c

 tkWindow.o: $(GENERIC_DIR)/tkWindow.c
-	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkWindow.c
+	$(CC) -c $(CC_SWITCHES) -DTK_LIBRARY=\"${TK_LIBRARY}\" $(GENERIC_DIR)/tkWindow.c

 tkButton.o: $(GENERIC_DIR)/tkButton.c
 	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkButton.c


code:
This patch resolves a build failure when building TopHat 2.1.0 with SeqAn 1.4.
This is the relevant part of a patch originally posted here:
https://lists.fu-berlin.de/pipermail/seqan-dev/2014-July/msg00001.html

--- a/src/segment_juncs.cpp
+++ b/src/segment_juncs.cpp
@@ -2050,10 +2050,13 @@ void juncs_from_ref_segs(RefSequenceTabl
     typedef map<uint32_t, IntronMotifs> MotifMap;

     MotifMap ims;
-
-    seqan::DnaStringReverseComplement rev_donor_dinuc(donor_dinuc);
-    seqan::DnaStringReverseComplement rev_acceptor_dinuc(acceptor_dinuc);
-
+
+    typedef seqan::ModifiedString<
+                    seqan::ModifiedString<seqan::DnaString const, seqan::ModView<seqan::FunctorComplement<seqan::Dna> > >,
+                    seqan::ModReverse>   ConstDnaStringReverseComplement;
+    ConstDnaStringReverseComplement rev_donor_dinuc(donor_dinuc);
+    ConstDnaStringReverseComplement rev_acceptor_dinuc(acceptor_dinuc);
+
     if (talkative)
         fprintf(stderr, "Collecting potential splice sites in islands\n");


code:
Fix a bug whereby the 'have_easy_codec' would be left undefined
when passing '-D enable-easy-codec-installation=no'.  Likewise,
don't rely on GStreamer's plug-in support when it's disabled.

--- totem-3.26.0/meson.build	2017-10-11 22:29:44.506280919 +0200
+++ totem-3.26.0/meson.build	2017-10-11 22:29:50.902252058 +0200
@@ -203,6 +203,8 @@ if easy_codec_option != 'no'
   missing_plugins_deps += gst_pbutils_dep
   config_h.set('ENABLE_MISSING_PLUGIN_INSTALLATION', have_easy_codec,
                description: 'Whether we can and want to do installation of missing plugins')
+else
+  have_easy_codec = false
 endif

 # python support

--- totem-3.26.0/src/backend/bacon-video-widget.c	2017-10-11 22:40:52.531217356 +0200
+++ totem-3.26.0/src/backend/bacon-video-widget.c	2017-10-11 22:45:44.973847231 +0200
@@ -341,6 +341,22 @@ get_type_name (GType class_type, int typ
   return value->value_nick;
 }

+#ifndef ENABLE_MISSING_PLUGIN_INSTALLATION
+
+gchar *
+gst_missing_plugin_message_get_installer_detail (GstMessage *message)
+{
+  return NULL;
+}
+
+char *
+gst_missing_plugin_message_get_description (GstMessage *message)
+{
+  return NULL;
+}
+
+#endif
+
 static gchar **
 bvw_get_missing_plugins_foo (const GList * missing_plugins, MsgToStrFunc func)
 {
@@ -1654,10 +1670,12 @@ bvw_handle_element_message (BaconVideoWi
       }
     }
     goto done;
+#ifdef ENABLE_MISSING_PLUGIN_INSTALLATION
   } else if (gst_is_missing_plugin_message (msg)) {
     bvw->priv->missing_plugins =
       g_list_prepend (bvw->priv->missing_plugins, gst_message_ref (msg));
     goto done;
+#endif
   } else if (strcmp (type_name, "not-mounted") == 0) {
     const GValue *val;
     GFile *file;
@@ -6109,7 +6127,9 @@ bacon_video_widget_initable_init (GInita
   GST_DEBUG ("Initialised %s", version_str);
   g_free (version_str);

+#ifdef ENABLE_MISSING_PLUGIN_INSTALLATION
   gst_pb_utils_init ();
+#endif

   /* Instantiate all the fallible plugins */
   bvw->priv->play = element_make_or_warn ("playbin", "play");


code:
From resolution of https://code.google.com/p/ttf2eot/issues/detail?id=26

--- ttf2eot-0.0.2-2/OpenTypeUtilities.cpp	2009-04-30 04:18:46.000000000 -0500
+++ ttf2eot-0.0.2-2/OpenTypeUtilities.cpp	2016-03-31 01:06:39.109996011 -0500
@@ -25,6 +25,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */

+#include <cstddef>
 #include <string.h>
 #include <vector>


code:
Honour an external definition of SOURCE_DATE_EPOCH when updating the embedded
modification date in TTF/TTC files.

--- a/lib/tatime.c
+++ b/lib/tatime.c
@@ -15,6 +15,8 @@

 #include <time.h>
 #include <stdint.h>
+#include <errno.h>
+#include <limits.h>

 #include "ta.h"

@@ -27,12 +29,51 @@ TA_get_current_time(FT_ULong* high,
 {
   /* there have been 24107 days between January 1st, 1904 (the epoch of */
   /* OpenType), and January 1st, 1970 (the epoch of the `time' function) */
-  TA_ULongLong seconds_to_1970 = 24107 * 24 * 60 * 60;
-  TA_ULongLong seconds_to_today = seconds_to_1970 + (TA_ULongLong)time(NULL);
+  const TA_ULongLong seconds_to_1970 = 24107 * 24 * 60 * 60;
+  TA_ULongLong seconds_to_build;

+  time_t now;
+  char *source_date_epoch, *endptr;
+  TA_ULongLong epoch;
+  source_date_epoch = getenv("SOURCE_DATE_EPOCH");
+  if (source_date_epoch) {
+    errno = 0;
+    epoch = strtoull(source_date_epoch, &endptr, 10);
+    if ((errno == ERANGE && (epoch == ULLONG_MAX || epoch == 0))
+	|| (errno != 0 && epoch == 0)) {
+      fprintf(stderr,
+	      "Environment variable $SOURCE_DATE_EPOCH: strtoull: %s\n",
+	      strerror(errno));
+      exit(EXIT_FAILURE);
+    }
+    if (endptr == source_date_epoch) {
+      fprintf(stderr,
+	      "Environment variable $SOURCE_DATE_EPOCH: No digits were found: %s\n",
+	      endptr);
+      exit(EXIT_FAILURE);
+    }
+    if (*endptr != '\0') {
+      fprintf(stderr,
+	      "Environment variable $SOURCE_DATE_EPOCH: Trailing garbage: %s\n",
+	      endptr);
+      exit(EXIT_FAILURE);
+    }
+    if (epoch > ULONG_MAX) {
+      fprintf(stderr,
+	      "Environment variable $SOURCE_DATE_EPOCH: value must be smaller "
+	      "than or equal to: %lu but was found to be: %llu \n",
+	      ULONG_MAX, epoch);
+      exit(EXIT_FAILURE);
+    }
+    now = epoch;
+  } else {
+    now = time(NULL);
+  }

-  *high = (FT_ULong)(seconds_to_today >> 32);
-  *low = (FT_ULong)seconds_to_today;
+  seconds_to_build = seconds_to_1970 + (TA_ULongLong)now;
+
+  *high = (FT_ULong)(seconds_to_build >> 32);
+  *low = (FT_ULong)seconds_to_build;
 }

 /* end of tatime.c */


code:
--- tuxpaint-0.9.22/src/tuxpaint.c
+++ tuxpaint-0.9.22/src/tuxpaint.c
@@ -7474,11 +7474,21 @@
 static void load_stamps(SDL_Surface * screen)
 {
   char *homedirdir = get_fname("stamps", DIR_DATA);
+  char *stamps_path = getenv("TUXPAINT_STAMPS_PATH");

   default_stamp_size = compute_default_scale_factor(1.0);

   load_stamp_dir(screen, homedirdir);
   load_stamp_dir(screen, DATA_PREFIX "stamps");
+  /* Load any stamps in TUXPAINT_STAMPS_PATH */
+  if (stamps_path) {
+    char *token;
+    token = strtok(stamps_path, ":");
+    while (token != NULL) {
+      load_stamp_dir(screen, token);
+      token = strtok(NULL, ":");
+    }
+  }
 #ifdef __APPLE__
   load_stamp_dir(screen, "/Library/Application Support/TuxPaint/stamps");
 #endif


code:
Copied from upstream:

https://github.com/LubosD/twinkle/commit/4b42755619011c117a76bdf98e417ebedc47e319

From 4b42755619011c117a76bdf98e417ebedc47e319 Mon Sep 17 00:00:00 2001
From: Michal Kubecek <mkubecek@suse.cz>
Date: Wed, 6 Jun 2018 10:07:21 +0200
Subject: [PATCH] Include <QRegExpValidator> explicitly

Since Qt 5.11, generated ui_getprofilename.h no longer includes QHeaderView
which breaks the chain that included qvalidator.h in getprofilename.cpp.
As it feels rather fragile to rely on such indirect includes, let's include
<QRegExpValidator> explicitly in each file using QRegExpValidator class.
---
 src/gui/diamondcardprofileform.cpp | 1 +
 src/gui/getprofilenameform.cpp     | 2 +-
 src/gui/inviteform.cpp             | 1 +
 src/gui/mphoneform.cpp             | 1 +
 src/gui/numberconversionform.cpp   | 1 +
 src/gui/syssettingsform.cpp        | 1 +
 src/gui/userprofileform.cpp        | 1 +
 src/gui/wizardform.cpp             | 1 +
 8 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/gui/diamondcardprofileform.cpp b/src/gui/diamondcardprofileform.cpp
index 6656909..517180b 100644
--- a/src/gui/diamondcardprofileform.cpp
+++ b/src/gui/diamondcardprofileform.cpp
@@ -21,6 +21,7 @@

 #include <QRegExp>
 #include <QValidator>
+#include <QRegExpValidator>
 #include "gui.h"
 #include "diamondcard.h"
 #include "getprofilenameform.h"
diff --git a/src/gui/getprofilenameform.cpp b/src/gui/getprofilenameform.cpp
index 1319e1d..89c715e 100644
--- a/src/gui/getprofilenameform.cpp
+++ b/src/gui/getprofilenameform.cpp
@@ -1,7 +1,7 @@
 #include "getprofilenameform.h"
-
 #include <QDir>
 #include <QMessageBox>
+#include <QRegExpValidator>
 #include "user.h"
 #include "protocol.h"

diff --git a/src/gui/inviteform.cpp b/src/gui/inviteform.cpp
index 433fb22..2a5b68d 100644
--- a/src/gui/inviteform.cpp
+++ b/src/gui/inviteform.cpp
@@ -7,6 +7,7 @@
 #include "sys_settings.h"
 #include <QRegExp>
 #include <QValidator>
+#include <QRegExpValidator>

 /*
     Copyright (C) 2005-2009  Michel de Boer <michel@twinklephone.com>
diff --git a/src/gui/mphoneform.cpp b/src/gui/mphoneform.cpp
index 260fda7..c4e3c1d 100644
--- a/src/gui/mphoneform.cpp
+++ b/src/gui/mphoneform.cpp
@@ -54,6 +54,7 @@
 #include <QRegExp>
 #include <QValidator>
 #include <QSettings>
+#include <QRegExpValidator>
 #include "buddyform.h"
 #include "diamondcardprofileform.h"
 #include "osd.h"
diff --git a/src/gui/numberconversionform.cpp b/src/gui/numberconversionform.cpp
index f8ae64c..8481a9b 100644
--- a/src/gui/numberconversionform.cpp
+++ b/src/gui/numberconversionform.cpp
@@ -1,5 +1,6 @@
 #include "numberconversionform.h"

+#include <QRegExpValidator>
 #include "gui.h"

 /*
diff --git a/src/gui/syssettingsform.cpp b/src/gui/syssettingsform.cpp
index 216af54..355df59 100644
--- a/src/gui/syssettingsform.cpp
+++ b/src/gui/syssettingsform.cpp
@@ -28,6 +28,7 @@
 #include "twinkle_config.h"
 #include <QRegExp>
 #include <QValidator>
+#include <QRegExpValidator>
 #include "syssettingsform.h"
 /*
  *  Constructs a SysSettingsForm as a child of 'parent', with the
diff --git a/src/gui/userprofileform.cpp b/src/gui/userprofileform.cpp
index 28700a6..9ed9209 100644
--- a/src/gui/userprofileform.cpp
+++ b/src/gui/userprofileform.cpp
@@ -31,6 +31,7 @@
 #include <QStringList>
 #include "twinkle_config.h"
 #include <QListWidget>
+#include <QRegExpValidator>
 #include "numberconversionform.h"
 #include "util.h"
 #include "userprofileform.h"
diff --git a/src/gui/wizardform.cpp b/src/gui/wizardform.cpp
index 777aa12..f925875 100644
--- a/src/gui/wizardform.cpp
+++ b/src/gui/wizardform.cpp
@@ -23,6 +23,7 @@
 #include <QTextStream>
 #include "gui.h"
 #include <QFile>
+#include <QRegExpValidator>
 #include "wizardform.h"

 #define PROV_NONE	QT_TRANSLATE_NOOP("WizardForm", "None (direct IP to IP calls)")
--
2.17.0


code:
Fix CVE-2016-10091 (stack-based buffer overflows in cmd_* functions):

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10091
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849705
http://seclists.org/oss-sec/2016/q4/787

Patch adapted from Debian:

https://anonscm.debian.org/cgit/collab-maint/unrtf.git/commit/?h=jessie&id=7500a48fb0fbad3ab963fb17560b2f90a8a485c8

The Debian patch adapts this upstream commit so that it can be applied
to the 0.21.9 release tarball:

http://hg.savannah.gnu.org/hgweb/unrtf/rev/3b16893a6406

From 7dd568ed8a6a5acb6c04f2b40f457d63a00435f3 Mon Sep 17 00:00:00 2001
From: Willi Mann <willi@debian.org>
Date: Sat, 31 Dec 2016 20:31:38 +0100
Subject: [PATCH] Add patch from upstream to fix CVE-2016-10091 (buffer
 overflow in various cmd_ functions)

diff --git a/src/attr.c b/src/attr.c
index 02b5c81..e2951ea 100644
--- a/src/attr.c
+++ b/src/attr.c
@@ -746,7 +746,7 @@ char *
 assemble_string(char *string, int nr)
 {

-	char *s, tmp[12];/* Number of characters that can be in int type (including '\0') - AF */
+	char *s, tmp[20];
 	int i = 0, j = 0;

 	if (string == NULL)
@@ -762,7 +762,7 @@ assemble_string(char *string, int nr)
 		}

 		if (string[i] != '\0') {
-			sprintf(tmp, "%d", nr);
+			snprintf(tmp, 20, "%d", nr);
 			strcpy(&s[j], tmp);
 			j = j + strlen(tmp);
 		}
diff --git a/src/convert.c b/src/convert.c
index c76d7d6..8eacdcb 100644
--- a/src/convert.c
+++ b/src/convert.c
@@ -472,7 +472,7 @@ static const int fcharsetparmtocp(int parm)
 }

 // Translate code page to encoding name hopefully suitable as iconv input
-static char *cptoencoding(parm)
+static char *cptoencoding(int parm)
 {
     // Note that CP0 is supposed to mean current system default, which does
     // not make any sense as a stored value, we don't handle it.
@@ -964,7 +964,7 @@ cmd_cf (Word *w, int align, char has_param, int num)
 	}
 	else
 	{
-		sprintf(str,"#%02x%02x%02x",
+		snprintf(str, 40, "#%02x%02x%02x",
 			color_table[num].r,
 			color_table[num].g,
 			color_table[num].b);
@@ -993,7 +993,7 @@ cmd_cb (Word *w, int align, char has_param, int num)
 	}
 	else
 	{
-		sprintf(str,"#%02x%02x%02x",
+		snprintf(str, 40, "#%02x%02x%02x",
 			color_table[num].r,
 			color_table[num].g,
 			color_table[num].b);
@@ -1018,7 +1018,7 @@ cmd_fs (Word *w, int align, char has_param, int points) {
 	/* Note, fs20 means 10pt */
 	points /= 2;

-	sprintf(str,"%d",points);
+	snprintf(str, 20, "%d", points);
 	attr_push(ATTR_FONTSIZE,str);

 	return FALSE;
@@ -1166,7 +1166,7 @@ cmd_f (Word *w, int align, char has_param, int num)
         {
             // TOBEDONE: WHAT'S THIS ???
             name = my_malloc(12);
-            sprintf(name, "%d", num);
+			snprintf(name, 12, "%d", num);
         }

         /* we are going to output entities, so should not output font */
@@ -1218,7 +1218,7 @@ cmd_highlight (Word *w, int align, char has_param, int num)
 	}
 	else
 	{
-		sprintf(str,"#%02x%02x%02x",
+		snprintf(str, 40, "#%02x%02x%02x",
 			color_table[num].r,
 			color_table[num].g,
 			color_table[num].b);
@@ -1373,9 +1373,9 @@ cmd_ftech (Word *w, int align, char has_param, int param) {

 static int
 cmd_expand (Word *w, int align, char has_param, int param) {
-	char str[10];
+	char str[20];
 	if (has_param) {
-		sprintf(str, "%d", param/4);
+		snprintf(str, 20, "%d", param / 4);
 		if (!param)
 			attr_pop(ATTR_EXPAND);
 		else
@@ -1394,7 +1394,7 @@ cmd_expand (Word *w, int align, char has_param, int param) {

 static int
 cmd_emboss (Word *w, int align, char has_param, int param) {
-	char str[10];
+	char str[20];
 	if (has_param && !param)
 #ifdef SUPPORT_UNNESTED
 		attr_find_pop(ATTR_EMBOSS);
@@ -1403,7 +1403,7 @@ cmd_emboss (Word *w, int align, char has_param, int param) {
 #endif
 	else
 	{
-		sprintf(str, "%d", param);
+		snprintf(str, 20, "%d", param);
 		attr_push(ATTR_EMBOSS, str);
 	}
 	return FALSE;
@@ -1419,12 +1419,12 @@ cmd_emboss (Word *w, int align, char has_param, int param) {

 static int
 cmd_engrave (Word *w, int align, char has_param, int param) {
-	char str[10];
+	char str[20];
 	if (has_param && !param)
 		attr_pop(ATTR_ENGRAVE);
 	else
 	{
-		sprintf(str, "%d", param);
+		snprintf(str, 20, "%d", param);
 		attr_push(ATTR_ENGRAVE, str);
 	}
 	return FALSE;
@@ -1976,7 +1976,7 @@ static int cmd_u (Word *w, int align, char has_param, int param) {

 	short	done=0;
 	long unicode_number = (long) param; /* On 16bit architectures int is too small to store unicode characters. - AF */
-	char tmp[12]; /* Number of characters that can be in int type (including '\0'). If int size is greater than 4 bytes change this value. - AF */
+	char tmp[20]; /* Number of characters that can be in int type (including '\0'). If int size is greater than 4 bytes change this value. - AF */
 	const char *alias;
 #define DEBUG 0
 #if DEBUG
@@ -2006,7 +2006,7 @@ static int cmd_u (Word *w, int align, char has_param, int param) {
                             /* RTF spec: Unicode values beyond 32767 are represented by negative numbers */
 				unicode_number += 65536;
 			}
-			sprintf(tmp, "%ld", unicode_number);
+			snprintf(tmp, 20, "%ld", unicode_number);

 			if (safe_printf(1, op->unisymbol_print, tmp)) fprintf(stderr, TOO_MANY_ARGS, "unisymbol_print");
 			done++;
diff --git a/src/output.c b/src/output.c
index 86d8b5c..4cdbfa6 100644
--- a/src/output.c
+++ b/src/output.c
@@ -320,7 +320,7 @@ op_begin_std_fontsize (OutputPersonality *op, int size)
 	if (!found_std_expr) {
 		if (op->fontsize_begin) {
 			char expr[16];
-			sprintf (expr, "%d", size);
+			snprintf(expr, 16, "%d", size);
 			if (safe_printf (1, op->fontsize_begin, expr)) fprintf(stderr, TOO_MANY_ARGS, "fontsize_begin");
 		} else {
 			/* If we cannot write out a change for the exact
@@ -440,7 +440,7 @@ op_end_std_fontsize (OutputPersonality *op, int size)
 	if (!found_std_expr) {
 		if (op->fontsize_end) {
 			char expr[16];
-			sprintf (expr, "%d", size);
+			snprintf(expr, 16, "%d", size);
 			if (safe_printf(1, op->fontsize_end, expr)) fprintf(stderr, TOO_MANY_ARGS, "fontsize_end");
 		} else {
 			/* If we cannot write out a change for the exact
-
.11.0


code:
From: sms
Subject: Fix CVE-2014-8139: CRC32 verification heap-based overflow
Bug-Debian: http://bugs.debian.org/773722

--- a/extract.c
+++ b/extract.c
@@ -1,5 +1,5 @@
 /*
-  Copyright (c) 1990-2009 Info-ZIP.  All rights reserved.
+  Copyright (c) 1990-2014 Info-ZIP.  All rights reserved.

   See the accompanying file LICENSE, version 2009-Jan-02 or later
   (the contents of which are also included in unzip.h) for terms of use.
@@ -298,6 +298,8 @@
 #ifndef SFX
    static ZCONST char Far InconsistEFlength[] = "bad extra-field entry:\n \
      EF block length (%u bytes) exceeds remaining EF data (%u bytes)\n";
+   static ZCONST char Far TooSmallEFlength[] = "bad extra-field entry:\n \
+     EF block length (%u bytes) invalid (< %d)\n";
    static ZCONST char Far InvalidComprDataEAs[] =
      " invalid compressed data for EAs\n";
 #  if (defined(WIN32) && defined(NTSD_EAS))
@@ -2023,7 +2025,8 @@
         ebID = makeword(ef);
         ebLen = (unsigned)makeword(ef+EB_LEN);

-        if (ebLen > (ef_len - EB_HEADSIZE)) {
+        if (ebLen > (ef_len - EB_HEADSIZE))
+        {
            /* Discovered some extra field inconsistency! */
             if (uO.qflag)
                 Info(slide, 1, ((char *)slide, "%-22s ",
@@ -2032,6 +2035,16 @@
               ebLen, (ef_len - EB_HEADSIZE)));
             return PK_ERR;
         }
+        else if (ebLen < EB_HEADSIZE)
+        {
+            /* Extra block length smaller than header length. */
+            if (uO.qflag)
+                Info(slide, 1, ((char *)slide, "%-22s ",
+                  FnFilter1(G.filename)));
+            Info(slide, 1, ((char *)slide, LoadFarString(TooSmallEFlength),
+              ebLen, EB_HEADSIZE));
+            return PK_ERR;
+        }

         switch (ebID) {
             case EF_OS2:


code:
From: sms
Subject: Fix CVE-2014-8140: out-of-bounds write issue in test_compr_eb()
Bug-Debian: http://bugs.debian.org/773722

--- a/extract.c
+++ b/extract.c
@@ -2234,10 +2234,17 @@
     if (compr_offset < 4)                /* field is not compressed: */
         return PK_OK;                    /* do nothing and signal OK */

+    /* Return no/bad-data error status if any problem is found:
+     *    1. eb_size is too small to hold the uncompressed size
+     *       (eb_ucsize).  (Else extract eb_ucsize.)
+     *    2. eb_ucsize is zero (invalid).  2014-12-04 SMS.
+     *    3. eb_ucsize is positive, but eb_size is too small to hold
+     *       the compressed data header.
+     */
     if ((eb_size < (EB_UCSIZE_P + 4)) ||
-        ((eb_ucsize = makelong(eb+(EB_HEADSIZE+EB_UCSIZE_P))) > 0L &&
-         eb_size <= (compr_offset + EB_CMPRHEADLEN)))
-        return IZ_EF_TRUNC;               /* no compressed data! */
+     ((eb_ucsize = makelong( eb+ (EB_HEADSIZE+ EB_UCSIZE_P))) == 0L) ||
+     ((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN))))
+        return IZ_EF_TRUNC;             /* no/bad compressed data! */

     if (
 #ifdef INT_16BIT


code:
From: sms
Subject: Fix CVE-2014-8141: out-of-bounds read issues in getZip64Data()
Bug-Debian: http://bugs.debian.org/773722

--- a/fileio.c
+++ b/fileio.c
@@ -176,6 +176,8 @@
 #endif
 static ZCONST char Far ExtraFieldTooLong[] =
   "warning:  extra field too long (%d).  Ignoring...\n";
+static ZCONST char Far ExtraFieldCorrupt[] =
+  "warning:  extra field (type: 0x%04x) corrupt.  Continuing...\n";

 #ifdef WINDLL
    static ZCONST char Far DiskFullQuery[] =
@@ -2295,7 +2297,12 @@
             if (readbuf(__G__ (char *)G.extra_field, length) == 0)
                 return PK_EOF;
             /* Looks like here is where extra fields are read */
-            getZip64Data(__G__ G.extra_field, length);
+            if (getZip64Data(__G__ G.extra_field, length) != PK_COOL)
+            {
+                Info(slide, 0x401, ((char *)slide,
+                 LoadFarString( ExtraFieldCorrupt), EF_PKSZ64));
+                error = PK_WARN;
+            }
 #ifdef UNICODE_SUPPORT
             G.unipath_filename = NULL;
             if (G.UzO.U_flag < 2) {
--- a/process.c
+++ b/process.c
@@ -1,5 +1,5 @@
 /*
-  Copyright (c) 1990-2009 Info-ZIP.  All rights reserved.
+  Copyright (c) 1990-2014 Info-ZIP.  All rights reserved.

   See the accompanying file LICENSE, version 2009-Jan-02 or later
   (the contents of which are also included in unzip.h) for terms of use.
@@ -1901,48 +1901,82 @@
     and a 4-byte version of disk start number.
     Sets both local header and central header fields.  Not terribly clever,
     but it means that this procedure is only called in one place.
+
+    2014-12-05 SMS.
+    Added checks to ensure that enough data are available before calling
+    makeint64() or makelong().  Replaced various sizeof() values with
+    simple ("4" or "8") constants.  (The Zip64 structures do not depend
+    on our variable sizes.)  Error handling is crude, but we should now
+    stay within the buffer.
   ---------------------------------------------------------------------------*/

+#define Z64FLGS 0xffff
+#define Z64FLGL 0xffffffff
+
     if (ef_len == 0 || ef_buf == NULL)
         return PK_COOL;

     Trace((stderr,"\ngetZip64Data: scanning extra field of length %u\n",
       ef_len));

-    while (ef_len >= EB_HEADSIZE) {
+    while (ef_len >= EB_HEADSIZE)
+    {
         eb_id = makeword(EB_ID + ef_buf);
         eb_len = makeword(EB_LEN + ef_buf);

-        if (eb_len > (ef_len - EB_HEADSIZE)) {
-            /* discovered some extra field inconsistency! */
+        if (eb_len > (ef_len - EB_HEADSIZE))
+        {
+            /* Extra block length exceeds remaining extra field length. */
             Trace((stderr,
               "getZip64Data: block length %u > rest ef_size %u\n", eb_len,
               ef_len - EB_HEADSIZE));
             break;
         }
-        if (eb_id == EF_PKSZ64) {
-
+        if (eb_id == EF_PKSZ64)
+        {
           int offset = EB_HEADSIZE;

-          if (G.crec.ucsize == 0xffffffff || G.lrec.ucsize == 0xffffffff){
-            G.lrec.ucsize = G.crec.ucsize = makeint64(offset + ef_buf);
-            offset += sizeof(G.crec.ucsize);
+          if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL))
+          {
+            if (offset+ 8 > ef_len)
+              return PK_ERR;
+
+            G.crec.ucsize = G.lrec.ucsize = makeint64(offset + ef_buf);
+            offset += 8;
           }
-          if (G.crec.csize == 0xffffffff || G.lrec.csize == 0xffffffff){
-            G.csize = G.lrec.csize = G.crec.csize = makeint64(offset + ef_buf);
-            offset += sizeof(G.crec.csize);
+
+          if ((G.crec.csize == Z64FLGL) || (G.lrec.csize == Z64FLGL))
+          {
+            if (offset+ 8 > ef_len)
+              return PK_ERR;
+
+            G.csize = G.crec.csize = G.lrec.csize = makeint64(offset + ef_buf);
+            offset += 8;
           }
-          if (G.crec.relative_offset_local_header == 0xffffffff){
+
+          if (G.crec.relative_offset_local_header == Z64FLGL)
+          {
+            if (offset+ 8 > ef_len)
+              return PK_ERR;
+
             G.crec.relative_offset_local_header = makeint64(offset + ef_buf);
-            offset += sizeof(G.crec.relative_offset_local_header);
+            offset += 8;
           }
-          if (G.crec.disk_number_start == 0xffff){
+
+          if (G.crec.disk_number_start == Z64FLGS)
+          {
+            if (offset+ 4 > ef_len)
+              return PK_ERR;
+
             G.crec.disk_number_start = (zuvl_t)makelong(offset + ef_buf);
-            offset += sizeof(G.crec.disk_number_start);
+            offset += 4;
           }
+#if 0
+          break;                /* Expect only one EF_PKSZ64 block. */
+#endif /* 0 */
         }

-        /* Skip this extra field block */
+        /* Skip this extra field block. */
         ef_buf += (eb_len + EB_HEADSIZE);
         ef_len -= (eb_len + EB_HEADSIZE);
     }


code:
Copied from Fedora.

http://pkgs.fedoraproject.org/cgit/unzip.git/plain/unzip-6.0-overflow.patch?id=d18f821e

diff --git a/extract.c b/extract.c
index a0a4929..9ef80b3 100644
--- a/extract.c
+++ b/extract.c
@@ -2214,6 +2214,7 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata)
     ulg eb_ucsize;
     uch *eb_ucptr;
     int r;
+    ush method;

     if (compr_offset < 4)                /* field is not compressed: */
         return PK_OK;                    /* do nothing and signal OK */
@@ -2223,6 +2224,12 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata)
          eb_size <= (compr_offset + EB_CMPRHEADLEN)))
         return IZ_EF_TRUNC;               /* no compressed data! */

+    method = makeword(eb + (EB_HEADSIZE + compr_offset));
+    if ((method == STORED) && (eb_size != compr_offset + EB_CMPRHEADLEN + eb_ucsize))
+        return PK_ERR;            /* compressed & uncompressed
+                                   * should match in STORED
+                                   * method */
+
     if (
 #ifdef INT_16BIT
         (((ulg)(extent)eb_ucsize) != eb_ucsize) ||


code:
Copied from Debian.

From: Petr Stodulka <pstodulk@redhat.com>
Date: Mon, 14 Sep 2015 18:23:17 +0200
Subject: Upstream fix for heap overflow
Bug-Debian: https://bugs.debian.org/802162
Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1260944
Origin: https://bugzilla.redhat.com/attachment.cgi?id=1073002
Forwarded: yes

---
 crypt.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/crypt.c
+++ b/crypt.c
@@ -465,7 +465,17 @@
     GLOBAL(pInfo->encrypted) = FALSE;
     defer_leftover_input(__G);
     for (n = 0; n < RAND_HEAD_LEN; n++) {
-        b = NEXTBYTE;
+        /* 2012-11-23 SMS.  (OUSPG report.)
+         * Quit early if compressed size < HEAD_LEN.  The resulting
+         * error message ("unable to get password") could be improved,
+         * but it's better than trying to read nonexistent data, and
+         * then continuing with a negative G.csize.  (See
+         * fileio.c:readbyte()).
+         */
+        if ((b = NEXTBYTE) == (ush)EOF)
+        {
+            return PK_ERR;
+        }
         h[n] = (uch)b;
         Trace((stdout, " (%02x)", h[n]));
     }


code:
Copied from Debian.

From: Kamil Dudka <kdudka@redhat.com>
Date: Mon, 14 Sep 2015 18:24:56 +0200
Subject: fix infinite loop when extracting empty bzip2 data
Bug-Debian: https://bugs.debian.org/802160
Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1260944
Origin: other, https://bugzilla.redhat.com/attachment.cgi?id=1073339

---
 extract.c | 6 ++++++
 1 file changed, 6 insertions(+)

--- a/extract.c
+++ b/extract.c
@@ -2728,6 +2728,12 @@
     int repeated_buf_err;
     bz_stream bstrm;

+    if (G.incnt <= 0 && G.csize <= 0L) {
+        /* avoid an infinite loop */
+        Trace((stderr, "UZbunzip2() got empty input\n"));
+        return 2;
+    }
+
 #if (defined(DLL) && !defined(NO_SLIDE_REDIR))
     if (G.redirect_slide)
         wsize = G.redirect_size, redirSlide = G.redirect_buffer;


code:
Copied from Debian.

From: Santiago Vila <sanvila@debian.org>
Subject: zipinfo.c: Do not crash when hostver byte is >= 100

--- a/zipinfo.c
+++ b/zipinfo.c
@@ -2114,7 +2114,7 @@
             else
                 attribs[9] = (xattr & UNX_ISVTX)? 'T' : '-';  /* T==undefined */

-            sprintf(&attribs[12], "%u.%u", hostver/10, hostver%10);
+            sprintf(&attribs[11], "%2u.%u", hostver/10, hostver%10);
             break;

     } /* end switch (hostnum: external attributes format) */


code:
Copied from Fedora.

http://pkgs.fedoraproject.org/cgit/unzip.git/plain/unzip-6.0-attribs-overflow.patch?id=d18f821e

diff -up unzip60/zipinfo.c.attribs-overflow unzip60/zipinfo.c
--- unzip60/zipinfo.c.attribs-overflow	2009-11-30 09:55:39.000000000 +0100
+++ unzip60/zipinfo.c	2009-11-30 09:56:42.844263244 +0100
@@ -1881,7 +1881,7 @@ static int zi_short(__G)   /* return PK-
 #endif
     int         k, error, error_in_archive=PK_COOL;
     unsigned    hostnum, hostver, methid, methnum, xattr;
-    char        *p, workspace[12], attribs[16];
+    char        *p, workspace[12], attribs[17];
     char        methbuf[5];
     static ZCONST char dtype[5]="NXFS"; /* normal, maximum, fast, superfast */
     static ZCONST char Far os[NUM_HOSTS+1][4] = {


code:
Copied from Fedora.

http://pkgs.fedoraproject.org/cgit/unzip.git/plain/unzip-6.0-format-secure.patch?id=d18f821e

diff --git a/extract.c b/extract.c
index eeb2f57..a0a4929 100644
--- a/extract.c
+++ b/extract.c
@@ -472,8 +472,8 @@ int extract_or_test_files(__G)    /* return PK-type error code */
                      */
                     Info(slide, 0x401, ((char *)slide,
                       LoadFarString(CentSigMsg), j + blknum*DIR_BLKSIZ + 1));
-                    Info(slide, 0x401, ((char *)slide,
-                      LoadFarString(ReportMsg)));
+                    Info(slide, 0x401,
+                         ((char *)slide,"%s", LoadFarString(ReportMsg)));
                     error_in_archive = PK_BADERR;
                 }
                 reached_end = TRUE;     /* ...so no more left to do */
@@ -752,8 +752,8 @@ int extract_or_test_files(__G)    /* return PK-type error code */

 #ifndef SFX
     if (no_endsig_found) {                      /* just to make sure */
-        Info(slide, 0x401, ((char *)slide, LoadFarString(EndSigMsg)));
-        Info(slide, 0x401, ((char *)slide, LoadFarString(ReportMsg)));
+        Info(slide, 0x401, ((char *)slide,"%s", LoadFarString(EndSigMsg)));
+        Info(slide, 0x401, ((char *)slide,"%s", LoadFarString(ReportMsg)));
         if (!error_in_archive)       /* don't overwrite stronger error */
             error_in_archive = PK_WARN;
     }
diff --git a/list.c b/list.c
index 15e0011..f7359c3 100644
--- a/list.c
+++ b/list.c
@@ -181,7 +181,7 @@ int list_files(__G)    /* return PK-type error code */
                 Info(slide, 0x401,
                      ((char *)slide, LoadFarString(CentSigMsg), j));
                 Info(slide, 0x401,
-                     ((char *)slide, LoadFarString(ReportMsg)));
+                     ((char *)slide,"%s", LoadFarString(ReportMsg)));
                 return PK_BADERR;   /* sig not found */
             }
         }
@@ -507,7 +507,8 @@ int list_files(__G)    /* return PK-type error code */
             && (!G.ecrec.is_zip64_archive)
             && (memcmp(G.sig, end_central_sig, 4) != 0)
            ) {          /* just to make sure again */
-            Info(slide, 0x401, ((char *)slide, LoadFarString(EndSigMsg)));
+            Info(slide, 0x401,
+                 ((char *)slide,"%s", LoadFarString(EndSigMsg)));
             error_in_archive = PK_WARN;   /* didn't find sig */
         }

@@ -591,7 +592,7 @@ int get_time_stamp(__G__ last_modtime, nmember)  /* return PK-type error code */
                 Info(slide, 0x401,
                      ((char *)slide, LoadFarString(CentSigMsg), j));
                 Info(slide, 0x401,
-                     ((char *)slide, LoadFarString(ReportMsg)));
+                     ((char *)slide,"%s", LoadFarString(ReportMsg)));
                 return PK_BADERR;   /* sig not found */
             }
         }
@@ -674,7 +675,7 @@ int get_time_stamp(__G__ last_modtime, nmember)  /* return PK-type error code */
   ---------------------------------------------------------------------------*/

     if (memcmp(G.sig, end_central_sig, 4)) {    /* just to make sure again */
-        Info(slide, 0x401, ((char *)slide, LoadFarString(EndSigMsg)));
+        Info(slide, 0x401, ((char *)slide,"%s", LoadFarString(EndSigMsg)));
         error_in_archive = PK_WARN;
     }
     if (*nmember == 0L && error_in_archive <= PK_WARN)
diff --git a/zipinfo.c b/zipinfo.c
index 6e22cc8..ac5c61b 100644
--- a/zipinfo.c
+++ b/zipinfo.c
@@ -771,7 +771,7 @@ int zipinfo(__G)   /* return PK-type error code */
                 Info(slide, 0x401,
                      ((char *)slide, LoadFarString(CentSigMsg), j));
                 Info(slide, 0x401,
-                     ((char *)slide, LoadFarString(ReportMsg)));
+                     ((char *)slide,"%s", LoadFarString(ReportMsg)));
                 error_in_archive = PK_BADERR;   /* sig not found */
                 break;
             }
@@ -960,7 +960,8 @@ int zipinfo(__G)   /* return PK-type error code */
             && (!G.ecrec.is_zip64_archive)
             && (memcmp(G.sig, end_central_sig, 4) != 0)
            ) {          /* just to make sure again */
-            Info(slide, 0x401, ((char *)slide, LoadFarString(EndSigMsg)));
+            Info(slide, 0x401,
+                 ((char *)slide,"%s", LoadFarString(EndSigMsg)));
             error_in_archive = PK_WARN;   /* didn't find sig */
         }


code:
Copied from Debian.

From: Andreas Schwab <schwab@linux-m68k.org>
Subject: Initialize the symlink flag
Bug-Debian: http://bugs.debian.org/717029
X-Debian-version: 6.0-10

--- a/process.c
+++ b/process.c
@@ -1758,6 +1758,12 @@
         = (G.crec.general_purpose_bit_flag & (1 << 11)) == (1 << 11);
 #endif

+#ifdef SYMLINKS
+    /* Initialize the symlink flag, may be set by the platform-specific
+       mapattr function.  */
+    G.pInfo->symlink = 0;
+#endif
+
     return PK_COOL;

 } /* end function process_cdir_file_hdr() */


code:
Copied from Fedora.

http://pkgs.fedoraproject.org/cgit/unzip.git/plain/unzip-6.0-overflow-long-fsize.patch?id=d18f821e

diff --git a/list.c b/list.c
index f7359c3..4c3d703 100644
--- a/list.c
+++ b/list.c
@@ -97,7 +97,7 @@ int list_files(__G)    /* return PK-type error code */
 {
     int do_this_file=FALSE, cfactor, error, error_in_archive=PK_COOL;
 #ifndef WINDLL
-    char sgn, cfactorstr[10];
+    char sgn, cfactorstr[13];
     int longhdr=(uO.vflag>1);
 #endif
     int date_format;
@@ -339,7 +339,19 @@ int list_files(__G)    /* return PK-type error code */
                 G.crec.compression_method == ENHDEFLATED) {
                 methbuf[5] = dtype[(G.crec.general_purpose_bit_flag>>1) & 3];
             } else if (methnum >= NUM_METHODS) {
-                sprintf(&methbuf[4], "%03u", G.crec.compression_method);
+                /* 2013-02-26 SMS.
+                 * http://sourceforge.net/tracker/?func=detail
+                 *  &aid=2861648&group_id=118012&atid=679786
+                 * Unexpectedly large compression methods overflow
+                 * &methbuf[].  Use the old, three-digit decimal format
+                 * for values which fit.  Otherwise, sacrifice the
+                 * colon, and use four-digit hexadecimal.
+                 */
+                if (G.crec.compression_method <= 999) {
+                    sprintf( &methbuf[ 4], "%03u", G.crec.compression_method);
+                } else {
+                    sprintf( &methbuf[ 3], "%04X", G.crec.compression_method);
+                }
             }

 #if 0       /* GRR/Euro:  add this? */


code:
Extracted from a patch in Fedora.

http://pkgs.fedoraproject.org/cgit/unzip.git/tree/unzip-6.0-heap-overflow-infloop.patch?id=d18f821e

From bd150334fb4084f5555a6be26b015a0671cb5b74 Mon Sep 17 00:00:00 2001
From: Kamil Dudka <kdudka@redhat.com>
Date: Tue, 22 Sep 2015 18:52:23 +0200
Subject: [PATCH 3/3] extract: prevent unsigned overflow on invalid input

Suggested-by: Stefan Cornelius
---
 extract.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/extract.c b/extract.c
index 29db027..b9ae667 100644
--- a/extract.c
+++ b/extract.c
@@ -1257,8 +1257,17 @@ static int extract_or_test_entrylist(__G__ numchunk,
         if (G.lrec.compression_method == STORED) {
             zusz_t csiz_decrypted = G.lrec.csize;

-            if (G.pInfo->encrypted)
+            if (G.pInfo->encrypted) {
+                if (csiz_decrypted <= 12) {
+                    /* handle the error now to prevent unsigned overflow */
+                    Info(slide, 0x401, ((char *)slide,
+                      LoadFarStringSmall(ErrUnzipNoFile),
+                      LoadFarString(InvalidComprData),
+                      LoadFarStringSmall2(Inflate)));
+                    return PK_ERR;
+                }
                 csiz_decrypted -= 12;
+            }
             if (G.lrec.ucsize != csiz_decrypted) {
                 Info(slide, 0x401, ((char *)slide,
                   LoadFarStringSmall2(WrnStorUCSizCSizDiff),
--
2.5.2


code:
Copied from Debian.

From: Jérémy Bobbio <lunar@debian.org>
Subject: Remove build date
Bug-Debian: http://bugs.debian.org/782851
 In order to make unzip build reproducibly, we remove the
 (already optional) build date from the binary.

--- a/unix/unix.c
+++ b/unix/unix.c
@@ -1705,7 +1705,7 @@
 #endif /* Sun */
 #endif /* SGI */

-#ifdef __DATE__
+#if 0
       " on ", __DATE__
 #else
       "", ""


code:
Remove explicit set of UPOWER_CONF_FILE_NAME in up-self-test.c;
instead the harness should set it.  In Guix we set it explicitly; the
right thing is to use AM_TEST_ENVIRONMENT and regenerate the
makefiles, but we can't regenerate because current autotools carp on
some things, so we patch the Makefile.in instead.

Also fix to not try to create /var/lib/upower if /var isn't writable.

Patch by Andy Wingo <wingo@igalia.com>

--- upower-0.99.2.orig/src/Makefile.in	2014-12-18 10:32:01.000000000 +0100
+++ upower-0.99.2/src/Makefile.in	2015-04-04 19:49:28.020843678 +0200
@@ -780,6 +780,7 @@

 @UP_BUILD_TESTS_TRUE@up_self_test_CFLAGS = $(AM_CFLAGS) $(WARNINGFLAGS_C)
 @UP_BUILD_TESTS_TRUE@TESTS_ENVIRONMENT = $(DBUS_LAUNCH)
+@UP_BUILD_TESTS_TRUE@AM_TESTS_ENVIRONMENT = UPOWER_CONF_FILE_NAME=$(top_srcdir)/etc/UPower.conf
 dbusservicedir = $(datadir)/dbus-1/system-services
 dbusservice_in_files = org.freedesktop.UPower.service.in
 dbusservice_DATA = $(dbusservice_in_files:.service.in=.service)
@@ -1789,7 +1790,7 @@
 @HAVE_SYSTEMDSYSTEMUNITDIR_TRUE@	@sed -e "s|\@libexecdir\@|$(libexecdir)|" $< > $@

 install-data-hook:
-	if test -w $(DESTDIR)$(prefix)/; then \
+	if test -w $(DESTDIR)$(localstatedir)/; then \
 		mkdir -p $(DESTDIR)$(historydir); \
 	fi

--- upower-0.99.2.orig/src/up-self-test.c	2014-07-17 09:46:15.000000000 +0200
+++ upower-0.99.2/src/up-self-test.c	2015-04-04 18:43:04.952741927 +0200
@@ -295,12 +295,6 @@
 #endif
 	g_test_init (&argc, &argv, NULL);

-	/* make check, vs. make distcheck */
-	if (g_file_test ("../etc/UPower.conf", G_FILE_TEST_EXISTS))
-		g_setenv ("UPOWER_CONF_FILE_NAME", "../etc/UPower.conf", TRUE);
-	else
-		g_setenv ("UPOWER_CONF_FILE_NAME", "../../../etc/UPower.conf", TRUE);
-
 	/* tests go here */
 	g_test_add_func ("/power/backend", up_test_backend_func);
 	g_test_add_func ("/power/device", up_test_device_func);


code:
From 3e0c2966dffb5dadb512a476ef4be3d0cc51c2be Mon Sep 17 00:00:00 2001
From: Pierre Neidhardt <ambrevar@gmail.com>
Date: Sat, 16 Jun 2018 16:35:00 +0200
Subject: [PATCH] Protect against bad crafted input

Also check for wrap-around when checking oversize involving e_shoff and e_shnum.

raised by https://github.com/upx/upx/pull/190
	modified:   p_lx_elf.cpp
---
 src/p_lx_elf.cpp | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/src/p_lx_elf.cpp b/src/p_lx_elf.cpp
index 822a7652..41e805ee 100644
--- a/src/p_lx_elf.cpp
+++ b/src/p_lx_elf.cpp
@@ -235,8 +235,17 @@ PackLinuxElf32::PackLinuxElf32help1(InputFile *f)
         sz_phdrs = 0;
         return;
     }
+    if (0==e_phnum) throwCantUnpack("0==e_phnum");
     e_phoff = get_te32(&ehdri.e_phoff);
+    unsigned const last_Phdr = e_phoff + e_phnum * sizeof(Elf32_Phdr);
+    if (last_Phdr < e_phoff || (unsigned long)file_size < last_Phdr) {
+        throwCantUnpack("bad e_phoff");
+    }
     e_shoff = get_te32(&ehdri.e_shoff);
+    unsigned const last_Shdr = e_shoff + e_shnum * sizeof(Elf32_Shdr);
+    if (last_Shdr < e_shoff || (unsigned long)file_size < last_Shdr) {
+        throwCantUnpack("bad e_shoff");
+    }
     sz_phdrs = e_phnum * e_phentsize;

     if (f && Elf32_Ehdr::ET_DYN!=e_type) {
@@ -599,8 +608,17 @@ PackLinuxElf64::PackLinuxElf64help1(InputFile *f)
         sz_phdrs = 0;
         return;
     }
+    if (0==e_phnum) throwCantUnpack("0==e_phnum");
     e_phoff = get_te64(&ehdri.e_phoff);
+    upx_uint64_t const last_Phdr = e_phoff + e_phnum * sizeof(Elf64_Phdr);
+    if (last_Phdr < e_phoff || (unsigned long)file_size < last_Phdr) {
+        throwCantUnpack("bad e_phoff");
+    }
     e_shoff = get_te64(&ehdri.e_shoff);
+    upx_uint64_t const last_Shdr = e_shoff + e_shnum * sizeof(Elf64_Shdr);
+    if (last_Shdr < e_shoff || (unsigned long)file_size < last_Shdr) {
+        throwCantUnpack("bad e_shoff");
+    }
     sz_phdrs = e_phnum * e_phentsize;

     if (f && Elf64_Ehdr::ET_DYN!=e_type) {
@@ -3763,6 +3781,9 @@ void PackLinuxElf64::pack4(OutputFile *fo, Filter &ft)

 void PackLinuxElf64::unpack(OutputFile *fo)
 {
+    if (e_phoff != sizeof(Elf64_Ehdr)) {// Phdrs not contiguous with Ehdr
+        throwCantUnpack("bad e_phoff");
+    }
     unsigned const c_phnum = get_te16(&ehdri.e_phnum);
     upx_uint64_t old_data_off = 0;
     upx_uint64_t old_data_len = 0;
@@ -3828,6 +3849,9 @@ void PackLinuxElf64::unpack(OutputFile *fo)
     unsigned total_out = 0;
     unsigned c_adler = upx_adler32(NULL, 0);
     unsigned u_adler = upx_adler32(NULL, 0);
+    if ((MAX_ELF_HDR - sizeof(Elf64_Ehdr))/sizeof(Elf64_Phdr) < u_phnum) {
+        throwCantUnpack("bad compressed e_phnum");
+    }

     // Packed ET_EXE has no PT_DYNAMIC.
     // Packed ET_DYN has original PT_DYNAMIC for info needed by rtld.
@@ -4383,6 +4407,9 @@ Elf64_Sym const *PackLinuxElf64::elf_lookup(char const *name) const

 void PackLinuxElf32::unpack(OutputFile *fo)
 {
+    if (e_phoff != sizeof(Elf32_Ehdr)) {// Phdrs not contiguous with Ehdr
+        throwCantUnpack("bad e_phoff");
+    }
     unsigned const c_phnum = get_te16(&ehdri.e_phnum);
     unsigned old_data_off = 0;
     unsigned old_data_len = 0;
@@ -4449,6 +4476,9 @@ void PackLinuxElf32::unpack(OutputFile *fo)
     unsigned total_out = 0;
     unsigned c_adler = upx_adler32(NULL, 0);
     unsigned u_adler = upx_adler32(NULL, 0);
+    if ((MAX_ELF_HDR - sizeof(Elf32_Ehdr))/sizeof(Elf32_Phdr) < u_phnum) {
+        throwCantUnpack("bad compressed e_phnum");
+    }

     // Packed ET_EXE has no PT_DYNAMIC.
     // Packed ET_DYN has original PT_DYNAMIC for info needed by rtld.
--
2.17.0