diff -u seamonkey-2.0.13+nobinonly/debian/changelog seamonkey-2.0.13+nobinonly/debian/changelog --- seamonkey-2.0.13+nobinonly/debian/changelog +++ seamonkey-2.0.13+nobinonly/debian/changelog @@ -1,3 +1,12 @@ +seamonkey (2.0.13+nobinonly-0ubuntu1.1) natty-proposed; urgency=low + + * fix LP: #72380 - Seamonkey triggers _FORTIFY_SOURCE crash on pages + with spellcheck enabled + - add debian/patches/lp723830_hunspell_fortify.patch + - update debian/patches/series + + -- Evan Broder Fri, 03 Jun 2011 08:56:36 -0700 + seamonkey (2.0.13+nobinonly-0ubuntu1) natty; urgency=low * New upstream release v2.0.13 (SEAMONKEY_2_0_13_RELEASE) diff -u seamonkey-2.0.13+nobinonly/debian/patches/series seamonkey-2.0.13+nobinonly/debian/patches/series --- seamonkey-2.0.13+nobinonly/debian/patches/series +++ seamonkey-2.0.13+nobinonly/debian/patches/series @@ -5,0 +6 @@ +lp723830_hunspell_fortify.patch only in patch2: unchanged: --- seamonkey-2.0.13+nobinonly.orig/debian/patches/lp723830_hunspell_fortify.patch +++ seamonkey-2.0.13+nobinonly/debian/patches/lp723830_hunspell_fortify.patch @@ -0,0 +1,36 @@ +Description: Fix hunspell crash from _FORTIFY_SOURCE + Ubuntu uses the system's copy of hunspell instead of the copy + embedded in seamonkey. In Ubuntu's version of hunspell, hp->word is + of type char[1] (instead of char), which makes &(hp->word) of type + char (*)[1]. + . + This causes _FORTIFY_SOURCE to conclude that hpw can only be a single + character long. Dropping the pointerization operator, combined with + the change in upstream hunspell, causes _FORTIFY_SOURCE to correctly + detect the "flexible array" idiom. +Author: Konstantin Khlebnikov +Author: Anders Kaseorg +Author: Evan Broder +Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=653914 +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/seamonkey/+bug/723830 +Forwarded: no + +Index: mozilla/mozilla/extensions/spellcheck/hunspell/src/hashmgr.cpp +=================================================================== +--- mozilla.orig/mozilla/extensions/spellcheck/hunspell/src/hashmgr.cpp 2011-06-03 08:33:48.626475893 -0700 ++++ mozilla/mozilla/extensions/spellcheck/hunspell/src/hashmgr.cpp 2011-06-03 08:36:33.429325727 -0700 +@@ -182,12 +182,12 @@ + int al, const char * desc, bool onlyupcase) + { + bool upcasehomonym = false; +- int descl = desc ? (aliasm ? sizeof(short) : strlen(desc) + 1) : 0; ++ int descl = desc ? (aliasm ? sizeof(char *) : strlen(desc) + 1) : 0; + // variable-length hash record with word and optional fields + struct hentry* hp = + (struct hentry *) malloc (sizeof(struct hentry) + wbl + descl); + if (!hp) return 1; +- char * hpw = &(hp->word); ++ char * hpw = hp->word; + strcpy(hpw, word); + if (ignorechars != NULL) { + if (utf8) {