Re: libidn update for wheezy/jessie and CVE-2015-2059

[Alessandro Ghedini]

On Sat, Jul 18, 2015 at 03:47:23PM +0200, Florian Weimer wrote:
> * Alessandro Ghedini:
> 
> > On Sat, Jul 18, 2015 at 12:08:06pm +0200, Florian Weimer wrote:
> >> Hi,
> >> 
> >> would you please prepare a security update for wheezy and jessie for
> >> CVE-2015-2059?
> >
> > I had a look at this yesterday, but the libidn package in jessie
> > fails to build (even without the CVE-2015-2059 patch).
> 
> Details?  It builds for me.

It seems that when using pbuilder the failure is only triggered when the patch
is applied. The error I get is:

> /tmp/buildd/libidn-1.29/build-aux/missing: line 81: makeinfo: command not 
> found
> WARNING: 'makeinfo' is missing on your system.
>          You should only need it if you modified a '.texi' file, or
>          any other file indirectly affecting the aspect of the manual.
>          You might want to install the Texinfo package:
>          <http://www.gnu.org/software/texinfo/>
>          The spurious makeinfo call might also be the consequence of
>          using a buggy 'make' (AIX, DU, IRIX), in which case you might
>          want to install GNU make:
>          <http://www.gnu.org/software/make/>
> Makefile:1505: recipe for target 'libidn.info' failed

After adding texinfo (which provides makeinfo) to Build-Depends the build still
fails with:

> texi/stringprep_utf8_to_ucs4.texi:10: misplaced {
> texi/stringprep_utf8_to_ucs4.texi:10: misplaced }
> texi/stringprep_4i.texi:11: misplaced {
> texi/stringprep_4i.texi:11: misplaced }
> texi/stringprep_4i.texi:13: misplaced {
> texi/stringprep_4i.texi:13: misplaced }
> texi/stringprep_4i.texi:20: misplaced {
> texi/stringprep_4i.texi:20: misplaced }
> texi/stringprep_4i.texi:27: misplaced {
> texi/stringprep_4i.texi:27: misplaced }
> texi/stringprep_4i.texi:29: misplaced {
> texi/stringprep_4i.texi:29: misplaced }
> texi/stringprep_4i.texi:34: misplaced {
> texi/stringprep_4i.texi:34: misplaced }
> texi/stringprep_4i.texi:35: misplaced {
> texi/stringprep_4i.texi:35: misplaced }
> texi/stringprep.texi:8: misplaced {
> texi/stringprep.texi:8: misplaced }
> texi/stringprep.texi:10: misplaced {
> texi/stringprep.texi:10: misplaced }
> texi/stringprep.texi:23: misplaced {
> texi/stringprep.texi:23: misplaced }
> texi/stringprep.texi:25: misplaced {
> texi/stringprep.texi:25: misplaced }
> texi/stringprep.texi:30: misplaced {
> texi/stringprep.texi:30: misplaced }
> texi/stringprep_profile.texi:18: misplaced {
> texi/stringprep_profile.texi:18: misplaced }
> Makefile:1505: recipe for target 'libidn.info' failed

I think that the fact that the patch changes some Makefile.am files may trigger
a regeneration of some autotools files which then triggers a rebuild of the
documentation (which fails). Not sure what would be a good way to avoid it.

I attached my debdiff for jessie so far if you want to have a look.

Cheers

libidn_1.29-1+deb8u1.diff
Description: Text Data

signature.asc
Description: Digital signature