A patch for the spec file too. :) Thank You. You are making it very easy to put in. I had just hoped that this latest errata had the fix in it. Have you filed this bug with the upstream vendor too? Troy Oleg Sadov wrote: > Hi, Troy! > > No, the latest evolution-data-server update is not fix it. Only one new > patch (evolution-data-server-1.8.0-apop-auth-vulnerability.patch) > included to this one and just fix only APOP authentication security bug. > > I hope, our patches (attached) will be helpful. > > --Oleg > > Troy Dawson wrote: >> Hi Oleg, >> Did the latest release of the evolution-data-server fix this problem? >> Troy >> >> Troy Dawson wrote: >>> Hi Oleg, >>> I'm hoping that The Upstream Vendor know's about the problem so that it >>> get's fixed upstream. But I definatly like simple one line fixes. If >>> it looks like RedHat isn't going to put it in anytime soon, then we'll >>> put it in testing for a short time, then into errata. >>> >>> As for building it. we used the 1.4.8 version of m4. There was several >>> rpm's that wouldn't build without it. That isn't the version that we >>> shipped, but we thought we had put the src.rpm in our SRPMS/SL area so >>> that others could use it. >>> After checking we saw that it wasn't there, so Connie just put it up >>> there right now. >>> ftp://ftp.scientificlinux.org/linux/scientific/5x/SRPMS/SL/m4-1.4.8-1.src.rpm >>> >>> >>> Troy >>> >>> Oleg Sadov wrote: >>>> At Sunday Time we spent a lot of time for testing of desktop environment >>>> in a fresh installation from SL50 and was slightly frustrated by >>>> crushing of Evolution during startup. In CentOS Evolution started >>>> without problems (but it has version 2.8.0-33, not 2.8.0-33.0.1). >>>> >>>> Further analisys shows dependency of this problem of last evolution- >>>> data-server timezone description changes. This bug may be reproduced by >>>> setting TZ environment variable, for example: >>>> >>>> TZ=Europe/Moscow evolution >>>> >>>> Some of bug-sensitive timezones: >>>> Russia -- Europe/Moscow, Europe/Volgograd, Asia/Irkutsk >>>> Indonesia -- Asia/Makassar, Asia/Ujung_Pandang >>>> Mongolia -- Asia/Ulaanbaatar, Asia/Ulan_Bator >>>> >>>> After looking to backtrace & source code debugging I found the root of >>>> evil -- into the last changes of data-server zoneinfo descriptions >>>> (evolution-data-server-1.8.0-updated-zoneinfo.patch) removed TZNAME tags >>>> from Australia/Perth.ics and Asia/Jerusalem.ics. As a consequence -- >>>> NULL pointer for TZ name string references, string comparison with NULL >>>> pointers an so on... >>>> >>>> Because, evolution-data-server is important infrastructure component not >>>> only for Evolution, but for some other GNOME components too, I think, >>>> this problem must be resolved. Given above, we have three ways for that: >>>> 1) quick&dirty -- setting up corresponding UTC-relative TZ (not exactly >>>> equivalent) or starting of evolution with --disable-eplugin option >>>> 2) orthodox -- downgrading of evolution-data-server package, or setting >>>> up TZNAME tags in Australia/Perth and Asia/Jerusalem timezones >>>> 3) hackers way -- source patching by single line of code (the patch is >>>> attached) >>>> >>>> Of course, further testing will be helpfull and, may be, escalating this >>>> problem to the upstream vendor will be reasonably. >>>> >>>> Apropos, Connie or/and Troy, which procedure was used for evolution- >>>> data-server package building? My rpmbuild on SL50 was finished with some >>>> error messages: >>>> >>>> ================================================== >>>> + aclocal >>>> configure.in:706: /usr/bin/m4: builtin `mkstemp' requested by frozen >>>> file is not supported >>>> autom4te: /usr/bin/m4 failed with exit status: 1 >>>> aclocal: autom4te failed with exit status: 1 >>>> ================================================== >>>> >>>> Seems like your package built by previous version of automake tool box. >>>> Package was rebuilded on SL50 only after removing `mkstemp' function >>>> checking directive in a line 706 of configure.in. >>>> >>>> --Oleg >>>> >>>> >>>> ------------------------------------------------------------------------ >>>> >>>> --- >>>> evolution-data-server-1.8.0/calendar/libical/src/libical/icaltimezone.c.orig >>>> 2007-05-25 01:20:43.000000000 +0400 >>>> +++ >>>> evolution-data-server-1.8.0/calendar/libical/src/libical/icaltimezone.c >>>> 2007-05-25 01:23:01.000000000 +0400 >>>> @@ -1433,6 +1433,8 @@ >>>> >>>> z_offset = get_offset(zone); >>>> >>>> + if (zone->tznames == NULL) continue; >>>> + >>>> if (z_offset == offset && !strcmp(tzname, zone->tznames)) >>>> return zone; >>>> } >>> >> >> -- >> __________________________________________________ >> Troy Dawson [log in to unmask] (630)840-6468 >> Fermilab ComputingDivision/LCSI/CSI DSS Group >> __________________________________________________ >> >> ------------------------------------------------------------------------ >> >> --- evolution-data-server-1.8.0/calendar/libical/src/libical/icaltimezone.c.orig 2007-05-25 01:20:43.000000000 +0400 >> +++ evolution-data-server-1.8.0/calendar/libical/src/libical/icaltimezone.c 2007-05-25 01:23:01.000000000 +0400 >> @@ -1433,6 +1433,8 @@ >> >> z_offset = get_offset(zone); >> >> + if (zone->tznames == NULL) continue; >> + >> if (z_offset == offset && !strcmp(tzname, zone->tznames)) >> return zone; >> } >> >> ------------------------------------------------------------------------ >> >> --- evolution-data-server.spec 2007-05-01 21:05:48.000000000 +0400 >> +++ evolution-data-server-1.8.0-15.0.3.1.spec 2007-06-07 13:33:39.000000000 +0400 >> @@ -25,7 +25,7 @@ >> >> Name: evolution-data-server >> Version: 1.8.0 >> -Release: 15.0.3%{?dist} >> +Release: 15.0.3.1%{?dist} >> License: LGPL >> Group: System Environment/Libraries >> Summary: Backend data server for Evolution >> @@ -87,6 +87,9 @@ >> # RH bug #235290 / GNOME bug #424373 >> Patch28: evolution-data-server-1.8.0-apop-auth-vulnerability.patch >> >> +# zone->tznames NULL pointer crash fix (ICS decsription without TZNAME tag) >> +Patch100: evolution-data-server-1.8.0-fix-timezone-crash.patch >> + >> ### Dependencies ### >> >> Requires: GConf2 >> @@ -184,6 +187,7 @@ >> %patch26 -p1 -b .emsgport-fix >> %patch27 -p1 -b .updated-zoneinfo >> %patch28 -p1 -b .apop-auth-vulnerability >> +%patch100 -p1 -b .icaltimezone >> >> mkdir -p krb5-fakeprefix/include >> mkdir -p krb5-fakeprefix/lib >> @@ -401,6 +405,9 @@ >> %{_libdir}/pkgconfig/libexchange-storage-%{eds_api_version}.pc >> >> %changelog >> +* Thu May 25 2007 Oleg Sadov <sadov at linux-ink dot ru> - 1.8.0-15.0.3.1.sl5 >> +- Fixed NULL-pointer tznames crash for timezone ICS VCARDs without TZNAME tag. >> + >> * Tue May 01 2007 Matthew Barnes <[log in to unmask]> - 1.8.0-15.0.3.el5 >> - Add patch for RH bug #235289 (APOP authentication vulnerability). >> -- __________________________________________________ Troy Dawson [log in to unmask] (630)840-6468 Fermilab ComputingDivision/LCSI/CSI DSS Group __________________________________________________