MantisBT - Doomseeker
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0003297Doomseeker[All Projects] Suggestionpublic2017-10-08 02:192018-10-27 22:55
ReporterWubTheCaptain 
Assigned ToZalewa 
PrioritynormalSeverityexploitReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOSOS Version
Product Version1.1 
Target Version1.1Fixed in Version1.2 
Summary0003297: Update bundled (and possibly vulnerable) zlib 1.2.7 dependency
DescriptionDoomseeker source bundles a private fork of zlib 1.2.7.

I propose it to be updated to a recent version.
Steps To Reproduce
Additional InformationThe README file incorrectly suggests the bundled zlib dependency version to be 1.2.5.

Suggested downstream by Gentoo GNU/Linux:'https://wiki.gentoo.org/wiki/Why_not_bundle_dependencies#What_to_do_upstream [^]'

Quote from Gentoo Wiki
When keeping dependency D bundled make sure to follow the upstream of D closely and update your copy to a recent version of D on every minor (and major) release to at least reduce the damage done to people using your bundled version a little.


Current release available is zlib 1.2.11.'http://zlib.net/ [^]'

Note: Vulnerabilities were discovered in zlib 1.2.8 (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843). Pre-cautionary exploit severity.
TagsNo tags attached.
Relationships
related to 0003238closed  Split Doomseeker's build dependencies off source archive distribution, distribute seperately 
child of 0003246acknowledged  Debian packaging 
Attached Fileslog diffoscope.log (34,005) 2017-11-09 05:45
/tracker/file_download.php?file_id=2276&type=bug
Issue History
Date ModifiedUsernameFieldChange
2017-10-08 02:19WubTheCaptainNew Issue
2017-10-08 02:20WubTheCaptainRelationship addedrelated to 0003238
2017-11-04 01:22WubTheCaptainTarget Version => 1.1
2017-11-04 01:24WubTheCaptainSummaryUpdate bundled zlib 1.2.7 dependency => Update bundled (and possibly vulnerable) zlib 1.2.7 dependency
2017-11-04 01:27WubTheCaptainRelationship addedchild of 0003279
2017-11-04 01:44WubTheCaptainRelationship deletedchild of 0003279
2017-11-04 01:44WubTheCaptainRelationship addedchild of 0003246
2017-11-04 09:17ZalewaAssigned To => Zalewa
2017-11-04 09:17ZalewaStatusnew => assigned
2017-11-08 21:39ZalewaNote Added: 0018825
2017-11-08 21:39ZalewaStatusassigned => feedback
2017-11-09 03:54Blzut3Note Added: 0018834
2017-11-09 05:13WubTheCaptainNote Added: 0018835
2017-11-09 05:13WubTheCaptainStatusfeedback => assigned
2017-11-09 05:21WubTheCaptainNote Added: 0018836
2017-11-09 05:21WubTheCaptainStatusassigned => needs review
2017-11-09 05:45WubTheCaptainFile Added: diffoscope.log
2017-11-09 05:45WubTheCaptainNote Added: 0018837
2017-11-09 05:46WubTheCaptainNote Edited: 0018837bug_revision_view_page.php?bugnote_id=18837#r11319
2017-11-09 05:48WubTheCaptainNote Edited: 0018837bug_revision_view_page.php?bugnote_id=18837#r11320
2017-11-09 05:50WubTheCaptainNote Edited: 0018837bug_revision_view_page.php?bugnote_id=18837#r11321
2017-11-11 11:18ZalewaNote Added: 0018854
2017-11-13 08:57Blzut3Note Added: 0018867
2017-11-13 11:15WubTheCaptainNote Added: 0018868
2017-11-13 17:16ZalewaStatusneeds review => resolved
2017-11-13 17:16ZalewaFixed in Version => 1.2
2017-11-13 17:16ZalewaResolutionopen => fixed
2018-10-27 22:55WubTheCaptainStatusresolved => closed

Notes
(0018825)
Zalewa   
2017-11-08 21:39   
I updated the dependencies/zlib to 1.2.11 as requested:'https://bitbucket.org/Doomseeker/doomseeker/commits/8443d61cf99d504a4a8cd6d0c3a7c74c65772109 [^]'

I wonder if we should take care of the other zlib copy that is in Mendeley Updater's code. We feed the updater with known archives, so exploitation risk is non-existant (?), but keeping & using another build of the same thing seems like asking for trouble.
(0018834)
Blzut3   
2017-11-09 03:54   
Are there any issues with switching it over? I can't imagine it would be that difficult to use the already existing targets.
(0018835)
WubTheCaptain   
2017-11-09 05:13   
There's a lot other things that go to Mendeley's code: An older repository without any license (no grant of rights, later relicensed at upstream under Expat license), CPOL-licensed dependencies, etc. It'd be best to file bugs upstream to Mendeley in that case, else leave it rot because of downstream consequences (wasted time opportunities in maintaining a private fork). (These issues don't have subtickets of 0003237 yet.)

You can obviously tell I don't like Mendeley at all, and my preference is to replace it completely (with something like 0003292, yes MSI can be network installed by admin and silent upgrades too).

Another ticket, 0003238, would've been my preference of resolution (as said in the Gentoo GNU/Linux wiki article), but that's apparently no go because of Microsoft Windows operating system family.

I'm unable to test this patch without much effort, because qtmultimedia5-dev package depends on zlib1g-dev and so I cannot build without using system library zlib (1.2.8) in Debian. I guess I'll run a diffoscope later to verify, but I have good faith in this to be resolved.
(0018836)
WubTheCaptain   
2017-11-09 05:21   
Forgot there's FORCE_INTERNAL_ZLIB option to cmake:

cmake -DFORCE_INTERNAL_ZLIB=YES $DOOMSEEKER_SOURCE


Builds fine with zlib 1.2.11 for me.
(0018837)
WubTheCaptain   
2017-11-09 05:45   
(edited on: 2017-11-09 05:50)
diffoscope log passes for me. Notice algorithm.txt, example.c and zlib.vcproj though. (The lattermost is a Doomseeker "feature".)

This is unexplained to be a Doomseeker thing:

if( CMAKE_C_COMPILER_ID STREQUAL "GNU" OR CMAKE_C_COMPILER_ID STREQUAL "Clang" 
)
    set( CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fPIC" )
endif()


It was probably in the old version too, though.
(0018854)
Zalewa   
2017-11-11 11:18   
The unexplained Doomseeker thing should be explained now.

Moreover, I removed zlib and bzip2 convenience copies from Mendeley's "external" directory. Blzut, you should check if it didn't break anything on Mac, especially when "use internals" are off.
(0018867)
Blzut3   
2017-11-13 08:57   
Appears to be fine on Mac.
(0018868)
WubTheCaptain   
2017-11-13 11:15   
Guess this is resolved, then.

Only a remaining question to be answered: What's the target version for this? 1.1 patch release or 1.2?