Re: [Podofo-users] ABI fix for the fix CVE-2017-5852

[Peter L. <pli...@sc...>]

On Fri, 27 Oct 2017 00:54:11 +0200 (CEST)
Matthew Brincke <ma...@ma...> wrote:

> Hello Mattia,
> 
> > Mattia Rizzolo has written on 23. Oktober 2017 at 11:10:
> > 
> > On Sun, Oct 22, 2017 at 05:20:31PM +0200, Matthew Brincke wrote:  
> > > Debian bug 854600 [2], I wonder why no one answered to the last
> > > post ...)  
> > 
> > My fault.
> > TBH, I totally forgot of that. I suppose I could have come up with
> > simple patch to retain ABI compatibility on my own, but I forgot
> > and I haven't than that.  
> 
> that's likely a typo, what do you mean, please? I see from your Debian
> Maintainer Dashboard
> https://udd.debian.org/dmd/?mattia%40debian.org#todo that there are
> many to-do list entries, yet could you please accept my patch also?
> Could it be that the original one in the Debian bug report wasn't
> accepted for Jessie and later because of the ABI break? With that
> cured by my patch, wouldn't it be acceptable together? If not, please
> tell why not.
> 
> > > I wonder why changing a private method is relevant to ABI at all,
> > > and (at least when you're still unconvinced ;-) to accept) would
> > > welcome your elucidation (if you have come across any, to date),
> > > please ...  
> > 
> > There is a more widespread problem in podofo where all symbols are
> > exported and therefore are formally part of the public ABI (even if
> > not intended to). Even if I suppose no program within Debian uses
> > those symbols (I could check, I haven't), I would not happily break
> > the ABI nonetheless.
> >   
> Thanks for the explanation, there's one aspect I'm still curious
> about: I wonder why any C++ compiler, much less g++, would export any
> private symbols, as they aren't supposed to be accessible from
> anywhere (beyond their class and compilation unit) except for friend
> classes (can those reside in a different library/executable?), so
> maybe they should be marked PODOFO_LOCAL?
> 
> > https://sourceforge.net/p/podofo/mailman/message/35819398/
> > (then, the lack of an actual bug tracker makes those request/reports
> > very hard to track, and I wouldn't be surprised if many missed it,
> > or even if they did completely forgot about it, as many other
> > reports) 
> I concur, I'd also like a tracker for bug reports/feature requests,
> the sf.net one was probably closed because of spam, IIRC. Could maybe
> the bug reports be copied there by someone with the permissions for
> that?
> 

HI all,

I had set up Mantis on SF before.  As Dominic is the only admin, he the
only one with permissions to make changes.

Cheers,
Peter