SOURCES/less-590-fix_sast1.patch

@@ -1,26 +0,0 @@
-diff -up less-590/command.c.fix_sast1 less-590/command.c
---- less-590/command.c.fix_sast1	2021-06-03 19:45:48.000000000 +0200
-+++ less-590/command.c	2024-08-06 23:28:58.042048590 +0200
-@@ -927,8 +927,8 @@ getcc_repl(orig, repl, gr_getc, gr_unget
- 	LWCHAR (*gr_getc)(VOID_PARAM);
- 	void (*gr_ungetc)(LWCHAR);
- {
--	LWCHAR c;
--	LWCHAR keys[16];
-+	char c;
-+	char keys[16];
- 	int ki = 0;
- 
- 	c = (*gr_getc)();
-diff -up less-590/decode.c.fix_sast1 less-590/decode.c
---- less-590/decode.c.fix_sast1	2024-08-06 23:28:58.041048580 +0200
-+++ less-590/decode.c	2024-08-06 23:29:55.715615701 +0200
-@@ -934,7 +934,7 @@ add_hometable(call_lesskey, envname, def
- 	char *def_filename;
- 	int sysvar;
- {
--	char *filename;
-+	char *filename = NULL;
- 	int r;
- 
- 	if (envname != NULL && (filename = lgetenv(envname)) != NULL)

SOURCES/less-590-fix_sast2.patch

@@ -1,53 +0,0 @@
-diff -up less-590/lesskey_parse.c.fix_sast2 less-590/lesskey_parse.c
---- less-590/lesskey_parse.c.fix_sast2	2024-08-06 23:42:33.839079731 +0200
-+++ less-590/lesskey_parse.c	2024-08-06 23:47:17.433874330 +0200
-@@ -548,9 +548,9 @@ parse_lesskey(infile, tables)
- 	FILE *desc;
- 	char line[1024];
- 
--	if (infile == NULL)
--		infile = homefile(DEF_LESSKEYINFILE);
--	lesskey_file = infile;
-+	lesskey_file = (infile != NULL) ? strdup(infile) : homefile(DEF_LESSKEYINFILE);
-+	if (lesskey_file == NULL)
-+		return (-1);
- 
- 	init_tables(tables);
- 	errors = 0;
-@@ -559,22 +559,29 @@ parse_lesskey(infile, tables)
- 	/*
- 	 * Open the input file.
- 	 */
--	if (strcmp(infile, "-") == 0)
-+	if (strcmp(lesskey_file, "-") == 0)
- 		desc = stdin;
--	else if ((desc = fopen(infile, "r")) == NULL)
-+	else if ((desc = fopen(lesskey_file, "r")) == NULL)
- 	{
--		/* parse_error("cannot open lesskey file ", infile); */
--		return (-1);
-+		/* parse_error("cannot open lesskey file %s", lesskey_file); */
-+		errors = -1;
- 	}
- 
- 	/*
- 	 * Read and parse the input file, one line at a time.
- 	 */
--	while (fgets(line, sizeof(line), desc) != NULL)
-+	if (desc != NULL)
- 	{
--		++linenum;
--		parse_line(line, tables);
-+		while (fgets(line, sizeof(line), desc) != NULL)
-+		{
-+			++linenum;
-+			parse_line(line, tables);
-+		}
-+		if (desc != stdin)
-+			fclose(desc);
- 	}
-+	free(lesskey_file);
-+	lesskey_file = NULL;
- 
- 	return (errors);
- }

SPECS/less.spec

@@ -1,7 +1,7 @@
 Summary: A text file browser similar to more, but better
 Name: less
 Version: 590
-Release: 5%{?dist}
+Release: 4%{?dist}
 License: GPLv3+ or BSD
 Source0: https://www.greenwoodsoftware.com/less/%{name}-%{version}.tar.gz
 Source1: lesspipe.sh
@@ -17,16 +17,7 @@ Patch10: less-458-lesskey-usage.patch
 Patch11: less-458-old-bot-in-help.patch
 Patch12: less-590-CVE-2022-46663.patch
 Patch13: less-590-CVE-2022-48624.patch
-# from upstream, for less < 661 , RHEL-32739
 Patch14: less-590-CVE-2024-32487.patch
-
-# from upstream, for less < 661, RHEL-51178
-# based on https://github.com/gwsw/less/commit/2a79e5cd341f9c8437a71096c23c8fe8e94b7d0a
-# based on https://github.com/gwsw/less/commit/987ebdc424c4865bf883eb0b11aea2b261b353f2
-Patch15: less-590-fix_sast1.patch
-
-# from upstream, for less < 661, based on commit#1649cc355a9eb824837feb4359828f5627e2eb69, RHEL-51178
-Patch16: less-590-fix_sast2.patch
 URL: https://www.greenwoodsoftware.com/less/
 BuildRequires: ncurses-devel
 BuildRequires: autoconf automake libtool
@@ -44,19 +35,17 @@ files, and you'll use it frequently.
 
 %prep
 %setup -q
-%patch -P 4 -p1 -b .time
+%patch4 -p1 -b .time
-%patch -P 5 -p1 -b .fsync
+%patch5 -p1 -b .fsync
-%patch -P 6 -p1 -b .manpage-add-old-bot-option
+%patch6 -p1 -b .manpage-add-old-bot-option
-%patch -P 7 -p1 -b .help
+%patch7 -p1 -b .help
-%patch -P 8 -p1 -b .lessecho-usage
+%patch8 -p1 -b .lessecho-usage
-%patch -P 9 -p1 -b .less-filters-man
+%patch9 -p1 -b .less-filters-man
-%patch -P 10 -p1 -b .lesskey-usage
+%patch10 -p1 -b .lesskey-usage
-%patch -P 11 -p1 -b .old-bot
+%patch11 -p1 -b .old-bot
-%patch -P 12 -p1 -b .CVE-2022-46663
+%patch12 -p1 -b .CVE-2022-46663
-%patch -P 13 -p1 -b .CVE-2022-48624
+%patch13 -p1 -b .CVE-2022-48624
-%patch -P 14 -p1 -b .CVE-2024-32487
+%patch14 -p1 -b .CVE-2024-32487
-%patch -P 15 -p1 -b .fix_sast1
-%patch -P 16 -p1 -b .fix_sast2
 
 
 %build
@@ -80,14 +69,9 @@ install -p -m 644 %{SOURCE3} $RPM_BUILD_ROOT/etc/profile.d
 %{_mandir}/man1/*
 
 %changelog
-* Mon Oct 07 2024 MSVSphere Packaging Team <packager@msvsphere-os.ru> - 590-5
+* Tue Apr 23 2024 Matej Mužila <mmuzila@redhat.com> - 590-4
-- Rebuilt for MSVSphere 9.5 beta
+- Fix CVE-2024-32487
-
+- Resolves: RHEL-33773
-* Tue Aug 06 2024 Michal Hlavinka <mhlavink@redhat.com> - 590-5
-- fix static analysis findings (RHEL-51178)
-
-* Tue Aug 06 2024 Michal Hlavinka <mhlavink@redhat.com> - 590-4
-- fix less with LESSOPEN allowing command injection (CVE-2024-32487) (RHEL-32739)
 
 * Wed Feb 21 2024 Matej Mužila <mmuzila@redhat.com> 590-3
 - Fix CVE-2022-48624