Tue Apr 25 21:20:19 UTC 202320230425212019

d/git-2.40.1-x86_64-1.txz:  Upgraded.
  This update fixes security issues:
  By feeding specially crafted input to `git apply --reject`, a
  path outside the working tree can be overwritten with partially
  controlled contents (corresponding to the rejected hunk(s) from
  the given patch).
  When Git is compiled with runtime prefix support and runs without
  translated messages, it still used the gettext machinery to
  display messages, which subsequently potentially looked for
  translated messages in unexpected places. This allowed for
  malicious placement of crafted messages.
  When renaming or deleting a section from a configuration file,
  certain malicious configuration values may be misinterpreted as
  the beginning of a new configuration section, leading to arbitrary
  configuration injection.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-25652
    https://www.cve.org/CVERecord?id=CVE-2023-25815
    https://www.cve.org/CVERecord?id=CVE-2023-29007
  (* Security fix *)
n/snownews-1.11-x86_64-1.txz:  Upgraded.
xap/mozilla-firefox-112.0.2-x86_64-1.txz:  Upgraded.
  This is a bugfix release.
  For more information, see:
    https://www.mozilla.org/en-US/firefox/112.0.2/releasenotes/
xap/mozilla-thunderbird-102.10.1-x86_64-1.txz:  Upgraded.
  This is a bugfix release.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.10.1/releasenotes/

1 files changed, 172 insertions, 0 deletions

diff --git a/source/xap/mozilla-thunderbird/thunderbird-102.10.0-upstream_fixes-1.patch b/source/xap/mozilla-thunderbird/thunderbird-102.10.0-upstream_fixes-1.patch
new file mode 100644
index 000000000..c407bfcb4
--- /dev/null
+++ b/source/xap/mozilla-thunderbird/thunderbird-102.10.0-upstream_fixes-1.patch
@@ -0,0 +1,172 @@
+Submitted By:            Douglas R. Reno <renodr at linuxfromscratch dot org>
+Date:                    2022-03-19
+Initial Package Version: 102.9.0esr
+Upstream Status:         Applied
+Origin:                  rust-bindgen upstream (#2338 and #2319), Self
+Description:             Updates the bundled rust-bindgen crate to be compatible
+                         with Clang/LLVM 16.
+
+                         Without this patch, you will encounter "not a valid
+                         Ident" errors when building Firefox, and it will come
+                         out of fallback.rs in proc-macro2. This references
+                         mfbt/Vector.h (symlinked to 
+                         firefox-build-dir/dist/include/mozilla/Vector.h) in
+                         it's error output, but it is because LLVM changed how
+                         it reports anonymous items.
+
+diff -Naurp firefox-102.9.0.orig/third_party/rust/bindgen/.cargo-checksum.json firefox-102.9.0/third_party/rust/bindgen/.cargo-checksum.json
+--- firefox-102.9.0.orig/third_party/rust/bindgen/.cargo-checksum.json	2023-03-09 17:59:38.000000000 -0600
++++ firefox-102.9.0/third_party/rust/bindgen/.cargo-checksum.json	2023-03-19 21:04:15.981453212 -0500
+@@ -1 +1 @@
+-{"files":{"Cargo.lock":"836e8f8431bd4ebdac9b1251676f6afa755757e401455259fe659e7280be8230","Cargo.toml":"3a585a6e27a177f08dedcb21f7d555e9db58fa158203273b228db91ebee4e6b3","LICENSE":"c23953d9deb0a3312dbeaf6c128a657f3591acee45067612fa68405eaa4525db","README.md":"29fe30d7a2729922b13a578bc8f5eedc808fd0f2ef67a3f12017548baf8f293a","build.rs":"3fe1e534c99df4ee207606794f133fb187c0948e055389f74c904994ecaed38a","csmith-fuzzing/README.md":"7107b70fedb0c0a0cadb3c439a49c1bd0119a6d38dc63b1aecc74d1942256ef2","src/callbacks.rs":"1e5a118b94977938751758ac0495b1d41ce5e280c066614a4a7cbd930f326350","src/clang.rs":"aa0644278a8319506be08904c0f6706fbcdcd72eb1e85564b8c7488bd810e126","src/codegen/bitfield_unit.rs":"a8fb1a2d97a99685106fcaac87d2013f79d2690d6a46ff05ad1e3629b6075664","src/codegen/bitfield_unit_tests.rs":"dd252134118450800b516e375c872e17b4c1aee63a7b8adbe5b2cd53434bbc7e","src/codegen/dyngen.rs":"15149bc927e5b2706f93e52a6b26ef55384b3baf40bfc9bc4343e9820479f26b","src/codegen/error.rs":"5e308b8c54b68511fc8ea2ad15ddac510172c4ff460a80a265336440b0c9653d","src/codegen/helpers.rs":"ea83104addb8af31736aaeb850e10c694cd434befe7ffaaa206208f722d72c58","src/codegen/impl_debug.rs":"1ff9ec754b610c98c757b114c6509473ead0e1a9375e9089a7fa40a41a753709","src/codegen/impl_partialeq.rs":"5e526fd88dd15dd1f04addd3c6ecea1d3da92293fadf04346d6c716791f436f9","src/codegen/mod.rs":"19fd11feefab0ff9ecaf8a01583583008269adce805508fb61b9a8acc49da586","src/codegen/struct_layout.rs":"b62c3569dcfb011daa4d09f1aa9eb732da69546c3deb9f247fa8ce7114dbc7b9","src/extra_assertions.rs":"494534bd4f18b80d89b180c8a93733e6617edcf7deac413e9a73fd6e7bc9ced7","src/features.rs":"fafb85510b1dfc9a41ed71f7d765fca49b236deb4ee567e00204e751362aaf23","src/ir/analysis/derive.rs":"ff4821d810961696008a57ae496f95ebcdc14b4c439fe87d78a84817442fa759","src/ir/analysis/has_destructor.rs":"d9a3a24bd4cabc87cddb0c76d27da1691f8f37ffb8eadf5b5975a1c44dea99c2","src/ir/analysis/has_float.rs":"5242cc07ec4d4bdf5a792e1f8ee5758a87838314917d42dbb9dcfc19620520ce","src/ir/analysis/has_type_param_in_array.rs":"ec3fb67f782abb4c866da91bce3f7ee6f8e2310c47a54065282431b909233f7d","src/ir/analysis/has_vtable.rs":"63e2d0f62171811893615c11453bc7b39438d0d83c3eb444dec2346140d86efe","src/ir/analysis/mod.rs":"2c54f0cd6f3d86cf3fcb07d9d0be06cde839cab4170671c80d806a3f27820faf","src/ir/analysis/sizedness.rs":"17f1f2b6affd025f73853b9b5a76b3f157b5f9e563e9eaa374735fcb84c13308","src/ir/analysis/template_params.rs":"da949976a7fd04d6fc564ea6a77dfdbf4f5bf05db64687ed7a0616cba598a42d","src/ir/annotations.rs":"1c931d7bbba1e1613e9cccaab58d14f75e79b831b5c881e41f5b5257a9cbced7","src/ir/comment.rs":"31d64a49ae3d9c3c348fa2539e03306ca3a23fae429cab452e42b31ecf632145","src/ir/comp.rs":"abaa90e27dc6416f1b8db003f87888e7651d5b46c4d4526153980e5621612e54","src/ir/context.rs":"3a76458a5aa74075a60a5cd752ed59ad3943054f55b017700389f78072935215","src/ir/derive.rs":"e5581852eec87918901a129284b4965aefc8a19394187a8095779a084f28fabe","src/ir/dot.rs":"e25ff72ac174a798894c9673d81bdfb86fa9f4228b34a14ce0dc741a186a52bd","src/ir/enum_ty.rs":"e49e3c6ffc0289584e2f836fe56a4b7ebf6ca3f8b602248141d67b9f533770cc","src/ir/function.rs":"aa454ace56bda8074b2865933282aa124624310c8bc0c994d454f5799f4e88be","src/ir/int.rs":"68a86182743ec338d58e42203364dc7c8970cb7ec3550433ca92f0c9489b4442","src/ir/item.rs":"a71bdacc7419ec86d52ac534158cf4bfa4600e9cbc214c0075766700f5b053b0","src/ir/item_kind.rs":"7666a1ff1b8260978b790a08b4139ab56b5c65714a5652bbcec7faa7443adc36","src/ir/layout.rs":"755e3787c262de434a53a8c326f0e825f95415ed6b0f925c1cddf208ca8e3bc4","src/ir/mod.rs":"713cd537434567003197a123cbae679602c715e976d22f7b23dafd0826ea4c70","src/ir/module.rs":"70cf6ddfeabe6cdc13fdc767c783216c073404848d827e85fc6c2de3a19b5c3f","src/ir/objc.rs":"195fb2a3e4371b90244f3a8f295fd80cc77e0f2daf8fd27e3d8e5b78bd6b55d6","src/ir/template.rs":"44bd7214cf1e7f70e60694115082aac5b8a6c1687fff584cd08cdcfadabc5734","src/ir/traversal.rs":"5ac088277f4dfe2918d81b9294aaee41fd83db8e46def66a05f89de078bf4c49","src/ir/ty.rs":"8f2b970da76850685c4d334289af6dede7742862d7a81f2236115afaa1a92fa9","src/ir/var.rs":"86e9f19403fb9231ba60dec0a04e5b56fe28a37c7a5e6f676c978789c9d93c5a","src/lib.rs":"ed2d0aeb48b28b4a96b8e76a10e00b10cb6cc32c0a686d536f9021463b7ee0e8","src/log_stubs.rs":"6dfdd908b7c6453da416cf232893768f9480e551ca4add0858ef88bf71ee6ceb","src/main.rs":"74e582c37b146090332b1496f5b4bca02c7629d03a4ae40302cb4a723f08e445","src/options.rs":"119358b741601dafc13560856f6e4b4f78b6cd2b19067893c2672ba8f5dc6de1","src/parse.rs":"4ffc54415eadb622ee488603862788c78361ef2c889de25259441a340c2a010f","src/regex_set.rs":"6c46357fb1ee68250e5e017cbf691f340041489ae78599eee7a5665a6ddce27f","src/time.rs":"8efe317e7c6b5ba8e0865ce7b49ca775ee8a02590f4241ef62f647fa3c22b68e"},"package":"2da379dbebc0b76ef63ca68d8fc6e71c0f13e59432e0987e508c1820e6ab5239"}
+\ No newline at end of file
++{"files":{"Cargo.lock":"836e8f8431bd4ebdac9b1251676f6afa755757e401455259fe659e7280be8230","Cargo.toml":"3a585a6e27a177f08dedcb21f7d555e9db58fa158203273b228db91ebee4e6b3","LICENSE":"c23953d9deb0a3312dbeaf6c128a657f3591acee45067612fa68405eaa4525db","README.md":"29fe30d7a2729922b13a578bc8f5eedc808fd0f2ef67a3f12017548baf8f293a","build.rs":"3fe1e534c99df4ee207606794f133fb187c0948e055389f74c904994ecaed38a","csmith-fuzzing/README.md":"7107b70fedb0c0a0cadb3c439a49c1bd0119a6d38dc63b1aecc74d1942256ef2","src/callbacks.rs":"1e5a118b94977938751758ac0495b1d41ce5e280c066614a4a7cbd930f326350","src/clang.rs":"30fdc473ff70dcbc394927d6fb674d70a62c1a3847e855becd988dc476997815","src/codegen/bitfield_unit.rs":"a8fb1a2d97a99685106fcaac87d2013f79d2690d6a46ff05ad1e3629b6075664","src/codegen/bitfield_unit_tests.rs":"dd252134118450800b516e375c872e17b4c1aee63a7b8adbe5b2cd53434bbc7e","src/codegen/dyngen.rs":"15149bc927e5b2706f93e52a6b26ef55384b3baf40bfc9bc4343e9820479f26b","src/codegen/error.rs":"5e308b8c54b68511fc8ea2ad15ddac510172c4ff460a80a265336440b0c9653d","src/codegen/helpers.rs":"ea83104addb8af31736aaeb850e10c694cd434befe7ffaaa206208f722d72c58","src/codegen/impl_debug.rs":"1ff9ec754b610c98c757b114c6509473ead0e1a9375e9089a7fa40a41a753709","src/codegen/impl_partialeq.rs":"5e526fd88dd15dd1f04addd3c6ecea1d3da92293fadf04346d6c716791f436f9","src/codegen/mod.rs":"19fd11feefab0ff9ecaf8a01583583008269adce805508fb61b9a8acc49da586","src/codegen/struct_layout.rs":"b62c3569dcfb011daa4d09f1aa9eb732da69546c3deb9f247fa8ce7114dbc7b9","src/extra_assertions.rs":"494534bd4f18b80d89b180c8a93733e6617edcf7deac413e9a73fd6e7bc9ced7","src/features.rs":"fafb85510b1dfc9a41ed71f7d765fca49b236deb4ee567e00204e751362aaf23","src/ir/analysis/derive.rs":"ff4821d810961696008a57ae496f95ebcdc14b4c439fe87d78a84817442fa759","src/ir/analysis/has_destructor.rs":"d9a3a24bd4cabc87cddb0c76d27da1691f8f37ffb8eadf5b5975a1c44dea99c2","src/ir/analysis/has_float.rs":"5242cc07ec4d4bdf5a792e1f8ee5758a87838314917d42dbb9dcfc19620520ce","src/ir/analysis/has_type_param_in_array.rs":"ec3fb67f782abb4c866da91bce3f7ee6f8e2310c47a54065282431b909233f7d","src/ir/analysis/has_vtable.rs":"63e2d0f62171811893615c11453bc7b39438d0d83c3eb444dec2346140d86efe","src/ir/analysis/mod.rs":"2c54f0cd6f3d86cf3fcb07d9d0be06cde839cab4170671c80d806a3f27820faf","src/ir/analysis/sizedness.rs":"17f1f2b6affd025f73853b9b5a76b3f157b5f9e563e9eaa374735fcb84c13308","src/ir/analysis/template_params.rs":"da949976a7fd04d6fc564ea6a77dfdbf4f5bf05db64687ed7a0616cba598a42d","src/ir/annotations.rs":"1c931d7bbba1e1613e9cccaab58d14f75e79b831b5c881e41f5b5257a9cbced7","src/ir/comment.rs":"31d64a49ae3d9c3c348fa2539e03306ca3a23fae429cab452e42b31ecf632145","src/ir/comp.rs":"232300be66abbbc3d7ef948c24f000dd8a50d78e72aa0e4b2cc43ffd4f800226","src/ir/context.rs":"3a76458a5aa74075a60a5cd752ed59ad3943054f55b017700389f78072935215","src/ir/derive.rs":"e5581852eec87918901a129284b4965aefc8a19394187a8095779a084f28fabe","src/ir/dot.rs":"e25ff72ac174a798894c9673d81bdfb86fa9f4228b34a14ce0dc741a186a52bd","src/ir/enum_ty.rs":"e49e3c6ffc0289584e2f836fe56a4b7ebf6ca3f8b602248141d67b9f533770cc","src/ir/function.rs":"aa454ace56bda8074b2865933282aa124624310c8bc0c994d454f5799f4e88be","src/ir/int.rs":"68a86182743ec338d58e42203364dc7c8970cb7ec3550433ca92f0c9489b4442","src/ir/item.rs":"a71bdacc7419ec86d52ac534158cf4bfa4600e9cbc214c0075766700f5b053b0","src/ir/item_kind.rs":"7666a1ff1b8260978b790a08b4139ab56b5c65714a5652bbcec7faa7443adc36","src/ir/layout.rs":"755e3787c262de434a53a8c326f0e825f95415ed6b0f925c1cddf208ca8e3bc4","src/ir/mod.rs":"713cd537434567003197a123cbae679602c715e976d22f7b23dafd0826ea4c70","src/ir/module.rs":"70cf6ddfeabe6cdc13fdc767c783216c073404848d827e85fc6c2de3a19b5c3f","src/ir/objc.rs":"195fb2a3e4371b90244f3a8f295fd80cc77e0f2daf8fd27e3d8e5b78bd6b55d6","src/ir/template.rs":"44bd7214cf1e7f70e60694115082aac5b8a6c1687fff584cd08cdcfadabc5734","src/ir/traversal.rs":"5ac088277f4dfe2918d81b9294aaee41fd83db8e46def66a05f89de078bf4c49","src/ir/ty.rs":"8d7e7883316245c54e5dfa2fd150df1be2dc559c7df0828da736dd6b18d2165b","src/ir/var.rs":"1e7be8eedba72effa995b48c581504e61e407867d8794a8528975688742b0420","src/lib.rs":"ed2d0aeb48b28b4a96b8e76a10e00b10cb6cc32c0a686d536f9021463b7ee0e8","src/log_stubs.rs":"6dfdd908b7c6453da416cf232893768f9480e551ca4add0858ef88bf71ee6ceb","src/main.rs":"74e582c37b146090332b1496f5b4bca02c7629d03a4ae40302cb4a723f08e445","src/options.rs":"119358b741601dafc13560856f6e4b4f78b6cd2b19067893c2672ba8f5dc6de1","src/parse.rs":"4ffc54415eadb622ee488603862788c78361ef2c889de25259441a340c2a010f","src/regex_set.rs":"6c46357fb1ee68250e5e017cbf691f340041489ae78599eee7a5665a6ddce27f","src/time.rs":"8efe317e7c6b5ba8e0865ce7b49ca775ee8a02590f4241ef62f647fa3c22b68e"},"package":"2da379dbebc0b76ef63ca68d8fc6e71c0f13e59432e0987e508c1820e6ab5239"}
+diff -Naurp firefox-102.9.0.orig/third_party/rust/bindgen/src/clang.rs firefox-102.9.0/third_party/rust/bindgen/src/clang.rs
+--- firefox-102.9.0.orig/third_party/rust/bindgen/src/clang.rs	2023-03-09 17:59:38.000000000 -0600
++++ firefox-102.9.0/third_party/rust/bindgen/src/clang.rs	2023-03-19 20:26:47.405305678 -0500
+@@ -54,6 +54,11 @@ impl Cursor {
+         unsafe { clang_isDeclaration(self.kind()) != 0 }
+     }
+ 
++    /// Is this cursor's referent an anonymous record or so?
++    pub fn is_anonymous(&self) -> bool {
++        unsafe { clang_Cursor_isAnonymous(self.x) != 0 }
++    }
++
+     /// Get this cursor's referent's spelling.
+     pub fn spelling(&self) -> String {
+         unsafe { cxstring_into_string(clang_getCursorSpelling(self.x)) }
+diff -Naurp firefox-102.9.0.orig/third_party/rust/bindgen/src/ir/comp.rs firefox-102.9.0/third_party/rust/bindgen/src/ir/comp.rs
+--- firefox-102.9.0.orig/third_party/rust/bindgen/src/ir/comp.rs	2023-03-09 17:59:38.000000000 -0600
++++ firefox-102.9.0/third_party/rust/bindgen/src/ir/comp.rs	2023-03-19 20:27:20.660487032 -0500
+@@ -1372,8 +1372,7 @@ impl CompInfo {
+ 
+                     // A declaration of an union or a struct without name could
+                     // also be an unnamed field, unfortunately.
+-                    if cur.spelling().is_empty() &&
+-                        cur.kind() != CXCursor_EnumDecl
++                    if cur.is_anonymous() && cur.kind() != CXCursor_EnumDecl
+                     {
+                         let ty = cur.cur_type();
+                         let offset = cur.offset_of_field().ok();
+diff -Naurp firefox-102.9.0.orig/third_party/rust/bindgen/src/ir/ty.rs firefox-102.9.0/third_party/rust/bindgen/src/ir/ty.rs
+--- firefox-102.9.0.orig/third_party/rust/bindgen/src/ir/ty.rs	2023-03-09 17:59:38.000000000 -0600
++++ firefox-102.9.0/third_party/rust/bindgen/src/ir/ty.rs	2023-03-19 21:02:47.947103359 -0500
+@@ -737,7 +737,12 @@ impl Type {
+ 
+         let layout = ty.fallible_layout(ctx).ok();
+         let cursor = ty.declaration();
+-        let mut name = cursor.spelling();
++        let is_anonymous = cursor.is_anonymous();
++        let mut name = if is_anonymous {
++            None
++        } else {
++            Some(cursor.spelling()).filter(|n| !n.is_empty())
++        };
+ 
+         debug!(
+             "from_clang_ty: {:?}, ty: {:?}, loc: {:?}",
+@@ -771,7 +776,7 @@ impl Type {
+             if is_canonical_objcpointer && is_template_type_param {
+                 // Objective-C generics are just ids with fancy name.
+                 // To keep it simple, just name them ids
+-                name = "id".to_owned();
++                name = Some("id".to_owned());
+             }
+         }
+ 
+@@ -900,7 +905,7 @@ impl Type {
+                                         return Err(ParseError::Recurse);
+                                     }
+                                 } else {
+-                                    name = location.spelling();
++                                    name = Some(location.spelling());
+                                 }
+ 
+                                 let complex = CompInfo::from_ty(
+@@ -942,7 +947,7 @@ impl Type {
+                                                 CXType_Typedef
+                                             );
+ 
+-                                            name = current.spelling();
++                                            name = Some(location.spelling());
+ 
+                                             let inner_ty = cur
+                                                 .typedef_type()
+@@ -1126,10 +1131,10 @@ impl Type {
+                 CXType_Enum => {
+                     let enum_ = Enum::from_ty(ty, ctx).expect("Not an enum?");
+ 
+-                    if name.is_empty() {
++                    if !is_anonymous {
+                         let pretty_name = ty.spelling();
+                         if clang::is_valid_identifier(&pretty_name) {
+-                            name = pretty_name;
++                            name = Some(pretty_name);
+                         }
+                     }
+ 
+@@ -1144,12 +1149,12 @@ impl Type {
+                     )
+                     .expect("Not a complex type?");
+ 
+-                    if name.is_empty() {
++                    if !is_anonymous {
+                         // The pretty-printed name may contain typedefed name,
+                         // but may also be "struct (anonymous at .h:1)"
+                         let pretty_name = ty.spelling();
+                         if clang::is_valid_identifier(&pretty_name) {
+-                            name = pretty_name;
++                            name = Some(pretty_name);
+                         }
+                     }
+ 
+@@ -1161,8 +1166,7 @@ impl Type {
+                         location,
+                         None,
+                         ctx,
+-                    )
+-                    .expect("Not able to resolve vector element?");
++                    )?;
+                     TypeKind::Vector(inner, ty.num_elements().unwrap())
+                 }
+                 CXType_ConstantArray => {
+@@ -1189,7 +1193,9 @@ impl Type {
+                 CXType_ObjCClass | CXType_ObjCInterface => {
+                     let interface = ObjCInterface::from_ty(&location, ctx)
+                         .expect("Not a valid objc interface?");
+-                    name = interface.rust_name();
++                    if !is_anonymous {
++                        name = Some(interface.rust_name());
++                    }
+                     TypeKind::ObjCInterface(interface)
+                 }
+                 CXType_Dependent => {
+@@ -1207,7 +1213,7 @@ impl Type {
+             }
+         };
+ 
+-        let name = if name.is_empty() { None } else { Some(name) };
++        name = name.filter(|n| !n.is_empty());
+ 
+         let is_const = ty.is_const() ||
+             (ty.kind() == CXType_ConstantArray &&
+diff -Naurp firefox-102.9.0.orig/third_party/rust/bindgen/src/ir/var.rs firefox-102.9.0/third_party/rust/bindgen/src/ir/var.rs
+--- firefox-102.9.0.orig/third_party/rust/bindgen/src/ir/var.rs	2023-03-09 17:59:38.000000000 -0600
++++ firefox-102.9.0/third_party/rust/bindgen/src/ir/var.rs	2023-03-19 21:03:37.413299390 -0500
+@@ -301,11 +301,11 @@ impl ClangSubItemParser for Var {
+                 let ty = match Item::from_ty(&ty, cursor, None, ctx) {
+                     Ok(ty) => ty,
+                     Err(e) => {
+-                        assert_eq!(
+-                            ty.kind(),
+-                            CXType_Auto,
++                        assert!(
++                            matches!(ty.kind(), CXType_Auto | CXType_Unexposed),
+                             "Couldn't resolve constant type, and it \
+-                             wasn't an nondeductible auto type!"
++                             wasn't an nondeductible auto type or unexposed \
++                             type!"
+                         );
+                         return Err(e);
+                     }