Add patch fixing CVE 2012-4425

0003-CVE-2012-4425.patch

@@ -0,0 +1,60 @@
+diff --git a/configure.ac b/configure.ac
+index 3841c56..b2defd3 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -243,6 +243,8 @@ else
+         EXTERNAL_PNP_IDS="$with_pnp_ids_path"
+ fi
+ 
++AC_CHECK_FUNCS(clearenv)
++
+ PKG_CHECK_MODULES(GLIB2, glib-2.0 >= 2.22)
+ AC_SUBST(GLIB2_CFLAGS)
+ AC_SUBST(GLIB2_LIBS)
+diff --git a/gtk/spice-client-glib-usb-acl-helper.c b/gtk/spice-client-glib-usb-acl-helper.c
+index 724d62a..93b9b3a 100644
+--- a/gtk/spice-client-glib-usb-acl-helper.c
++++ b/gtk/spice-client-glib-usb-acl-helper.c
+@@ -158,7 +158,8 @@ static void cleanup(void)
+     if (state == STATE_WAITING_FOR_STDIN_EOF)
+         set_facl(path, getuid(), 0);
+ 
+-    g_main_loop_quit(loop);
++    if (loop)
++        g_main_loop_quit(loop);
+ }
+ 
+ /* Not available in polkit < 0.101 */
+@@ -311,11 +312,32 @@ polkit_authority_get_sync (GCancellable *cancellable, GError **error)
+ }
+ #endif
+ 
++#ifndef HAVE_CLEARENV
++extern char **environ;
++
++static int
++clearenv (void)
++{
++        if (environ != NULL)
++                environ[0] = NULL;
++        return 0;
++}
++#endif
++
+ int main(void)
+ {
+     pid_t parent_pid;
+     GInputStream *stdin_unix_stream;
+ 
++  /* Nuke the environment to get a well-known and sanitized
++   * environment to avoid attacks via e.g. the DBUS_SYSTEM_BUS_ADDRESS
++   * environment variable and similar.
++   */
++    if (clearenv () != 0) {
++        FATAL_ERROR("Error clearing environment: %s\n", g_strerror (errno));
++        return 1;
++    }
++
+     g_type_init();
+ 
+     loop = g_main_loop_new(NULL, FALSE);

spice-gtk.spec

@@ -13,7 +13,7 @@
 
 Name:           spice-gtk
 Version:        0.11
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        A GTK+ widget for SPICE clients
 
 Group:          System Environment/Libraries
@@ -21,6 +21,7 @@ License:        LGPLv2+
 URL:            http://spice-space.org/page/Spice-Gtk
 Source0:        http://www.spice-space.org/download/gtk/%{name}-%{version}%{?_version_suffix}.tar.bz2
 Patch0:         0001-usbredir-Check-for-existing-usb-channels-after-libus.patch
+Patch1:         0003-CVE-2012-4425.patch
 
 BuildRequires: intltool
 BuildRequires: gtk2-devel >= 2.14
@@ -46,6 +47,8 @@ BuildRequires: gtk3-devel
 BuildRequires: spice-protocol
 # Hack because of bz #613466
 BuildRequires: libtool
+# For patch #1
+BuildRequires: autoconf automake
 Requires: spice-glib%{?_isa} = %{version}-%{release}
 
 ExclusiveArch: %{ix86} x86_64
@@ -148,6 +151,9 @@ fi
 
 pushd spice-gtk-%{version}
 %patch0 -p1
+%patch1 -p1
+# Patch 1 changes configure.ac
+autoreconf -fi
 popd
 
 %if %{with_gtk3}
@@ -260,6 +266,9 @@ rm -f %{buildroot}%{_libdir}/python*/site-packages/*.la
 %{_bindir}/spicy-stats
 
 %changelog
+* Fri Sep 14 2012 Christophe Fergeau <cfergeau@redhat.com> - 0.11-5
+- Add patch fixing CVE 2012-4425
+
 * Tue Mar 20 2012 Hans de Goede <hdegoede@redhat.com> - 0.11-4
 - Add missing BuildRequires: usbutils, so that we get proper USB device
   descriptions in the USB device selection menu