netpbm: Fix hardening

* Add some additional CFLAGS to workaround a gcc bug
  with enabled SSP.

* Add patch to proper use our LDFLAGS when linking libnetpbm.

* Disable stripping the binaries during install.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/netpbm/netpbm.nm b/netpbm/netpbm.nm
index 49488e5faabacea0c9b6393ad3b3a4038a2a3c15..cbafb517ce53d4731d39966c3d732fdb6f07cf44 100644 (file)
--- a/netpbm/netpbm.nm
+++ b/netpbm/netpbm.nm
@@ -5,7 +5,7 @@
 
 name       = netpbm
 version    = 10.73.42
-release    = 1
+release    = 2
 
 groups     = System/Libraries
 url        = https://netpbm.sourceforge.net/
@@ -37,6 +37,10 @@ build
                perl(English)
        end
 
+       CFLAGS += \
+               -fno-builtin-exit \
+               -D__noreturn__=
+
        prepare_cmds
                # Create config file.
                cp -avf config.mk.in  config.mk
@@ -58,6 +62,9 @@ build
                echo 'JPEGHDR_DIR = %{includedir}' >> config.mk
                echo 'PNGHDR_DIR = %{includedir}' >> config.mk
                echo 'ZHDR_DIR = %{includedir}' >> config.mk
+
+               # Do not strip the binaries during install.
+               echo 'STRIPFLAG =' >> config.mk
        end
 
        build

diff --git a/netpbm/patches/netpbm-libnetpbm-use-ldflags.patch b/netpbm/patches/netpbm-libnetpbm-use-ldflags.patch
new file mode 100644 (file)
index 0000000..21384cb
--- /dev/null
+++ b/netpbm/patches/netpbm-libnetpbm-use-ldflags.patch
@@ -0,0 +1,12 @@
+diff -Nur a/lib/Makefile b/lib/Makefile
+--- a/lib/Makefile     2019-06-29 01:07:55.000000000 +0200
++++ b/lib/Makefile     2023-03-12 09:21:25.558949353 +0100
+@@ -128,7 +128,7 @@
+       rm -f $@
+       $(SYMLINK) $< $@
+ libnetpbm.$(NETPBMLIBSUFFIX).$(MAJ).$(MIN): $(LIBOBJECTS) $(LIBOBJECTS_X)
+-      $(LD) $(LDSHLIB) -o $@ $(LIBOBJECTS) $(LIBOBJECTS_X) \
++      $(LD) $(LDFLAGS) $(LDSHLIB) -o $@ $(LIBOBJECTS) $(LIBOBJECTS_X) \
+           $(SHLIB_CLIB) -lm $(LADD)
+ endif
+