From: Simon McVittie <simon.mcvittie@collabora.co.uk>
Date: Thu, 20 Jun 2013 12:24:41 +0000 (+0100)
Subject: Merge branch 'dbus-1.6'
X-Git-Tag: dbus-1.7.6~180
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f2ea8ccc11778639dbbcbb599cb93914c908fc86;p=thirdparty%2Fdbus.git

Merge branch 'dbus-1.6'

Conflicts:
	NEWS
---

f2ea8ccc11778639dbbcbb599cb93914c908fc86
diff --cc NEWS
index cf24c1166,96d4b0c2f..3fe6c0e41
--- a/NEWS
+++ b/NEWS
@@@ -1,14 -1,17 +1,17 @@@
 -D-Bus 1.6.14 (UNRELEASED)
 +D-Bus 1.7.6 (UNRELEASED)
  ==
  
- ...
+ Fixes:
+ 
+ • If malloc() returns NULL in _dbus_string_init() or similar, don't free
+   an invalid pointer if the string is later freed (fd.o #65959, Chengwei Yang)
  
 -D-Bus 1.6.12 (2013-06-13)
 +D-Bus 1.7.4 (2013-06-13)
  ==
  
 -The “does this unit have a soul?” release.
 +The “but is your thread-safety thread-safe?” release.
  
 -Fixes:
 +Security fixes:
  
  • CVE-2013-2168: Fix misuse of va_list that could be used as a denial
    of service for system services. Vulnerability reported by Alexandru Cornea.