Skip to content

Conversation

tacaswell
Copy link
Member

attn @mdboom

@tacaswell tacaswell added this to the v1.4.3 milestone Feb 9, 2015
@tacaswell tacaswell added the Release critical For bugs that make the library unusable (segfaults, incorrect plots, etc) and major regressions. label Feb 9, 2015
@tacaswell
Copy link
Member Author

and attn @efiring

@tacaswell
Copy link
Member Author

@mgiuca ping me if you want this rebased with your name on the commit.

@mgiuca
Copy link

mgiuca commented Feb 9, 2015

Hi @tacaswell. Glad to see this is getting patched in. If you can, please set the author email to mgiuca@google.com (so that the work is attributed to Google).

@efiring
Copy link
Member

efiring commented Feb 9, 2015

Looks OK to me.

@tacaswell
Copy link
Member Author

I don't think that test actually tests Printf any more and something else along the line is raise an error that the file name is too long.

Trying to get to Printf via capstyle is also proving difficult, too many layers do verification before it goes to the c++ layer.

@efiring
Copy link
Member

efiring commented Feb 9, 2015

You could just take out the test. Nul-terminating a C string can't hurt. We'll never have tests for everything.

@tacaswell
Copy link
Member Author

and removed instead of going though and understanding how that exception changed between py2k and py3k.

No longer tests what it is meant to test
@tacaswell
Copy link
Member Author

This is failing on the pep8 tests.

I am strongly disinclined to back-port those fixes to the 1.4.x branch.

@efiring
Copy link
Member

efiring commented Feb 9, 2015

@tacaswell I agree--it doesn't seem worthwhile to do that backport. It's now one more reason to freeze the branch after 1.4.3.

@mdboom
Copy link
Member

mdboom commented Feb 9, 2015

This didn't introduce a PEP8 failure, right? Is there some change to the pep8 tool that is causing all these new warnings?

In any event, this patch looks fine. The code simply doesn't exist anymore on master, so it doesn't matter there.

@tacaswell
Copy link
Member Author

Yes, the pep8 issues are from the pep8 version bumping and changing error codes (see #4081).

@tacaswell
Copy link
Member Author

I'll add a flag to travis to force-install the old version for this branch.

@mdboom
Copy link
Member

mdboom commented Feb 9, 2015

Cool. Merging.

mdboom added a commit that referenced this pull request Feb 9, 2015
BUG : fix security bug reported via debian by Matt Giuca
@mdboom mdboom merged commit e600d8f into matplotlib:v1.4.x Feb 9, 2015
@tacaswell tacaswell deleted the cve_patch branch February 9, 2015 20:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Release critical For bugs that make the library unusable (segfaults, incorrect plots, etc) and major regressions.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants