From 26efb91c8210250e1cef6d57d05353e8683c0e53 Mon Sep 17 00:00:00 2001
From: Matthew Barnes <mbarnes@fedoraproject.org>
Date: Sep 27 2006 14:02:46 +0000
Subject: - Add patch for RH bug #203915 (fix dangerous mallocs in camel).


---

diff --git a/evolution-data-server-1.8.0-fix-camel-malloc.patch b/evolution-data-server-1.8.0-fix-camel-malloc.patch
new file mode 100644
index 0000000..30e53de
--- /dev/null
+++ b/evolution-data-server-1.8.0-fix-camel-malloc.patch
@@ -0,0 +1,32 @@
+--- evolution-data-server-1.8.0/camel/camel-object.c.fix-camel-malloc	2006-09-26 16:26:00.000000000 -0400
++++ evolution-data-server-1.8.0/camel/camel-object.c	2006-09-26 16:35:32.000000000 -0400
+@@ -455,9 +455,13 @@
+ 			/* maybe it was just version 0 afterall */
+ 			return 0;
+ 		}
++
++		count = MIN(count, CAMEL_ARGV_MAX);
+ 		
+ 		/* we batch up the properties and set them in one go */
+-		if (!(argv = g_try_malloc ((gulong)(sizeof (*argv) + (count - CAMEL_ARGV_MAX) * sizeof (argv->argv[0])))))
++		argv = g_try_malloc(sizeof(CamelArgV) -
++			((CAMEL_ARGV_MAX - count) * sizeof(CamelArg)));
++		if (argv == NULL)
+ 			return -1;
+ 		
+ 		argv->argc = 0;
+@@ -536,9 +540,12 @@
+ 	   we also need an argv to store the results - bit messy */
+ 
+ 	count = g_slist_length(props);
++	count = MIN(count, CAMEL_ARGV_MAX);
+ 
+-	arggetv = g_malloc0(sizeof(*arggetv) + (count - CAMEL_ARGV_MAX) * sizeof(arggetv->argv[0]));
+-	argv = g_malloc0(sizeof(*argv) + (count - CAMEL_ARGV_MAX) * sizeof(argv->argv[0]));
++	arggetv = g_malloc0(sizeof(CamelArgGetV) -
++		((CAMEL_ARGV_MAX - count) * sizeof(CamelArgGet)));
++	argv = g_malloc0(sizeof(CamelArgV) -
++		((CAMEL_ARGV_MAX - count) * sizeof(CamelArg)));
+ 	l = props;
+ 	i = 0;
+ 	while (l) {
diff --git a/evolution-data-server.spec b/evolution-data-server.spec
index 7a98a1f..caaf0fd 100644
--- a/evolution-data-server.spec
+++ b/evolution-data-server.spec
@@ -25,7 +25,7 @@
 
 Name: evolution-data-server
 Version: 1.8.0
-Release: 10%{?dist}
+Release: 11%{?dist}
 License: LGPL
 Group: System Environment/Libraries
 Summary: Backend data server for Evolution
@@ -66,6 +66,9 @@ Patch20: evolution-data-server-1.8.0-uninstall.patch
 # Gnome.org bug #357666
 Patch21: evolution-data-server-1.8.0-deprecated-glib.patch
 
+# RH bug #203915
+Patch22: evolution-data-server-1.8.0-fix-camel-malloc.patch
+
 ### Dependencies ###
 
 Requires: GConf2
@@ -156,6 +159,7 @@ cp %{SOURCE2} calendar/libical/zoneinfo/Asia
 %patch19 -p1 -b .fix-ecal-crash
 %patch20 -p1 -b .uninstall
 %patch21 -p1 -b .deprecated-glib
+%patch22 -p1 -b .fix-camel-malloc
 
 mkdir -p krb5-fakeprefix/include
 mkdir -p krb5-fakeprefix/lib
@@ -373,6 +377,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/pkgconfig/libexchange-storage-%{eds_api_version}.pc
 
 %changelog
+* Tue Sep 26 2006 Matthew Barnes <mbarnes@redhat.com> - 1.8.0-11.fc6
+- Add patch for RH bug #203915 (fix dangerous mallocs in camel).
+
 * Mon Sep 25 2006 Matthew Barnes <mbarnes@redhat.com> - 1.8.0-10.fc6
 - Add patch for Gnome.org bug #357666.