notmuch Debian 0.29.3-1 upload (same as 0.29.3)

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEkiyHYXwaY0SiY6fqA0U5G1WqFSEFAl3eb04ACgkQA0U5G1Wq
 FSG22w//UBCmmJ/osIqJQs0lCzrszJ7AqEwROSj5RluIMhHpYcaITdktUEcZ1JNM
 GW6+pmK5opH6JlbNlyogY/qZRPrfvb0TAxvHl9D2xABs+54mesRP9cNzeqqO52eA
 7E3mRYry3eReNCoW66Fmyqb9DL0AcmzDBVVmpM2/zYeWJp7bzbzTdSSnULkIfMqf
 U3ZakJv+9QbrBRTLNqrsRxuU7LqU88JhNjDYNEQN99mbc0mjApS2oQrn9vI08BGw
 IMTqprjTi+E+169WIiFgtguAE6w5LvqWqQNBK5mDdpR/JjxTAVcX/VhcWDq4zAw5
 7uK7mXSOVre5+NeZYPENa8N6sGM8CMwZgdJj3PIMwoxgfz1TX+qpVyfUm92gp3Zv
 ySVGHvME5Z8/4lwNL30uX+SmxdhMF1e1D45aXbeBvlOQzZOnplbRsezGynmh9bBw
 n3mvjGjM2A6/hiAsmgeH5nA4Mm6tyGCp7e0GrRdFYFYk0WkDRxzKFtZEUII0WRos
 77pmxcYMSDJ/PaZwHZ4upvAyQt5X9IIenTPFAdc7u3MtKPaVAtLNSeJ4wFa3tBoy
 gfO+RVT3gdWOnJZpUMAgsQXNBHdGLILSFjcoghIy4U4KXcHJ+dF0yt+0QL4wPOX3
 EhnRtyIzutDh93Q6QVCgSHCxCbHMnmh9/OD6kiDHzLZnWbyGAYw=
 =TdGH
 -----END PGP SIGNATURE-----

Merge tag 'debian/0.29.3-1' into debian/buster-backports

notmuch Debian 0.29.3-1 upload (same as 0.29.3)

NEWS

@@ -1,3 +1,27 @@
+Notmuch 0.29.3 (2019-11-27)
+===========================
+
+General
+-------
+
+Fix for use-after-free in notmuch_config_list_{key,val}.
+
+Fix for double close of file in notmuch-dump.
+
+Debian
+------
+
+Drop python2 support from shipped debian packaging.
+
+Notmuch 0.29.2 (2019-10-19)
+===========================
+
+General
+-------
+
+Fix for file descriptor leak when opening gzipped mail files. Thanks
+to James Troup for the bug report and the fix.
+
 Notmuch 0.29.1 (2019-06-11)
 ===========================
 
@@ -114,7 +138,7 @@ Build System
 ------------
 
 Serialize calls to sphinx-build to avoid race condition.
-`
+
 Notmuch 0.28.2 (2019-02-17)
 ===========================
 

bindings/python/notmuch/version.py

@@ -1,3 +1,3 @@
 # this file should be kept in sync with ../../../version
-__VERSION__ = '0.29.1'
+__VERSION__ = '0.29.3'
 SOVERSION = '5'

configure

@@ -529,7 +529,7 @@ int main () {
     return 0;
 }
 EOF
-    if ! TEMP_GPG=$(mktemp -d); then
+    if ! TEMP_GPG=$(mktemp -d "${TMPDIR:-/tmp}/notmuch.XXXXXX"); then
         printf 'No.\nCould not make tempdir for testing session-key support.\n'
         errors=$((errors + 1))
     elif ${CC} ${CFLAGS} ${gmime_cflags} _check_session_keys.c ${gmime_ldflags} -o _check_session_keys \

debian/changelog

@@ -1,3 +1,26 @@
+notmuch (0.29.3-1) unstable; urgency=medium
+
+  * New upstream bugfix release.
+    - fix use-after-free bug in libnotmuch
+    - fix double close of file in "notmuch dump"
+
+ -- David Bremner <bremner@debian.org>  Wed, 27 Nov 2019 08:19:57 -0400
+
+notmuch (0.29.2-2) experimental; urgency=medium
+
+  * Drop python-notmuch binary package.
+  * Drop python2 build-dependency (Closes: #937161).
+  * Convert to pybuild for python bindings
+
+ -- David Bremner <bremner@debian.org>  Sat, 02 Nov 2019 18:21:06 -0300
+
+notmuch (0.29.2-1) unstable; urgency=medium
+
+  * New upstream bug fix release: fix file descriptor leak with gzipped
+    files. Thanks to James Troup for reporting and the fix.
+
+ -- David Bremner <bremner@debian.org>  Sat, 19 Oct 2019 07:23:21 -0300
+
 notmuch (0.29.1-2~bpo10+1) buster-backports; urgency=medium
 
   * Rebuild for buster-backports.

debian/control

@@ -14,7 +14,6 @@ Build-Depends:
  libgmime-3.0-dev (>= 3.0.3~),
  libtalloc-dev,
  libz-dev,
- python-all (>= 2.6.6-3~),
  python3-all (>= 3.1.2-7~),
  dh-python,
  dh-elpa (>= 1.3),
@@ -73,19 +72,6 @@ Description: thread-based email index, search and tagging (development)
  This package provides the necessary development libraries and header
  files to allow you to develop new software using libnotmuch.
 
-Package: python-notmuch
-Architecture: all
-Section: python
-Depends: ${misc:Depends}, ${python:Depends}, libnotmuch5 (>= ${source:Version})
-Description: Python interface to the notmuch mail search and index library
- Notmuch is a system for indexing, searching, reading, and tagging
- large collections of email messages in maildir or mh format. It uses
- the Xapian library to provide fast, full-text search with a very
- convenient search syntax.
- .
- This package provides a Python interface to the notmuch
- functionality, directly interfacing with a shared notmuch library.
-
 Package: python3-notmuch
 Architecture: all
 Section: python

debian/python3-notmuch.install

@@ -1 +0,0 @@
-usr/lib/python3*

debian/rules

@@ -1,9 +1,9 @@
 #!/usr/bin/make -f
 
-python3_all = py3versions -s | xargs -n1 | xargs -t -I {} env {}
+export PYBUILD_NAME=notmuch
 
 %:
-	dh $@ --with python2,python3,elpa
+	dh $@ --with python3,elpa
 
 override_dh_auto_configure:
 	BASHCMD=/bin/bash ./configure --prefix=/usr \
@@ -17,20 +17,17 @@ override_dh_auto_configure:
 
 override_dh_auto_build:
 	dh_auto_build -- V=1
-	dh_auto_build --sourcedirectory bindings/python
+	dh_auto_build --buildsystem=pybuild --sourcedirectory bindings/python
-	cd bindings/python && $(python3_all) setup.py build
 	$(MAKE) -C contrib/notmuch-mutt
 
 override_dh_auto_clean:
 	dh_auto_clean
-	dh_auto_clean --sourcedirectory bindings/python
+	dh_auto_clean --buildsystem=pybuild --sourcedirectory bindings/python
-	cd bindings/python && $(python3_all) setup.py clean -a
 	dh_auto_clean --sourcedirectory bindings/ruby
 	$(MAKE) -C contrib/notmuch-mutt clean
 
 override_dh_auto_install:
 	dh_auto_install
-	dh_auto_install --sourcedirectory bindings/python
+	dh_auto_install --buildsystem=pybuild --sourcedirectory bindings/python
-	cd bindings/python && $(python3_all) setup.py install --install-layout=deb --root=$(CURDIR)/debian/tmp
 	$(MAKE) -C contrib/notmuch-mutt DESTDIR=$(CURDIR)/debian/tmp install
 	dh_auto_install --sourcedirectory bindings/ruby

lib/config.cc

@@ -150,13 +150,17 @@ notmuch_config_list_valid (notmuch_config_list_t *metadata)
     return true;
 }
 
+static inline char * _key_from_iterator (notmuch_config_list_t *list) {
+    return talloc_strdup (list, (*list->iterator).c_str () + CONFIG_PREFIX.length ());
+}
+
 const char *
 notmuch_config_list_key (notmuch_config_list_t *list)
 {
     if (list->current_key)
 	talloc_free (list->current_key);
 
-    list->current_key = talloc_strdup (list, (*list->iterator).c_str () + CONFIG_PREFIX.length ());
+    list->current_key = _key_from_iterator (list);
 
     return list->current_key;
 }
@@ -166,7 +170,7 @@ notmuch_config_list_value (notmuch_config_list_t *list)
 {
     std::string strval;
     notmuch_status_t status;
-    const char *key = notmuch_config_list_key (list);
+    char *key = _key_from_iterator (list);
 
     /* TODO: better error reporting?? */
     status = _metadata_value (list->notmuch, key, strval);
@@ -177,6 +181,7 @@ notmuch_config_list_value (notmuch_config_list_t *list)
 	talloc_free (list->current_val);
 
     list->current_val = talloc_strdup (list, strval.c_str ());
+    talloc_free (key);
     return list->current_val;
 }
 

notmuch-dump.c

@@ -329,13 +329,15 @@ notmuch_database_dump (notmuch_database_t *notmuch,
 	}
     }
 
-    if (gzclose_w (output) != Z_OK) {
+    ret = gzclose_w (output);
+    if (ret) {
 	fprintf (stderr, "Error closing %s: %s\n", name_for_error,
 		 gzerror (output, NULL));
 	ret = EXIT_FAILURE;
 	output = NULL;
 	goto DONE;
-    }
+    } else
+        output = NULL;
 
     if (output_file_name) {
 	ret = rename (tempname, output_file_name);

test/T750-gzip.sh

@@ -167,4 +167,11 @@ This is just a test message (#7)
 EOF
 test_expect_equal_file EXPECTED OUTPUT
 
+# there are more than 200 messages in this corpus
+add_email_corpus lkml
+test_begin_subtest "new doesn't run out of file descriptors with many gzipped files"
+ulimit -n 200
+gzip --recursive ${MAIL_DIR}
+test_expect_success "notmuch new"
+
 test_done

util/gmime-extra.c

@@ -28,6 +28,8 @@ _gzfile_maybe_filter (GMimeStream *file_stream) {
 
 	/* ignore filter id */
 	(void) g_mime_stream_filter_add ((GMimeStreamFilter *) gzstream, gzfilter);
+	g_object_unref (gzfilter);
+	g_object_unref (file_stream);
 	return gzstream;
     } else {
 	return file_stream;

version

@@ -1 +1 @@
-0.29.1
+0.29.3