Fix CVE-2017-11590:

https://bugzilla.gnome.org/show_bug.cgi?id=785479
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11590

Patch copied from upstream source repository:

https://git.gnome.org/browse/libgxps/commit/?id=9d5d292055250ed298f3b89dc332d6db4003a031

From 9d5d292055250ed298f3b89dc332d6db4003a031 Mon Sep 17 00:00:00 2001
From: Marek Kasik <mkasik@redhat.com>
Date: Wed, 26 Jul 2017 16:23:37 +0200
Subject: archive: Check for pathname being NULL before dereferencing

Check whether "archive_entry_pathname ()" returns a non-NULL pathname
before using it to avoid a NULL pointer being dereferenced.

https://bugzilla.gnome.org/show_bug.cgi?id=785479
---
 libgxps/gxps-archive.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libgxps/gxps-archive.c b/libgxps/gxps-archive.c
index acf8d7d..e763773 100644
--- a/libgxps/gxps-archive.c
+++ b/libgxps/gxps-archive.c
@@ -257,6 +257,7 @@ gxps_archive_initable_init (GInitable     *initable,
 	GXPSArchive          *archive;
 	ZipArchive           *zip;
 	struct archive_entry *entry;
+	const gchar          *pathname;
 
 	archive = GXPS_ARCHIVE (initable);
 
@@ -281,7 +282,9 @@ gxps_archive_initable_init (GInitable     *initable,
 
         while (gxps_zip_archive_iter_next (zip, &entry)) {
                 /* FIXME: We can ignore directories here */
-                g_hash_table_add (archive->entries, g_strdup (archive_entry_pathname (entry)));
+                pathname = archive_entry_pathname (entry);
+                if (pathname != NULL)
+                        g_hash_table_add (archive->entries, g_strdup (pathname));
                 archive_read_data_skip (zip->archive);
         }
 
-- 
cgit v0.12


<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=ad3c61fcd3d6e2e3eab41aae642467f5eaf64b57'>root</a>/<a href='/guix/log/gnu?id=ad3c61fcd3d6e2e3eab41aae642467f5eaf64b57'>gnu</a>/<a href='/guix/log/gnu/packages?id=ad3c61fcd3d6e2e3eab41aae642467f5eaf64b57'>packages</a>/<a href='/guix/log/gnu/packages/popt.scm?id=ad3c61fcd3d6e2e3eab41aae642467f5eaf64b57'>popt.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/popt.scm?id=ad3c61fcd3d6e2e3eab41aae642467f5eaf64b57&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2017-09-20 20:58:04 -0400'>2017-09-20</span></td><td><a href='/guix/commit/gnu/packages/popt.scm?id=dc1d3cdef70f0e3c047c229c2a0e561d1f47bde8'>gnu: Use 'modify-phases' syntax.</a><span class='msg-avail'>...</span></td><td>Kei Kebreau</td></tr>
<tr><td><span title='2017-03-30 01:30:16 +0200'>2017-03-30</span></td><td><a href='/guix/commit/gnu/packages/popt.scm?id=6fd52309b8f52c9bb59fccffac53e029ce94b698'>gnu: Use HTTPS for almost all gnu.org HOME-PAGEs.</a><span class='msg-avail'>...</span></td><td>Tobias Geerinckx-Rice</td></tr>
<tr><td><span title='2017-01-21 12:44:42 +0100'>2017-01-21</span></td><td><a href='/guix/commit/gnu/packages/popt.scm?id=f07e53fb53ca2701d5051e05a7ecc95f405ec817'>gnu: gflags: Update to 2.2.0.</a><span class='msg-avail'>...</span></td><td>Marius Bakke</td></tr>
<tr><td><span title='2016-07-21 18:09:40 -0400'>2016-07-21</span></td><td><a href='/guix/commit/gnu/packages/popt.scm?id=de67e922885baf68a746a0484ca0b45e45b0964b'>gnu: Update URLs for sourceforge.net.</a><span class='msg-avail'>...</span></td><td>Leo Famulari</td></tr>
<tr><td><span title='2016-06-15 15:34:58 +0200'>2016-06-15</span></td><td><a href='/guix/commit/gnu/packages/popt.scm?id=ba6a996eacab58b1791feb69bc460777352d5039'>gnu: Add gengetopt.</a><span class='msg-avail'>...</span></td><td>Ricardo Wurmus</td></tr>
<tr><td><span title='2016-06-03 13:54:39 +0200'>2016-06-03</span></td><td><a href='/guix/commit/gnu/packages/popt.scm?id=4b4e1b4b26a8ba56d57568ebd832a0ab8c1bf2a1'>gnu: Add gflags.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>