Wireshark · Ethereal-dev: Re: [Ethereal-dev] zlib version upgrade - security issue

[Thomas Boehne <TBoehne@xxxxxxxx>]

On Sunday 24 July 2005 21:44, Ulf Lamping wrote:
> Andrew Hood wrote:
> >Please update the version being used in the build.
> >
> >http://www.zlib.net/
>
> I've updated the zlib version used for the Windows build.

My SVN build just failed because zlib123 is downloaded, but zlib122 is
actually used for compiling and linking. We should not release 0.10.12
until this bug is fixed (I did not add it to bugzilla -- should I?).
(See patch config.nmake.diff).

Later on, the build failed in creating the NSIS installer with this
message:
File: "C:\ethereal-win32-libs\gtk-wimp\libwimp.dll" -> no files found.

The libwimp.dll was in the directory:
C:\ethereal-win32-libs\gtk-wimp\gtk-wimp-0.7.0-bin
(I guess this requires patches at several different files,
unfortunately, I don't have time to resolve them today)

The buildbot does not catch these problems, maybe it should always
clear c:\ethereal-win32-libs. We have already had similar problems
that would not occur if we would always delete the unzipped files
before building ethereal:

http://www.ethereal.com/lists/ethereal-dev/200501/threads.html#00543

Maybe the downloaded files and the unzipped directories should be in
different directories; than we could always delete the whole directory
with all unzipped files on make clean (or distclean or whatever). This
would increase the build time by some seconds, but IMHO, the current
behaviour is a security problem, since we link with old libraries
without recognizing it.

The README.win32 seems to be a bit outdated; I upgraded some version
numbers. I am not sure if the sections "Instructions for Cygwin" and
"Installing GTK-Wimp" are up-to-date. (see README.win32.diff).

I posted README.plugins.diff a while ago, but it has never been applied:
http://www.ethereal.com/lists/ethereal-dev/200505/msg00027.html


Thomas Boehne

-- 
Jäger Computergesteuerte Messtechnik GmbH
Thomas Böhne
Rheinstraße 2-4
64653 Lorsch
Germany
Phone: +49-6251-9632-0




Index: config.nmake
===================================================================
--- config.nmake	(revision 15053)
+++ config.nmake	(working copy)
@@ -89,7 +89,7 @@
 # If you don't have Zlib, comment this line out, so that Zlib isn't
 # defined.
 #
-ZLIB_DIR=$(ETHEREAL_LIBS)\zlib122-dll
+ZLIB_DIR=$(ETHEREAL_LIBS)\zlib123-dll
 
 #
 # Set PCAP_DIR to the pathname of the directory in which the WinPcap

Index: README.win32
===================================================================
--- README.win32	(revision 15053)
+++ README.win32	(working copy)
@@ -197,20 +197,20 @@
 
     Package                               Default Location
     -------                               ----------------
-    glib-2.2.3-20040116.zip               C:\ethereal-win32-libs\glib
-    glib-dev-2.2.3-20040116.zip           C:\ethereal-win32-libs\glib
+    glib-2.4.7.zip                        C:\ethereal-win32-libs\glib
+    glib-dev-2.4.7.zip                    C:\ethereal-win32-libs\glib
     gtk+-1.3.0-20030717.zip               C:\ethereal-win32-libs\gtk+
     gtk+-dev-1.3.0-20030115.zip           C:\ethereal-win32-libs\gtk+
     libiconv-1.9.1.bin.woe32.zip          C:\ethereal-win32-libs\libiconv-1.9.1.bin.woe32
     gettext-runtime-0.13.1.zip            C:\ethereal-win32-libs\gettext-runtime-0.13.1
-    net-snmp-5.1.zip                      C:\ethereal-win32-libs
+    net-snmp-5.2.1.2.zip                  C:\ethereal-win32-libs
     wpdpack_3_0.zip                       C:\ethereal-win32-libs
 
 and optional:
 
-    adns-1.0-win32-03.zip                 C:\ethereal-win32-libs
+    adns-1.0-win32-04.zip                 C:\ethereal-win32-libs
     pcre-4.4.zip                          C:\ethereal-win32-libs
-    zlib122-dll.zip                       C:\ethereal-win32-libs\zlib122-dll
+    zlib123-dll.zip                       C:\ethereal-win32-libs\zlib123-dll
 
 (to use the default locations, the directories in question should be
 created, and each zip file should be unpacked into the corresponding
@@ -223,7 +223,7 @@
 rename the directory.)
 
 The gettext runtime package provides intl.dll, which is needed by
-GLib 2.2.3.
+GLib 2.4.7.
 
 
 Compiling the Ethereal distribution using GTK+2
@@ -246,16 +246,16 @@
 
     Package                               Default Location
     -------                               ----------------
-    gtk+-2.2.4-20040124.zip               C:\ethereal-win32-libs\gtk2
-    gtk+-dev-2.2.4-20040124.zip	          C:\ethereal-win32-libs\gtk2
-    pango-1.2.5-20040124.zip              C:\ethereal-win32-libs\gtk2	
-    pango-dev-1.2.5-20040124.zip          C:\ethereal-win32-libs\gtk2
-    atk-1.4.0.zip                         C:\ethereal-win32-libs\gtk2	
-    atk-dev-1.4.0.zip                     C:\ethereal-win32-libs\gtk2
+    gtk+-2.4.14.zip                       C:\ethereal-win32-libs\gtk2
+    gtk+-dev-2.4.14.zip	                  C:\ethereal-win32-libs\gtk2
+    pango-1.4.1.zip                       C:\ethereal-win32-libs\gtk2	
+    pango-dev-1.4.1.zip                   C:\ethereal-win32-libs\gtk2
+    atk-1.6.0.zip                         C:\ethereal-win32-libs\gtk2	
+    atk-dev-1.6.0.zip                     C:\ethereal-win32-libs\gtk2
 
 and optional:
 
-    gtk-wimp-0.5.3-bin.zip                C:\ethereal-win32-libs\gtk-wimp
+    gtk-wimp-0.7.0-bin.zip                C:\ethereal-win32-libs\gtk-wimp
 
 Be sure to set GTK2_DIR in config.nmake correct, to be able to compile.
 
@@ -274,8 +274,8 @@
 	<Ethereal installation directory>\plugins\<version>
 
 Where <version> is the version number, without brackets.  For example,
-if you have Ethereal 0.9.8 installed in the default location, plugins
-will reside in C:\Program Files\Ethereal\plugins\0.9.8
+if you have Ethereal 0.10.12 installed in the default location, plugins
+will reside in C:\Program Files\Ethereal\plugins\0.10.12
 
 Yes, the location of plugins needs to be more flexible.
 
@@ -415,7 +415,7 @@
 In the ethereal directory, type "nmake -f makefile.nmake packaging" to build the installer. 
 Please be patient while the compression is done, it will take some time even on fast machines.
 
-You will hopefully now see something like ethereal-setup-0.10.2.exe in the dir packaging/nsis.
+You will hopefully now see something like ethereal-setup-0.10.12.exe in the dir packaging/nsis.
 
 
 Installing GTK-Wimp

Index: doc/README.plugins
===================================================================
--- doc/README.plugins	(revision 15053)
+++ doc/README.plugins	(working copy)
@@ -182,14 +182,20 @@
 You need to change the SUBDIRS directive to reflect the addition of 
 your plugin:
 
-SUBDIRS = gryphon mgcp xxx
+SUBDIRS = \
+	gryphon \
+	mgcp \
+	xxx
 
 
 4.5 Changes to plugins/Makefile.nmake
 
 To the Makefile.nmake you need to add your plugin to the all: rule
 
-all: plugin_api.obj gryphon mgcp xxx
+all: \
+	gryphon \
+	mgcp \
+	xxx
 
 then add a rule for your plugin:
 
@@ -202,7 +208,6 @@
 plugin:
 
 clean:
-	rm -f plugin_api.obj
 	cd gryphon
 	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake clean
 	cd ../mgcp