devel/upp: update to 11873

[fernape]

Summary

Sent via PR 227414
Maintainer already timed out

I had to add -msse2 to make it compile in i386

Test Plan

• portlint -AC OK
• poudriere builds for {10.4,11.1}{amd64,i386}, 12i386 OK
• run test in 11.1 amd64 OK

[tcberner]

You should first commit an entry to vuln.xml: https://www.freebsd.org/doc/en/books/porters-handbook/security-notify.html (you can prepare the change in this review here so that it is all together)

[linimon]

There is a shorthand for the Makefile logic: CXXFLAGS_i386= -msse2

[fernape]

• Simplify usage of architecture specific CXXFLAGS
• Add vuxml entry. There was already an entry for the SQLite sec. advisory. I based mine on that one.

[mat]

devel/upp/Makefile

132 ↗

(On Diff #44490)

or add -o -name '*.orig' to the find(1) speficications just above.

[fernape]

Improve handling of .orig files.

[tcberner]

security/vuxml/vuln.xml

67 ↗

(On Diff #44532)

^ this would affect the new version too

[fernape]

security/vuxml/vuln.xml

67 ↗

(On Diff #44532)

The new version has it fixed with files/patch-uppsrc_plugin_sqlite3_lib_sqlite3.c

[tcberner]

you misunderstood; i mean this

> pkg audit -f security/vuxml/vuln.xml `make -VPKGNAME -C devel/upp`
upp-11873 is vulnerable:
SQLite -- Corrupt DB can cause a NULL pointer dereference
CVE: CVE-2018-8740
WWW: https://vuxml.FreeBSD.org/freebsd/c1630aa3-7970-11e8-8634-dcfe074bd614.html

1 problem(s) in the installed packages found.

[fernape]

Fix vuxml entry.

[fernape]

In D16017#340633, @tcberner wrote:

you misunderstood; i mean this

:O yes, I did! :-)

I fixed the vuxml entry.

> pkg audit -f security/vuxml/vuln.xml `make -VPKGNAME -C devel/upp`
upp-11873 is vulnerable:
SQLite -- Corrupt DB can cause a NULL pointer dereference
CVE: CVE-2018-8740
WWW: https://vuxml.FreeBSD.org/freebsd/c1630aa3-7970-11e8-8634-dcfe074bd614.html

1 problem(s) in the installed packages found.

[tcberner]

Looks good to me.