update NEWS for 1.9.4

NEWS

@@ -1,6 +1,26 @@
 Changes from previous version of pkgconf
 ========================================
 
+Changes from 1.9.3 to 1.9.4:
+----------------------------
+
+* Fix a buffer overflow vulnerability involving very large variable expansions.
+  CVE-2023-24056
+
+* Fix a bunch of minor regressions with the solver.
+
+* Create separate solutions for `--cflags` and `--libs` when `--static` is not
+  used.
+
+* Remove final trailing whitespace in pkgconf_fragment_render_buf().
+
+* Revert broken pkg.m4 change involving querying module versions in
+  PKG_CHECK_MODULES.
+
+* Fix handling of tildes in version strings.
+
+* Various C99 formatting string fixes involving SIZE_FMT_SPECIFIER.
+
 Changes from 1.9.2 to 1.9.3:
 ----------------------------
 

cli/main.c

@@ -1382,41 +1382,41 @@ cleanup3:
 
 	if ((want_flags & PKG_DUMP_LICENSE) == PKG_DUMP_LICENSE)
 	{
-		apply_license(&pkg_client, &world, &ret, maximum_traverse_depth);
+		apply_license(&pkg_client, &world, &ret, 2);
 		goto out;
 	}
 
 	if ((want_flags & PKG_UNINSTALLED) == PKG_UNINSTALLED)
 	{
 		ret = EXIT_FAILURE;
-		apply_uninstalled(&pkg_client, &world, &ret, maximum_traverse_depth);
+		apply_uninstalled(&pkg_client, &world, &ret, 2);
 		goto out;
 	}
 
 	if (want_env_prefix != NULL)
 	{
-		apply_env(&pkg_client, &world, want_env_prefix, maximum_traverse_depth);
+		apply_env(&pkg_client, &world, want_env_prefix, 2);
 		want_flags = 0;
 	}
 
 	if ((want_flags & PKG_PROVIDES) == PKG_PROVIDES)
 	{
 		want_flags &= ~(PKG_CFLAGS|PKG_LIBS);
-		apply_provides(&pkg_client, &world, NULL, maximum_traverse_depth);
+		apply_provides(&pkg_client, &world, NULL, 2);
 	}
 
 #ifndef PKGCONF_LITE
 	if ((want_flags & PKG_DIGRAPH) == PKG_DIGRAPH)
 	{
 		want_flags &= ~(PKG_CFLAGS|PKG_LIBS);
-		apply_digraph(&pkg_client, &world, NULL, maximum_traverse_depth);
+		apply_digraph(&pkg_client, &world, NULL, 2);
 	}
 #endif
 
 	if ((want_flags & PKG_MODVERSION) == PKG_MODVERSION)
 	{
 		want_flags &= ~(PKG_CFLAGS|PKG_LIBS);
-		apply_modversion(&pkg_client, &world, NULL, maximum_traverse_depth);
+		apply_modversion(&pkg_client, &world, NULL, 2);
 	}
 
 	if ((want_flags & PKG_PATH) == PKG_PATH)
@@ -1424,13 +1424,13 @@ cleanup3:
 		want_flags &= ~(PKG_CFLAGS|PKG_LIBS);
 
 		pkgconf_client_set_flags(&pkg_client, want_client_flags | PKGCONF_PKG_PKGF_SKIP_ROOT_VIRTUAL);
-		apply_path(&pkg_client, &world, NULL, maximum_traverse_depth);
+		apply_path(&pkg_client, &world, NULL, 2);
 	}
 
 	if ((want_flags & PKG_VARIABLES) == PKG_VARIABLES)
 	{
 		want_flags &= ~(PKG_CFLAGS|PKG_LIBS);
-		apply_variables(&pkg_client, &world, NULL, maximum_traverse_depth);
+		apply_variables(&pkg_client, &world, NULL, 2);
 	}
 
 	if (want_variable)
@@ -1438,25 +1438,25 @@ cleanup3:
 		want_flags &= ~(PKG_CFLAGS|PKG_LIBS);
 
 		pkgconf_client_set_flags(&pkg_client, want_client_flags | PKGCONF_PKG_PKGF_SKIP_ROOT_VIRTUAL);
-		apply_variable(&pkg_client, &world, want_variable, maximum_traverse_depth);
+		apply_variable(&pkg_client, &world, want_variable, 2);
 	}
 
 	if ((want_flags & PKG_REQUIRES) == PKG_REQUIRES)
 	{
 		want_flags &= ~(PKG_CFLAGS|PKG_LIBS);
-		apply_requires(&pkg_client, &world, NULL, maximum_traverse_depth);
+		apply_requires(&pkg_client, &world, NULL, 2);
 	}
 
 	if ((want_flags & PKG_REQUIRES_PRIVATE) == PKG_REQUIRES_PRIVATE)
 	{
 		want_flags &= ~(PKG_CFLAGS|PKG_LIBS);
 
-		apply_requires_private(&pkg_client, &world, NULL, maximum_traverse_depth);
+		apply_requires_private(&pkg_client, &world, NULL, 2);
 	}
 
 	if ((want_flags & PKG_CFLAGS))
 	{
-		apply_cflags(&pkg_client, &world, NULL, maximum_traverse_depth);
+		apply_cflags(&pkg_client, &world, NULL, 2);
 	}
 
 	if ((want_flags & PKG_LIBS))
@@ -1479,7 +1479,7 @@ cleanup3:
 			}
 		}
 
-		apply_libs(&pkg_client, &world, NULL, maximum_traverse_depth);
+		apply_libs(&pkg_client, &world, NULL, 2);
 	}
 
 	if (want_flags & (PKG_CFLAGS|PKG_LIBS))

libpkgconf/pkg.c

@@ -1492,7 +1492,7 @@ pkgconf_pkg_walk_list(pkgconf_client_t *client,
 		if (pkgdep == NULL)
 			continue;
 
-		if (pkgdep->serial == client->serial)
+		if (pkgdep->serial == client->serial && !(parent->flags & PKGCONF_PKG_PROPF_VIRTUAL))
 		{
 			pkgdep->hits++;
 

tests/basic.sh

@@ -230,7 +230,7 @@ libs_circular1_body()
 libs_circular_directpc_body()
 {
 	atf_check \
-		-o inline:"-lcircular-1 -lcircular-2 -lcircular-3\n" \
+		-o inline:"-lcircular-2 -lcircular-3 -lcircular-1\n" \
 		pkgconf --libs ${selfdir}/lib1/circular-3.pc
 }
 

tests/regress.sh

@@ -233,7 +233,7 @@ virtual_variable_body()
 
 fragment_collision_body()
 {
-	atf_check -o inline:"-D_BAZ -D_FOO -D_BAR -D_THREAD_SAFE -pthread\n" \
+	atf_check -o inline:"-D_BAZ -D_BAR -D_FOO -D_THREAD_SAFE -pthread\n" \
 		pkgconf --with-path="${selfdir}/lib1" --cflags fragment-collision
 }
 

tests/requires.sh

@@ -69,7 +69,7 @@ private_duplication_body()
 {
 	export PKG_CONFIG_PATH="${selfdir}/lib1"
 	atf_check \
-		-o inline:"-lprivate -lfoo -lbaz -lzee -lfoo -lbar\n" \
+		-o inline:"-lprivate -lbaz -lzee -lbar -lfoo -lfoo\n" \
 		pkgconf --static --libs-only-l private-libs-duplication
 }