The libtxml it ships seems to be an expat derivative. torcs-1.3.1/src/libs/txml/ torcs-1.3.1/src/libs/txml/txml.def torcs-1.3.1/src/libs/txml/iasciitab.h torcs-1.3.1/src/libs/txml/xmldef.h torcs-1.3.1/src/libs/txml/xmlparse.c torcs-1.3.1/src/libs/txml/xml.cpp torcs-1.3.1/src/libs/txml/dllmain.c torcs-1.3.1/src/libs/txml/CVS/ torcs-1.3.1/src/libs/txml/CVS/Entries torcs-1.3.1/src/libs/txml/CVS/Repository torcs-1.3.1/src/libs/txml/CVS/Entries.Log torcs-1.3.1/src/libs/txml/CVS/Tag torcs-1.3.1/src/libs/txml/CVS/Root torcs-1.3.1/src/libs/txml/xmltok.h torcs-1.3.1/src/libs/txml/gennmtab/ torcs-1.3.1/src/libs/txml/gennmtab/CVS/ torcs-1.3.1/src/libs/txml/gennmtab/CVS/Entries torcs-1.3.1/src/libs/txml/gennmtab/CVS/Repository torcs-1.3.1/src/libs/txml/gennmtab/CVS/Tag torcs-1.3.1/src/libs/txml/gennmtab/CVS/Root torcs-1.3.1/src/libs/txml/gennmtab/gennmtab.c torcs-1.3.1/src/libs/txml/gennmtab/Makefile torcs-1.3.1/src/libs/txml/hashtable.h torcs-1.3.1/src/libs/txml/xmlrole.h torcs-1.3.1/src/libs/txml/xmltok.c torcs-1.3.1/src/libs/txml/nametab.h torcs-1.3.1/src/libs/txml/txml.dsp torcs-1.3.1/src/libs/txml/latin1tab.h torcs-1.3.1/src/libs/txml/gennmtab.c torcs-1.3.1/src/libs/txml/asciitab.h torcs-1.3.1/src/libs/txml/filemap.h torcs-1.3.1/src/libs/txml/xmlrole.c torcs-1.3.1/src/libs/txml/hashtable.c torcs-1.3.1/src/libs/txml/codepage.h torcs-1.3.1/src/libs/txml/utf8tab.h torcs-1.3.1/src/libs/txml/xml.h torcs-1.3.1/src/libs/txml/xmltok_impl.h torcs-1.3.1/src/libs/txml/Makefile torcs-1.3.1/src/libs/txml/xmlparse.h torcs-1.3.1/src/libs/txml/xmltok_impl.c
1.3.3 version blames to fix security issues: http://torcs.sourceforge.net/index.php?name=News&file=article&sid=79
So apparently our version is from 2014, and the newest release upstream is from 2016 [1]. Given that it still uses bundled expat, it's clearly vulnerable and there is null maintainer interest in fixing this. Let's remove it. [1] https://sourceforge.net/projects/torcs/files/all-in-one/
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3e7bbe6b88a4401652d06557238edf03551642d5 commit 3e7bbe6b88a4401652d06557238edf03551642d5 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2022-09-26 06:10:34 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2022-09-26 06:10:34 +0000 package.mask: Last rite games-sports/torcs Bug: https://bugs.gentoo.org/253517 Signed-off-by: Michał Górny <mgorny@gentoo.org> profiles/package.mask | 7 +++++++ 1 file changed, 7 insertions(+)
For the record, it has diverged a fair deal but games-sports/speed-dreams is based on torcs and can be a bit of a replacement.
(In reply to Ionen Wolkens from comment #4) > For the record, it has diverged a fair deal but games-sports/speed-dreams is > based on torcs and can be a bit of a replacement. I might add, haven't looked closely but given speed-dreams depends on expat I assume it's not bundled over there too :)
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=97caaf827ca530c3b8dcb7b1377bb403cac9b632 commit 97caaf827ca530c3b8dcb7b1377bb403cac9b632 Author: Jakov Smolić <jsmolic@gentoo.org> AuthorDate: 2022-11-01 04:37:21 +0000 Commit: Jakov Smolić <jsmolic@gentoo.org> CommitDate: 2022-11-01 04:37:21 +0000 games-sports/torcs: treeclean Closes: https://bugs.gentoo.org/253517 Closes: https://bugs.gentoo.org/479698 Closes: https://bugs.gentoo.org/601636 Closes: https://bugs.gentoo.org/711644 Closes: https://bugs.gentoo.org/846671 Signed-off-by: Jakov Smolić <jsmolic@gentoo.org> games-sports/torcs/Manifest | 1 - .../torcs/files/torcs-1.3.6-as-needed.patch | 96 ---------------------- games-sports/torcs/files/torcs-1.3.6-flags.patch | 14 ---- games-sports/torcs/files/torcs-1.3.6-format.patch | 34 -------- games-sports/torcs/files/torcs-1.3.6-gcc6.patch | 11 --- games-sports/torcs/files/torcs-1.3.6-gcc7.patch | 11 --- .../torcs/files/torcs-1.3.6-no-automake.patch | 21 ----- games-sports/torcs/files/torcs-1.3.6-noXmuXt.patch | 15 ---- games-sports/torcs/metadata.xml | 11 --- games-sports/torcs/torcs-1.3.6-r2.ebuild | 68 --------------- profiles/package.mask | 7 -- 11 files changed, 289 deletions(-)
