fix some buffer overflows #65773

4 files changed, 132 insertions, 1 deletions

diff --git a/app-arch/sharutils/ChangeLog b/app-arch/sharutils/ChangeLog
index db94114fdd92..ba305a3d29b8 100644
--- a/app-arch/sharutils/ChangeLog
+++ b/app-arch/sharutils/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for app-arch/sharutils
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-arch/sharutils/ChangeLog,v 1.16 2004/06/24 21:36:05 agriffis Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-arch/sharutils/ChangeLog,v 1.17 2004/09/29 14:19:29 vapier Exp $
+
+*sharutils-4.2.1-r10 (29 Sep 2004)
+
+  29 Sep 2004; Mike Frysinger <vapier@gentoo.org>
+  +files/sharutils-4.2.1-buffer-limits.patch, +sharutils-4.2.1-r10.ebuild:
+  Add patch from Debian/Florian Schilhabel to fix some buffer overflows #65773.
 
   16 May 2004; Luca Barbato <lu_zero@gentoo.org> sharutils-4.2.1-r9.ebuild:
   Marked ppc
diff --git a/app-arch/sharutils/files/digest-sharutils-4.2.1-r10 b/app-arch/sharutils/files/digest-sharutils-4.2.1-r10
new file mode 100644
index 000000000000..afb942300ec9
--- /dev/null
+++ b/app-arch/sharutils/files/digest-sharutils-4.2.1-r10
@@ -0,0 +1 @@
+MD5 b8ba1d409f07edcb335ff72a27bd9828 sharutils-4.2.1.tar.gz 306022
diff --git a/app-arch/sharutils/files/sharutils-4.2.1-buffer-limits.patch b/app-arch/sharutils/files/sharutils-4.2.1-buffer-limits.patch
new file mode 100644
index 000000000000..974677156496
--- /dev/null
+++ b/app-arch/sharutils/files/sharutils-4.2.1-buffer-limits.patch
@@ -0,0 +1,60 @@
+diff -Naur ./sharutils-4.2.1/src/shar.c ./sharutils-4.2.1_new/src/shar.c
+--- ./sharutils-4.2.1/src/shar.c	1999-09-10 21:20:41.000000000 +0200
++++ ./sharutils-4.2.1_new/src/shar.c	2004-09-29 15:09:40.790061000 +0200
+@@ -1571,7 +1571,7 @@
+ 	  sprintf (command, "%s '%s'", CHARACTER_COUNT_COMMAND, local_name);
+ 	  if (pfp = popen (command, "r"), pfp)
+ 	    {
+-	      char wc[BUFSIZ];
++		char wc[BUFSIZ], tempform[50];      
+ 	      const char *prefix = "";
+ 
+ 	      if (did_md5)
+@@ -1579,8 +1579,8 @@
+ 		  fputs ("  else\n", output);
+ 		  prefix = "  ";
+ 		}
+-
+-	      fscanf (pfp, "%s", wc);
++	sprintf (tempform, "%%%ds", BUFSIZ - 1);
++	fscanf (pfp, tempform, wc);
+ 	      fprintf (output, "\
+ %s  shar_count=\"`%s '%s'`\"\n\
+ %s  test %s -eq \"$shar_count\" ||\n\
+diff -Naur ./sharutils-4.2.1/src/unshar.c ./sharutils-4.2.1_new/src/unshar.c
+--- ./sharutils-4.2.1/src/unshar.c	1995-11-21 17:22:14.000000000 +0100
++++ ./sharutils-4.2.1_new/src/unshar.c	2004-09-29 15:09:44.682469264 +0200
+@@ -346,8 +346,8 @@
+ {
+   size_t size_read;
+   FILE *file;
+-  char name_buffer[NAME_BUFFER_SIZE];
+-  char copy_buffer[NAME_BUFFER_SIZE];
++  char name_buffer[NAME_BUFFER_SIZE] = {'\0'};
++  char copy_buffer[NAME_BUFFER_SIZE] = {'\0'};
+   int optchar;
+ 
+   program_name = argv[0];
+@@ -409,14 +409,14 @@
+   if (optind < argc)
+     for (; optind < argc; optind++)
+       {
+-	if (argv[optind][0] == '/')
+-	  stpcpy (name_buffer, argv[optind]);
+-	else
+-	  {
+-	    char *cp = stpcpy (name_buffer, current_directory);
+-	    *cp++ = '/';
+-	    stpcpy (cp, argv[optind]);
+-	  }
++	if (argv[optind][0] == '/') {
++		strncpy (name_buffer, argv[optind], sizeof(name_buffer));
++		name_buffer[sizeof(name_buffer)-1] = '\0';
++	}
++	else {
++		snprintf(name_buffer, sizeof(name_buffer),"%s/%s", current_directory, argv[optind]);
++		name_buffer[sizeof(name_buffer)-1] = '\0';
++	}
+ 	if (file = fopen (name_buffer, "r"), !file)
+ 	  error (EXIT_FAILURE, errno, name_buffer);
+ 	unarchive_shar_file (name_buffer, file);
diff --git a/app-arch/sharutils/sharutils-4.2.1-r10.ebuild b/app-arch/sharutils/sharutils-4.2.1-r10.ebuild
new file mode 100644
index 000000000000..9e1ada9bbf0d
--- /dev/null
+++ b/app-arch/sharutils/sharutils-4.2.1-r10.ebuild
@@ -0,0 +1,64 @@
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-arch/sharutils/sharutils-4.2.1-r10.ebuild,v 1.1 2004/09/29 14:19:29 vapier Exp $
+
+inherit eutils
+
+DESCRIPTION="Tools to deal with shar archives"
+HOMEPAGE="http://www.gnu.org/software/sharutils/"
+SRC_URI="mirror://gentoo/${P}.tar.gz
+	mirror://gnu/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+IUSE="nls"
+
+RDEPEND="sys-apps/texinfo
+	nls? ( >=sys-devel/gettext-0.10.35 )"
+DEPEND="${RDEPEND}
+	>=sys-apps/sed-4"
+
+src_unpack() {
+	unpack ${A}
+	cd ${S}
+	epatch ${FILESDIR}/${P}-r6-gentoo.diff
+	epatch ${FILESDIR}/${P}-buffer-check.patch #46998
+	epatch ${FILESDIR}/${P}-buffer-limits.patch #65773
+
+	cd ${S}/po
+	cp ja_JP.EUC.po ja.po
+	cp ja_JP.EUC.gmo ja.gmo
+	sed -i \
+		-e 's/aangemaakt/aangemaakt\\n/' nl.po \
+			|| die "sed nl.po failed"
+	sed -i \
+		-e 's/de %dk/de %dk\\n/' pt.po \
+			|| die "sed pt.po failed"
+}
+
+src_compile() {
+	econf `use_enable nls` || die
+	emake || die "emake failed"
+}
+
+src_install() {
+	local x=
+
+	einstall \
+		localedir=${D}/usr/share/locale \
+		|| die
+
+	doman doc/*.[15]
+	# Remove some strange locales
+	cd ${D}/usr/share/locale
+	for x in *.
+	do
+	  rm -rf ${x}
+	done
+	rm -rf ${D}/usr/lib
+
+	cd ${S}
+	dodoc AUTHORS BACKLOG ChangeLog ChangeLog.OLD \
+		NEWS README README.OLD THANKS TODO
+}