summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRobin H. Johnson <robbat2@gentoo.org>2015-08-08 13:49:04 -0700
committerRobin H. Johnson <robbat2@gentoo.org>2015-08-08 17:38:18 -0700
commit56bd759df1d0c750a065b8c845e93d5dfa6b549d (patch)
tree3f91093cdb475e565ae857f1c5a7fd339e2d781e /dev-libs/libtar/files
downloadgentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.gz
gentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.bz2
gentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.zip
proj/gentoo: Initial commit
This commit represents a new era for Gentoo: Storing the gentoo-x86 tree in Git, as converted from CVS. This commit is the start of the NEW history. Any historical data is intended to be grafted onto this point. Creation process: 1. Take final CVS checkout snapshot 2. Remove ALL ChangeLog* files 3. Transform all Manifests to thin 4. Remove empty Manifests 5. Convert all stale $Header$/$Id$ CVS keywords to non-expanded Git $Id$ 5.1. Do not touch files with -kb/-ko keyword flags. Signed-off-by: Robin H. Johnson <robbat2@gentoo.org> X-Thanks: Alec Warner <antarus@gentoo.org> - did the GSoC 2006 migration tests X-Thanks: Robin H. Johnson <robbat2@gentoo.org> - infra guy, herding this project X-Thanks: Nguyen Thai Ngoc Duy <pclouds@gentoo.org> - Former Gentoo developer, wrote Git features for the migration X-Thanks: Brian Harring <ferringb@gentoo.org> - wrote much python to improve cvs2svn X-Thanks: Rich Freeman <rich0@gentoo.org> - validation scripts X-Thanks: Patrick Lauer <patrick@gentoo.org> - Gentoo dev, running new 2014 work in migration X-Thanks: Michał Górny <mgorny@gentoo.org> - scripts, QA, nagging X-Thanks: All of other Gentoo developers - many ideas and lots of paint on the bikeshed
Diffstat (limited to 'dev-libs/libtar/files')
-rw-r--r--dev-libs/libtar/files/CVE-2013-4420.patch94
-rw-r--r--dev-libs/libtar/files/libtar-1.2.11-fortify.patch11
-rw-r--r--dev-libs/libtar/files/libtar-1.2.11-free.patch22
-rw-r--r--dev-libs/libtar/files/libtar-1.2.11-impl-dec.patch15
4 files changed, 142 insertions, 0 deletions
diff --git a/dev-libs/libtar/files/CVE-2013-4420.patch b/dev-libs/libtar/files/CVE-2013-4420.patch
new file mode 100644
index 000000000000..d6e24860c929
--- /dev/null
+++ b/dev-libs/libtar/files/CVE-2013-4420.patch
@@ -0,0 +1,94 @@
+--- a/libtar/lib/decode.c 2013-10-09 09:59:44.000000000 -0700
++++ b/libtar/lib/decode.c 2015-07-20 20:57:58.331945962 -0700
+@@ -21,24 +21,55 @@
+ # include <string.h>
+ #endif
+
++char *
++safer_name_suffix (char const *file_name)
++{
++ char const *p, *t;
++ p = t = file_name;
++ while (*p)
++ {
++ if (p[0] == '.' && p[0] == p[1] && p[2] == '/')
++ {
++ p += 3;
++ t = p;
++ }
++ /* advance pointer past the next slash */
++ while (*p && (p++)[0] != '/');
++ }
++
++ if (!*t)
++ {
++ t = ".";
++ }
++
++ if (t != file_name)
++ {
++ /* TODO: warn somehow that the path was modified */
++ }
++ return (char*)t;
++}
++
+
+ /* determine full path name */
+ char *
+ th_get_pathname(TAR *t)
+ {
+ static TLS_THREAD char filename[MAXPATHLEN];
++ char *safer_name;
+
+ if (t->th_buf.gnu_longname)
+- return t->th_buf.gnu_longname;
++ return safer_name_suffix(t->th_buf.gnu_longname);
++
++ safer_name = safer_name_suffix(t->th_buf.name);
+
+ if (t->th_buf.prefix[0] != '\0')
+ {
+ snprintf(filename, sizeof(filename), "%.155s/%.100s",
+- t->th_buf.prefix, t->th_buf.name);
++ t->th_buf.prefix, safer_name);
+ return filename;
+ }
+
+- snprintf(filename, sizeof(filename), "%.100s", t->th_buf.name);
++ snprintf(filename, sizeof(filename), "%.100s", safer_name);
+ return filename;
+ }
+
+--- a/libtar/lib/extract.c 2013-10-09 09:59:44.000000000 -0700
++++ b/libtar/lib/extract.c 2015-07-20 21:00:16.560956122 -0700
+@@ -305,7 +305,7 @@
+ linktgt = &lnp[strlen(lnp) + 1];
+ }
+ else
+- linktgt = th_get_linkname(t);
++ linktgt = safer_name_suffix(th_get_linkname(t));
+
+ #ifdef DEBUG
+ printf(" ==> extracting: %s (link to %s)\n", filename, linktgt);
+@@ -343,9 +343,9 @@
+
+ #ifdef DEBUG
+ printf(" ==> extracting: %s (symlink to %s)\n",
+- filename, th_get_linkname(t));
++ filename, safer_name_suffix(th_get_linkname(t)));
+ #endif
+- if (symlink(th_get_linkname(t), filename) == -1)
++ if (symlink(safer_name_suffix(th_get_linkname(t)), filename) == -1)
+ {
+ #ifdef DEBUG
+ perror("symlink()");
+--- a/libtar/lib/internal.h 2013-10-09 09:59:44.000000000 -0700
++++ b/libtar/lib/internal.h 2015-07-20 21:00:51.258958673 -0700
+@@ -15,6 +15,7 @@
+
+ #include <libtar.h>
+
++char* safer_name_suffix(char const*);
+ #ifdef TLS
+ #define TLS_THREAD TLS
+ #else
diff --git a/dev-libs/libtar/files/libtar-1.2.11-fortify.patch b/dev-libs/libtar/files/libtar-1.2.11-fortify.patch
new file mode 100644
index 000000000000..8b919ad8f4ac
--- /dev/null
+++ b/dev-libs/libtar/files/libtar-1.2.11-fortify.patch
@@ -0,0 +1,11 @@
+--- lib/encode.c
++++ lib/encode.c
+@@ -30,7 +30,7 @@
+ int i, sum = 0;
+
+ if (t->options & TAR_GNU)
+- strncpy(t->th_buf.magic, "ustar ", 8);
++ strncpy(t->th_buf.magic, "ustar", 6);
+ else
+ {
+ strncpy(t->th_buf.version, TVERSION, TVERSLEN);
diff --git a/dev-libs/libtar/files/libtar-1.2.11-free.patch b/dev-libs/libtar/files/libtar-1.2.11-free.patch
new file mode 100644
index 000000000000..3a7b028d5d2d
--- /dev/null
+++ b/dev-libs/libtar/files/libtar-1.2.11-free.patch
@@ -0,0 +1,22 @@
+stdlib.h is required for free()
+
+--- lib/output.c
++++ lib/output.c
+@@ -20,6 +20,7 @@
+ #include <sys/param.h>
+
+ #ifdef STDC_HEADERS
++# include <stdlib.h>
+ # include <string.h>
+ #endif
+
+--- lib/wrapper.c
++++ lib/wrapper.c
+@@ -18,6 +18,7 @@
+ #include <errno.h>
+
+ #ifdef STDC_HEADERS
++# include <stdlib.h>
+ # include <string.h>
+ #endif
+
diff --git a/dev-libs/libtar/files/libtar-1.2.11-impl-dec.patch b/dev-libs/libtar/files/libtar-1.2.11-impl-dec.patch
new file mode 100644
index 000000000000..ee00f5c1c9f3
--- /dev/null
+++ b/dev-libs/libtar/files/libtar-1.2.11-impl-dec.patch
@@ -0,0 +1,15 @@
+ lib/extract.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/lib/extract.c b/lib/extract.c
+index 6bbb801..3ef2fb8 100644
+--- a/lib/extract.c
++++ b/lib/extract.c
+@@ -18,6 +18,7 @@
+ #include <fcntl.h>
+ #include <errno.h>
+ #include <utime.h>
++#include <string.h>
+
+ #ifdef STDC_HEADERS
+ # include <stdlib.h>