app-arch/cpio: Security cleanup (bug #572428)

Package-Manager: Portage-2.3.5, Repoman-2.3.2
Closes: https://github.com/gentoo/gentoo/pull/4909

8 files changed, 0 insertions, 435 deletions

diff --git a/app-arch/cpio/Manifest b/app-arch/cpio/Manifest
index cd00f1ed150e..7f50fff8b172 100644
--- a/app-arch/cpio/Manifest
+++ b/app-arch/cpio/Manifest
@@ -1,2 +1 @@
-DIST cpio-2.11.tar.bz2 1018483 SHA256 bb820bfd96e74fc6ce43104f06fe733178517e7f5d1cdee553773e8eff7d5bbd SHA512 b6ccb3e121ea29780219d21c9cd6267c2f7b7ae72fb899bb80e1c54cc33e9eac5363443d93dbfbe37e8e8d295dad2724ac607f0543cc62797919605f68c396aa WHIRLPOOL 3e19212f8d5c16de0d531d189fa9fc288ff90d6299c1f3f98f61e182bb0ec278705ae5021c85c7aaeab869ad36b2b3bcd11327a746cde0bf5a596049d711d9cd
 DIST cpio-2.12.tar.bz2 1258605 SHA256 70998c5816ace8407c8b101c9ba1ffd3ebbecba1f5031046893307580ec1296e SHA512 0cd4da5f2fbca179ab4e666a5f878414c086a5f98bce4c76273f21d9b2a6fe422d901b5d453826c5f81bbe363aa015047a1e99779ad1a451c8feca6205c63120 WHIRLPOOL 2990d54b0832e36239737fbd71f197b28703ec22de8dbbab57c7b97dab88a6107cf5464e4dd0bbf208f2c3d49839c7c2abe8ef68c1f2318ff7018d0b07f179fc
diff --git a/app-arch/cpio/cpio-2.11-r3.ebuild b/app-arch/cpio/cpio-2.11-r3.ebuild
deleted file mode 100644
index 2c7553bfd852..000000000000
--- a/app-arch/cpio/cpio-2.11-r3.ebuild
+++ /dev/null
@@ -1,36 +0,0 @@
-# Copyright 1999-2017 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="5"
-
-inherit autotools eutils
-
-DESCRIPTION="A file archival tool which can also read and write tar files"
-HOMEPAGE="https://www.gnu.org/software/cpio/cpio.html"
-SRC_URI="mirror://gnu/cpio/${P}.tar.bz2"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="nls"
-
-src_prepare() {
-	epatch "${FILESDIR}"/${P}-stat.patch #328531
-	epatch "${FILESDIR}"/${P}-no-gets.patch #424974
-	epatch "${FILESDIR}"/${P}-non-gnu-compilers.patch #275295
-	epatch "${FILESDIR}"/${P}-security.patch #530512 #536010
-	epatch "${FILESDIR}"/${P}-symlink-bad-length-test.patch #554760
-	eautoreconf
-}
-
-src_configure() {
-	econf \
-		$(use_enable nls) \
-		--bindir="${EPREFIX}"/bin \
-		--with-rmt="${EPREFIX}"/usr/sbin/rmt
-}
-
-src_install() {
-	default
-	rm "${ED}"/usr/share/man/man1/mt.1 || die
-}
diff --git a/app-arch/cpio/cpio-2.12.ebuild b/app-arch/cpio/cpio-2.12.ebuild
deleted file mode 100644
index 08343edfc686..000000000000
--- a/app-arch/cpio/cpio-2.12.ebuild
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 1999-2017 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="5"
-
-inherit eutils
-
-DESCRIPTION="A file archival tool which can also read and write tar files"
-HOMEPAGE="https://www.gnu.org/software/cpio/cpio.html"
-SRC_URI="mirror://gnu/cpio/${P}.tar.bz2"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="nls"
-
-src_prepare() {
-	epatch "${FILESDIR}"/${PN}-2.12-non-gnu-compilers.patch #275295
-}
-
-src_configure() {
-	econf \
-		$(use_enable nls) \
-		--bindir="${EPREFIX}"/bin \
-		--with-rmt="${EPREFIX}"/usr/sbin/rmt
-}
diff --git a/app-arch/cpio/files/cpio-2.11-no-gets.patch b/app-arch/cpio/files/cpio-2.11-no-gets.patch
deleted file mode 100644
index f7a9be324df4..000000000000
--- a/app-arch/cpio/files/cpio-2.11-no-gets.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-https://bugs.gentoo.org/424974
-
-hack until gzip pulls a newer gnulib version
-
-From 66712c23388e93e5c518ebc8515140fa0c807348 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Thu, 29 Mar 2012 13:30:41 -0600
-Subject: [PATCH] stdio: don't assume gets any more
-
-Gnulib intentionally does not have a gets module, and now that C11
-and glibc have dropped it, we should be more proactive about warning
-any user on a platform that still has a declaration of this dangerous
-interface.
-
---- a/gnu/stdio.in.h
-+++ b/gnu/stdio.in.h
-@@ -125,7 +125,6 @@
-    so any use of gets warrants an unconditional warning.  Assume it is
-    always declared, since it is required by C89.  */
- #undef gets
--_GL_WARN_ON_USE (gets, "gets is a security hole - use fgets instead");
- 
- #if @GNULIB_FOPEN@
- # if @REPLACE_FOPEN@
diff --git a/app-arch/cpio/files/cpio-2.11-non-gnu-compilers.patch b/app-arch/cpio/files/cpio-2.11-non-gnu-compilers.patch
deleted file mode 100644
index 25e7373d4fcc..000000000000
--- a/app-arch/cpio/files/cpio-2.11-non-gnu-compilers.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-srcshelton@gmail.com: Patch for IRIX
-
-http://bugs.gentoo.org/show_bug.cgi?id=275295
-
-Sent upstream:
-https://savannah.gnu.org/patch/?7838
-
---- src/cpiohdr.h.dist  2009-06-24 15:41:26.983725240 +0100
-+++ src/cpiohdr.h       2009-06-24 15:41:59.753567720 +0100
-@@ -24,6 +24,8 @@
-
- #ifdef HAVE_ATTRIB_PACKED
- #define ATTRIB_PACKED __attribute__((packed))
-+#else
-+#define ATTRIB_PACKED
- #endif
-
- #ifdef HAVE_PRAGMA_PACK
diff --git a/app-arch/cpio/files/cpio-2.11-security.patch b/app-arch/cpio/files/cpio-2.11-security.patch
deleted file mode 100644
index e3ad7a44d000..000000000000
--- a/app-arch/cpio/files/cpio-2.11-security.patch
+++ /dev/null
@@ -1,266 +0,0 @@
-diff -uNr cpio-2.11.ORIG/src/copyin.c cpio-2.11/src/copyin.c
---- cpio-2.11.ORIG/src/copyin.c	2015-01-09 11:31:49.017090090 +0000
-+++ cpio-2.11/src/copyin.c	2015-01-09 11:35:37.723092293 +0000
-@@ -124,10 +124,30 @@
-   if (pad != 0)
-     tape_toss_input (in_file_des, pad);
- }
--
-+
-+static char *
-+get_link_name (struct cpio_file_stat *file_hdr, int in_file_des)
-+{
-+  char *link_name;
-+  
-+  if (file_hdr->c_filesize < 0 || file_hdr->c_filesize > SIZE_MAX-1)
-+    {
-+      error (0, 0, _("%s: stored filename length is out of range"),
-+	     file_hdr->c_name);
-+      link_name = NULL;
-+    }
-+  else
-+    {
-+      link_name = xmalloc (file_hdr->c_filesize + 1);
-+      tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
-+      link_name[file_hdr->c_filesize] = '\0';
-+      tape_skip_padding (in_file_des, file_hdr->c_filesize);
-+    }
-+  return link_name;
-+}
- 
- static void
--list_file(struct cpio_file_stat* file_hdr, int in_file_des)
-+list_file (struct cpio_file_stat* file_hdr, int in_file_des)
- {
-   if (verbose_flag)
-     {
-@@ -136,21 +156,16 @@
- 	{
- 	  if (archive_format != arf_tar && archive_format != arf_ustar)
- 	    {
--	      char *link_name = NULL;	/* Name of hard and symbolic links.  */
--
--	      link_name = (char *) xmalloc ((unsigned int) file_hdr->c_filesize + 1);
--	      link_name[file_hdr->c_filesize] = '\0';
--	      tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
--	      long_format (file_hdr, link_name);
--	      free (link_name);
--	      tape_skip_padding (in_file_des, file_hdr->c_filesize);
--	      return;
-+	      char *link_name = get_link_name (file_hdr, in_file_des);
-+	      if (link_name)
-+		{
-+		  long_format (file_hdr, link_name);
-+		  free (link_name);
-+		}
- 	    }
- 	  else
--	    {
--	      long_format (file_hdr, file_hdr->c_tar_linkname);
--	      return;
--	    }
-+	    long_format (file_hdr, file_hdr->c_tar_linkname);
-+	  return;
- 	}
-       else
- #endif
-@@ -640,7 +655,7 @@
- }
- 
- static void
--copyin_link(struct cpio_file_stat *file_hdr, int in_file_des)
-+copyin_link (struct cpio_file_stat *file_hdr, int in_file_des)
- {
-   char *link_name = NULL;	/* Name of hard and symbolic links.  */
-   int res;			/* Result of various function calls.  */
-@@ -650,10 +665,9 @@
- 
-   if (archive_format != arf_tar && archive_format != arf_ustar)
-     {
--      link_name = (char *) xmalloc ((unsigned int) file_hdr->c_filesize + 1);
--      link_name[file_hdr->c_filesize] = '\0';
--      tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
--      tape_skip_padding (in_file_des, file_hdr->c_filesize);
-+      link_name = get_link_name (file_hdr, in_file_des);
-+      if (!link_name)
-+	return;
-     }
-   else
-     {
-@@ -1005,7 +1019,7 @@
- 
-   file_hdr->c_tar_linkname = NULL;
- 
--  tape_buffered_read (magic.str, in_des, 6L);
-+  tape_buffered_read (magic.str, in_des, sizeof (magic.str));
-   while (1)
-     {
-       if (append_flag)
-@@ -1050,8 +1064,8 @@
- 	  break;
- 	}
-       bytes_skipped++;
--      memmove (magic.str, magic.str + 1, 5);
--      tape_buffered_read (magic.str, in_des, 1L);
-+      memmove (magic.str, magic.str + 1, sizeof (magic.str) - 1);
-+      tape_buffered_read (magic.str + sizeof (magic.str) - 1, in_des, 1L);
-     }
- }
- 
-diff -uNr cpio-2.11.ORIG/src/util.c cpio-2.11/src/util.c
---- cpio-2.11.ORIG/src/util.c	2015-01-09 11:31:49.018090090 +0000
-+++ cpio-2.11/src/util.c	2015-01-09 11:36:55.794093045 +0000
-@@ -206,10 +206,7 @@
-   if (input_size < 0)
-     error (1, errno, _("read error"));
-   if (input_size == 0)
--    {
--      error (0, 0, _("premature end of file"));
--      exit (1);
--    }
-+    error (PAXEXIT_FAILURE, 0, _("premature end of file"));
-   input_bytes += input_size;
- }
- 
-diff -uNr cpio-2.11.ORIG/tests/Makefile.am cpio-2.11/tests/Makefile.am
---- cpio-2.11.ORIG/tests/Makefile.am	2015-01-09 11:31:49.020090090 +0000
-+++ cpio-2.11/tests/Makefile.am	2015-01-09 11:34:05.121091401 +0000
-@@ -52,6 +52,8 @@
-  setstat04.at\
-  setstat05.at\
-  symlink.at\
-+ symlink-bad-length.at\
-+ symlink-long.at\
-  version.at
- 
- TESTSUITE = $(srcdir)/testsuite
-diff -uNr cpio-2.11.ORIG/tests/symlink-bad-length.at cpio-2.11/tests/symlink-bad-length.at
---- cpio-2.11.ORIG/tests/symlink-bad-length.at	1970-01-01 01:00:00.000000000 +0100
-+++ cpio-2.11/tests/symlink-bad-length.at	2015-01-09 11:35:52.124092432 +0000
-@@ -0,0 +1,64 @@
-+# Process this file with autom4te to create testsuite.  -*- Autotest -*-
-+# Copyright (C) 2014 Free Software Foundation, Inc.
-+
-+# This program is free software; you can redistribute it and/or modify
-+# it under the terms of the GNU General Public License as published by
-+# the Free Software Foundation; either version 3, or (at your option)
-+# any later version.
-+
-+# This program is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+# GNU General Public License for more details.
-+
-+# You should have received a copy of the GNU General Public License
-+# along with this program; if not, write to the Free Software
-+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
-+# 02110-1301 USA.
-+
-+# Cpio v2.11 did segfault with badly set symlink length.
-+# References:
-+# http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
-+
-+AT_SETUP([symlink-bad-length])
-+AT_KEYWORDS([symlink-long copyout])
-+
-+AT_DATA([ARCHIVE.base64],
-+[x3EjAIBAtIEtJy8nAQAAAHRUYW0FAAAADQBGSUxFAABzb21lIGNvbnRlbnQKAMdxIwBgQ/+hLScv
-+JwEAAAB0VEhuBQD/////TElOSwAARklMRcdxAAAAAAAAAAAAAAEAAAAAAAAACwAAAAAAVFJBSUxF
-+UiEhIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-+])
-+
-+# The exact error message and exit status depend on the host architecture,
-+# therefore strderr is filtered out and error code is not checked.
-+
-+# So far the only case when cpio would exit with code 0 is when it skips
-+# several bytes and encounters a valid record header.  Perhaps it should
-+# exit with code 2 (non-critical error), if at least one byte was skipped,
-+# but that could hurt backward compatibility.
-+
-+AT_CHECK([
-+base64 -d ARCHIVE.base64 > ARCHIVE || AT_SKIP_TEST
-+TZ=UTC cpio -ntv < ARCHIVE 2>stderr 
-+cat stderr | grep -v \
-+    -e 'stored filename length is out of range' \
-+    -e 'premature end of file' \
-+    -e 'archive header has reverse byte-order' \
-+    -e 'memory exhausted' \
-+    -e 'skipped [[0-9][0-9]*] bytes of junk' \
-+    -e '[[0-9][0-9]*] block' \
-+    >&2
-+echo >&2 STDERR
-+],
-+[0],
-+[-rw-rw-r--   1 10029    10031          13 Nov 25 11:52 FILE
-+],[STDERR
-+])
-+
-+AT_CLEANUP
-diff -uNr cpio-2.11.ORIG/tests/symlink-long.at cpio-2.11/tests/symlink-long.at
---- cpio-2.11.ORIG/tests/symlink-long.at	1970-01-01 01:00:00.000000000 +0100
-+++ cpio-2.11/tests/symlink-long.at	2015-01-09 11:32:53.908090715 +0000
-@@ -0,0 +1,46 @@
-+# Process this file with autom4te to create testsuite.  -*- Autotest -*-
-+# Copyright (C) 2014 Free Software Foundation, Inc.
-+
-+# This program is free software; you can redistribute it and/or modify
-+# it under the terms of the GNU General Public License as published by
-+# the Free Software Foundation; either version 3, or (at your option)
-+# any later version.
-+
-+# This program is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+# GNU General Public License for more details.
-+
-+# You should have received a copy of the GNU General Public License
-+# along with this program; if not, write to the Free Software
-+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
-+# 02110-1301 USA.
-+
-+# Cpio v2.11.90 changed the way symlink name is read from archive.
-+# References:
-+# http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
-+
-+AT_SETUP([symlink-long])
-+AT_KEYWORDS([symlink-long copyout])
-+
-+AT_CHECK([
-+
-+# len(dirname) > READBUFSIZE
-+dirname=
-+for i in {1..52}; do
-+    dirname="xxxxxxxxx/$dirname"
-+    mkdir "$dirname"
-+done
-+ln -s "$dirname" x || AT_SKIP_TEST
-+
-+echo x | cpio -o > ar
-+list=`cpio -tv < ar | sed 's|.*-> ||'`
-+test "$list" = "$dirname" && echo success || echo fail
-+],
-+[0],
-+[success
-+],[2 blocks
-+2 blocks
-+])
-+
-+AT_CLEANUP
-diff -uNr cpio-2.11.ORIG/tests/testsuite.at cpio-2.11/tests/testsuite.at
---- cpio-2.11.ORIG/tests/testsuite.at	2015-01-09 11:31:49.020090090 +0000
-+++ cpio-2.11/tests/testsuite.at	2015-01-09 11:34:34.386091683 +0000
-@@ -31,6 +31,8 @@
- 
- m4_include([inout.at])
- m4_include([symlink.at])
-+m4_include([symlink-bad-length.at])
-+m4_include([symlink-long.at])
- m4_include([interdir.at])
- 
- m4_include([setstat01.at])
diff --git a/app-arch/cpio/files/cpio-2.11-stat.patch b/app-arch/cpio/files/cpio-2.11-stat.patch
deleted file mode 100644
index dcd991e3f20c..000000000000
--- a/app-arch/cpio/files/cpio-2.11-stat.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-http://bugs.gentoo.org/328531
-
-From 3a7a1820d4cecbd77c7b74c785af5942510bf080 Mon Sep 17 00:00:00 2001
-From: Sergey Poznyakoff <gray@gnu.org.ua>
-Date: Thu, 22 Jul 2010 13:13:34 +0300
-Subject: [PATCH] Minor fix.
-
-* src/filetypes.h: Remove declarations of stat and lstat.
----
- src/filetypes.h |    2 --
- 1 files changed, 0 insertions(+), 2 deletions(-)
-
-diff --git a/src/filetypes.h b/src/filetypes.h
-index f80faab..81f0c32 100644
---- a/src/filetypes.h
-+++ b/src/filetypes.h
-@@ -81,5 +81,3 @@
- #ifndef S_ISLNK
- #define lstat stat
- #endif
--int lstat ();
--int stat ();
--- 
-1.7.3
-
diff --git a/app-arch/cpio/files/cpio-2.11-symlink-bad-length-test.patch b/app-arch/cpio/files/cpio-2.11-symlink-bad-length-test.patch
deleted file mode 100644
index 7af5fe0f0bc5..000000000000
--- a/app-arch/cpio/files/cpio-2.11-symlink-bad-length-test.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-https://lists.gnu.org/archive/html/bug-cpio/2015-06/msg00001.html
-https://bugs.gentoo.org/554760
-
-this fix is squashed into 0396591026410f91f7a81b4b150bc7285d9f2278
-(as upstream doesn't seem to understand git)
-
->From bebf9662c406d1d137a66c567d8748b489d352e7 Mon Sep 17 00:00:00 2001
-From: Pavel Raiskup <address@hidden>
-Date: Thu, 4 Jun 2015 13:27:42 +0200
-Subject: [PATCH] tests: fix expected output for old file
-
-Thanks Victor Rodriguez.  Upstream thread:
-http://lists.gnu.org/archive/html/bug-cpio/2015-06/msg00000.html
-
-* tests/symlink-bad-length.at (STDOUT): Expect the year string
-'2014' is printed and not time because the file in archive is
-older than 6 months.
-* Thanks: Mention Victor.
----
- THANKS                      | 1 +
- tests/symlink-bad-length.at | 2 +-
- 2 files changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/tests/symlink-bad-length.at b/tests/symlink-bad-length.at
-index e1a7093..2cdc692 100644
---- a/tests/symlink-bad-length.at
-+++ b/tests/symlink-bad-length.at
-@@ -57,7 +57,7 @@ cat stderr | grep -v \
- echo >&2 STDERR
- ],
- [0],
--[-rw-rw-r--   1 10029    10031          13 Nov 25 11:52 FILE
-+[-rw-rw-r--   1 10029    10031          13 Nov 25  2014 FILE
- ],[STDERR
- ])
- 
--- 
-2.1.0
-