Add fix for CVE-2007-4476 #196978.

(Portage version: 2.1.3.16)

4 files changed, 136 insertions, 1 deletions

diff --git a/app-arch/cpio/ChangeLog b/app-arch/cpio/ChangeLog
index 946f7df179d0..1ea9998f8820 100644
--- a/app-arch/cpio/ChangeLog
+++ b/app-arch/cpio/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for app-arch/cpio
 # Copyright 1999-2007 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-arch/cpio/ChangeLog,v 1.81 2007/10/03 06:06:28 tgall Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-arch/cpio/ChangeLog,v 1.82 2007/10/28 21:40:19 vapier Exp $
+
+*cpio-2.9-r1 (28 Oct 2007)
+
+  28 Oct 2007; Mike Frysinger <vapier@gentoo.org>
+  +files/cpio-2.9-CVE-2007-4476.patch, +cpio-2.9-r1.ebuild:
+  Add fix for CVE-2007-4476 #196978.
 
   02 Oct 2007; Tom Gall <tgall@gentoo.org> cpio-2.9.ebuild:
   stable on ppc64
diff --git a/app-arch/cpio/cpio-2.9-r1.ebuild b/app-arch/cpio/cpio-2.9-r1.ebuild
new file mode 100644
index 000000000000..1fddbaf8b28f
--- /dev/null
+++ b/app-arch/cpio/cpio-2.9-r1.ebuild
@@ -0,0 +1,36 @@
+# Copyright 1999-2007 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-arch/cpio/cpio-2.9-r1.ebuild,v 1.1 2007/10/28 21:40:19 vapier Exp $
+
+DESCRIPTION="A file archival tool which can also read and write tar files"
+HOMEPAGE="http://www.gnu.org/software/cpio/cpio.html"
+SRC_URI="mirror://gnu/cpio/${P}.tar.bz2"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~sparc-fbsd ~x86 ~x86-fbsd"
+IUSE="nls"
+
+DEPEND=""
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+	epatch "${FILESDIR}"/${P}-CVE-2007-4476.patch #196978
+}
+
+src_compile() {
+	econf \
+		$(use_enable nls) \
+		--bindir=/bin \
+		--with-rmt=/usr/sbin/rmt \
+		|| die
+	emake || die
+}
+
+src_install() {
+	emake install DESTDIR="${D}" || die
+	dodoc ChangeLog NEWS README
+	rm -f "${D}"/usr/share/man/man1/mt.1
+	rmdir "${D}"/usr/libexec || die
+}
diff --git a/app-arch/cpio/files/cpio-2.9-CVE-2007-4476.patch b/app-arch/cpio/files/cpio-2.9-CVE-2007-4476.patch
new file mode 100644
index 000000000000..2edbb1eb1c56
--- /dev/null
+++ b/app-arch/cpio/files/cpio-2.9-CVE-2007-4476.patch
@@ -0,0 +1,90 @@
+http://bugs.gentoo.org/196978
+
+--- lib/paxnames.c
++++ lib/paxnames.c
+@@ -36,15 +36,27 @@
+   return strcmp (name1, name2) == 0;
+ }
+ 
+-/* Return zero if TABLE contains a copy of STRING; otherwise, insert a
+-   copy of STRING to TABLE and return 1.  */
+-bool
+-hash_string_insert (Hash_table **table, char const *string)
++/* Return zero if TABLE contains a LEN-character long prefix of STRING,
++   otherwise, insert a newly allocated copy of this prefix to TABLE and
++   return 1.  If RETURN_PREFIX is not NULL, point it to the allocated
++   copy. */
++static bool
++hash_string_insert_prefix (Hash_table **table, char const *string, size_t len,
++			   const char **return_prefix)
+ {
+   Hash_table *t = *table;
+-  char *s = xstrdup (string);
++  char *s;
+   char *e;
+ 
++  if (len)
++    {
++      s = xmalloc (len + 1);
++      memcpy (s, string, len);
++      s[len] = 0;
++    }
++  else
++    s = xstrdup (string);
++  
+   if (! ((t
+ 	  || (*table = t = hash_initialize (0, 0, hash_string_hasher,
+ 					    hash_string_compare, 0)))
+@@ -52,7 +64,11 @@
+     xalloc_die ();
+ 
+   if (e == s)
+-    return 1;
++    {
++      if (return_prefix)
++	*return_prefix = s;
++      return 1;
++    }
+   else
+     {
+       free (s);
+@@ -60,6 +76,14 @@
+     }
+ }
+ 
++/* Return zero if TABLE contains a copy of STRING; otherwise, insert a
++   copy of STRING to TABLE and return 1.  */
++bool
++hash_string_insert (Hash_table **table, char const *string)
++{
++  return hash_string_insert_prefix (table, string, 0, NULL);
++}
++
+ /* Return 1 if TABLE contains STRING.  */
+ bool
+ hash_string_lookup (Hash_table const *table, char const *string)
+@@ -88,7 +112,8 @@
+    If ABSOLUTE_NAMES is 0, strip filesystem prefix from the file name. */
+ 
+ char *
+-safer_name_suffix (char const *file_name, bool link_target, bool absolute_names)
++safer_name_suffix (char const *file_name, bool link_target,
++		   bool absolute_names)
+ {
+   char const *p;
+ 
+@@ -121,11 +146,9 @@
+ 
+       if (prefix_len)
+ 	{
+-	  char *prefix = alloca (prefix_len + 1);
+-	  memcpy (prefix, file_name, prefix_len);
+-	  prefix[prefix_len] = '\0';
+-
+-	  if (hash_string_insert (&prefix_table[link_target], prefix))
++	  const char *prefix;
++	  if (hash_string_insert_prefix (&prefix_table[link_target], file_name,
++					 prefix_len, &prefix))
+ 	    {
+ 	      static char const *const diagnostic[] =
+ 	      {
diff --git a/app-arch/cpio/files/digest-cpio-2.9-r1 b/app-arch/cpio/files/digest-cpio-2.9-r1
new file mode 100644
index 000000000000..3827e3d7fe96
--- /dev/null
+++ b/app-arch/cpio/files/digest-cpio-2.9-r1
@@ -0,0 +1,3 @@
+MD5 e387abfdae3a0b9a8a5f762db653a96d cpio-2.9.tar.bz2 758195
+RMD160 6fbd93755e266ad7ff9644cb7fe3c3e54d61ac44 cpio-2.9.tar.bz2 758195
+SHA256 bb9a5fa693a8f4ef4685eb447cea1dc5b787e37c302569928ef74df460724707 cpio-2.9.tar.bz2 758195