Applied buffer overflows and directory traversal patches. See http://lists.netsys.com/pipermail/full-disclosure/2004-May/020776.html for detail.

5 files changed, 128 insertions, 2 deletions

diff --git a/app-arch/lha/ChangeLog b/app-arch/lha/ChangeLog
index 652a076ce06d..af39c8cf32ac 100644
--- a/app-arch/lha/ChangeLog
+++ b/app-arch/lha/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for app-arch/lha
 # Copyright 2002-2004 Gentoo Technologies, Inc.; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-arch/lha/ChangeLog,v 1.14 2004/03/12 15:17:01 aliz Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-arch/lha/ChangeLog,v 1.15 2004/05/04 12:17:34 usata Exp $
+
+*lha-114i-r2 (04 May 2004)
+
+  04 May 2004; Mamoru KOMACHI <usata@gentoo.org> lha-114i-r2.ebuild,
+  files/lha-114i.diff:
+  Applied buffer overflows and directory traversal patches.
+  See http://lists.netsys.com/pipermail/full-disclosure/2004-May/020776.html
+  for detail.
 
   12 Mar 2004; Daniel Ahlberg <aliz@gentoo.org> lha-114i-r1.ebuild:
   amd64 unmask.
diff --git a/app-arch/lha/Manifest b/app-arch/lha/Manifest
index 781d56ab2f24..cb8c88ce4cc3 100644
--- a/app-arch/lha/Manifest
+++ b/app-arch/lha/Manifest
@@ -1,5 +1,8 @@
 MD5 1c088142fea249e48a7f34e7e659b142 lha-114i-r1.ebuild 977
+MD5 8860ec5d586ce59f15d0c135cac3a71b ChangeLog 1738
+MD5 a92c349058bce101d2735b5e7d9c1397 lha-114i-r2.ebuild 871
 MD5 2dc78c761b7c185673e930a8f6d9a141 lha-114i.ebuild 813
-MD5 06926b9b0ec166313ccb65a032d06d8f ChangeLog 1465
 MD5 8d44f00f248f7ae367372b6f8edbfb06 files/digest-lha-114i-r1 78
 MD5 0ca54fececc10dcda9d3e9f649102c78 files/digest-lha-114i 59
+MD5 0ca54fececc10dcda9d3e9f649102c78 files/digest-lha-114i-r2 59
+MD5 7e87f643ac65634d0b934b7bfcd6a8cb files/lha-114i.diff 1721
diff --git a/app-arch/lha/files/digest-lha-114i-r2 b/app-arch/lha/files/digest-lha-114i-r2
new file mode 100644
index 000000000000..44da31fd5180
--- /dev/null
+++ b/app-arch/lha/files/digest-lha-114i-r2
@@ -0,0 +1 @@
+MD5 5225884d557b91f04124693e2c5c9e94 lha-114i.tar.gz 64608
diff --git a/app-arch/lha/files/lha-114i.diff b/app-arch/lha/files/lha-114i.diff
new file mode 100644
index 000000000000..d723d668a94c
--- /dev/null
+++ b/app-arch/lha/files/lha-114i.diff
@@ -0,0 +1,75 @@
+--- header.c.old	2000-10-05 19:36:03.000000000 +0200
++++ header.c	2004-04-17 23:55:54.000000000 +0200
+@@ -538,6 +538,10 @@
+ 				/*
+ 				 * filename
+ 				 */
++				if (header_size >= 256) {
++				  fprintf(stderr, "Possible buffer overflow hack attack, type #1\n");
++				  exit(109);
++				}
+ 				for (i = 0; i < header_size - 3; i++)
+ 					hdr->name[i] = (char) get_byte();
+ 				hdr->name[header_size - 3] = '\0';
+@@ -547,6 +551,10 @@
+ 				/*
+ 				 * directory
+ 				 */
++				if (header_size >= FILENAME_LENGTH) {
++				  fprintf(stderr, "Possible buffer overflow hack attack, type #2\n");
++				  exit(110);
++				}
+ 				for (i = 0; i < header_size - 3; i++)
+ 					dirname[i] = (char) get_byte();
+ 				dirname[header_size - 3] = '\0';
+--- lhext.c.old	2000-10-04 16:57:38.000000000 +0200
++++ lhext.c	2004-04-18 01:27:44.000000000 +0200
+@@ -190,8 +190,13 @@
+ 		q = (char *) rindex(hdr->name, '/') + 1;
+ 	}
+ 	else {
++		if (is_directory_traversal(q)) {
++		  fprintf(stderr, "Possible directory traversal hack attempt in %s\n", q);
++		  exit(111);
++		}
++
+ 		if (*q == '/') {
+-			q++;
++			while (*q == '/') { q++; }
+ 			/*
+ 			 * if OSK then strip device name
+ 			 */
+@@ -419,6 +424,33 @@
+ 	return;
+ }
+ 
++int
++is_directory_traversal(char *string)
++{
++  unsigned int type = 0; /* 0 = new, 1 = only dots, 2 = other chars than dots */
++  char *temp;
++
++  temp = string;
++
++  while (*temp != 0) {
++    if (temp[0] == '/') {
++      if (type == 1) { return 1; }
++      type = 0;
++      temp++;
++      continue;
++    }
++
++    if ((temp[0] == '.') && (type < 2))
++      type = 1;
++    if (temp[0] != '.')
++      type = 2;
++
++    temp++;
++  } /* while */
++
++  return (type == 1);
++}
++
+ /* Local Variables: */
+ /* mode:c */
+ /* tab-width:4 */
diff --git a/app-arch/lha/lha-114i-r2.ebuild b/app-arch/lha/lha-114i-r2.ebuild
new file mode 100644
index 000000000000..73e2373c3b23
--- /dev/null
+++ b/app-arch/lha/lha-114i-r2.ebuild
@@ -0,0 +1,39 @@
+# Copyright 1999-2004 Gentoo Technologies, Inc.
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-arch/lha/lha-114i-r2.ebuild,v 1.1 2004/05/04 12:17:34 usata Exp $
+
+inherit eutils
+
+IUSE=""
+
+DESCRIPTION="Utility for creating and opening lzh archives."
+HOMEPAGE="http://www2m.biglobe.ne.jp/~dolphin/lha/lha-unix.htm"
+SRC_URI="http://www2m.biglobe.ne.jp/~dolphin/lha/prog/${P}.tar.gz"
+
+SLOT="0"
+LICENSE="lha"
+KEYWORDS="x86 ppc sparc alpha amd64"
+
+DEPEND="virtual/glibc"
+
+src_unpack () {
+	unpack ${A} ; cd ${S}
+	sed -i -e "/^OPTIMIZE/ s:-O2:${CFLAGS}:" Makefile
+	cd src
+	epatch ${FILESDIR}/${P}.diff
+}
+
+src_compile() {
+	emake || die
+}
+
+src_install() {
+	dodir /usr/bin
+	dodir /usr/share/man/ja/man1
+	make \
+		BINDIR=${D}/usr/bin \
+		MANDIR=${D}/usr/share/man/ja \
+		install MANSECT=1 || die
+
+	dodoc *.txt *.euc *.eng
+}