diff options
Diffstat (limited to 'app-arch/lha')
| -rw-r--r-- | app-arch/lha/ChangeLog | 10 | ||||
| -rw-r--r-- | app-arch/lha/Manifest | 5 | ||||
| -rw-r--r-- | app-arch/lha/files/digest-lha-114i-r2 | 1 | ||||
| -rw-r--r-- | app-arch/lha/files/lha-114i.diff | 75 | ||||
| -rw-r--r-- | app-arch/lha/lha-114i-r2.ebuild | 39 |
5 files changed, 128 insertions, 2 deletions
diff --git a/app-arch/lha/ChangeLog b/app-arch/lha/ChangeLog index 652a076ce06d..af39c8cf32ac 100644 --- a/app-arch/lha/ChangeLog +++ b/app-arch/lha/ChangeLog @@ -1,6 +1,14 @@ # ChangeLog for app-arch/lha # Copyright 2002-2004 Gentoo Technologies, Inc.; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/app-arch/lha/ChangeLog,v 1.14 2004/03/12 15:17:01 aliz Exp $ +# $Header: /var/cvsroot/gentoo-x86/app-arch/lha/ChangeLog,v 1.15 2004/05/04 12:17:34 usata Exp $ + +*lha-114i-r2 (04 May 2004) + + 04 May 2004; Mamoru KOMACHI <usata@gentoo.org> lha-114i-r2.ebuild, + files/lha-114i.diff: + Applied buffer overflows and directory traversal patches. + See http://lists.netsys.com/pipermail/full-disclosure/2004-May/020776.html + for detail. 12 Mar 2004; Daniel Ahlberg <aliz@gentoo.org> lha-114i-r1.ebuild: amd64 unmask. diff --git a/app-arch/lha/Manifest b/app-arch/lha/Manifest index 781d56ab2f24..cb8c88ce4cc3 100644 --- a/app-arch/lha/Manifest +++ b/app-arch/lha/Manifest @@ -1,5 +1,8 @@ MD5 1c088142fea249e48a7f34e7e659b142 lha-114i-r1.ebuild 977 +MD5 8860ec5d586ce59f15d0c135cac3a71b ChangeLog 1738 +MD5 a92c349058bce101d2735b5e7d9c1397 lha-114i-r2.ebuild 871 MD5 2dc78c761b7c185673e930a8f6d9a141 lha-114i.ebuild 813 -MD5 06926b9b0ec166313ccb65a032d06d8f ChangeLog 1465 MD5 8d44f00f248f7ae367372b6f8edbfb06 files/digest-lha-114i-r1 78 MD5 0ca54fececc10dcda9d3e9f649102c78 files/digest-lha-114i 59 +MD5 0ca54fececc10dcda9d3e9f649102c78 files/digest-lha-114i-r2 59 +MD5 7e87f643ac65634d0b934b7bfcd6a8cb files/lha-114i.diff 1721 diff --git a/app-arch/lha/files/digest-lha-114i-r2 b/app-arch/lha/files/digest-lha-114i-r2 new file mode 100644 index 000000000000..44da31fd5180 --- /dev/null +++ b/app-arch/lha/files/digest-lha-114i-r2 @@ -0,0 +1 @@ +MD5 5225884d557b91f04124693e2c5c9e94 lha-114i.tar.gz 64608 diff --git a/app-arch/lha/files/lha-114i.diff b/app-arch/lha/files/lha-114i.diff new file mode 100644 index 000000000000..d723d668a94c --- /dev/null +++ b/app-arch/lha/files/lha-114i.diff @@ -0,0 +1,75 @@ +--- header.c.old 2000-10-05 19:36:03.000000000 +0200 ++++ header.c 2004-04-17 23:55:54.000000000 +0200 +@@ -538,6 +538,10 @@ + /* + * filename + */ ++ if (header_size >= 256) { ++ fprintf(stderr, "Possible buffer overflow hack attack, type #1\n"); ++ exit(109); ++ } + for (i = 0; i < header_size - 3; i++) + hdr->name[i] = (char) get_byte(); + hdr->name[header_size - 3] = '\0'; +@@ -547,6 +551,10 @@ + /* + * directory + */ ++ if (header_size >= FILENAME_LENGTH) { ++ fprintf(stderr, "Possible buffer overflow hack attack, type #2\n"); ++ exit(110); ++ } + for (i = 0; i < header_size - 3; i++) + dirname[i] = (char) get_byte(); + dirname[header_size - 3] = '\0'; +--- lhext.c.old 2000-10-04 16:57:38.000000000 +0200 ++++ lhext.c 2004-04-18 01:27:44.000000000 +0200 +@@ -190,8 +190,13 @@ + q = (char *) rindex(hdr->name, '/') + 1; + } + else { ++ if (is_directory_traversal(q)) { ++ fprintf(stderr, "Possible directory traversal hack attempt in %s\n", q); ++ exit(111); ++ } ++ + if (*q == '/') { +- q++; ++ while (*q == '/') { q++; } + /* + * if OSK then strip device name + */ +@@ -419,6 +424,33 @@ + return; + } + ++int ++is_directory_traversal(char *string) ++{ ++ unsigned int type = 0; /* 0 = new, 1 = only dots, 2 = other chars than dots */ ++ char *temp; ++ ++ temp = string; ++ ++ while (*temp != 0) { ++ if (temp[0] == '/') { ++ if (type == 1) { return 1; } ++ type = 0; ++ temp++; ++ continue; ++ } ++ ++ if ((temp[0] == '.') && (type < 2)) ++ type = 1; ++ if (temp[0] != '.') ++ type = 2; ++ ++ temp++; ++ } /* while */ ++ ++ return (type == 1); ++} ++ + /* Local Variables: */ + /* mode:c */ + /* tab-width:4 */ diff --git a/app-arch/lha/lha-114i-r2.ebuild b/app-arch/lha/lha-114i-r2.ebuild new file mode 100644 index 000000000000..73e2373c3b23 --- /dev/null +++ b/app-arch/lha/lha-114i-r2.ebuild @@ -0,0 +1,39 @@ +# Copyright 1999-2004 Gentoo Technologies, Inc. +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/app-arch/lha/lha-114i-r2.ebuild,v 1.1 2004/05/04 12:17:34 usata Exp $ + +inherit eutils + +IUSE="" + +DESCRIPTION="Utility for creating and opening lzh archives." +HOMEPAGE="http://www2m.biglobe.ne.jp/~dolphin/lha/lha-unix.htm" +SRC_URI="http://www2m.biglobe.ne.jp/~dolphin/lha/prog/${P}.tar.gz" + +SLOT="0" +LICENSE="lha" +KEYWORDS="x86 ppc sparc alpha amd64" + +DEPEND="virtual/glibc" + +src_unpack () { + unpack ${A} ; cd ${S} + sed -i -e "/^OPTIMIZE/ s:-O2:${CFLAGS}:" Makefile + cd src + epatch ${FILESDIR}/${P}.diff +} + +src_compile() { + emake || die +} + +src_install() { + dodir /usr/bin + dodir /usr/share/man/ja/man1 + make \ + BINDIR=${D}/usr/bin \ + MANDIR=${D}/usr/share/man/ja \ + install MANSECT=1 || die + + dodoc *.txt *.euc *.eng +} |