rpms/gnustep-base/F-13 gnustep-base-1.18-cve-2010-1457.patch, NONE, 1.1 gnustep-base-1.18-cve-2010-1620.patch, NONE, 1.1 gnustep-base.spec, 1.5, 1.6 sources, 1.3, 1.4
Jochen Schmitt
s4504kr at fedoraproject.org
Fri May 14 14:21:55 UTC 2010
Author: s4504kr
Update of /cvs/pkgs/rpms/gnustep-base/F-13
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv15888
Modified Files:
gnustep-base.spec sources
Added Files:
gnustep-base-1.18-cve-2010-1457.patch
gnustep-base-1.18-cve-2010-1620.patch
Log Message:
Fallback to 1.18, backporting security patches
gnustep-base-1.18-cve-2010-1457.patch:
gdomap.c | 41 +++++++++++++++++++++++++++++++++++------
1 file changed, 35 insertions(+), 6 deletions(-)
--- NEW FILE gnustep-base-1.18-cve-2010-1457.patch ---
diff -up gnustep-base-1.18.0/Tools/gdomap.c.cve1 gnustep-base-1.18.0/Tools/gdomap.c
--- gnustep-base-1.18.0/Tools/gdomap.c.cve1 2010-05-14 16:00:49.793009385 +0200
+++ gnustep-base-1.18.0/Tools/gdomap.c 2010-05-14 16:01:15.788009110 +0200
@@ -1054,6 +1054,13 @@ dump_tables()
FILE *fptr;
soft_int++;
+ if (access(".", W_OK) != 0)
+ {
+ snprintf(ebuf, sizeof(ebuf),
+ "Failed to access gdomap.dump file for output\n");
+ gdomap_log(LOG_ERR);
+ return;
+ }
fptr = fopen("gdomap.dump", "w");
if (fptr != 0)
{
@@ -1414,10 +1421,19 @@ init_iface()
static void
load_iface(const char* from)
{
- FILE *fptr = fopen(from, "rt");
+ FILE *fptr;
char buf[128];
+ int line = 0;
int num_iface = 0;
+ if (access(from, R_OK) != 0)
+ {
+ snprintf(ebuf, sizeof(ebuf),
+ "Unable to access address config - '%s'", from);
+ gdomap_log(LOG_CRIT);
+ exit(EXIT_FAILURE);
+ }
+ fptr = fopen(from, "rt");
if (fptr == 0)
{
sprintf(ebuf, "Unable to open address config - '%s'", from);
@@ -1429,6 +1445,7 @@ load_iface(const char* from)
{
char *ptr = buf;
+ line++;
/*
* Strip leading white space.
*/
@@ -1495,6 +1512,7 @@ load_iface(const char* from)
char *ptr = buf;
char *msk;
+ line++;
/*
* Strip leading white space.
*/
@@ -4486,20 +4504,29 @@ printf(
case 'c':
{
- FILE *fptr = fopen(optarg, "rt");
+ FILE *fptr;
+ int line = 0;
char buf[128];
+ if (access(optarg, R_OK) != 0)
+ {
+ fprintf(stderr, "Unable to access probe config - '%s'\n",
+ optarg);
+ exit(EXIT_FAILURE);
+ }
+ fptr = fopen(optarg, "rt");
if (fptr == 0)
{
fprintf(stderr, "Unable to open probe config - '%s'\n",
- optarg);
+ optarg);
exit(EXIT_FAILURE);
}
while (fgets(buf, sizeof(buf), fptr) != 0)
{
- char *ptr = buf;
+ char *ptr = buf;
plentry *prb;
+ line++;
/*
* Strip leading white space.
*/
@@ -4545,7 +4572,9 @@ printf(
prb->addr.s_addr = inet_addr(buf);
if (prb->addr.s_addr == (uint32_t)-1)
{
- fprintf(stderr, "'%s' is not as valid address\n", buf);
+ fprintf(stderr,
+ "line %d of '%s' is not a valid address\n",
+ line, optarg);
free(prb);
}
else
@@ -4566,7 +4595,7 @@ printf(
if (tmp->addr.s_addr == prb->addr.s_addr)
{
fprintf(stderr, "'%s' repeat in '%s'\n",
- buf, optarg);
+ buf, optarg);
free(prb);
break;
}
gnustep-base-1.18-cve-2010-1620.patch:
gdomap.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++++++---------
1 file changed, 56 insertions(+), 9 deletions(-)
--- NEW FILE gnustep-base-1.18-cve-2010-1620.patch ---
diff -up gnustep-base-1.18.0/Tools/gdomap.c.cve2 gnustep-base-1.18.0/Tools/gdomap.c
--- gnustep-base-1.18.0/Tools/gdomap.c.cve2 2010-05-14 16:09:22.049008561 +0200
+++ gnustep-base-1.18.0/Tools/gdomap.c 2010-05-14 16:13:34.239008904 +0200
@@ -145,6 +145,7 @@ typedef unsigned char *uptr;
#ifndef __MINGW32__
static int is_daemon = 0; /* Currently running as daemon. */
#endif
+static int in_config = 0; /* Reading config file. */
static int debug = 0; /* Extra debug gdomap_logging. */
static int nobcst = 0; /* turn off broadcast probing. */
static int nofork = 0; /* turn off fork() for debugging. */
@@ -276,6 +277,15 @@ static int log_priority;
static void
gdomap_log (int prio)
{
+ if (in_config)
+ {
+#ifndef __MINGW__
+ if (geteuid () != getuid ())
+ {
+ strcpy(ebuf, "problem with config file");
+ }
+#endif
+ }
if (is_daemon)
{
syslog (log_priority | prio, ebuf);
@@ -315,6 +325,15 @@ gdomap_log (int prio)
void
gdomap_log (int prio)
{
+ if (in_config)
+ {
+#ifndef __MINGW__
+ if (geteuid () != getuid ())
+ {
+ strcpy(ebuf, "problem with config file");
+ }
+#endif
+ }
write (2, ebuf, strlen (ebuf));
write (2, "\n", 1);
if (prio == LOG_CRIT)
@@ -1426,6 +1445,7 @@ load_iface(const char* from)
int line = 0;
int num_iface = 0;
+ in_config = 1;
if (access(from, R_OK) != 0)
{
snprintf(ebuf, sizeof(ebuf),
@@ -1485,7 +1505,12 @@ load_iface(const char* from)
{
continue;
}
- num_iface++;
+ if (num_iface++ > 1000)
+ {
+ snprintf(ebuf, sizeof(ebuf), "Too many network interfaces found");
+ gdomap_log(LOG_CRIT);
+ exit(EXIT_FAILURE);
+ }
}
fseek(fptr, 0, 0);
@@ -1586,12 +1611,14 @@ load_iface(const char* from)
if (addr[interfaces].s_addr == (uint32_t)-1)
{
sprintf(ebuf, "'%s' is not as valid address", buf);
- gdomap_log(LOG_ERR);
+ gdomap_log(LOG_CRIT);
+ exit(EXIT_FAILURE);
}
else if (mask[interfaces].s_addr == (uint32_t)-1)
{
sprintf(ebuf, "'%s' is not as valid netmask", ptr);
- gdomap_log(LOG_ERR);
+ gdomap_log(LOG_CRIT);
+ exit(EXIT_FAILURE);
}
else
{
@@ -1599,6 +1626,7 @@ load_iface(const char* from)
}
}
fclose(fptr);
+ in_config = 0;
}
/*
@@ -4506,19 +4534,25 @@ printf(
{
FILE *fptr;
int line = 0;
+ int count = 0;
char buf[128];
+ in_config = 1;
if (access(optarg, R_OK) != 0)
{
- fprintf(stderr, "Unable to access probe config - '%s'\n",
+ snprintf(ebuf, sizeof(ebuf),
+ "Unable to access probe config - '%s'\n",
optarg);
+ gdomap_log(LOG_CRIT);
exit(EXIT_FAILURE);
}
fptr = fopen(optarg, "rt");
if (fptr == 0)
{
- fprintf(stderr, "Unable to open probe config - '%s'\n",
+ snprintf(ebuf, sizeof(ebuf),
+ "Unable to open probe config - '%s'\n",
optarg);
+ gdomap_log(LOG_CRIT);
exit(EXIT_FAILURE);
}
while (fgets(buf, sizeof(buf), fptr) != 0)
@@ -4567,15 +4601,24 @@ printf(
continue;
}
+ if (count++ > 1000)
+ {
+ snprintf(ebuf, sizeof(ebuf),
+ "Too many probe configurations found");
+ gdomap_log(LOG_CRIT);
+ exit(EXIT_FAILURE);
+ }
prb = (plentry*)malloc(sizeof(plentry));
memset((char*)prb, '\0', sizeof(plentry));
prb->addr.s_addr = inet_addr(buf);
if (prb->addr.s_addr == (uint32_t)-1)
{
- fprintf(stderr,
- "line %d of '%s' is not a valid address\n",
- line, optarg);
+ snprintf(ebuf, sizeof(ebuf),
+ "line %d of '%s' (%s) is not a valid address\n",
+ line, optarg, buf);
free(prb);
+ gdomap_log(LOG_CRIT);
+ exit(EXIT_FAILURE);
}
else
{
@@ -4594,9 +4637,12 @@ printf(
{
if (tmp->addr.s_addr == prb->addr.s_addr)
{
- fprintf(stderr, "'%s' repeat in '%s'\n",
+ snprintf(ebuf, sizeof(ebuf),
+ "'%s' repeat in '%s'\n",
buf, optarg);
free(prb);
+ gdomap_log(LOG_CRIT);
+ exit(EXIT_FAILURE);
break;
}
tmp = tmp->next;
@@ -4609,6 +4655,7 @@ printf(
}
}
fclose(fptr);
+ in_config = 0;
}
break;
Index: gnustep-base.spec
===================================================================
RCS file: /cvs/pkgs/rpms/gnustep-base/F-13/gnustep-base.spec,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -p -r1.5 -r1.6
--- gnustep-base.spec 13 May 2010 13:26:40 -0000 1.5
+++ gnustep-base.spec 14 May 2010 14:21:54 -0000 1.6
@@ -1,14 +1,16 @@
-%global gsb_vers 1.20
+%global gsb_vers 1.18
%global gslibdir %{_libdir}/GNUstep/Libraries
Name: gnustep-base
Version: %{gsb_vers}.0
-Release: 1xe%{?dist}
+Release: 9%{?dist}
License: LGPLv2+ and GPLv2+ and GPLv3+
Group: Development/Libraries
Summary: GNUstep Base library package
URL: http://www.gnustep.org/
Source: ftp://ftp.gnustep.org/pub/gnustep/core/%{name}-%{version}.tar.gz
+Patch1: gnustep-base-1.18-cve-2010-1457.patch
+Patch2: gnustep-base-1.18-cve-2010-1620.patch
BuildRoot: %{_tmppath}/-%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -71,6 +73,8 @@ This package contains the documentation
%prep
%setup -q
+%patch1 -p1
+%patch2 -p1
iconv -f iso-8859-1 -t utf-8 ChangeLog.2 -o ChangeLog.2.utf8
mv ChangeLog.2.utf8 ChangeLog.2
@@ -162,7 +166,6 @@ fi
%{_includedir}/Foundation/
%{_includedir}/GNUstepBase/
%{_includedir}/gnustep/
-%{_includedir}/ObjectiveC2/
%{_libdir}/libgnustep-base.so
%{_libdir}/GNUstep/Makefiles/Additional/base.make
%doc Examples
@@ -173,7 +176,10 @@ fi
%{_datadir}/GNUstep/Documentation/*
%changelog
-* Thu May 13 2010 Jochen Schmitt <Jochen herr-schmitt de> 1.20.0-1xe
+* Fri May 14 2010 Jochen Schmitt <sJOchen herr-schmitt de> - 1.18.0-9
+- Fallback to 1.18. Backport security patches for #591602
+
+* Thu May 13 2010 Jochen Schmitt <Jochen herr-schmitt de> 1.20.0-1
- New upatream release which fix CVE-2010-1457 and CVE-2010-1620 (#591602)
* Mon Nov 30 2009 Jochen Schmitt <Jochen herr-schmitt de> 1.18.0-8
Index: sources
===================================================================
RCS file: /cvs/pkgs/rpms/gnustep-base/F-13/sources,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -p -r1.3 -r1.4
--- sources 13 May 2010 13:26:40 -0000 1.3
+++ sources 14 May 2010 14:21:54 -0000 1.4
@@ -1 +1 @@
-cb099fb8cf960a8dde78d9de7d1b3640 gnustep-base-1.20.0.tar.gz
+880491e0fc64ab3507887f43faa67572 gnustep-base-1.18.0.tar.gz
More information about the scm-commits
mailing list