Sun Jul 13 14:38:41 2008 UTC ()
Fix overlong string DoS in pwlib's PString::vsprintf code (CVE-2007-4897).


(tonnerre)
diff -r1.58 -r1.59 pkgsrc/devel/pwlib/Makefile
diff -r1.24 -r1.25 pkgsrc/devel/pwlib/distinfo
diff -r0 -r1.1 pkgsrc/devel/pwlib/patches/patch-ax
cvs diff -r1.58 -r1.59 pkgsrc/devel/pwlib/Makefile (expand / switch to unified diff)

--- pkgsrc/devel/pwlib/Makefile 2008/01/18 05:14:38 1.58
+++ pkgsrc/devel/pwlib/Makefile 2008/07/13 14:38:41 1.59
@@ -1,18 +1,18 @@ @@ -1,18 +1,18 @@
1# $NetBSD: Makefile,v 1.58 2008/01/18 05:14:38 tnn Exp $ 1# $NetBSD: Makefile,v 1.59 2008/07/13 14:38:41 tonnerre Exp $
2 2
3DISTNAME= pwlib-v1_8_3-src 3DISTNAME= pwlib-v1_8_3-src
4PKGNAME= pwlib-1.8.3 4PKGNAME= pwlib-1.8.3
5PKGREVISION= 7 5PKGREVISION= 8
6CATEGORIES= devel 6CATEGORIES= devel
7MASTER_SITES+= http://www.voxgratia.org/releases/ 7MASTER_SITES+= http://www.voxgratia.org/releases/
8EXTRACT_SUFX= -tar.gz 8EXTRACT_SUFX= -tar.gz
9 9
10MAINTAINER= pkgsrc-users@NetBSD.org 10MAINTAINER= pkgsrc-users@NetBSD.org
11HOMEPAGE= http://sourceforge.net/projects/openh323/ 11HOMEPAGE= http://sourceforge.net/projects/openh323/
12COMMENT= Portable Windows Libary 12COMMENT= Portable Windows Libary
13 13
14BUILD_DEPENDS+= bison-[0-9]*:../../devel/bison 14BUILD_DEPENDS+= bison-[0-9]*:../../devel/bison
15 15
16WRKSRC= ${WRKDIR}/pwlib 16WRKSRC= ${WRKDIR}/pwlib
17USE_TOOLS+= gmake tar 17USE_TOOLS+= gmake tar
18USE_LANGUAGES= c c++ 18USE_LANGUAGES= c c++
cvs diff -r1.24 -r1.25 pkgsrc/devel/pwlib/distinfo (expand / switch to unified diff)

--- pkgsrc/devel/pwlib/distinfo 2007/10/10 15:16:12 1.24
+++ pkgsrc/devel/pwlib/distinfo 2008/07/13 14:38:41 1.25
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1$NetBSD: distinfo,v 1.24 2007/10/10 15:16:12 rillig Exp $ 1$NetBSD: distinfo,v 1.25 2008/07/13 14:38:41 tonnerre Exp $
2 2
3SHA1 (pwlib-v1_8_3-src-tar.gz) = d3a6eff571ebfd37889e75cbaef75983e6119d2e 3SHA1 (pwlib-v1_8_3-src-tar.gz) = d3a6eff571ebfd37889e75cbaef75983e6119d2e
4RMD160 (pwlib-v1_8_3-src-tar.gz) = 1ce2544ef631c8344543e62988f97022c998bb05 4RMD160 (pwlib-v1_8_3-src-tar.gz) = 1ce2544ef631c8344543e62988f97022c998bb05
5Size (pwlib-v1_8_3-src-tar.gz) = 1900922 bytes 5Size (pwlib-v1_8_3-src-tar.gz) = 1900922 bytes
6SHA1 (patch-aa) = e8dc5e42fc758ec2a437caed47a29495b3017b5e 6SHA1 (patch-aa) = e8dc5e42fc758ec2a437caed47a29495b3017b5e
7SHA1 (patch-ab) = 597cbdcd050b4c0d20d8dee7358bbf5dbf3cf210 7SHA1 (patch-ab) = 597cbdcd050b4c0d20d8dee7358bbf5dbf3cf210
8SHA1 (patch-ac) = c0284e67ce689d774b715be4dc17214aa88c3d4a 8SHA1 (patch-ac) = c0284e67ce689d774b715be4dc17214aa88c3d4a
9SHA1 (patch-ad) = 75e346285b12fad914b31fb83a9d625d48dce255 9SHA1 (patch-ad) = 75e346285b12fad914b31fb83a9d625d48dce255
10SHA1 (patch-ae) = 50d12cf0fd713ccbb553c6642b5ec05fcc1f6cc1 10SHA1 (patch-ae) = 50d12cf0fd713ccbb553c6642b5ec05fcc1f6cc1
11SHA1 (patch-af) = c38f646d75d57f17101ce42813f8e66232778447 11SHA1 (patch-af) = c38f646d75d57f17101ce42813f8e66232778447
12SHA1 (patch-ag) = bc08c8fc6d14021b1ebfab12d6ffb86404a588bb 12SHA1 (patch-ag) = bc08c8fc6d14021b1ebfab12d6ffb86404a588bb
13SHA1 (patch-ah) = fff6483f2a2f5864df57a6d90489846b5cc7ffdf 13SHA1 (patch-ah) = fff6483f2a2f5864df57a6d90489846b5cc7ffdf
14SHA1 (patch-ai) = f0a9a80914dd4ae0f531c646001bce06c68e8e2f 14SHA1 (patch-ai) = f0a9a80914dd4ae0f531c646001bce06c68e8e2f
@@ -16,22 +16,23 @@ SHA1 (patch-aj) = 93e039bb60c5cb75abb916 @@ -16,22 +16,23 @@ SHA1 (patch-aj) = 93e039bb60c5cb75abb916
16SHA1 (patch-ak) = 74c9733c010c6620d7d6355afb8f482f7087a2b0 16SHA1 (patch-ak) = 74c9733c010c6620d7d6355afb8f482f7087a2b0
17SHA1 (patch-al) = a849ef5c4486948919299815f1627158482adb75 17SHA1 (patch-al) = a849ef5c4486948919299815f1627158482adb75
18SHA1 (patch-am) = 5b80fce03de136913dadfdbbdc161edef2f72919 18SHA1 (patch-am) = 5b80fce03de136913dadfdbbdc161edef2f72919
19SHA1 (patch-an) = f79776e86d32bd15fd9f8fe1c0c02196ce4bcd3e 19SHA1 (patch-an) = f79776e86d32bd15fd9f8fe1c0c02196ce4bcd3e
20SHA1 (patch-ao) = 665d7c87476b8bb7afe3bdb1a892cf98f7bff8d2 20SHA1 (patch-ao) = 665d7c87476b8bb7afe3bdb1a892cf98f7bff8d2
21SHA1 (patch-ap) = 5f7d299cdd15e5c773ffdc4085be4466d70ca412 21SHA1 (patch-ap) = 5f7d299cdd15e5c773ffdc4085be4466d70ca412
22SHA1 (patch-aq) = f590dad7d36d3926586f5158d3ae599fda38f554 22SHA1 (patch-aq) = f590dad7d36d3926586f5158d3ae599fda38f554
23SHA1 (patch-ar) = f4c8b0141758613506a95e2fe0ce328c49898144 23SHA1 (patch-ar) = f4c8b0141758613506a95e2fe0ce328c49898144
24SHA1 (patch-as) = f8d20a9fc2b577c158bf500bfe933903aa64b987 24SHA1 (patch-as) = f8d20a9fc2b577c158bf500bfe933903aa64b987
25SHA1 (patch-at) = 87bbff9a5426c18c3e8407406b244eef2413cdbd 25SHA1 (patch-at) = 87bbff9a5426c18c3e8407406b244eef2413cdbd
26SHA1 (patch-au) = 4947ee29e91c84f39a370ebc128c1e67737234d1 26SHA1 (patch-au) = 4947ee29e91c84f39a370ebc128c1e67737234d1
27SHA1 (patch-av) = 2bb533f6a29f10d357aed1b12c0bfc43af8a4f3b 27SHA1 (patch-av) = 2bb533f6a29f10d357aed1b12c0bfc43af8a4f3b
28SHA1 (patch-aw) = 236cb19fc7f0b78055b0634b3821c099318abb9f 28SHA1 (patch-aw) = 236cb19fc7f0b78055b0634b3821c099318abb9f
 29SHA1 (patch-ax) = ef77c8c1f767490eba3400e1d784419e7cbfd335
29SHA1 (patch-ay) = 4a7978e13956172e9190444cb773c950c2e95ace 30SHA1 (patch-ay) = 4a7978e13956172e9190444cb773c950c2e95ace
30SHA1 (patch-az) = b82405bea8da7d93d965457f1090e64149e5f561 31SHA1 (patch-az) = b82405bea8da7d93d965457f1090e64149e5f561
31SHA1 (patch-ba) = 5695be7e37677e7d4db84bb997404030e8a8523f 32SHA1 (patch-ba) = 5695be7e37677e7d4db84bb997404030e8a8523f
32SHA1 (patch-bb) = 03345fade582539c3b7332f14f1956686ad15289 33SHA1 (patch-bb) = 03345fade582539c3b7332f14f1956686ad15289
33SHA1 (patch-bd) = 2d2fb1c6772a1e015cc1bceeb27fda39f57f5acc 34SHA1 (patch-bd) = 2d2fb1c6772a1e015cc1bceeb27fda39f57f5acc
34SHA1 (patch-ca) = 931083e2254cf8e09d0f95ce01d36e8176efcba5 35SHA1 (patch-ca) = 931083e2254cf8e09d0f95ce01d36e8176efcba5
35SHA1 (patch-cb) = 8d8370a61f7905c4aea30aca9f41b5e9d6e547cc 36SHA1 (patch-cb) = 8d8370a61f7905c4aea30aca9f41b5e9d6e547cc
36SHA1 (patch-cc) = 4d62cba89dea1b522d8a41197ed788da01d2d40b 37SHA1 (patch-cc) = 4d62cba89dea1b522d8a41197ed788da01d2d40b
37SHA1 (patch-cd) = 124ac099a8e378be1d47d8ce7ce503c6a10532e0 38SHA1 (patch-cd) = 124ac099a8e378be1d47d8ce7ce503c6a10532e0
File Added: pkgsrc/devel/pwlib/patches/patch-ax
$NetBSD: patch-ax,v 1.1 2008/07/13 14:38:41 tonnerre Exp $

--- ptlib/common/contain.cxx.orig	2004-10-21 15:04:21.000000000 +0200
+++ ptlib/common/contain.cxx
@@ -2454,7 +2454,7 @@ PString & PString::vsprintf(const char *
   PAssert(SetSize(2000), POutOfMemory);
   ::vsprintf(theArray+len, fmt, arg);
 #else
-  PINDEX size = 0;
+  PINDEX size = len;
   do {
     size += 1000;
     PAssert(SetSize(size), POutOfMemory);