Add patches for wml privilege escalation (CVE-2008-0665 and CVE-2008-0666).


(tonnerre)

$NetBSD: patch-aj,v 1.1 2008/07/13 20:35:46 tonnerre Exp $

--- work/wml-2.0.9/wml_contrib/wmg.cgi.orig	1999-05-20 13:39:28.000000000 +0200
+++ work/wml-2.0.9/wml_contrib/wmg.cgi
@@ -367,14 +367,7 @@ if ($level >= 1) {
         ($w, $h, $t) = Image::Size::imgsize(\$contents);
         if ($w*$h == 1) {
             #   read image into GD
-            $tmpfile = "/tmp/pe.tmp.$$";
-            unlink($tmpfile);
-            open(TMP, ">$tmpfile");
-            print TMP $contents;
-            close(TMP);
-            open(TMP, "<$tmpfile");
-            $tmpimg = newFromGif GD::Image(TMP);
-            close(TMP);
+            $tmpimg = newFromGifData GD::Image($contents);
             unlink($tmpfile);
             if ($tmpimg->transparent != -1) {
                 my $im = new GD::Image($w, $h);

$NetBSD: patch-ak,v 1.1 2008/07/13 20:35:46 tonnerre Exp $

--- work/wml-2.0.9/wml_backend/p1_ipp/ipp.src.orig	2002-04-20 23:26:19.000000000 +0200
+++ work/wml-2.0.9/wml_backend/p1_ipp/ipp.src
@@ -565,6 +565,8 @@ foreach $str (@opt_D) {
 #   process the pre-loaded include files
 #
 $tmpdir = $ENV{'TMPDIR'} || '/tmp';
+my $tmpldir = ($ENV{'TMPDIR'} || '/tmp') . '/ipp.XXXXXX';
+$tmpdir = mkdtemp($tmpldir) or die "Unable to create temporary directory: $!\n";
 $tmpfile = $tmpdir . "/ipp.$$.tmp";
 unlink($tmpfile);
 $tmp = new IO::File;

$NetBSD: patch-al,v 1.1 2008/07/13 20:35:46 tonnerre Exp $

--- work/wml-2.0.9/wml_backend/p3_eperl/eperl_sys.c.orig	2002-08-08 23:56:26.000000000 +0200
+++ work/wml-2.0.9/wml_backend/p3_eperl/eperl_sys.c
@@ -211,13 +211,20 @@ char *mytmpfile(char *id)
 {
     char ca[1024];
     char *cp, *tmpdir;
+    char tmpfile[]="eperl_sourceXXXXXX";
     int i;
+    int fd=-1;
 
     tmpdir = getenv ("TMPDIR");
     if (tmpdir == (char *) NULL)
         tmpdir="/tmp";
 
-    snprintf(ca, sizeof(ca), "%s/%s.%d.tmp%d", tmpdir, id, (int)getpid(), mytmpfilecnt++);
+    snprintf(ca, sizeof(ca), "%s/%s", tmpdir, tmpfile);
+    if((fd = mkstemp(tmpfile)) == -1){
+        perror("can not create tmpfile");
+        return NULL;
+    }
+    close(fd);
     ca[sizeof(ca)-1] = NUL;
     cp = strdup(ca);
     for (i = 0; mytmpfiles[i] != NULL; i++)