Pullup ticket 3182 - requested by tron
security patch

Revisions pulled up:
- pkgsrc/audio/pulseaudio/Makefile	1.38
- pkgsrc/audio/pulseaudio/distinfo	1.21

Files added:
pkgsrc/audio/pulseaudio/patches/patch-ba
pkgsrc/audio/pulseaudio/patches/patch-bb

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Sat Jul 24 12:51:09 UTC 2010

   Modified Files:
           pkgsrc/audio/pulseaudio: Makefile distinfo
   Added Files:
           pkgsrc/audio/pulseaudio/patches: patch-ba patch-bb

   Log Message:
   Add fix for symlink race reported in CVE-2009-1299 taken from
   Lennart Poettering's GIT repository.

   To generate a diff of this commit:
   cvs rdiff -u -r1.37 -r1.38 pkgsrc/audio/pulseaudio/Makefile
   cvs rdiff -u -r1.20 -r1.21 pkgsrc/audio/pulseaudio/distinfo
   cvs rdiff -u -r0 -r1.6 pkgsrc/audio/pulseaudio/patches/patch-ba
   cvs rdiff -u -r0 -r1.5 pkgsrc/audio/pulseaudio/patches/patch-bb


(spz)

$NetBSD: patch-ba,v 1.6.2.2 2010/07/25 13:16:12 spz Exp $

Fix for security vulnerability reported in CVE-2009-1299, taken from here:

http://git.0pointer.de/?p=pulseaudio.git;a=patch;h=d3efa43d85ac132c6a5a416a2b6f2115f5d577ee

--- configure.ac.orig	2009-11-23 04:06:47.000000000 +0000
+++ configure.ac	2010-07-24 13:33:30.000000000 +0100
@@ -424,7 +424,7 @@
 AC_FUNC_FORK
 AC_FUNC_GETGROUPS
 AC_FUNC_SELECT_ARGTYPES
-AC_CHECK_FUNCS_ONCE([chmod chown clock_gettime getaddrinfo getgrgid_r getgrnam_r \
+AC_CHECK_FUNCS_ONCE([chmod chown fstat fchown fchmod clock_gettime getaddrinfo getgrgid_r getgrnam_r \
     getpwnam_r getpwuid_r gettimeofday getuid inet_ntop inet_pton mlock nanosleep \
     pipe posix_fadvise posix_madvise posix_memalign setpgid setsid shm_open \
     sigaction sleep sysconf pthread_setaffinity_np])

$NetBSD: patch-bb,v 1.5.2.2 2010/07/25 13:16:12 spz Exp $

Fix for security vulnerability reported in CVE-2009-1299, taken from here:

http://git.0pointer.de/?p=pulseaudio.git;a=patch;h=d3efa43d85ac132c6a5a416a2b6f2115f5d577ee

--- src/pulsecore/core-util.c.orig	2009-11-23 03:57:07.000000000 +0000
+++ src/pulsecore/core-util.c	2010-07-24 13:33:30.000000000 +0100
@@ -196,7 +196,7 @@
 /** Creates a directory securely */
 int pa_make_secure_dir(const char* dir, mode_t m, uid_t uid, gid_t gid) {
     struct stat st;
-    int r, saved_errno;
+    int r, saved_errno, fd;
 
     pa_assert(dir);
 
@@ -214,16 +214,45 @@
     if (r < 0 && errno != EEXIST)
         return -1;
 
-#ifdef HAVE_CHOWN
+#ifdef HAVE_FSTAT
+    if ((fd = open(dir,
+#ifdef O_CLOEXEC
+                   O_CLOEXEC|
+#endif
+#ifdef O_NOCTTY
+                   O_NOCTTY|
+#endif
+#ifdef O_NOFOLLOW
+                   O_NOFOLLOW|
+#endif
+                   O_RDONLY)) < 0)
+        goto fail;
+
+    if (fstat(fd, &st) < 0) {
+        pa_assert_se(pa_close(fd) >= 0);
+        goto fail;
+    }
+
+    if (!S_ISDIR(st.st_mode)) {
+        pa_assert_se(pa_close(fd) >= 0);
+        errno = EEXIST;
+        goto fail;
+    }
+
+#ifdef HAVE_FCHOWN
     if (uid == (uid_t)-1)
         uid = getuid();
     if (gid == (gid_t)-1)
         gid = getgid();
-    (void) chown(dir, uid, gid);
+    (void) fchown(fd, uid, gid);
+#endif
+
+#ifdef HAVE_FCHMOD
+    (void) fchmod(fd, m);
 #endif
 
-#ifdef HAVE_CHMOD
-    chmod(dir, m);
+    pa_assert_se(pa_close(fd) >= 0);
+
 #endif
 
 #ifdef HAVE_LSTAT