summaryrefslogtreecommitdiff
path: root/source/d/gcc/fastjar-patches
diff options
context:
space:
mode:
authorPatrick J Volkerding <volkerdi@slackware.com>2011-04-25 13:37:00 +0000
committerEric Hameleers <alien@slackware.com>2018-05-31 22:45:18 +0200
commit75a4a592e5ccda30715f93563d741b83e0dcf39e (patch)
tree502f745607e77a2c4386ad38d818ddcafe81489c /source/d/gcc/fastjar-patches
parentb76270bf9e6dd375e495fec92140a79a79415d27 (diff)
downloadcurrent-75a4a592e5ccda30715f93563d741b83e0dcf39e.tar.gz
Slackware 13.37slackware-13.37
Mon Apr 25 13:37:00 UTC 2011 Slackware 13.37 x86_64 stable is released! Thanks to everyone who pitched in on this release: the Slackware team, the folks producing upstream code, and linuxquestions.org for providing a great forum for collaboration and testing. The ISOs are off to be replicated, a 6 CD-ROM 32-bit set and a dual-sided 32-bit/64-bit x86/x86_64 DVD. Please consider supporting the Slackware project by picking up a copy from store.slackware.com. We're taking pre-orders now, and offer a discount if you sign up for a subscription. As always, thanks to the Slackware community for testing, suggestions, and feedback. :-) Have fun!
Diffstat (limited to 'source/d/gcc/fastjar-patches')
-rw-r--r--source/d/gcc/fastjar-patches/1000-fastjar-0.97-segfault.patch29
-rw-r--r--source/d/gcc/fastjar-patches/1001-fastjar-0.97-len1.patch16
-rw-r--r--source/d/gcc/fastjar-patches/1002-fastjar-0.97-filename0.patch14
-rw-r--r--source/d/gcc/fastjar-patches/1003-fastjar-CVE-2010-0831.patch102
-rw-r--r--source/d/gcc/fastjar-patches/1004-fastjar-man.patch27
5 files changed, 188 insertions, 0 deletions
diff --git a/source/d/gcc/fastjar-patches/1000-fastjar-0.97-segfault.patch b/source/d/gcc/fastjar-patches/1000-fastjar-0.97-segfault.patch
new file mode 100644
index 00000000..ab626240
--- /dev/null
+++ b/source/d/gcc/fastjar-patches/1000-fastjar-0.97-segfault.patch
@@ -0,0 +1,29 @@
+2009-01-14 Jakub Jelinek <jakub@redhat.com>
+
+ * jartool.c (make_manifest): Initialize current_time before
+ calling unix2dostime on it.
+
+--- fastjar-0.97/jartool.c.jj 2008-10-15 18:35:37.000000000 +0200
++++ fastjar-0.97/jartool.c 2009-01-14 15:40:50.000000000 +0100
+@@ -820,6 +820,10 @@ int make_manifest(int jfd, const char *m
+ int mod_time; /* file modification time */
+ struct zipentry *ze;
+
++ current_time = time(NULL);
++ if(current_time == (time_t)-1)
++ exit_on_error("time");
++
+ mod_time = unix2dostime(&current_time);
+
+ /* If we are creating a new manifest, create a META-INF directory entry */
+@@ -828,10 +832,6 @@ int make_manifest(int jfd, const char *m
+
+ memset((file_header + 12), '\0', 16); /*clear mod time, crc, size fields*/
+
+- current_time = time(NULL);
+- if(current_time == (time_t)-1)
+- exit_on_error("time");
+-
+ PACK_UB2(file_header, LOC_EXTRA, 0);
+ PACK_UB2(file_header, LOC_COMP, 0);
+ PACK_UB2(file_header, LOC_FNLEN, nlen);
diff --git a/source/d/gcc/fastjar-patches/1001-fastjar-0.97-len1.patch b/source/d/gcc/fastjar-patches/1001-fastjar-0.97-len1.patch
new file mode 100644
index 00000000..722351d3
--- /dev/null
+++ b/source/d/gcc/fastjar-patches/1001-fastjar-0.97-len1.patch
@@ -0,0 +1,16 @@
+2009-12-21 Chris Ball <cjb@laptop.org>
+
+ * jartool.c (add_file_to_jar): Test write return value against -1
+ instead of 1.
+
+--- fastjar-0.97/jartool.c.jj 2008-10-15 12:35:37.000000000 -0400
++++ fastjar-0.97/jartool.c 2009-12-22 06:48:09.309530000 -0500
+@@ -1257,7 +1257,7 @@ int add_file_to_jar(int jfd, int ffd, co
+ exit_on_error("write");
+
+ /* write the file name to the zip file */
+- if (1 == write(jfd, fname, file_name_length))
++ if (-1 == write(jfd, fname, file_name_length))
+ exit_on_error("write");
+
+ if(verbose){
diff --git a/source/d/gcc/fastjar-patches/1002-fastjar-0.97-filename0.patch b/source/d/gcc/fastjar-patches/1002-fastjar-0.97-filename0.patch
new file mode 100644
index 00000000..34a02a74
--- /dev/null
+++ b/source/d/gcc/fastjar-patches/1002-fastjar-0.97-filename0.patch
@@ -0,0 +1,14 @@
+2010-03-01 Richard Guenther <rguenther@suse.de>
+
+ * jartool.c (read_entries): Properly zero-terminate filename.
+
+--- fastjar-0.97/jartool.c 6 Sep 2009 22:16:00 -0000 1.59
++++ fastjar-0.97/jartool.c 1 Mar 2010 15:38:43 -0000 1.60
+@@ -790,6 +790,7 @@ int read_entries (int fd)
+ progname, jarfile);
+ return 1;
+ }
++ ze->filename[len] = '\0';
+ len = UNPACK_UB4(header, CEN_EFLEN);
+ len += UNPACK_UB4(header, CEN_COMLEN);
+ if (lseek (fd, len, SEEK_CUR) == -1)
diff --git a/source/d/gcc/fastjar-patches/1003-fastjar-CVE-2010-0831.patch b/source/d/gcc/fastjar-patches/1003-fastjar-CVE-2010-0831.patch
new file mode 100644
index 00000000..2c6e23c7
--- /dev/null
+++ b/source/d/gcc/fastjar-patches/1003-fastjar-CVE-2010-0831.patch
@@ -0,0 +1,102 @@
+2010-06-10 Jakub Jelinek <jakub@redhat.com>
+ Dan Rosenberg <dan.j.rosenberg@gmail.com>
+
+ * jartool.c (extract_jar): Fix up checks for traversal to parent
+ directories, disallow absolute paths, make the code slightly more
+ efficient.
+
+--- fastjar-0.97/jartool.c.jj 2009-09-07 00:10:47.000000000 +0200
++++ fastjar-0.97/jartool.c 2010-06-08 20:00:29.000000000 +0200
+@@ -1730,7 +1730,17 @@ int extract_jar(int fd, const char **fil
+ struct stat sbuf;
+ int depth = 0;
+
+- tmp_buff = malloc(sizeof(char) * strlen((const char *)filename));
++ if(*filename == '/'){
++ fprintf(stderr, "Absolute path names are not allowed.\n");
++ exit(EXIT_FAILURE);
++ }
++
++ tmp_buff = malloc(strlen((const char *)filename));
++
++ if(tmp_buff == NULL) {
++ fprintf(stderr, "Out of memory.\n");
++ exit(EXIT_FAILURE);
++ }
+
+ for(;;){
+ const ub1 *idx = (const unsigned char *)strchr((const char *)start, '/');
+@@ -1738,25 +1748,28 @@ int extract_jar(int fd, const char **fil
+ if(idx == NULL)
+ break;
+ else if(idx == start){
++ tmp_buff[idx - filename] = '/';
+ start++;
+ continue;
+ }
+- start = idx + 1;
+
+- strncpy(tmp_buff, (const char *)filename, (idx - filename));
+- tmp_buff[(idx - filename)] = '\0';
++ memcpy(tmp_buff + (start - filename), (const char *)start, (idx - start));
++ tmp_buff[idx - filename] = '\0';
+
+ #ifdef DEBUG
+ printf("checking the existance of %s\n", tmp_buff);
+ #endif
+- if(strcmp(tmp_buff, "..") == 0){
++ if(idx - start == 2 && memcmp(start, "..", 2) == 0){
+ --depth;
+ if (depth < 0){
+ fprintf(stderr, "Traversal to parent directories during unpacking!\n");
+ exit(EXIT_FAILURE);
+ }
+- } else if (strcmp(tmp_buff, ".") != 0)
++ } else if (idx - start != 1 || *start != '.')
+ ++depth;
++
++ start = idx + 1;
++
+ if(stat(tmp_buff, &sbuf) < 0){
+ if(errno != ENOENT)
+ exit_on_error("stat");
+@@ -1765,6 +1778,7 @@ int extract_jar(int fd, const char **fil
+ #ifdef DEBUG
+ printf("Directory exists\n");
+ #endif
++ tmp_buff[idx - filename] = '/';
+ continue;
+ }else {
+ fprintf(stderr, "Hmmm.. %s exists but isn't a directory!\n",
+@@ -1781,10 +1795,11 @@ int extract_jar(int fd, const char **fil
+ if(verbose && handle)
+ printf("%10s: %s/\n", "created", tmp_buff);
+
++ tmp_buff[idx - filename] = '/';
+ }
+
+ /* only a directory */
+- if(strlen((const char *)start) == 0)
++ if(*start == '\0')
+ dir = TRUE;
+
+ #ifdef DEBUG
+@@ -1792,7 +1807,7 @@ int extract_jar(int fd, const char **fil
+ #endif
+
+ /* If the entry was just a directory, don't write to file, etc */
+- if(strlen((const char *)start) == 0)
++ if(*start == '\0')
+ f_fd = -1;
+
+ free(tmp_buff);
+@@ -1876,7 +1891,8 @@ int extract_jar(int fd, const char **fil
+ exit(EXIT_FAILURE);
+ }
+
+- close(f_fd);
++ if (f_fd != -1)
++ close(f_fd);
+
+ if(verbose && dir == FALSE && handle)
+ printf("%10s: %s\n",
diff --git a/source/d/gcc/fastjar-patches/1004-fastjar-man.patch b/source/d/gcc/fastjar-patches/1004-fastjar-man.patch
new file mode 100644
index 00000000..34bf704d
--- /dev/null
+++ b/source/d/gcc/fastjar-patches/1004-fastjar-man.patch
@@ -0,0 +1,27 @@
+2010-03-24 Jan Kratochvil <jan.kratochvil@redhat.com>
+
+ * Makefile.am (POD2MAN): Provide --date from ChangeLog.
+ * Makefile.in: Regenerate.
+
+--- fastjar-0.97/Makefile.am.jj 2008-10-16 04:24:55.000000000 -0400
++++ fastjar-0.97/Makefile.am 2010-06-21 09:29:41.021398000 -0400
+@@ -39,7 +39,7 @@ EXTRA_DIST = \
+ texi2pod.pl
+
+ TEXI2POD = perl $(srcdir)/texi2pod.pl
+-POD2MAN = pod2man --center="GNU" --release=@VERSION@
++POD2MAN = pod2man --center="GNU" --release=@VERSION@ --date=$(shell sed -n '1s/ .*//p' <$(srcdir)/ChangeLog)
+
+ .pod.1:
+ -($(POD2MAN) --section=1 $< > $(@).T$$$$ && \
+--- fastjar-0.97/Makefile.in.jj 2008-10-16 04:15:16.000000000 -0400
++++ fastjar-0.97/Makefile.in 2010-06-21 09:30:15.882810000 -0400
+@@ -515,7 +515,7 @@ EXTRA_DIST = \
+ texi2pod.pl
+
+ TEXI2POD = perl $(srcdir)/texi2pod.pl
+-POD2MAN = pod2man --center="GNU" --release=@VERSION@
++POD2MAN = pod2man --center="GNU" --release=@VERSION@ --date=$(shell sed -n '1s/ .*//p' <$(srcdir)/ChangeLog)
+
+ #SPLINT_FLAGS=-I . -I $(srcdir)/lib -I $(srcdir) -DHAVE_CONFIG_H +posixlib +weak
+ SPLINT_FLAGS = -I . -I $(srcdir)/lib -I $(srcdir) -DHAVE_CONFIG_H -DPRIx32= -warnposix +weak