From: "Andreas K. Hüttel" <dilfridge@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] repo/gentoo:master commit in: app-arch/sharutils/, app-arch/sharutils/files/
Date: Wed, 13 Mar 2019 12:03:22 +0000 (UTC) [thread overview]
Message-ID: <1552478566.648bdf9134d87d5d6ca086b742964b77c3da87d8.dilfridge@gentoo> (raw)
commit: 648bdf9134d87d5d6ca086b742964b77c3da87d8
Author: Andreas K. Hüttel <dilfridge <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 13 12:02:46 2019 +0000
Commit: Andreas K. Hüttel <dilfridge <AT> gentoo <DOT> org>
CommitDate: Wed Mar 13 12:02:46 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=648bdf91
app-arch/sharutils: Add patch for CVE-2018-1000097
Bug: https://bugs.gentoo.org/652686
Package-Manager: Portage-2.3.62, Repoman-2.3.12
Signed-off-by: Andreas K. Hüttel <dilfridge <AT> gentoo.org>
.../files/sharutils-4.15.2-CVE-2018-1000097.patch | 16 ++++++++++++++++
...harutils-4.15.2.ebuild => sharutils-4.15.2-r1.ebuild} | 1 +
2 files changed, 17 insertions(+)
diff --git a/app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch b/app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch
new file mode 100644
index 00000000000..f61662040b6
--- /dev/null
+++ b/app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch
@@ -0,0 +1,16 @@
+From: Petr Pisar
+Subject: Fix CVE-2018-1000097, heap buffer overflow in unshar
+Bug-Debian: https://bugs.debian.org/893525
+X-Debian-version: 1:4.15.2-3
+
+--- a/src/unshar.c
++++ b/src/unshar.c
+@@ -240,7 +240,7 @@
+ off_t position = ftello (file);
+
+ /* Read next line, fail if no more and no previous process. */
+- if (!fgets (rw_buffer, BUFSIZ, file))
++ if (!fgets (rw_buffer, rw_base_size, file))
+ {
+ if (!start)
+ error (0, 0, _("Found no shell commands in %s"), name);
diff --git a/app-arch/sharutils/sharutils-4.15.2.ebuild b/app-arch/sharutils/sharutils-4.15.2-r1.ebuild
similarity index 94%
rename from app-arch/sharutils/sharutils-4.15.2.ebuild
rename to app-arch/sharutils/sharutils-4.15.2-r1.ebuild
index ab637e3cd24..2a7873196c5 100644
--- a/app-arch/sharutils/sharutils-4.15.2.ebuild
+++ b/app-arch/sharutils/sharutils-4.15.2-r1.ebuild
@@ -25,6 +25,7 @@ src_prepare() {
default
epatch "${FILESDIR}/sharutils-4.15.2-glibc228.patch"
+ epatch "${FILESDIR}/sharutils-4.15.2-CVE-2018-1000097.patch"
# Upstream is aware but thinks this isn't a bug/problem in sharutils itself
# See http://lists.gnu.org/archive/html/bug-gnu-utils/2013-10/msg00011.html
next reply other threads:[~2019-03-13 12:03 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-13 12:03 Andreas K. Hüttel [this message]
-- strict thread matches above, loose matches on Subject: below --
2020-05-02 12:18 [gentoo-commits] repo/gentoo:master commit in: app-arch/sharutils/, app-arch/sharutils/files/ Sergei Trofimovich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1552478566.648bdf9134d87d5d6ca086b742964b77c3da87d8.dilfridge@gentoo \
--to=dilfridge@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox