Fix buffer overflow in rc parse routine. #340905

Package-Manager: portage-2.2.0_alpha29/cvs/Linux x86_64

4 files changed, 73 insertions, 8 deletions

diff --git a/app-editors/dav/ChangeLog b/app-editors/dav/ChangeLog
index 29ed1ecf091b..b20dbfcd8423 100644
--- a/app-editors/dav/ChangeLog
+++ b/app-editors/dav/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for app-editors/dav
-# Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-editors/dav/ChangeLog,v 1.13 2010/04/05 04:06:56 abcd Exp $
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/app-editors/dav/ChangeLog,v 1.14 2011/04/05 18:20:51 signals Exp $
+
+*dav-0.8.5-r1 (05 Apr 2011)
+
+  05 Apr 2011; Kevin McCarthy <signals@gentoo.org> +dav-0.8.5-r1.ebuild,
+  +files/dav-0.8.5-davrc-buffer-overflow.patch:
+  Fix buffer overflow in rc parse routine. #340905
 
   05 Apr 2010; Jonathan Callen <abcd@gentoo.org> dav-0.8.5.ebuild:
   Bump to EAPI=3, add prefix keywords
diff --git a/app-editors/dav/Manifest b/app-editors/dav/Manifest
index bf6bb6223d59..9c1d8b9bc2e0 100644
--- a/app-editors/dav/Manifest
+++ b/app-editors/dav/Manifest
@@ -1,15 +1,21 @@
 -----BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA1
+Hash: SHA256
 
 AUX dav-0.8.5-asneeded.patch 318 RMD160 aae34871af93d2a8330e893ba4090f954547004b SHA1 8dcbfe3582430d5ea16acce15c49128b2d810d4e SHA256 a20f1e1965ef7e9d5dd68c514b538733e949144a793913153c1cf4f3d18ccd1a
+AUX dav-0.8.5-davrc-buffer-overflow.patch 246 RMD160 f0586a6824ec622d92aa0001599db5d72f68ca5d SHA1 c0b40b794d9db8a9b4daa66a1d580bf1d8daa44b SHA256 5f0eb25c62b4b6bef694d7691ec6f525d66c7f5f71b15d8752f3df3c394a4c68
 DIST dav-0.8.5.tar.gz 22824 RMD160 979b698218aa5dd52f7695a6536f0e7339602759 SHA1 ec43ac1314ea740e909f149203845d5071084d76 SHA256 af3835c31f7fb28815bc9b5fcc76e229d0e389d13b178858d120664af486a9ba
+EBUILD dav-0.8.5-r1.ebuild 1066 RMD160 838cdf78fba13df938a2ecc4a10837e1feee1013 SHA1 65e8c26eee5c0b61a070247bda8547874407bfee SHA256 1f36a8144c0b3ccb9d2dbc0dbe172e9ad74355d4eb1901f910f690746b6218cb
 EBUILD dav-0.8.5.ebuild 987 RMD160 81d5cc992f139f174bb5e63f58e4500525fd78eb SHA1 f460bf19fd3d7d6eaaa3546b7a0c641883a6b592 SHA256 255853c69c330d65542e35f495fcbbf323a77b2a504e800f6015a4fa7662e2b2
-MISC ChangeLog 1543 RMD160 65b5e52afa31f6991f19b1b735037db27a0e918a SHA1 39e334f05d0bdf340fcf9d3c78381cf80d271379 SHA256 f1cbd06f57ab29cd4ec2846c431f2d494371a4c8346dda3b018e7c19a98a255e
+MISC ChangeLog 1748 RMD160 255da4461daf2f3e3adfb6165d032acfc47351fd SHA1 0544ba4676689d93a50a10f7e791b94c1d3ace55 SHA256 f8249263fcfba6e53c92bd1ce9813af9fd91efa60d45e561aaf85cc140e4052c
 MISC metadata.xml 314 RMD160 25181cde297628576a9545bea3a76601485bfaf3 SHA1 ac16b621acf5a22b64859e3323d466fb556fc4c8 SHA256 736baab77aea9c4da199c01e3cd6877c271bd02357ff9b41b537a2232c6e96d7
 -----BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.14 (GNU/Linux)
+Version: GnuPG v2.0.17 (GNU/Linux)
 
-iEYEARECAAYFAku5YecACgkQOypDUo0oQOppmgCfWVoDgqxLFQK+bQegb3qu+Ce3
-I24AnjdzeGcvO1+WE1NPfcxaBavZ+YIn
-=Y5wT
+iQEcBAEBCAAGBQJNm12NAAoJEMxKBLrQri3olK4H/igST2ZWvV1CeSnpWRzg7lAK
+iz0Baji/TdYvisDJTBkJqxU6B/f3vh8/V5VWWZ7sHyQLkb5BecMiGd1b3HoKPyN4
+ozTK+q5vZen3w0vt0K+8WrgTdBpKQTLEOCUIHKY/5AKL4Ug/aXX5nL4JsmgZieV9
+wcLLUZwbIPlblJ0qVTaD+0JVrHUqfyrsRQOi0BWmshk0OQLFCVF9aCvJCliH1X2V
+AIq/m3JiQHPlNaxiAGBpYDkyfThBMchrn4cLvjPvKxzWiQM8rQChcTA+emUQsehD
+D4c7OtWhIj2AyTNCzUXimtPKwBsp3bI9rjDAsU7nd5FLKY47JNESV6GY5oquKVs=
+=8/4I
 -----END PGP SIGNATURE-----
diff --git a/app-editors/dav/dav-0.8.5-r1.ebuild b/app-editors/dav/dav-0.8.5-r1.ebuild
new file mode 100644
index 000000000000..be5606e2057b
--- /dev/null
+++ b/app-editors/dav/dav-0.8.5-r1.ebuild
@@ -0,0 +1,42 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-editors/dav/dav-0.8.5-r1.ebuild,v 1.1 2011/04/05 18:20:51 signals Exp $
+
+EAPI="3"
+
+inherit eutils toolchain-funcs
+
+DESCRIPTION="A minimal console text editor"
+HOMEPAGE="http://dav-text.sourceforge.net/"
+
+# The maintainer does not keep sourceforge's mirrors up-to-date,
+# so we point to the website's store of files.
+SRC_URI="http://dav-text.sourceforge.net/files/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~ppc ~x86 ~amd64-linux ~x86-linux ~ppc-macos"
+IUSE=""
+
+DEPEND="sys-libs/ncurses"
+RDEPEND="${DEPEND}"
+
+src_prepare() {
+	epatch "${FILESDIR}"/${P}-asneeded.patch \
+		"${FILESDIR}"/${P}-davrc-buffer-overflow.patch
+}
+
+src_configure() { :; }
+
+src_compile() {
+	emake CFLAGS="${CFLAGS}" \
+		LDFLAGS="${LDFLAGS} -lncurses" \
+		CC="$(tc-getCC)" \
+		|| die "emake failed"
+}
+
+src_install() {
+	# no ./configure and doesn't hardcode /usr, so ED is fine
+	emake DESTDIR="${ED}" install || die
+	dodoc README
+}
diff --git a/app-editors/dav/files/dav-0.8.5-davrc-buffer-overflow.patch b/app-editors/dav/files/dav-0.8.5-davrc-buffer-overflow.patch
new file mode 100644
index 000000000000..a32e78ebc818
--- /dev/null
+++ b/app-editors/dav/files/dav-0.8.5-davrc-buffer-overflow.patch
@@ -0,0 +1,11 @@
+--- dav-0.8.5.orig/main.c	2011-01-29 14:16:53.537725568 -0500
++++ dav-0.8.5/main.c	2011-01-29 14:20:45.139125094 -0500
+@@ -327,7 +327,7 @@
+ void loadSettings()
+ {
+   int l;
+-  char s[80];
++  char s[200];
+   char home[80];
+   char *r;
+   char *c;