Fix possible security issue (DoS), bug 191154

Package-Manager: portage-2.1.2.12

4 files changed, 120 insertions, 4 deletions

diff --git a/net-mail/fetchmail/Manifest b/net-mail/fetchmail/Manifest
index a0afd29d304c..fd0bddf0e2f2 100644
--- a/net-mail/fetchmail/Manifest
+++ b/net-mail/fetchmail/Manifest
@@ -17,6 +17,10 @@ AUX fetchmail-6.3.7-poll-again.patch 473 RMD160 daedf8181972b4759870618ea287a022
 MD5 89ed33f251feda3430a87165a3ce86c2 files/fetchmail-6.3.7-poll-again.patch 473
 RMD160 daedf8181972b4759870618ea287a0221b309aaf files/fetchmail-6.3.7-poll-again.patch 473
 SHA256 c97a7dc9be48b3e0b8a6e9de329c412990e25677f361c749011b779557c35626 files/fetchmail-6.3.7-poll-again.patch 473
+AUX fetchmail-6.3.8-null-msg-pointer.patch 497 RMD160 6b0da53abcb4eee861a8ddba47b1353ef5e58f4f SHA1 707d678ce3a7c0a0898db80cbb6d903873014a5b SHA256 6625692842a1c654fd7e07389ab476ac2a45a73a7dfcf4907524bffebdca7e67
+MD5 bfc6b66d803fb29d7367f958384e697f files/fetchmail-6.3.8-null-msg-pointer.patch 497
+RMD160 6b0da53abcb4eee861a8ddba47b1353ef5e58f4f files/fetchmail-6.3.8-null-msg-pointer.patch 497
+SHA256 6625692842a1c654fd7e07389ab476ac2a45a73a7dfcf4907524bffebdca7e67 files/fetchmail-6.3.8-null-msg-pointer.patch 497
 DIST fetchmail-6.3.6.tar.bz2 1307730 RMD160 455c1413cc5090f834e82be4876b572d4bef35cc SHA1 4c362d8d86c0d4efb191d0faae0b48b54b0887ba SHA256 3c81e7776617b78f18d9cd8b5e5f62944e70f1d7bd47a840fd8d44bcded784ff
 DIST fetchmail-6.3.7.tar.bz2 1315062 RMD160 95b06b5e014c89416269dbc762c8556b20ce74ad SHA1 163634b7b6b491c5f5e84a535f7943ba4d4f0001 SHA256 7957f5eaf4aca6d839ca9869f607b005d09ded884774b8757693410b492ce9f3
 DIST fetchmail-6.3.8.tar.bz2 1323515 RMD160 34034f9ae9fe44ba35f0a16d3128d4a9b0001df2 SHA1 b8e8c51ed6cf53fc398c821fdb29d166c6713bb0 SHA256 5612f9af367f641e0efd084f44fcf1889669e711dbd8c60f6b7953e494d1b09b
@@ -28,6 +32,10 @@ EBUILD fetchmail-6.3.7-r1.ebuild 2358 RMD160 0fa7183be2437032fe6804491b20a3188da
 MD5 df3da1560807a9079c45d4d8665e5943 fetchmail-6.3.7-r1.ebuild 2358
 RMD160 0fa7183be2437032fe6804491b20a3188da95952 fetchmail-6.3.7-r1.ebuild 2358
 SHA256 1a211a31d48f83b62aece15fc376f69b8d68bfa6c67721b44db535e749a218c3 fetchmail-6.3.7-r1.ebuild 2358
+EBUILD fetchmail-6.3.8-r1.ebuild 2323 RMD160 788471b5d315537e9a7b3ab5bddd761f4d5d6d0f SHA1 0841eeff6b217faa238a46505c1c1af0ba89a1a2 SHA256 dc4af9dfea9d93050e3ccd05a42b59e28deed9c3c2c02e7fe19eef85d8a56d16
+MD5 4b7708ce3ca6a7113443b38e06f9c41f fetchmail-6.3.8-r1.ebuild 2323
+RMD160 788471b5d315537e9a7b3ab5bddd761f4d5d6d0f fetchmail-6.3.8-r1.ebuild 2323
+SHA256 dc4af9dfea9d93050e3ccd05a42b59e28deed9c3c2c02e7fe19eef85d8a56d16 fetchmail-6.3.8-r1.ebuild 2323
 EBUILD fetchmail-6.3.8.ebuild 2249 RMD160 51878f1893e020d090fc89120bbf4d96121e8a47 SHA1 f9b54fa54f7592ddd3393f4b046fff37652e0192 SHA256 7b3521f1a44e48fd8b0c37afbe43e281265309c0d87b91bbd5c82072d0610ebe
 MD5 e2e4c6309656d40e6450360f5c21ae40 fetchmail-6.3.8.ebuild 2249
 RMD160 51878f1893e020d090fc89120bbf4d96121e8a47 fetchmail-6.3.8.ebuild 2249
@@ -49,10 +57,17 @@ SHA256 a8abb287803d26983abe8ce158a63f2b0d5373d44e4480583700adb85321e190 files/di
 MD5 c20e9d8ee584986a31956652dfa459d2 files/digest-fetchmail-6.3.8 253
 RMD160 be37c0ab0d77ea7a9d78335df5ba7fbb63d01817 files/digest-fetchmail-6.3.8 253
 SHA256 bcfbd6e2bd81b6f2e0e2baa7754adb04128493e796decc9feed108ed34e71eff files/digest-fetchmail-6.3.8 253
+MD5 c20e9d8ee584986a31956652dfa459d2 files/digest-fetchmail-6.3.8-r1 253
+RMD160 be37c0ab0d77ea7a9d78335df5ba7fbb63d01817 files/digest-fetchmail-6.3.8-r1 253
+SHA256 bcfbd6e2bd81b6f2e0e2baa7754adb04128493e796decc9feed108ed34e71eff files/digest-fetchmail-6.3.8-r1 253
 -----BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.4 (GNU/Linux)
+Version: GnuPG v1.4.7 (GNU/Linux)
 
-iD8DBQFGfuuKp/wUKkr7RBoRAmOLAJwK+5+N6Jzj5ZxnOxdBSaeCplTuIwCeOs4b
-NgCHMWohAAnJlBWQgQf/jac=
-=ZKV+
+iQEVAwUBRtwa0zvRww8BFPxFAQJU/gf+M2V44Ew4K0mwpaVd2bJXk6MUvVOpY+v7
+WRuKDi0XOtYA2NoYgcOv92ZmXYpYZZn//A+JH+VYK2TWsQ0B97pL1ZIp2DN8dtZZ
+3NSZhNk/wpJDL099HRhi6LccP+kc71P6xwTmdXOipN+uzOOQUtTMTPlL7JV1ay6U
+EnGcnpY4El1HAuTLNEySgTUUzsDYzKXQC5wkzF5A8TOQmpol5Mw7eMpJyvndgkfE
+5TbD3Ow8ywFJtBW+NT7DCp4l3SVPDU9oXXtOf4pAlX7A/xg2NWtSJqg8Ht7SbWaY
+Zvh5gr2tVcJ0LlK5K+4emUrkfAvkjFIm3eT2sx95HSUNjboDbOgg3A==
+=kCq0
 -----END PGP SIGNATURE-----
diff --git a/net-mail/fetchmail/fetchmail-6.3.8-r1.ebuild b/net-mail/fetchmail/fetchmail-6.3.8-r1.ebuild
new file mode 100644
index 000000000000..52b7587eb972
--- /dev/null
+++ b/net-mail/fetchmail/fetchmail-6.3.8-r1.ebuild
@@ -0,0 +1,85 @@
+# Copyright 1999-2007 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-mail/fetchmail/fetchmail-6.3.8-r1.ebuild,v 1.1 2007/09/03 14:31:41 falco Exp $
+
+inherit eutils
+
+DESCRIPTION="the legendary remote-mail retrieval and forwarding utility"
+HOMEPAGE="http://fetchmail.berlios.de"
+SRC_URI="http://download2.berlios.de/${PN}/${P}.tar.bz2"
+
+LICENSE="GPL-2 public-domain"
+SLOT="0"
+KEYWORDS="alpha amd64 arm hppa ia64 mips ppc ppc64 s390 sh sparc x86 ~x86-fbsd"
+IUSE="ssl nls ipv6 kerberos krb4 hesiod"
+
+RDEPEND="hesiod? ( net-dns/hesiod )
+	ssl? ( >=dev-libs/openssl-0.9.6 )
+	kerberos? ( app-crypt/mit-krb5 )
+	nls? ( virtual/libintl )
+	elibc_FreeBSD? ( sys-libs/com_err )"
+DEPEND="${RDEPEND}
+	nls? ( sys-devel/gettext )"
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+
+	# fixes DoS, #191154
+	epatch "${FILESDIR}"/${P}-null-msg-pointer.patch
+
+	# this patch fixes bug #34788 (ticho@gentoo.org 2004-09-03)
+	epatch "${FILESDIR}"/${PN}-6.2.5-broken-headers.patch
+}
+
+src_compile() {
+	econf \
+		--disable-dependency-tracking \
+		--enable-RPA \
+		--enable-NTLM \
+		--enable-SDPS \
+		$(use_enable nls) \
+		$(use_enable ipv6 inet6) \
+		$(use_with kerberos gssapi) $(use_with kerberos kerberos5) \
+		$(use_with krb4 kerberos) \
+		$(use_with ssl) \
+		$(use_with hesiod) \
+		${myconf} || die "Configuration failed."
+	# wont compile reliably on smp (mkennedy@gentoo.org 2003-11-12)
+	emake || die "Compilation failed."
+}
+
+src_install() {
+	emake DESTDIR="${D}" install || die
+
+	dohtml *.html
+
+	dodoc FAQ FEATURES ABOUT-NLS NEWS NOTES README README.NTLM README.SSL TODO
+
+	newinitd "${FILESDIR}"/fetchmail fetchmail
+	newconfd "${FILESDIR}"/conf.d-fetchmail fetchmail
+
+	docinto contrib
+	local f
+	for f in contrib/*
+	do
+		[ -f "${f}" ] && dodoc "${f}"
+	done
+}
+
+pkg_postinst() {
+	if ! python -c "import Tkinter" >/dev/null 2>&1
+	then
+		elog
+		elog "You will not be able to use fetchmailconf(1), because you"
+		elog "don't seem to have Python with tkinter support."
+		elog
+		elog "If you want to be able to use fetchmailconf(1), do the following:"
+		elog "  1.  Add 'tk' to the USE variable in /etc/make.conf."
+		elog "  2.  (Re-)merge Python."
+		elog
+	fi
+
+	elog "Please see /etc/conf.d/fetchmail if you want to adjust"
+	elog "the polling delay used by the fetchmail init script."
+}
diff --git a/net-mail/fetchmail/files/digest-fetchmail-6.3.8-r1 b/net-mail/fetchmail/files/digest-fetchmail-6.3.8-r1
new file mode 100644
index 000000000000..e32b9c4065b0
--- /dev/null
+++ b/net-mail/fetchmail/files/digest-fetchmail-6.3.8-r1
@@ -0,0 +1,3 @@
+MD5 66b97500b0a1e3c0916b3b5314f597f5 fetchmail-6.3.8.tar.bz2 1323515
+RMD160 34034f9ae9fe44ba35f0a16d3128d4a9b0001df2 fetchmail-6.3.8.tar.bz2 1323515
+SHA256 5612f9af367f641e0efd084f44fcf1889669e711dbd8c60f6b7953e494d1b09b fetchmail-6.3.8.tar.bz2 1323515
diff --git a/net-mail/fetchmail/files/fetchmail-6.3.8-null-msg-pointer.patch b/net-mail/fetchmail/files/fetchmail-6.3.8-null-msg-pointer.patch
new file mode 100644
index 000000000000..cc89aa6a44c4
--- /dev/null
+++ b/net-mail/fetchmail/files/fetchmail-6.3.8-null-msg-pointer.patch
@@ -0,0 +1,13 @@
+Index: sink.c
+===================================================================
+--- sink.c	(revision 5118)
++++ sink.c	(revision 5119)
+@@ -262,7 +262,7 @@
+     const char *md1 = "MAILER-DAEMON", *md2 = "MAILER-DAEMON@";
+ 
+     /* don't bounce in reply to undeliverable bounces */
+-    if (!msg->return_path[0] ||
++    if (!msg || !msg->return_path[0] ||
+ 	strcmp(msg->return_path, "<>") == 0 ||
+ 	strcasecmp(msg->return_path, md1) == 0 ||
+ 	strncasecmp(msg->return_path, md2, strlen(md2)) == 0)