dev-libs/libtasn1: fix asn1_find_node issue

Package-Manager: Portage-2.3.5, Repoman-2.3.1

diff --git a/dev-libs/libtasn1/files/libtasn1-4.10-asn1_find_node.patch b/dev-libs/libtasn1/files/libtasn1-4.10-asn1_find_node.patch
new file mode 100644 (file)
index 0000000..b57eb2f
--- /dev/null
+++ b/dev-libs/libtasn1/files/libtasn1-4.10-asn1_find_node.patch
@@ -0,0 +1,43 @@
+From 5520704d075802df25ce4ffccc010ba1641bd484 Mon Sep 17 00:00:00 2001
+From: Nikos Mavrogiannopoulos <nmav@redhat.com>
+Date: Thu, 18 May 2017 18:03:34 +0200
+Subject: [PATCH] asn1_find_node: added safety check on asn1_find_node()
+
+This prevents a stack overflow in asn1_find_node() which
+is triggered by too long variable names in the definitions
+files. That means that applications have to deliberately
+pass a too long 'name' constant to asn1_write_value()
+and friends.  Reported by Jakub Jirasek.
+
+Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
+---
+ lib/parser_aux.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/lib/parser_aux.c b/lib/parser_aux.c
+index b4a7370..976ab38 100644
+--- a/lib/parser_aux.c
++++ b/lib/parser_aux.c
+@@ -120,6 +120,9 @@ asn1_find_node (asn1_node pointer, const char *name)
+       if (n_end)
+       {
+         nsize = n_end - n_start;
++        if (nsize >= sizeof(n))
++              return NULL;
++
+         memcpy (n, n_start, nsize);
+         n[nsize] = 0;
+         n_start = n_end;
+@@ -158,6 +161,9 @@ asn1_find_node (asn1_node pointer, const char *name)
+       if (n_end)
+       {
+         nsize = n_end - n_start;
++        if (nsize >= sizeof(n))
++              return NULL;
++
+         memcpy (n, n_start, nsize);
+         n[nsize] = 0;
+         n_start = n_end;
+--
+libgit2 0.25.0
+

diff --git a/dev-libs/libtasn1/libtasn1-4.10-r2.ebuild b/dev-libs/libtasn1/libtasn1-4.10-r2.ebuild
new file mode 100644 (file)
index 0000000..2279187
--- /dev/null
+++ b/dev-libs/libtasn1/libtasn1-4.10-r2.ebuild
@@ -0,0 +1,54 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit multilib-minimal libtool
+
+DESCRIPTION="ASN.1 library"
+HOMEPAGE="https://www.gnu.org/software/libtasn1/"
+SRC_URI="mirror://gnu/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-3 LGPL-2.1"
+SLOT="0/6" # subslot = libtasn1 soname version
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="doc static-libs valgrind"
+
+DEPEND=">=dev-lang/perl-5.6
+       sys-apps/help2man
+       virtual/yacc"
+RDEPEND="
+       valgrind? ( dev-util/valgrind )
+       abi_x86_32? (
+               !<=app-emulation/emul-linux-x86-baselibs-20131008-r16
+               !app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)]
+       )"
+
+DOCS=( AUTHORS ChangeLog NEWS README THANKS )
+
+PATCHES=(
+       "${FILESDIR}/${P}-asn1_find_node.patch"
+)
+
+pkg_setup() {
+       if use doc; then
+               DOCS+=( doc/libtasn1.pdf )
+               HTML_DOCS=( doc/reference/html/. )
+       fi
+}
+
+src_prepare() {
+       default
+       elibtoolize  # for Solaris shared library
+}
+
+multilib_src_configure() {
+       ECONF_SOURCE="${S}" econf \
+               $(use_enable static-libs static) \
+               $(multilib_native_use_enable valgrind valgrind-tests)
+}
+
+multilib_src_install_all() {
+       einstalldocs
+       use static-libs || find "${ED}" -name '*.la' -delete
+}