Revbump to fix security bug #325557, patch from ubuntu.

Package-Manager: portage-2.2_rc67/cvs/Linux x86_64

diff --git a/app-arch/fastjar/ChangeLog b/app-arch/fastjar/ChangeLog
index a714c01e61a75cc580679780ddcd87896fdb604d..9fdbb7cdecb52149ee755eab49a990cb6310038d 100644 (file)
--- a/app-arch/fastjar/ChangeLog
+++ b/app-arch/fastjar/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for app-arch/fastjar
 # Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-arch/fastjar/ChangeLog,v 1.17 2010/05/26 18:45:01 pacho Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-arch/fastjar/ChangeLog,v 1.18 2010/06/30 21:48:11 caster Exp $
+
+*fastjar-0.98-r1 (30 Jun 2010)
+
+  30 Jun 2010; Vlastimil Babka <caster@gentoo.org>
+  +files/0.98-traversal.patch, -fastjar-0.95.ebuild,
+  +fastjar-0.98-r1.ebuild:
+  Revbump to fix security bug #325557, patch from ubuntu.
 
   26 May 2010; Pacho Ramos <pacho@gentoo.org> fastjar-0.98.ebuild:
   stable amd64, bug 316289

diff --git a/app-arch/fastjar/Manifest b/app-arch/fastjar/Manifest
index 33fa971a87144a44000c8a480ffd3391601d9d78..24e286683775330856b2583303d9a80ae0992279 100644 (file)
--- a/app-arch/fastjar/Manifest
+++ b/app-arch/fastjar/Manifest
@@ -1,16 +1,6 @@
------BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA1
-
-DIST fastjar-0.95.tar.gz 593955 RMD160 b8405e5ba9b94572fc634f0328c9df31d21cff64 SHA1 1a3ea32f2ce23d6c2a759a4ef5d9aa2d2262026b SHA256 ca03811490c965abc9f466e75418ae48bb71f14d8e8ed4c43e8109207b85ce54
+AUX 0.98-traversal.patch 3010 RMD160 b428effa3dae2dd438e330784b194a72c9d80a78 SHA1 beffdf4760c105810e2a28113cf6845449aa9707 SHA256 8dab968b23684cd2ea5d5d876bd6e35c8e4aec7be52c2fa00c85635dc620984d
 DIST fastjar-0.98.tar.gz 717984 RMD160 593ed2dfcc02599a3540028a0f0b5c77d6be7071 SHA1 c240a9e2115aad486329360d9166514261149af2 SHA256 f156abc5de8658f22ee8f08d7a72c88f9409ebd8c7933e9466b0842afeb2f145
-EBUILD fastjar-0.95.ebuild 644 RMD160 9ac406a8bc2c01dae2c305f12ec944d6f3abc0a6 SHA1 a2b8dd6c49571079c5d724934ac9cd47675e2b88 SHA256 1c32f3be2baf178c095f026097089cae30a6e4486d4e6cb0e084e1d3170c4c7e
+EBUILD fastjar-0.98-r1.ebuild 752 RMD160 9d207002843582b7523b85b56b611acc941929b3 SHA1 bbc2f31470f2c1e922e1f72d251c535a282ad297 SHA256 6fe18a907524f10dd6a186dabd5f89281d6b700fe6836d390af1f35b546aad71
 EBUILD fastjar-0.98.ebuild 643 RMD160 72995fc8656a5dcc479fddeaf98b42418d3331d0 SHA1 75f21feafa735db6ba7c5b990dac30540bdce715 SHA256 79b0a80a03ae895e6514562664f534e8523296006ee1f09536429626a083388f
-MISC ChangeLog 2140 RMD160 eb948e469d07e8163c715ef4bfa708d40bf54505 SHA1 d8fa654a48593888ea0a5fa2f782e222796f76d4 SHA256 d981b30ae6028adaf88b9e62268b033fc1f6a6c6fb771f341aff2b6d7e5aa882
+MISC ChangeLog 2363 RMD160 2028d3e33bb8aa9cc45ee19b928d7039289606d5 SHA1 4f6827410ee41b9f987d870ef85ac9d002536a7b SHA256 60d5e6ad96bc366e45a7c9b025f17d76da337ba6407de8a2dac28b11d71634f0
 MISC metadata.xml 400 RMD160 1c51d317ff2b35d491b1e9030a20202e62d766e5 SHA1 2ad18d4b562e8507cd7ed9090b90892eb235fb06 SHA256 31fed5bfe5c4eacb486b5dcc494bd450fe6e39642c2940d5a8fb41c879bb91ee
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.14 (GNU/Linux)
-
-iEYEARECAAYFAkv9bDMACgkQCaWpQKGI+9S/UQCeI96IfRDGfar8MuRWWDiNKK+N
-lBcAnjy0op78yJzds2tH6k3C3v9uyPQs
-=OIHe
------END PGP SIGNATURE-----

diff --git a/app-arch/fastjar/fastjar-0.95.ebuild b/app-arch/fastjar/fastjar-0.98-r1.ebuild
similarity index 61%
rename from app-arch/fastjar/fastjar-0.95.ebuild
rename to app-arch/fastjar/fastjar-0.98-r1.ebuild
index b41c41e0477c633a057fa0fc687f9000472c55aa..3f08094e19aae0e7f7f74cef9c65e4351b67824c 100644 (file)
--- a/app-arch/fastjar/fastjar-0.95.ebuild
+++ b/app-arch/fastjar/fastjar-0.98-r1.ebuild
@@ -1,6 +1,10 @@
-# Copyright 1999-2008 Gentoo Foundation
+# Copyright 1999-2010 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-arch/fastjar/fastjar-0.95.ebuild,v 1.7 2008/03/31 22:02:38 maekke Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-arch/fastjar/fastjar-0.98-r1.ebuild,v 1.1 2010/06/30 21:48:11 caster Exp $
+
+EAPI=2
+
+inherit eutils
 
 DESCRIPTION="A jar program written in C"
 HOMEPAGE="https://savannah.nongnu.org/projects/fastjar"
@@ -8,7 +12,7 @@ SRC_URI="http://download.savannah.nongnu.org/releases/${PN}/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="amd64 ppc ppc64 x86"
+KEYWORDS="~amd64 ~ppc ~ppc64 ~x86"
 
 IUSE=""
 
@@ -16,6 +20,11 @@ IUSE=""
 RDEPEND="!<=dev-java/kaffe-1.1.7-r5"
 DEPEND=""
 
+src_prepare() {
+       # bug #325557
+       epatch "${FILESDIR}/0.98-traversal.patch"
+}
+
 src_install() {
        emake DESTDIR="${D}" install || die "make install failed"
        dodoc AUTHORS ChangeLog NEWS README TODO || die

diff --git a/app-arch/fastjar/files/0.98-traversal.patch b/app-arch/fastjar/files/0.98-traversal.patch
new file mode 100644 (file)
index 0000000..511f4c6
--- /dev/null
+++ b/app-arch/fastjar/files/0.98-traversal.patch
@@ -0,0 +1,112 @@
+--- fastjar-0.98.orig/jartool.c
++++ fastjar-0.98/jartool.c
+@@ -790,6 +790,7 @@
+                  progname, jarfile);
+         return 1;
+       }
++      ze->filename[len] = '\0';
+       len = UNPACK_UB4(header, CEN_EFLEN);
+       len += UNPACK_UB4(header, CEN_COMLEN);
+       if (lseek (fd, len, SEEK_CUR) == -1)
+@@ -1257,7 +1258,7 @@
+       exit_on_error("write");
+ 
+   /* write the file name to the zip file */
+-  if (1 == write(jfd, fname, file_name_length))
++  if (-1 == write(jfd, fname, file_name_length))
+     exit_on_error("write");
+ 
+   if(verbose){
+@@ -1730,7 +1731,17 @@
+       struct stat sbuf;
+       int depth = 0;
+ 
+-      tmp_buff = malloc(sizeof(char) * strlen((const char *)filename));
++      if(*filename == '/'){
++      fprintf(stderr, "Absolute path names are not allowed.\n");
++      exit(EXIT_FAILURE);
++      }
++
++      tmp_buff = malloc(strlen((const char *)filename));
++
++      if(tmp_buff == NULL) {
++      fprintf(stderr, "Out of memory.\n");
++      exit(EXIT_FAILURE);
++      }
+ 
+       for(;;){
+         const ub1 *idx = (const unsigned char *)strchr((const char *)start, '/');
+@@ -1738,25 +1749,28 @@
+         if(idx == NULL)
+           break;
+         else if(idx == start){
++        tmp_buff[idx - filename] = '/';
+           start++;
+           continue;
+         }
+-        start = idx + 1;
+ 
+-        strncpy(tmp_buff, (const char *)filename, (idx - filename));
+-        tmp_buff[(idx - filename)] = '\0';
++      memcpy(tmp_buff + (start - filename), (const char *)start, (idx - start));
++      tmp_buff[idx - filename] = '\0';
+ 
+ #ifdef DEBUG    
+         printf("checking the existance of %s\n", tmp_buff);
+ #endif
+-      if(strcmp(tmp_buff, "..") == 0){
++      if(idx - start == 2 && memcmp(start, "..", 2) == 0){
+         --depth;
+         if (depth < 0){
+           fprintf(stderr, "Traversal to parent directories during unpacking!\n");
+           exit(EXIT_FAILURE);
+         }
+-      } else if (strcmp(tmp_buff, ".") != 0)
++      } else if (idx - start != 1 || *start != '.')
+         ++depth;
++
++        start = idx + 1;
++
+         if(stat(tmp_buff, &sbuf) < 0){
+           if(errno != ENOENT)
+             exit_on_error("stat");
+@@ -1765,6 +1779,7 @@
+ #ifdef DEBUG    
+           printf("Directory exists\n");
+ #endif
++        tmp_buff[idx - filename] = '/';
+           continue;
+         }else {
+           fprintf(stderr, "Hmmm.. %s exists but isn't a directory!\n",
+@@ -1781,10 +1796,11 @@
+         if(verbose && handle)
+           printf("%10s: %s/\n", "created", tmp_buff);
+ 
++      tmp_buff[idx - filename] = '/';
+       }
+ 
+       /* only a directory */
+-      if(strlen((const char *)start) == 0)
++      if(*start == '\0')
+         dir = TRUE;
+ 
+ #ifdef DEBUG    
+@@ -1792,7 +1808,7 @@
+ #endif
+ 
+       /* If the entry was just a directory, don't write to file, etc */
+-      if(strlen((const char *)start) == 0)
++      if(*start == '\0')
+         f_fd = -1;
+ 
+       free(tmp_buff);
+@@ -1876,7 +1892,8 @@
+       exit(EXIT_FAILURE);
+     }
+ 
+-    close(f_fd);
++    if (f_fd != -1)
++      close(f_fd);
+ 
+     if(verbose && dir == FALSE && handle)
+       printf("%10s: %s\n",