From: Andreas K. Hüttel <dilfridge@gentoo.org>
Date: Wed, 13 Mar 2019 12:02:46 +0000 (+0100)
Subject: app-arch/sharutils: Add patch for CVE-2018-1000097
X-Git-Url: http://git.tremily.us/gitweb.cgi?a=commitdiff_plain;h=648bdf9134d87d5d6ca086b742964b77c3da87d8;p=gentoo.git

app-arch/sharutils: Add patch for CVE-2018-1000097

Bug: https://bugs.gentoo.org/652686
Package-Manager: Portage-2.3.62, Repoman-2.3.12
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
---

diff --git a/app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch b/app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch
new file mode 100644
index 000000000000..f61662040b6a
--- /dev/null
+++ b/app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch
@@ -0,0 +1,16 @@
+From: Petr Pisar
+Subject: Fix CVE-2018-1000097, heap buffer overflow in unshar
+Bug-Debian: https://bugs.debian.org/893525
+X-Debian-version: 1:4.15.2-3
+
+--- a/src/unshar.c
++++ b/src/unshar.c
+@@ -240,7 +240,7 @@
+       off_t position = ftello (file);
+ 
+       /* Read next line, fail if no more and no previous process.  */
+-      if (!fgets (rw_buffer, BUFSIZ, file))
++      if (!fgets (rw_buffer, rw_base_size, file))
+ 	{
+ 	  if (!start)
+ 	    error (0, 0, _("Found no shell commands in %s"), name);
diff --git a/app-arch/sharutils/sharutils-4.15.2.ebuild b/app-arch/sharutils/sharutils-4.15.2-r1.ebuild
similarity index 94%
rename from app-arch/sharutils/sharutils-4.15.2.ebuild
rename to app-arch/sharutils/sharutils-4.15.2-r1.ebuild
index ab637e3cd242..2a7873196c5b 100644
--- a/app-arch/sharutils/sharutils-4.15.2.ebuild
+++ b/app-arch/sharutils/sharutils-4.15.2-r1.ebuild
@@ -25,6 +25,7 @@ src_prepare() {
 	default
 
 	epatch "${FILESDIR}/sharutils-4.15.2-glibc228.patch"
+	epatch "${FILESDIR}/sharutils-4.15.2-CVE-2018-1000097.patch"
 
 	# Upstream is aware but thinks this isn't a bug/problem in sharutils itself
 	# See http://lists.gnu.org/archive/html/bug-gnu-utils/2013-10/msg00011.html