From 648bdf9134d87d5d6ca086b742964b77c3da87d8 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Andreas=20K=2E=20H=C3=BCttel?= Date: Wed, 13 Mar 2019 13:02:46 +0100 Subject: [PATCH] app-arch/sharutils: Add patch for CVE-2018-1000097 MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Bug: https://bugs.gentoo.org/652686 Package-Manager: Portage-2.3.62, Repoman-2.3.12 Signed-off-by: Andreas K. Hüttel --- .../sharutils-4.15.2-CVE-2018-1000097.patch | 16 ++++++++++++++++ ...-4.15.2.ebuild => sharutils-4.15.2-r1.ebuild} | 1 + 2 files changed, 17 insertions(+) create mode 100644 app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch rename app-arch/sharutils/{sharutils-4.15.2.ebuild => sharutils-4.15.2-r1.ebuild} (94%) diff --git a/app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch b/app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch new file mode 100644 index 000000000000..f61662040b6a --- /dev/null +++ b/app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch @@ -0,0 +1,16 @@ +From: Petr Pisar +Subject: Fix CVE-2018-1000097, heap buffer overflow in unshar +Bug-Debian: https://bugs.debian.org/893525 +X-Debian-version: 1:4.15.2-3 + +--- a/src/unshar.c ++++ b/src/unshar.c +@@ -240,7 +240,7 @@ + off_t position = ftello (file); + + /* Read next line, fail if no more and no previous process. */ +- if (!fgets (rw_buffer, BUFSIZ, file)) ++ if (!fgets (rw_buffer, rw_base_size, file)) + { + if (!start) + error (0, 0, _("Found no shell commands in %s"), name); diff --git a/app-arch/sharutils/sharutils-4.15.2.ebuild b/app-arch/sharutils/sharutils-4.15.2-r1.ebuild similarity index 94% rename from app-arch/sharutils/sharutils-4.15.2.ebuild rename to app-arch/sharutils/sharutils-4.15.2-r1.ebuild index ab637e3cd242..2a7873196c5b 100644 --- a/app-arch/sharutils/sharutils-4.15.2.ebuild +++ b/app-arch/sharutils/sharutils-4.15.2-r1.ebuild @@ -25,6 +25,7 @@ src_prepare() { default epatch "${FILESDIR}/sharutils-4.15.2-glibc228.patch" + epatch "${FILESDIR}/sharutils-4.15.2-CVE-2018-1000097.patch" # Upstream is aware but thinks this isn't a bug/problem in sharutils itself # See http://lists.gnu.org/archive/html/bug-gnu-utils/2013-10/msg00011.html -- 2.26.2