Attachment 156216 Details for Bug 236586 – New patch

[patch] New patch

lha-114i-CVE-2007-2030.patch (text/plain), 3.06 KB, created by Tomas Smetana on 2007-06-05 13:18:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Smetana

Created: 2007-06-05 13:18:11 UTC

Size: 3.06 KB

patch

obsolete

>--- lha-114i/src/lhext.c.cve2	2007-06-05 15:03:55.000000000 +0200
>+++ lha-114i/src/lhext.c	2007-06-05 15:03:55.000000000 +0200
>@@ -360,7 +360,6 @@
> 				}
> 
> 				unlink(bb1);
>-				make_parent_path(bb1);
> 				l_code = symlink(bb2, bb1);
> 				if (l_code < 0) {
> 					if (quiet != TRUE)
>--- lha-114i/src/lhadd.c.cve2	2000-10-04 16:57:38.000000000 +0200
>+++ lha-114i/src/lhadd.c	2007-06-05 15:03:55.000000000 +0200
>@@ -35,6 +35,8 @@
> 	if ((hdr->unix_mode & UNIX_FILE_SYMLINK) == UNIX_FILE_SYMLINK) {
> 		char            buf[256], *b1, *b2;
> 		if (!quiet) {
>+			/* make sure we use a zero-terminated buffer */
>+			hdr->name[255] = 0;
> 			strcpy(buf, hdr->name);
> 			b1 = strtok(buf, "|");
> 			b2 = strtok(NULL, "|");
>@@ -211,8 +213,11 @@
> 				add_sp(&sp, hdr.name, strlen(hdr.name) + 1);
> 		}
> 		else if ((hdr.unix_mode & UNIX_FILE_TYPEMASK) == UNIX_FILE_DIRECTORY) {
>+			/* make sure we use a zero-terminated buffer */
>+			hdr.name[sizeof(hdr.name)-1] = 0;
> 			strcpy(name, hdr.name);
> 			len = strlen(name);
>+			/* XXX thomas: what about multiple '/' or about ".." */
> 			if (len > 0 && name[len - 1] == '/')
> 				name[--len] = '\0';	/* strip tail '/' */
> 			if (stat(name, &stbuf) >= 0)	/* exist ? */
>@@ -237,17 +242,21 @@
> 
> 	old_header_pos = ftell(oafp);
> 	while (get_header(oafp, &ahdr)) {
>+		/* make sure we use a zero-terminated buffer */
>+		ahdr.name[sizeof(ahdr.name)-1] = 0;
> 		strcpy(lpath, ahdr.name);
> 		b1 = strtok(lpath, "|");
> 		b2 = strtok(NULL, "|");
> 		if (need_file(b1)) {	/* skip */
> 			fseek(oafp, ahdr.packed_size, SEEK_CUR);
> 			if (noexec || !quiet)
>+			{
> 				if (b2 != NULL)
> 					printf("delete %s -> %s\n", b1, b2);
> 				else
> 					printf("delete %s\n", b1);
> 		}
>+		}
> 		else {		/* copy */
> 			if (noexec) {
> 				fseek(oafp, ahdr.packed_size, SEEK_CUR);
>@@ -276,7 +285,7 @@
> 	signal(SIGHUP, interrupt);
> 
> 	old_umask = umask(077);
>-	afp = xfopen(temporary_name, WRITE_BINARY);
>+	afp = xfopen(temporary_name, "!" WRITE_BINARY);
> 	remove_temporary_at_error = TRUE;
> 	temporary_fp = afp;
> 	umask(old_umask);
>--- lha-114i/src/lharc.c.cve2	2007-06-05 15:03:55.000000000 +0200
>+++ lha-114i/src/lharc.c	2007-06-05 15:06:07.000000000 +0200
>@@ -1005,10 +1005,21 @@
> xfopen(name, mode)
> 	char           *name, *mode;
> {
>-	FILE           *fp;
>+	FILE           *fp = NULL;
> 
>+	if (mode[0] == '!') {
>+		int	fd;
>+#ifdef MKSTEMP
>+		fd = open(name, O_RDWR|O_EXCL, 0600);
>+#else
>+		fd = open(name, O_RDWR|O_CREAT|O_EXCL, 0600);
>+#endif
>+		if (fd < 0 || (fp = fdopen(fd, mode + 1)) == NULL)
>+			fatal_error(name);
>+	} else {
> 	if ((fp = fopen(name, mode)) == NULL)
> 		fatal_error(name);
>+	}
> 
> 	return fp;
> }
>@@ -1066,6 +1077,12 @@
> 	if (open_old_archive_1(archive_name, &fp))
> 		return fp;
> 	snprintf(expanded_archive_name, sizeof(expanded_archive_name),
>+		"%s.lha", archive_name);
>+        if (open_old_archive_1(expanded_archive_name, &fp)) {
>+                archive_name = expanded_archive_name;
>+                return fp;
>+        }
>+	snprintf(expanded_archive_name, sizeof(expanded_archive_name),
> 		"%s.lzh", archive_name);
> 	if (open_old_archive_1(expanded_archive_name, &fp)) {
> 		archive_name = expanded_archive_name;

Actions: View | Diff

Attachments on bug 236586: 156216