summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLeo Famulari <leo@famulari.name>2017-01-10 15:27:44 -0500
committerLeo Famulari <leo@famulari.name>2017-01-10 17:52:42 -0500
commitb0a567640cf66f396de3fb4a827f9cf8a7ee0abb (patch)
treea6afe95b3cd1034bbb050f00aa1bb372c40edad6
parent4b96149d8b199048aa526159120d14a44d6ee054 (diff)
gnu: cracklib: Fix buffer overflow.
* gnu/packages/patches/cracklib-fix-buffer-overflow.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/password-utils.scm (cracklib)[source]: Use it.
-rw-r--r--gnu/local.mk1
-rw-r--r--gnu/packages/password-utils.scm3
-rw-r--r--gnu/packages/patches/cracklib-fix-buffer-overflow.patch39
3 files changed, 42 insertions, 1 deletions
diff --git a/gnu/local.mk b/gnu/local.mk
index e34ae17796..21580a3870 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -511,6 +511,7 @@ dist_patch_DATA = \
%D%/packages/patches/cpio-CVE-2016-2037.patch \
%D%/packages/patches/cpufrequtils-fix-aclocal.patch \
%D%/packages/patches/cracklib-CVE-2016-6318.patch \
+ %D%/packages/patches/cracklib-fix-buffer-overflow.patch \
%D%/packages/patches/crda-optional-gcrypt.patch \
%D%/packages/patches/crossmap-allow-system-pysam.patch \
%D%/packages/patches/csound-header-ordering.patch \
diff --git a/gnu/packages/password-utils.scm b/gnu/packages/password-utils.scm
index f8111b2abf..cb8dacc3ea 100644
--- a/gnu/packages/password-utils.scm
+++ b/gnu/packages/password-utils.scm
@@ -173,7 +173,8 @@ and vice versa.")
(uri (string-append "https://github.com/cracklib/cracklib/"
"releases/download/" name "-" version "/"
name "-" version ".tar.gz"))
- (patches (search-patches "cracklib-CVE-2016-6318.patch"))
+ (patches (search-patches "cracklib-CVE-2016-6318.patch"
+ "cracklib-fix-buffer-overflow.patch"))
(sha256
(base32
"0hrkb0prf7n92w6rxgq0ilzkk6rkhpys2cfqkrbzswp27na7dkqp"))))
diff --git a/gnu/packages/patches/cracklib-fix-buffer-overflow.patch b/gnu/packages/patches/cracklib-fix-buffer-overflow.patch
new file mode 100644
index 0000000000..b1c990f282
--- /dev/null
+++ b/gnu/packages/patches/cracklib-fix-buffer-overflow.patch
@@ -0,0 +1,39 @@
+Fix buffer overflow processing long words in Mangle().
+
+Patch adpated from upstream commit, omitting changes to 'NEWS':
+
+https://github.com/cracklib/cracklib/commit/33d7fa4585247cd2247a1ffa032ad245836c6edb
+
+From 33d7fa4585247cd2247a1ffa032ad245836c6edb Mon Sep 17 00:00:00 2001
+From: Jan Dittberner <jan@dittberner.info>
+Date: Thu, 25 Aug 2016 17:17:53 +0200
+Subject: [PATCH] Fix a buffer overflow processing long words
+
+A buffer overflow processing long words has been discovered. This commit
+applies the patch from
+https://build.opensuse.org/package/view_file/Base:System/cracklib/0004-overflow-processing-long-words.patch
+by Howard Guo.
+
+See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=835386 and
+http://www.openwall.com/lists/oss-security/2016/08/23/8
+---
+ src/NEWS | 1 +
+ src/lib/rules.c | 5 ++---
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/lib/rules.c b/src/lib/rules.c
+index d193cc0..3a2aa46 100644
+--- a/lib/rules.c
++++ b/lib/rules.c
+@@ -434,9 +434,8 @@ Mangle(input, control) /* returns a pointer to a controlled Mangle */
+ {
+ int limit;
+ register char *ptr;
+- static char area[STRINGSIZE];
+- char area2[STRINGSIZE];
+- area[0] = '\0';
++ static char area[STRINGSIZE * 2] = {0};
++ char area2[STRINGSIZE * 2] = {0};
+ strcpy(area, input);
+
+ for (ptr = control; *ptr; ptr++)