diff options
| author | Christian Weisgerber <naddy@FreeBSD.org> | 2010-03-24 18:46:46 +0000 |
|---|---|---|
| committer | Christian Weisgerber <naddy@FreeBSD.org> | 2010-03-24 18:46:46 +0000 |
| commit | 0f7ef19845048b03f7c9c5f994ef0074fda28676 (patch) | |
| tree | 267f661a716128bfa49f2ba4e885cc93ac9e6ddf /archivers | |
| parent | cba7c53cd64b729c777c2a23e5fe57ebbf0210eb (diff) | |
| download | ports-0f7ef19845048b03f7c9c5f994ef0074fda28676.tar.gz ports-0f7ef19845048b03f7c9c5f994ef0074fda28676.zip | |
Fix a buffer overflow in the rmt client functionality.
From upstream.
Security: c175d72f-3773-11df-8bb8-0211d880e350
Notes
Notes:
svn path=/head/; revision=251453
Diffstat (limited to 'archivers')
| -rw-r--r-- | archivers/gtar/Makefile | 2 | ||||
| -rw-r--r-- | archivers/gtar/files/patch-lib_rtapelib.c | 28 |
2 files changed, 29 insertions, 1 deletions
diff --git a/archivers/gtar/Makefile b/archivers/gtar/Makefile index fedcea4be192..5aceaf271bd0 100644 --- a/archivers/gtar/Makefile +++ b/archivers/gtar/Makefile @@ -7,7 +7,7 @@ PORTNAME= tar PORTVERSION= 1.22 -PORTREVISION= 2 +PORTREVISION= 3 CATEGORIES= archivers sysutils MASTER_SITES= ${MASTER_SITE_GNU} MASTER_SITE_SUBDIR= ${PORTNAME} diff --git a/archivers/gtar/files/patch-lib_rtapelib.c b/archivers/gtar/files/patch-lib_rtapelib.c new file mode 100644 index 000000000000..e6c81e14a0aa --- /dev/null +++ b/archivers/gtar/files/patch-lib_rtapelib.c @@ -0,0 +1,28 @@ + +$FreeBSD$ + +--- lib/rtapelib.c.orig ++++ lib/rtapelib.c +@@ -570,7 +570,8 @@ + + sprintf (command_buffer, "R%lu\n", (unsigned long) length); + if (do_command (handle, command_buffer) == -1 +- || (status = get_status (handle)) == SAFE_READ_ERROR) ++ || (status = get_status (handle)) == SAFE_READ_ERROR ++ || status > length) + return SAFE_READ_ERROR; + + for (counter = 0; counter < status; counter += rlen, buffer += rlen) +@@ -706,6 +707,12 @@ + || (status = get_status (handle), status == -1)) + return -1; + ++ if (status > sizeof (struct mtop)) ++ { ++ errno = EOVERFLOW; ++ return -1; ++ } ++ + for (; status > 0; status -= counter, argument += counter) + { + counter = safe_read (READ_SIDE (handle), argument, status); |