Buffer overflow and format string fixes.

(Also don't put several patches in a single file.)

Approved by:	sergei
Obtained from:	upstream
Reported by:	Ulf Harnhammar <Ulf.Harnhammar.9485@student.uu.se>

8 files changed, 199 insertions, 40 deletions

diff --git a/mail/anubis/Makefile b/mail/anubis/Makefile
index 7b155c67ac17..a0cf2d21a523 100644
--- a/mail/anubis/Makefile
+++ b/mail/anubis/Makefile
@@ -19,7 +19,7 @@
 
 PORTNAME=		anubis
 PORTVERSION=		3.6.2
-PORTREVISION=		1
+PORTREVISION=		2
 CATEGORIES=		mail
 MASTER_SITES=		${MASTER_SITE_GNU}
 MASTER_SITE_SUBDIR=	${PORTNAME}
@@ -27,7 +27,6 @@ MASTER_SITE_SUBDIR=	${PORTNAME}
 MAINTAINER=		sergei@FreeBSD.org
 COMMENT=		Outgoing SMTP mail processor
 
-PATCH_STRIP=		-p1
 USE_REINPLACE=		yes
 USE_GETOPT_LONG=	yes
 GNU_CONFIGURE=		yes
diff --git a/mail/anubis/files/patch-freebsd b/mail/anubis/files/patch-freebsd
deleted file mode 100644
index 42057fc495e2..000000000000
--- a/mail/anubis/files/patch-freebsd
+++ /dev/null
@@ -1,38 +0,0 @@
-diff -urN anubis-3.6.2/src/net.c anubis-3.6.2-fix/src/net.c
---- anubis-3.6.2/src/net.c	Wed Dec 11 15:37:56 2002
-+++ anubis-3.6.2-fix/src/net.c	Thu Jun  5 23:38:49 2003
-@@ -122,6 +122,7 @@
- 	int sd = 0;
- 	unsigned long inaddr;
- 	struct sockaddr_in addr;
-+	int true = 1;
- 
- 	memset(&addr, 0, sizeof(addr));
- 	addr.sin_family = AF_INET;
-@@ -153,6 +154,8 @@
- 	else
- 		addr.sin_addr.s_addr = htonl(INADDR_ANY);
- 
-+	setsockopt (sd, SOL_SOCKET, SO_REUSEADDR, &true, sizeof(true));
-+
- 	if (bind(sd, (struct sockaddr *)&addr, sizeof(addr)))
- 		anubis_error(HARD, _("bind() failed: %s."), strerror(errno));
- 	info(VERBOSE, _("GNU Anubis bound to %s:%u"), inet_ntoa(addr.sin_addr),
-diff -urN anubis-3.6.2/src/tunnel.c anubis-3.6.2-fix/src/tunnel.c
---- anubis-3.6.2/src/tunnel.c	Sun Dec  8 19:04:51 2002
-+++ anubis-3.6.2-fix/src/tunnel.c	Tue Mar 11 11:04:10 2003
-@@ -554,9 +554,11 @@
- 				ptr1 = strstr(boundary_buf, "boundary=");
- 				if (ptr1 == 0) {
- 					plist = plist->next;
--					safe_strcpy(boundary_buf, plist->line);
--					change_to_lower(boundary_buf);
--					ptr1 = strstr(boundary_buf, "boundary=");
-+					if (plist) {
-+						safe_strcpy(boundary_buf, plist->line);
-+						change_to_lower(boundary_buf);
-+						ptr1 = strstr(boundary_buf, "boundary=");
-+					}
- 				}
- 
- 				if (ptr1) {
diff --git a/mail/anubis/files/patch-src_auth.c b/mail/anubis/files/patch-src_auth.c
new file mode 100644
index 000000000000..f4e4209b1c52
--- /dev/null
+++ b/mail/anubis/files/patch-src_auth.c
@@ -0,0 +1,114 @@
+
+$FreeBSD$
+
+--- src/auth.c.orig	Wed Dec  4 22:43:34 2002
++++ src/auth.c	Sun Mar  7 15:10:48 2004
+@@ -42,6 +42,66 @@
+  IDENT protocol support
+ ************************/
+ 
++#define USERNAME_C "USERID :"
++
++/* If the reply matches sscanf expression
++   
++      "%*[^:]: USERID :%*[^:]:%s"
++
++   and the length of "%s" part does not exceed size-1 bytes,
++   copies this part to USERNAME and returns 0. Otherwise,
++   returns 1 */
++
++static int
++ident_extract_username(char *reply, char *username, size_t size)
++{
++	char *p;
++
++	p = strchr (reply, ':');
++	if (!p)
++		return 1;
++	if (p[1] != ' '
++	    || strncmp (p + 2, USERNAME_C, sizeof (USERNAME_C) - 1))
++		return 1;
++	p += 2 + sizeof (USERNAME_C) - 1;
++	p = strchr (p, ':');
++	if (!p)
++		return 1;
++	p++;
++	if (strlen (p) >= size)
++		return 1;
++	strcpy(username, p);
++	return 0;
++}
++
++/* If the reply matches sscanf expression
++
++      "%*[^ ] %*[^ ] %*[^ ] %*[^ ] %*[^ ] %s"
++
++   and the length of "%s" part does not exceed size-1 bytes,
++   copies this part to USERNAME and returns 0. Otherwise,
++   returns 1 */
++
++static int
++crypt_extract_username(char *reply, char *username, size_t size)
++{
++	int i;
++	char *p = reply;
++#define skip_word(c) while (*c && (*c) != ' ') c++
++
++	/* Skip five words */
++	for (i = 0; i < 5; i++) {
++		skip_word(p);
++		if (!*p++)
++			return 1;
++	}
++	
++	if (strlen (p) >= size)
++		return 1;
++	strcpy(username, p);
++	return 0;
++}
++
+ int
+ auth_ident(struct sockaddr_in *addr, char *user, int size)
+ {
+@@ -51,7 +111,8 @@
+ 	int sd = 0;
+ 
+ 	if ((sd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
+-		anubis_error(SOFT, _("IDENT: socket() failed: %s."), strerror(errno));
++		anubis_error(SOFT, _("IDENT: socket() failed: %s."),
++			     strerror(errno));
+ 		return 0;
+ 	}
+ 	memcpy(&ident, addr, sizeof(ident));
+@@ -69,11 +130,7 @@
+ 	info(VERBOSE, _("IDENT: connected to %s:%u"),
+ 	inet_ntoa(ident.sin_addr), ntohs(ident.sin_port));
+ 
+-	#ifdef HAVE_SNPRINTF
+ 	snprintf(buf, LINEBUFFER,
+-	#else
+-	sprintf(buf,
+-	#endif /* HAVE_SNPRINTF */
+ 		"%u , %u"CRLF, ntohs(addr->sin_port), session.tunnel_port);
+ 
+ 	if (send(sd, buf, strlen(buf), 0) == -1) {
+@@ -89,7 +146,8 @@
+ 	close_socket(sd);
+ 	memset(user, 0, size);
+ 
+-	if (sscanf(buf, "%*[^:]: USERID :%*[^:]:%s", user) != 1) {
++	remcrlf (buf);
++	if (ident_extract_username(buf, user, size)) {
+ 		info(VERBOSE, _("IDENT: incorrect data."));
+ 		return 0;
+ 	}
+@@ -105,7 +163,8 @@
+ 		if (rs == -1)
+ 			return 0;
+ 
+-		if (sscanf(buf, "%*[^ ] %*[^ ] %*[^ ] %*[^ ] %*[^ ] %s", user) != 1) {
++		remcrlf (buf);
++		if (crypt_extract_username(buf, user, size)) {
+ 			info(VERBOSE, _("IDENT: incorrect data (DES deciphered)."));
+ 			return 0;
+ 		}
diff --git a/mail/anubis/files/patch-src_errs.c b/mail/anubis/files/patch-src_errs.c
new file mode 100644
index 000000000000..5fc5f5ab0485
--- /dev/null
+++ b/mail/anubis/files/patch-src_errs.c
@@ -0,0 +1,14 @@
+
+$FreeBSD$
+
+--- src/errs.c.orig	Wed Dec  4 22:42:02 2002
++++ src/errs.c	Sun Mar  7 15:10:48 2004
+@@ -51,7 +51,7 @@
+ 			if (options.slogfile)
+ 				filelog(options.slogfile, txt);
+ 			else
+-				syslog(LOG_ERR | LOG_MAIL, txt);
++				syslog(LOG_ERR | LOG_MAIL, "%s", txt);
+ 
+ 			if (options.ulogfile && options.uloglevel >= FAILS)
+ 				filelog(options.ulogfile, txt);
diff --git a/mail/anubis/files/patch-src_log.c b/mail/anubis/files/patch-src_log.c
new file mode 100644
index 000000000000..6ec3bdd268be
--- /dev/null
+++ b/mail/anubis/files/patch-src_log.c
@@ -0,0 +1,14 @@
+
+$FreeBSD$
+
+--- src/log.c.orig	Wed Dec  4 22:42:26 2002
++++ src/log.c	Sun Mar  7 15:10:48 2004
+@@ -70,7 +70,7 @@
+ 		if (options.slogfile)
+ 			filelog(options.slogfile, txt);
+ 		else
+-			syslog(LOG_INFO | LOG_MAIL, txt);
++			syslog(LOG_INFO | LOG_MAIL, "%s", txt);
+ 
+ 		if (options.ulogfile && options.uloglevel >= ALL)
+ 			filelog(options.ulogfile, txt);
diff --git a/mail/anubis/files/patch-src_net.c b/mail/anubis/files/patch-src_net.c
new file mode 100644
index 000000000000..9fbbfea08c9a
--- /dev/null
+++ b/mail/anubis/files/patch-src_net.c
@@ -0,0 +1,22 @@
+
+$FreeBSD$
+
+--- src/net.c.orig	Wed Dec 11 15:37:56 2002
++++ src/net.c	Sun Mar  7 14:55:10 2004
+@@ -122,6 +122,7 @@
+ 	int sd = 0;
+ 	unsigned long inaddr;
+ 	struct sockaddr_in addr;
++	int true = 1;
+ 
+ 	memset(&addr, 0, sizeof(addr));
+ 	addr.sin_family = AF_INET;
+@@ -152,6 +153,8 @@
+ 	}
+ 	else
+ 		addr.sin_addr.s_addr = htonl(INADDR_ANY);
++
++	setsockopt (sd, SOL_SOCKET, SO_REUSEADDR, &true, sizeof(true));
+ 
+ 	if (bind(sd, (struct sockaddr *)&addr, sizeof(addr)))
+ 		anubis_error(HARD, _("bind() failed: %s."), strerror(errno));
diff --git a/mail/anubis/files/patch-src_ssl.c b/mail/anubis/files/patch-src_ssl.c
new file mode 100644
index 000000000000..6e91d35a01ae
--- /dev/null
+++ b/mail/anubis/files/patch-src_ssl.c
@@ -0,0 +1,14 @@
+
+$FreeBSD$
+
+--- src/ssl.c.orig	Wed Dec  4 22:40:45 2002
++++ src/ssl.c	Sun Mar  7 15:10:48 2004
+@@ -64,7 +64,7 @@
+ 	if (options.termlevel != SILENT) {
+ 		#ifdef HAVE_SYSLOG
+ 		if ((topt & T_DAEMON) && !(topt & T_FOREGROUND))
+-			syslog(LOG_ERR | LOG_MAIL, string_error);
++			syslog(LOG_ERR | LOG_MAIL, "%s", string_error);
+ 		else
+ 		#endif /* HAVE_SYSLOG */
+ 			mprintf(">>%s", string_error);
diff --git a/mail/anubis/files/patch-src_tunnel.c b/mail/anubis/files/patch-src_tunnel.c
new file mode 100644
index 000000000000..76b4f17d31f2
--- /dev/null
+++ b/mail/anubis/files/patch-src_tunnel.c
@@ -0,0 +1,20 @@
+
+$FreeBSD$
+
+--- src/tunnel.c.orig	Sun Dec  8 19:04:51 2002
++++ src/tunnel.c	Sun Mar  7 14:55:10 2004
+@@ -554,9 +554,11 @@
+ 				ptr1 = strstr(boundary_buf, "boundary=");
+ 				if (ptr1 == 0) {
+ 					plist = plist->next;
+-					safe_strcpy(boundary_buf, plist->line);
+-					change_to_lower(boundary_buf);
+-					ptr1 = strstr(boundary_buf, "boundary=");
++					if (plist) {
++						safe_strcpy(boundary_buf, plist->line);
++						change_to_lower(boundary_buf);
++						ptr1 = strstr(boundary_buf, "boundary=");
++					}
+ 				}
+ 
+ 				if (ptr1) {