diff options
| author |   Andreas K. Hüttel <dilfridge@gentoo.org> | 2019-03-13 13:02:46 +0100 |
|---|---|---|
| committer | Andreas K. Hüttel <dilfridge@gentoo.org> | 2019-03-13 13:02:46 +0100 |
| commit | 648bdf9134d87d5d6ca086b742964b77c3da87d8 (patch) | |
| tree | 60d739deb8b3a39b33c8dec52d37f6e8e2b67f33 | |
| parent | app-arch/sharutils: Add glibc-2.28 build fix (diff) | |
| download | gentoo-648bdf91.tar.gz gentoo-648bdf91.tar.bz2 gentoo-648bdf91.zip | |
app-arch/sharutils: Add patch for CVE-2018-1000097
Bug: https://bugs.gentoo.org/652686
Package-Manager: Portage-2.3.62, Repoman-2.3.12
Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
| -rw-r--r-- | app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch | 16 | ||||
| -rw-r--r-- | app-arch/sharutils/sharutils-4.15.2-r1.ebuild (renamed from app-arch/sharutils/sharutils-4.15.2.ebuild) | 1 |
2 files changed, 17 insertions, 0 deletions
diff --git a/app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch b/app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch new file mode 100644 index 000000000000..f61662040b6a --- /dev/null +++ b/app-arch/sharutils/files/sharutils-4.15.2-CVE-2018-1000097.patch @@ -0,0 +1,16 @@ +From: Petr Pisar +Subject: Fix CVE-2018-1000097, heap buffer overflow in unshar +Bug-Debian: https://bugs.debian.org/893525 +X-Debian-version: 1:4.15.2-3 + +--- a/src/unshar.c ++++ b/src/unshar.c +@@ -240,7 +240,7 @@ + off_t position = ftello (file); + + /* Read next line, fail if no more and no previous process. */ +- if (!fgets (rw_buffer, BUFSIZ, file)) ++ if (!fgets (rw_buffer, rw_base_size, file)) + { + if (!start) + error (0, 0, _("Found no shell commands in %s"), name); diff --git a/app-arch/sharutils/sharutils-4.15.2.ebuild b/app-arch/sharutils/sharutils-4.15.2-r1.ebuild index ab637e3cd242..2a7873196c5b 100644 --- a/app-arch/sharutils/sharutils-4.15.2.ebuild +++ b/app-arch/sharutils/sharutils-4.15.2-r1.ebuild @@ -25,6 +25,7 @@ src_prepare() { default epatch "${FILESDIR}/sharutils-4.15.2-glibc228.patch" + epatch "${FILESDIR}/sharutils-4.15.2-CVE-2018-1000097.patch" # Upstream is aware but thinks this isn't a bug/problem in sharutils itself # See http://lists.gnu.org/archive/html/bug-gnu-utils/2013-10/msg00011.html |