Add fix for CVE-2007-3999 #214208 by Robert Buchholz.

Package-Manager: portage-2.2_pre5

4 files changed, 92 insertions, 4 deletions

diff --git a/net-libs/libtirpc/ChangeLog b/net-libs/libtirpc/ChangeLog
index 045566eb748a..57e4bf7cd188 100644
--- a/net-libs/libtirpc/ChangeLog
+++ b/net-libs/libtirpc/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for net-libs/libtirpc
-# Copyright 1999-2007 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-libs/libtirpc/ChangeLog,v 1.1 2007/12/29 08:58:18 vapier Exp $
+# Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/net-libs/libtirpc/ChangeLog,v 1.2 2008/05/11 14:31:07 vapier Exp $
+
+*libtirpc-0.1.7-r1 (11 May 2008)
+
+  11 May 2008; Mike Frysinger <vapier@gentoo.org>
+  +files/libtirpc-0.1.7-CVE-2007-3999.patch, +libtirpc-0.1.7-r1.ebuild:
+  Add fix for CVE-2007-3999 #214208 by Robert Buchholz.
 
 *libtirpc-0.1.7 (29 Dec 2007)
 
diff --git a/net-libs/libtirpc/Manifest b/net-libs/libtirpc/Manifest
index 965ec9c8a1e7..26a8e083e0a9 100644
--- a/net-libs/libtirpc/Manifest
+++ b/net-libs/libtirpc/Manifest
@@ -1,4 +1,15 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
+AUX libtirpc-0.1.7-CVE-2007-3999.patch 1301 RMD160 0942eba90a1c9b91b15bbb1568d93363b6fb02e3 SHA1 71a9e274f86c2496afd1726bff58bf4709852409 SHA256 431deb3168ddd550dc4fb1bd328bdb3778c6897f948b50ec93e4d036d1a42d11
 DIST libtirpc-0.1.7.tar.bz2 450332 RMD160 0d8fa7c7af4423e79a9b6bc3a464e24aac54860f SHA1 2072b24ea544885ba0d19766b158f1f0068b720b SHA256 c66778f179fd5883d2cf8172c6aa730edacb2c1e4fc30ed4db165aed82d4c984
-EBUILD libtirpc-0.1.7.ebuild 838 RMD160 730026793f1e15a8a3d8fb7415c708bb1d28b725 SHA1 7ce0c303c5e0715320ffa4642e272345be1d56b5 SHA256 23c4e4298ba4bb9ebc7d8667b64afecb34e060600e05da73c929e9c01139f86e
-MISC ChangeLog 354 RMD160 525fe1fc29ab51aa0ac102f189375bbb93d7aead SHA1 4db16822e43c5a297661556f162a000fc9fe4555 SHA256 25f6e47f968dc7991cf76aa7e5bcfade1714474a0e19188b9580dd8efe425933
+EBUILD libtirpc-0.1.7-r1.ebuild 896 RMD160 2b42c298e920b196f65f0b91d3904d347991ceaf SHA1 70edf60e9b5f433d36d7f7ed6bf4e88f459287ad SHA256 68b23442ff8cd7fa64113a75261755bc8cebb2c2457ca40d8d852160b1db539b
+MISC ChangeLog 567 RMD160 25d15533bbedef7c6ace96ddee818763a3883513 SHA1 b913e69a1dd689b9d8dc9624b568d3fb858fe461 SHA256 e570449d4f7b23d5396d981b4447992c3c958581e6f2e8475147f9639454d169
 MISC metadata.xml 159 RMD160 8e0977b9abd90afe9e1d5c1326823a5726f6e2a4 SHA1 33f35324ce730e28838be228d9ee4e4dd1bab1e5 SHA256 562c59615c028ffa088de789b3a792fd4cbbbfe71628ddd6a55d3b176becbc6b
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.7 (GNU/Linux)
+
+iD8DBQFIJwMwj9hvisErhMIRAs3cAKDen63MTcZyKJwHy2+M7ixpGmr99gCgsfqP
+28kFOoHHKIhWaeP5NnlgYjs=
+=1h+n
+-----END PGP SIGNATURE-----
diff --git a/net-libs/libtirpc/files/libtirpc-0.1.7-CVE-2007-3999.patch b/net-libs/libtirpc/files/libtirpc-0.1.7-CVE-2007-3999.patch
new file mode 100644
index 000000000000..b9a7aa4f21f1
--- /dev/null
+++ b/net-libs/libtirpc/files/libtirpc-0.1.7-CVE-2007-3999.patch
@@ -0,0 +1,35 @@
+commit 3cf1a3ce1a409e647f9b8ca4497c26e6d066f293
+Author: Steve Dickson <steved@redhat.com>
+Date:   Thu Jan 24 15:01:22 2008 -0500
+
+    Protect from buffer overflow in the GSS code.
+    
+    Signed-off-by: Steve Dickson <steved@redhat.com>
+
+diff -up libtirpc-0.1.7/src/svc_auth_gss.c.orig libtirpc-0.1.7/src/svc_auth_gss.c
+--- libtirpc-0.1.7/src/svc_auth_gss.c.orig	2008-01-24 14:41:21.000000000 -0500
++++ libtirpc-0.1.7/src/svc_auth_gss.c	2008-01-24 14:59:31.000000000 -0500
+@@ -294,6 +294,15 @@ svcauth_gss_validate(struct svc_rpc_gss_
+ 	memset(rpchdr, 0, sizeof(rpchdr));
+ 
+ 	/* XXX - Reconstruct RPC header for signing (from xdr_callmsg). */
++	oa = &msg->rm_call.cb_cred;
++	if (oa->oa_length > MAX_AUTH_BYTES)
++		return (FALSE);
++	
++	/* 8 XDR units from the IXDR macro calls. */
++	if (sizeof(rpchdr) < (8 * BYTES_PER_XDR_UNIT +
++			RNDUP(oa->oa_length)))
++		return (FALSE);
++
+ 	buf = (int32_t *)rpchdr;
+ 	IXDR_PUT_LONG(buf, msg->rm_xid);
+ 	IXDR_PUT_ENUM(buf, msg->rm_direction);
+@@ -301,7 +310,6 @@ svcauth_gss_validate(struct svc_rpc_gss_
+ 	IXDR_PUT_LONG(buf, msg->rm_call.cb_prog);
+ 	IXDR_PUT_LONG(buf, msg->rm_call.cb_vers);
+ 	IXDR_PUT_LONG(buf, msg->rm_call.cb_proc);
+-	oa = &msg->rm_call.cb_cred;
+ 	IXDR_PUT_ENUM(buf, oa->oa_flavor);
+ 	IXDR_PUT_LONG(buf, oa->oa_length);
+ 	if (oa->oa_length) {
diff --git a/net-libs/libtirpc/libtirpc-0.1.7-r1.ebuild b/net-libs/libtirpc/libtirpc-0.1.7-r1.ebuild
new file mode 100644
index 000000000000..58680cc91fdc
--- /dev/null
+++ b/net-libs/libtirpc/libtirpc-0.1.7-r1.ebuild
@@ -0,0 +1,36 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-libs/libtirpc/libtirpc-0.1.7-r1.ebuild,v 1.1 2008/05/11 14:31:07 vapier Exp $
+
+DESCRIPTION="Transport Independent RPC library (SunRPC replacement)"
+HOMEPAGE="http://libtirpc.sourceforge.net/"
+SRC_URI="http://nfsv4.bullopensource.org/tarballs/tirpc/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+DEPEND=""
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+	epatch "${FILESDIR}"/${P}-CVE-2007-3999.patch #214208
+	sed -i \
+		-e 's:/etc/netconfig:$(DESTDIR)/etc/netconfig:' \
+		Makefile.in
+	emake -s distclean || die
+}
+
+src_compile() {
+	# gss stuff needs updating to latest API
+	econf --disable-gss || die
+	emake || die
+}
+
+src_install() {
+	dodir /etc
+	emake install DESTDIR="${D}" || die
+	dodoc AUTHORS ChangeLog NEWS README THANKS TODO
+}