aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages/patches
diff options
context:
space:
mode:
authorEfraim Flashner <efraim@flashner.co.il>2016-05-30 07:13:47 +0300
committerEfraim Flashner <efraim@flashner.co.il>2016-05-30 07:44:29 +0300
commit6447e19108c69277ff2ead3fb084b04cd516e76a (patch)
treeef961f68636b327021c6fbed034f29c0613b106b /gnu/packages/patches
parentccda7c8317fcbcdf929d6f8a183d4dbd2f5c1391 (diff)
downloadguix-6447e19108c69277ff2ead3fb084b04cd516e76a.tar
guix-6447e19108c69277ff2ead3fb084b04cd516e76a.tar.gz
gnu: a2ps: Fix CVE-2001-1593, CVE-2014-0466.
* gnu/packages/pretty-print.scm (a2ps)[source]: Add patches. * gnu/packages/patches/a2ps-CVE-2001-1593.patch, gnu/packages/patches/a2ps-CVE-2014-0466.patch: New variables. * gnu/local.mk (dist_patch_DATA): Add them.
Diffstat (limited to 'gnu/packages/patches')
-rw-r--r--gnu/packages/patches/a2ps-CVE-2001-1593.patch69
-rw-r--r--gnu/packages/patches/a2ps-CVE-2014-0466.patch30
2 files changed, 99 insertions, 0 deletions
diff --git a/gnu/packages/patches/a2ps-CVE-2001-1593.patch b/gnu/packages/patches/a2ps-CVE-2001-1593.patch
new file mode 100644
index 0000000000..17b7e7d932
--- /dev/null
+++ b/gnu/packages/patches/a2ps-CVE-2001-1593.patch
@@ -0,0 +1,69 @@
+Index: b/lib/routines.c
+===================================================================
+--- a/lib/routines.c
++++ b/lib/routines.c
+@@ -242,3 +242,50 @@
+ /* Don't complain if you can't unlink. Who cares of a tmp file? */
+ unlink (filename);
+ }
++
++/*
++ * Securely generate a temp file, and make sure it gets
++ * deleted upon exit.
++ */
++static char ** tempfiles;
++static unsigned ntempfiles;
++
++static void
++cleanup_tempfiles()
++{
++ while (ntempfiles--)
++ unlink(tempfiles[ntempfiles]);
++}
++
++char *
++safe_tempnam(const char *pfx)
++{
++ char *dirname, *filename;
++ int fd;
++
++ if (!(dirname = getenv("TMPDIR")))
++ dirname = "/tmp";
++
++ tempfiles = (char **) realloc(tempfiles,
++ (ntempfiles+1) * sizeof(char *));
++ if (tempfiles == NULL)
++ return NULL;
++
++ filename = malloc(strlen(dirname) + strlen(pfx) + sizeof("/XXXXXX"));
++ if (!filename)
++ return NULL;
++
++ sprintf(filename, "%s/%sXXXXXX", dirname, pfx);
++
++ if ((fd = mkstemp(filename)) < 0) {
++ free(filename);
++ return NULL;
++ }
++ close(fd);
++
++ if (ntempfiles == 0)
++ atexit(cleanup_tempfiles);
++ tempfiles[ntempfiles++] = filename;
++
++ return filename;
++}
+Index: b/lib/routines.h
+===================================================================
+--- a/lib/routines.h
++++ b/lib/routines.h
+@@ -255,7 +255,8 @@
+ /* If _STR_ is not defined, give it a tempname in _TMPDIR_ */
+ #define tempname_ensure(Str) \
+ do { \
+- (Str) = (Str) ? (Str) : tempnam (NULL, "a2_"); \
++ (Str) = (Str) ? (Str) : safe_tempnam("a2_"); \
+ } while (0)
++char * safe_tempnam(const char *);
+
+ #endif
diff --git a/gnu/packages/patches/a2ps-CVE-2014-0466.patch b/gnu/packages/patches/a2ps-CVE-2014-0466.patch
new file mode 100644
index 0000000000..85199e35b0
--- /dev/null
+++ b/gnu/packages/patches/a2ps-CVE-2014-0466.patch
@@ -0,0 +1,30 @@
+Description: CVE-2014-0466: fixps does not invoke gs with -dSAFER
+ A malicious PostScript file could delete files with the privileges of
+ the invoking user.
+Origin: vendor
+Bug-Debian: http://bugs.debian.org/742902
+Author: Salvatore Bonaccorso <carnil@debian.org>
+Last-Update: 2014-03-28
+
+--- a/contrib/fixps.in
++++ b/contrib/fixps.in
+@@ -389,7 +389,7 @@
+ eval "$command" ;;
+ gs)
+ $verbose "$program: making a full rewrite of the file ($gs)." >&2
+- $gs -q -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;;
++ $gs -q -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;;
+ esac
+ )
+ fi
+--- a/contrib/fixps.m4
++++ b/contrib/fixps.m4
+@@ -307,7 +307,7 @@
+ eval "$command" ;;
+ gs)
+ $verbose "$program: making a full rewrite of the file ($gs)." >&2
+- $gs -q -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;;
++ $gs -q -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;;
+ esac
+ )
+ fi