Revbump to fix security bug #325557, patch from ubuntu.

(Portage version: 2.2_rc67/cvs/Linux x86_64)

3 files changed, 132 insertions, 4 deletions

diff --git a/app-arch/fastjar/ChangeLog b/app-arch/fastjar/ChangeLog
index a714c01e61a7..9fdbb7cdecb5 100644
--- a/app-arch/fastjar/ChangeLog
+++ b/app-arch/fastjar/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for app-arch/fastjar
 # Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-arch/fastjar/ChangeLog,v 1.17 2010/05/26 18:45:01 pacho Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-arch/fastjar/ChangeLog,v 1.18 2010/06/30 21:48:11 caster Exp $
+
+*fastjar-0.98-r1 (30 Jun 2010)
+
+  30 Jun 2010; Vlastimil Babka <caster@gentoo.org>
+  +files/0.98-traversal.patch, -fastjar-0.95.ebuild,
+  +fastjar-0.98-r1.ebuild:
+  Revbump to fix security bug #325557, patch from ubuntu.
 
   26 May 2010; Pacho Ramos <pacho@gentoo.org> fastjar-0.98.ebuild:
   stable amd64, bug 316289
diff --git a/app-arch/fastjar/fastjar-0.95.ebuild b/app-arch/fastjar/fastjar-0.98-r1.ebuild
index b41c41e0477c..3f08094e19aa 100644
--- a/app-arch/fastjar/fastjar-0.95.ebuild
+++ b/app-arch/fastjar/fastjar-0.98-r1.ebuild
@@ -1,6 +1,10 @@
-# Copyright 1999-2008 Gentoo Foundation
+# Copyright 1999-2010 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-arch/fastjar/fastjar-0.95.ebuild,v 1.7 2008/03/31 22:02:38 maekke Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-arch/fastjar/fastjar-0.98-r1.ebuild,v 1.1 2010/06/30 21:48:11 caster Exp $
+
+EAPI=2
+
+inherit eutils
 
 DESCRIPTION="A jar program written in C"
 HOMEPAGE="https://savannah.nongnu.org/projects/fastjar"
@@ -8,7 +12,7 @@ SRC_URI="http://download.savannah.nongnu.org/releases/${PN}/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="amd64 ppc ppc64 x86"
+KEYWORDS="~amd64 ~ppc ~ppc64 ~x86"
 
 IUSE=""
 
@@ -16,6 +20,11 @@ IUSE=""
 RDEPEND="!<=dev-java/kaffe-1.1.7-r5"
 DEPEND=""
 
+src_prepare() {
+	# bug #325557
+	epatch "${FILESDIR}/0.98-traversal.patch"
+}
+
 src_install() {
 	emake DESTDIR="${D}" install || die "make install failed"
 	dodoc AUTHORS ChangeLog NEWS README TODO || die
diff --git a/app-arch/fastjar/files/0.98-traversal.patch b/app-arch/fastjar/files/0.98-traversal.patch
new file mode 100644
index 000000000000..511f4c6cd838
--- /dev/null
+++ b/app-arch/fastjar/files/0.98-traversal.patch
@@ -0,0 +1,112 @@
+--- fastjar-0.98.orig/jartool.c
++++ fastjar-0.98/jartool.c
+@@ -790,6 +790,7 @@
+ 		   progname, jarfile);
+ 	  return 1;
+ 	}
++      ze->filename[len] = '\0';
+       len = UNPACK_UB4(header, CEN_EFLEN);
+       len += UNPACK_UB4(header, CEN_COMLEN);
+       if (lseek (fd, len, SEEK_CUR) == -1)
+@@ -1257,7 +1258,7 @@
+       exit_on_error("write");
+ 
+   /* write the file name to the zip file */
+-  if (1 == write(jfd, fname, file_name_length))
++  if (-1 == write(jfd, fname, file_name_length))
+     exit_on_error("write");
+ 
+   if(verbose){
+@@ -1730,7 +1731,17 @@
+       struct stat sbuf;
+       int depth = 0;
+ 
+-      tmp_buff = malloc(sizeof(char) * strlen((const char *)filename));
++      if(*filename == '/'){
++	fprintf(stderr, "Absolute path names are not allowed.\n");
++	exit(EXIT_FAILURE);
++      }
++
++      tmp_buff = malloc(strlen((const char *)filename));
++
++      if(tmp_buff == NULL) {
++	fprintf(stderr, "Out of memory.\n");
++	exit(EXIT_FAILURE);
++      }
+ 
+       for(;;){
+         const ub1 *idx = (const unsigned char *)strchr((const char *)start, '/');
+@@ -1738,25 +1749,28 @@
+         if(idx == NULL)
+           break;
+         else if(idx == start){
++	  tmp_buff[idx - filename] = '/';
+           start++;
+           continue;
+         }
+-        start = idx + 1;
+ 
+-        strncpy(tmp_buff, (const char *)filename, (idx - filename));
+-        tmp_buff[(idx - filename)] = '\0';
++	memcpy(tmp_buff + (start - filename), (const char *)start, (idx - start));
++	tmp_buff[idx - filename] = '\0';
+ 
+ #ifdef DEBUG    
+         printf("checking the existance of %s\n", tmp_buff);
+ #endif
+-	if(strcmp(tmp_buff, "..") == 0){
++	if(idx - start == 2 && memcmp(start, "..", 2) == 0){
+ 	  --depth;
+ 	  if (depth < 0){
+ 	    fprintf(stderr, "Traversal to parent directories during unpacking!\n");
+ 	    exit(EXIT_FAILURE);
+ 	  }
+-	} else if (strcmp(tmp_buff, ".") != 0)
++	} else if (idx - start != 1 || *start != '.')
+ 	  ++depth;
++
++        start = idx + 1;
++
+         if(stat(tmp_buff, &sbuf) < 0){
+           if(errno != ENOENT)
+             exit_on_error("stat");
+@@ -1765,6 +1779,7 @@
+ #ifdef DEBUG    
+           printf("Directory exists\n");
+ #endif
++	  tmp_buff[idx - filename] = '/';
+           continue;
+         }else {
+           fprintf(stderr, "Hmmm.. %s exists but isn't a directory!\n",
+@@ -1781,10 +1796,11 @@
+         if(verbose && handle)
+           printf("%10s: %s/\n", "created", tmp_buff);
+ 
++	tmp_buff[idx - filename] = '/';
+       }
+ 
+       /* only a directory */
+-      if(strlen((const char *)start) == 0)
++      if(*start == '\0')
+         dir = TRUE;
+ 
+ #ifdef DEBUG    
+@@ -1792,7 +1808,7 @@
+ #endif
+ 
+       /* If the entry was just a directory, don't write to file, etc */
+-      if(strlen((const char *)start) == 0)
++      if(*start == '\0')
+         f_fd = -1;
+ 
+       free(tmp_buff);
+@@ -1876,7 +1892,8 @@
+       exit(EXIT_FAILURE);
+     }
+ 
+-    close(f_fd);
++    if (f_fd != -1)
++      close(f_fd);
+ 
+     if(verbose && dir == FALSE && handle)
+       printf("%10s: %s\n",