propolice/ssp caught minicom going out of bounds using memcpy() in the winschar2() function, so we add some basic sanity checking to the function.

8 files changed, 83 insertions, 13 deletions

diff --git a/net-dialup/minicom/ChangeLog b/net-dialup/minicom/ChangeLog
index 3dffd99af39a..6a1af58e21be 100644
--- a/net-dialup/minicom/ChangeLog
+++ b/net-dialup/minicom/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for net-dialup/minicom
-# Copyright 2002-2003 Gentoo Technologies, Inc.; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-dialup/minicom/ChangeLog,v 1.17 2004/03/19 09:07:23 aliz Exp $
+# Copyright 2002-2004 Gentoo Technologies, Inc.; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/net-dialup/minicom/ChangeLog,v 1.18 2004/03/24 05:59:37 solar Exp $
+
+*minicom-2.1-r1 (24 Mar 2004)
+
+  24 Mar 2004; <solar@gentoo.org> minicom-1.83.1-r1.ebuild,
+  minicom-2.00.0.ebuild, minicom-2.1-r1.ebuild, minicom-2.1.ebuild,
+  files/minicom-2.1-memcpy-bounds.diff:
+  propolice/ssp caught minicom going out of bounds using memcpy() in the
+  winschar2() function, so we add some basic sanity checking to the function.
 
   18 Dec 2003; Jason Wever <weeve@gentoo.org> minicom-2.00.0.ebuild:
   Marked stable on sparc.
diff --git a/net-dialup/minicom/Manifest b/net-dialup/minicom/Manifest
index d8df39585dde..0e4ee7a2ea55 100644
--- a/net-dialup/minicom/Manifest
+++ b/net-dialup/minicom/Manifest
@@ -1,9 +1,12 @@
-MD5 1fd45175212cb2af5d8b60fd9471aef1 minicom-2.1.ebuild 1063
-MD5 b51614c347a530931e01538fa3c91663 minicom-2.00.0.ebuild 1042
-MD5 022a0128aa63bf4c0d5082e17f39dd19 minicom-1.83.1-r1.ebuild 1732
 MD5 71a2a4e69c30af4f52e9fce3e2e8f44c ChangeLog 2106
+MD5 022a0128aa63bf4c0d5082e17f39dd19 minicom-1.83.1-r1.ebuild 1732
+MD5 b51614c347a530931e01538fa3c91663 minicom-2.00.0.ebuild 1042
+MD5 1fd45175212cb2af5d8b60fd9471aef1 minicom-2.1.ebuild 1063
 MD5 ec2f84816306825d125d0c01bd86758d metadata.xml 163
-MD5 6362e781f7e7a1300d8a3c7b602ddd6f files/minirc.dfl 66
-MD5 67f667abec40aca4b4418ae3937105ff files/digest-minicom-2.1 63
+MD5 23629e6485a14ab52f6ae18b60c7edc4 minicom-2.1-r1.ebuild 1245
 MD5 fc4dc154118b88e1aab6aab216bb70aa files/digest-minicom-1.83.1-r1 70
 MD5 bbd752eddf4c3da2156d40ae2713b371 files/digest-minicom-2.00.0 70
+MD5 6362e781f7e7a1300d8a3c7b602ddd6f files/minirc.dfl 66
+MD5 67f667abec40aca4b4418ae3937105ff files/digest-minicom-2.1 63
+MD5 a31777cb2fefdf6dde761b58a8076333 files/minicom-2.1-memcpy-bounds.diff 487
+MD5 67f667abec40aca4b4418ae3937105ff files/digest-minicom-2.1-r1 63
diff --git a/net-dialup/minicom/files/digest-minicom-2.1-r1 b/net-dialup/minicom/files/digest-minicom-2.1-r1
new file mode 100644
index 000000000000..5e8d7ce8b8f5
--- /dev/null
+++ b/net-dialup/minicom/files/digest-minicom-2.1-r1
@@ -0,0 +1 @@
+MD5 1c8f3b247c38fb16c3c2170df9fc102a minicom-2.1.tar.gz 607939
diff --git a/net-dialup/minicom/files/minicom-2.1-memcpy-bounds.diff b/net-dialup/minicom/files/minicom-2.1-memcpy-bounds.diff
new file mode 100644
index 000000000000..64e64400202c
--- /dev/null
+++ b/net-dialup/minicom/files/minicom-2.1-memcpy-bounds.diff
@@ -0,0 +1,14 @@
+--- src/window.c.orig	2004-02-26 23:47:07.000000000 -0500
++++ src/window.c	2004-02-26 23:46:24.000000000 -0500
+@@ -1583,7 +1583,11 @@ int move;
+   x = w->x1 + w->curx;
+   oldx = w->curx;
+   len = w->xs - w->curx;
++#ifdef NO_BOUNDS_CHECKING
+   memcpy(buf, gmap + COLS * y + x, sizeof(ELM) * len);
++#else
++  memcpy(buf, gmap + COLS * y + x, ((sizeof(ELM) * len) < sizeof(buf)) ? (sizeof(ELM) * len) : sizeof(buf) );
++#endif
+ 
+   /* Now, put the new character on screen. */
+   wputc(w, c);
diff --git a/net-dialup/minicom/minicom-1.83.1-r1.ebuild b/net-dialup/minicom/minicom-1.83.1-r1.ebuild
index e5bb7b361d80..310bc1bc39fa 100644
--- a/net-dialup/minicom/minicom-1.83.1-r1.ebuild
+++ b/net-dialup/minicom/minicom-1.83.1-r1.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2003 Gentoo Technologies, Inc.
+# Copyright 1999-2004 Gentoo Technologies, Inc.
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-dialup/minicom/minicom-1.83.1-r1.ebuild,v 1.12 2003/09/07 00:09:22 msterret Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-dialup/minicom/minicom-1.83.1-r1.ebuild,v 1.13 2004/03/24 05:59:37 solar Exp $
 
 S=${WORKDIR}/${P}
 DESCRIPTION="Serial Communication Program"
diff --git a/net-dialup/minicom/minicom-2.00.0.ebuild b/net-dialup/minicom/minicom-2.00.0.ebuild
index 2e73f88f4bd5..96dd742a18f0 100644
--- a/net-dialup/minicom/minicom-2.00.0.ebuild
+++ b/net-dialup/minicom/minicom-2.00.0.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2003 Gentoo Technologies, Inc.
+# Copyright 1999-2004 Gentoo Technologies, Inc.
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-dialup/minicom/minicom-2.00.0.ebuild,v 1.13 2003/12/18 17:12:46 weeve Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-dialup/minicom/minicom-2.00.0.ebuild,v 1.14 2004/03/24 05:59:37 solar Exp $
 
 DESCRIPTION="Serial Communication Program"
 SRC_URI="http://www.netsonic.fi/~walker/${P}.src.tar.gz"
diff --git a/net-dialup/minicom/minicom-2.1-r1.ebuild b/net-dialup/minicom/minicom-2.1-r1.ebuild
new file mode 100644
index 000000000000..574c5bc33ede
--- /dev/null
+++ b/net-dialup/minicom/minicom-2.1-r1.ebuild
@@ -0,0 +1,44 @@
+# Copyright 1999-2004 Gentoo Technologies, Inc.
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-dialup/minicom/minicom-2.1-r1.ebuild,v 1.1 2004/03/24 05:59:37 solar Exp $
+
+DESCRIPTION="Serial Communication Program"
+SRC_URI="http://alioth.debian.org/download.php/123/${P}.tar.gz"
+HOMEPAGE="http://alioth.debian.org/projects/minicom"
+
+SLOT="0"
+LICENSE="GPL-2"
+KEYWORDS="~x86 ~ppc ~alpha ~hppa ~sparc ~mips ~amd64"
+
+DEPEND=">=sys-libs/ncurses-5.2-r3"
+
+src_unpack() {
+	unpack ${A}
+	cd ${S}
+	# solar@gentoo.org (Mar 24 2004)
+	# propolice/ssp caught minicom going out of bounds here.
+	epatch ${FILESDIR}/${PN}-2.1-memcpy-bounds.diff
+}
+
+src_compile() {
+	econf --sysconfdir=/etc/${PN} || die "econf failed"
+	emake || die "emake failed"
+}
+
+src_install() {
+	einstall || die "einstall failed"
+	dodoc doc/minicom.FAQ
+	insinto /etc/minicom
+	doins ${FILESDIR}/minirc.dfl
+
+	dodoc AUTHORS COPYING ChangeLog INSTALL NEWS README
+}
+
+pkg_postinst() {
+	einfo "Minicom relies on the net-misc/lrzsz package to transfer"
+	einfo "files using the XMODEM, YMODEM and ZMODEM protocols."
+	echo
+	einfo "If you need the capability of using the above protocols,"
+	einfo "make sure to install net-misc/lrzsz."
+	echo
+}
diff --git a/net-dialup/minicom/minicom-2.1.ebuild b/net-dialup/minicom/minicom-2.1.ebuild
index 6709baa7e374..ea38036d3dca 100644
--- a/net-dialup/minicom/minicom-2.1.ebuild
+++ b/net-dialup/minicom/minicom-2.1.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2003 Gentoo Technologies, Inc.
+# Copyright 1999-2004 Gentoo Technologies, Inc.
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-dialup/minicom/minicom-2.1.ebuild,v 1.5 2004/02/23 15:54:36 brad_mssw Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-dialup/minicom/minicom-2.1.ebuild,v 1.6 2004/03/24 05:59:37 solar Exp $
 
 DESCRIPTION="Serial Communication Program"
 SRC_URI="http://alioth.debian.org/download.php/123/${P}.tar.gz"