Menu
▾
▴
[Astlinux-commits] SF.net SVN: astlinux:[7006] branches/1.0/package/vsftpd
|
From: <abe...@us...> - 2015-03-15 14:19:32
|
Revision: 7006
http://sourceforge.net/p/astlinux/code/7006
Author: abelbeck
Date: 2015-03-15 14:19:23 +0000 (Sun, 15 Mar 2015)
Log Message:
-----------
vsftpd, Fixes CVE-2015-1419 - config option deny_file is not handled correctly
Added Paths:
-----------
branches/1.0/package/vsftpd/vsftpd-0002-dont-force-largefile.patch
branches/1.0/package/vsftpd/vsftpd-0003-fix-CVE-2015-1419.patch
Removed Paths:
-------------
branches/1.0/package/vsftpd/vsftpd-2.3.2-dont-force-largefile.patch
Copied: branches/1.0/package/vsftpd/vsftpd-0002-dont-force-largefile.patch (from rev 7005, branches/1.0/package/vsftpd/vsftpd-2.3.2-dont-force-largefile.patch)
===================================================================
--- branches/1.0/package/vsftpd/vsftpd-0002-dont-force-largefile.patch (rev 0)
+++ branches/1.0/package/vsftpd/vsftpd-0002-dont-force-largefile.patch 2015-03-15 14:19:23 UTC (rev 7006)
@@ -0,0 +1,27 @@
+[PATCH] vsftpd: don't enforce largefile support
+
+In Buildroot we enable/disable largefile support globally, and pass the
+correct defines in CFLAGS, so don't enforce it unconditionally.
+
+Signed-off-by: Peter Korsgaard <ja...@su...>
+---
+ sysutil.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+Index: vsftpd-2.3.2/sysutil.c
+===================================================================
+--- vsftpd-2.3.2.orig/sysutil.c
++++ vsftpd-2.3.2/sysutil.c
+@@ -17,12 +17,6 @@
+ #include "tunables.h"
+ #include "sysdeputil.h"
+
+-/* Activate 64-bit file support on Linux/32bit plus others */
+-#define _FILE_OFFSET_BITS 64
+-#define _LARGEFILE_SOURCE 1
+-#define _LARGEFILE64_SOURCE 1
+-#define _LARGE_FILES 1
+-
+ /* For Linux, this adds nothing :-) */
+ #include "port/porting_junk.h"
+
Added: branches/1.0/package/vsftpd/vsftpd-0003-fix-CVE-2015-1419.patch
===================================================================
--- branches/1.0/package/vsftpd/vsftpd-0003-fix-CVE-2015-1419.patch (rev 0)
+++ branches/1.0/package/vsftpd/vsftpd-0003-fix-CVE-2015-1419.patch 2015-03-15 14:19:23 UTC (rev 7006)
@@ -0,0 +1,102 @@
+Fix CVE-2015-1419 - config option deny_file is not handled correctly.
+From SUSE: https://bugzilla.suse.com/show_bug.cgi?id=915522
+
+Signed-off-by: Gustavo Zacarias <gu...@za...>
+
+Index: vsftpd-3.0.2/ls.c
+===================================================================
+--- vsftpd-3.0.2.orig/ls.c
++++ vsftpd-3.0.2/ls.c
+@@ -7,6 +7,7 @@
+ * Would you believe, code to handle directory listing.
+ */
+
++#include <stdlib.h>
+ #include "ls.h"
+ #include "access.h"
+ #include "defs.h"
+@@ -243,11 +244,42 @@ vsf_filename_passes_filter(const struct
+ struct mystr temp_str = INIT_MYSTR;
+ struct mystr brace_list_str = INIT_MYSTR;
+ struct mystr new_filter_str = INIT_MYSTR;
++ struct mystr normalize_filename_str = INIT_MYSTR;
++ const char *normname;
++ const char *path;
+ int ret = 0;
+ char last_token = 0;
+ int must_match_at_current_pos = 1;
++
+ str_copy(&filter_remain_str, p_filter_str);
+- str_copy(&name_remain_str, p_filename_str);
++
++ /* normalize filepath */
++ path = str_strdup(p_filename_str);
++ normname = realpath(path, NULL);
++ if (normname == NULL)
++ goto out;
++ str_alloc_text(&normalize_filename_str, normname);
++
++ if (!str_isempty (&filter_remain_str) && !str_isempty(&normalize_filename_str)) {
++ if (str_get_char_at(p_filter_str, 0) == '/') {
++ if (str_get_char_at(&normalize_filename_str, 0) != '/') {
++ str_getcwd (&name_remain_str);
++
++ if (str_getlen(&name_remain_str) > 1) /* cwd != root dir */
++ str_append_char (&name_remain_str, '/');
++
++ str_append_str (&name_remain_str, &normalize_filename_str);
++ }
++ else
++ str_copy (&name_remain_str, &normalize_filename_str);
++ } else {
++ if (str_get_char_at(p_filter_str, 0) != '{')
++ str_basename (&name_remain_str, &normalize_filename_str);
++ else
++ str_copy (&name_remain_str, &normalize_filename_str);
++ }
++ } else
++ str_copy(&name_remain_str, &normalize_filename_str);
+
+ while (!str_isempty(&filter_remain_str) && *iters < VSFTP_MATCHITERS_MAX)
+ {
+@@ -360,6 +392,9 @@ vsf_filename_passes_filter(const struct
+ ret = 0;
+ }
+ out:
++ free(normname);
++ free(path);
++ str_free(&normalize_filename_str);
+ str_free(&filter_remain_str);
+ str_free(&name_remain_str);
+ str_free(&temp_str);
+Index: vsftpd-3.0.2/str.c
+===================================================================
+--- vsftpd-3.0.2.orig/str.c
++++ vsftpd-3.0.2/str.c
+@@ -711,3 +711,14 @@ str_replace_unprintable(struct mystr* p_
+ }
+ }
+
++void
++str_basename (struct mystr* d_str, const struct mystr* path)
++{
++ static struct mystr tmp;
++
++ str_copy (&tmp, path);
++ str_split_char_reverse(&tmp, d_str, '/');
++
++ if (str_isempty(d_str))
++ str_copy (d_str, path);
++}
+Index: vsftpd-3.0.2/str.h
+===================================================================
+--- vsftpd-3.0.2.orig/str.h
++++ vsftpd-3.0.2/str.h
+@@ -100,6 +100,7 @@ void str_replace_unprintable(struct myst
+ int str_atoi(const struct mystr* p_str);
+ filesize_t str_a_to_filesize_t(const struct mystr* p_str);
+ unsigned int str_octal_to_uint(const struct mystr* p_str);
++void str_basename (struct mystr* d_str, const struct mystr* path);
+
+ /* PURPOSE: Extract a line of text (delimited by \n or EOF) from a string
+ * buffer, starting at character position 'p_pos'. The extracted line will
Deleted: branches/1.0/package/vsftpd/vsftpd-2.3.2-dont-force-largefile.patch
===================================================================
--- branches/1.0/package/vsftpd/vsftpd-2.3.2-dont-force-largefile.patch 2015-03-09 23:29:41 UTC (rev 7005)
+++ branches/1.0/package/vsftpd/vsftpd-2.3.2-dont-force-largefile.patch 2015-03-15 14:19:23 UTC (rev 7006)
@@ -1,27 +0,0 @@
-[PATCH] vsftpd: don't enforce largefile support
-
-In Buildroot we enable/disable largefile support globally, and pass the
-correct defines in CFLAGS, so don't enforce it unconditionally.
-
-Signed-off-by: Peter Korsgaard <ja...@su...>
----
- sysutil.c | 6 ------
- 1 file changed, 6 deletions(-)
-
-Index: vsftpd-2.3.2/sysutil.c
-===================================================================
---- vsftpd-2.3.2.orig/sysutil.c
-+++ vsftpd-2.3.2/sysutil.c
-@@ -17,12 +17,6 @@
- #include "tunables.h"
- #include "sysdeputil.h"
-
--/* Activate 64-bit file support on Linux/32bit plus others */
--#define _FILE_OFFSET_BITS 64
--#define _LARGEFILE_SOURCE 1
--#define _LARGEFILE64_SOURCE 1
--#define _LARGE_FILES 1
--
- /* For Linux, this adds nothing :-) */
- #include "port/porting_junk.h"
-
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
|
