remove package.cfg per new epel-playground policy

Resolves: rhbz#1828689
Resolves: rhbz#1831060

0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch

@@ -0,0 +1,34 @@
+From 8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa Mon Sep 17 00:00:00 2001
+From: Frank Denis <github@pureftpd.org>
+Date: Tue, 18 Feb 2020 18:36:58 +0100
+Subject: [PATCH] diraliases: always set the tail of the list to NULL
+
+Spotted and reported by Antonio Norales from GitHub Security Labs.
+Thanks!
+---
+ src/diraliases.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/diraliases.c b/src/diraliases.c
+index 4002a36..fb70273 100644
+--- a/src/diraliases.c
++++ b/src/diraliases.c
+@@ -93,7 +93,6 @@ int init_aliases(void)
+                 (tail->dir = strdup(dir)) == NULL) {
+                 die_mem();
+             }
+-            tail->next = NULL;
+         } else {
+             DirAlias *curr;
+ 
+@@ -105,6 +104,7 @@ int init_aliases(void)
+             tail->next = curr;
+             tail = curr;
+         }
++        tail->next = NULL;
+     }
+     fclose(fp);
+     aliases_up++;
+-- 
+2.25.4
+

0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch

@@ -0,0 +1,70 @@
+From aea56f4bcb9948d456f3fae4d044fd3fa2e19706 Mon Sep 17 00:00:00 2001
+From: Frank Denis <github@pureftpd.org>
+Date: Mon, 30 Dec 2019 17:40:04 +0100
+Subject: [PATCH] listdir(): reuse a single buffer to store every file name to
+ display
+
+Allocating a new buffer for each entry is useless.
+
+And as these buffers are allocated on the stack, on systems with a
+small stack size, with many entries, the limit can easily be reached,
+causing a stack exhaustion and aborting the user session.
+
+Reported by Antonio Morales from the GitHub Security Lab team, thanks!
+---
+ src/ls.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/src/ls.c b/src/ls.c
+index cf804c7..f8a588f 100644
+--- a/src/ls.c
++++ b/src/ls.c
+@@ -661,6 +661,8 @@ static void listdir(unsigned int depth, int f, void * const tls_fd,
+     char *names;
+     PureFileInfo *s;
+     PureFileInfo *r;
++    char *alloca_subdir;
++    size_t sizeof_subdir;
+     int d;
+ 
+     if (depth >= max_ls_depth || matches >= max_ls_files) {
+@@ -690,14 +692,12 @@ static void listdir(unsigned int depth, int f, void * const tls_fd,
+     }
+     outputfiles(f, tls_fd);
+     r = dir;
++    sizeof_subdir = PATH_MAX + 1U;
++    if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) {
++        goto toomany;
++    }
+     while (opt_R && r != s) {
+         if (r->name_offset != (size_t) -1 && !chdir(FI_NAME(r))) {
+-            char *alloca_subdir;
+-            const size_t sizeof_subdir = PATH_MAX + 1U;
+-
+-            if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) {
+-                goto toomany;
+-            }
+             if (SNCHECK(snprintf(alloca_subdir, sizeof_subdir, "%s/%s",
+                                  name, FI_NAME(r)), sizeof_subdir)) {
+                 goto nolist;
+@@ -706,8 +706,8 @@ static void listdir(unsigned int depth, int f, void * const tls_fd,
+             wrstr(f, tls_fd, alloca_subdir);
+             wrstr(f, tls_fd, ":\r\n\r\n");
+             listdir(depth + 1U, f, tls_fd, alloca_subdir);
++
+             nolist:
+-            ALLOCA_FREE(alloca_subdir);
+             if (matches >= max_ls_files) {
+                 goto toomany;
+             }
+@@ -720,6 +720,7 @@ static void listdir(unsigned int depth, int f, void * const tls_fd,
+         r++;
+     }
+     toomany:
++    ALLOCA_FREE(alloca_subdir);
+     free(names);
+     free(dir);
+     names = NULL;
+-- 
+2.20.1
+

0001-pure_strcmp-len-s2-can-be-len-s1.patch

@@ -0,0 +1,28 @@
+From bf6fcd4935e95128cf22af5924cdc8fe5c0579da Mon Sep 17 00:00:00 2001
+From: Frank Denis <github@pureftpd.org>
+Date: Mon, 24 Feb 2020 15:19:43 +0100
+Subject: [PATCH] pure_strcmp(): len(s2) can be > len(s1)
+
+Reported by Antonio Morales from GitHub Security Labs, thanks!
+---
+ src/utils.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/utils.c b/src/utils.c
+index f41492d..5e88104 100644
+--- a/src/utils.c
++++ b/src/utils.c
+@@ -45,5 +45,9 @@ int pure_memcmp(const void * const b1_, const void * const b2_, size_t len)
+ 
+ int pure_strcmp(const char * const s1, const char * const s2)
+ {
+-    return pure_memcmp(s1, s2, strlen(s1) + 1U);
++    const size_t s1_len = strlen(s1);
++    const size_t s2_len = strlen(s2);
++    const size_t len = (s1_len < s2_len) ? s1_len : s2_len;
++
++    return pure_memcmp(s1, s2, len + 1);
+ }
+-- 
+2.25.4
+

pure-ftpd.spec

@@ -1,6 +1,6 @@
 Name:       pure-ftpd
 Version:    1.0.49
-Release:    2%{?dist}
+Release:    4%{?dist}
 Summary:    Lightweight, fast and secure FTP server
 License:    BSD
 URL:        http://www.pureftpd.org
@@ -16,6 +16,12 @@ Source8:    pure-ftpd-with-tls-init.service
 Source9:    pure-ftpd-with-tls.service
 Patch0:     0001-modify-pam.patch
 Patch1:     0002-fedora-specific-config-file.patch
+# Upstream patch:
+Patch2:     0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch
+# Upstream patch:
+Patch3: 0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch
+# Upstream patch:
+Patch4: 0001-pure_strcmp-len-s2-can-be-len-s1.patch
 
 Provides:   ftpserver
 BuildRequires:  pam-devel, libcap-devel
@@ -227,6 +233,15 @@ fi
 
 
 %changelog
+* Wed May 06 2020 Ondřej Lysoněk <olysonek@redhat.com> - 1.0.49-4
+- Fix CVE-2020-9365 and CVE-2020-9274
+- Resolves: rhbz#1828689
+- Resolves: rhbz#1831060
+
+* Mon Jan 27 2020 Ondřej Lysoněk <olysonek@redhat.com> - 1.0.49-3
+- Fix potential stack exhaustion in function listdir (CVE-2019-20176)
+- Resolves: rhbz#1795153
+
 * Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.49-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild