From 7c3226ee276bbdb8bad1dd4b8ba3a8334957c50e Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Fri, 3 Jun 2011 15:22:37 +0200
Subject: [PATCH 1/2] build with RELPRO

---
 sudo.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sudo.spec b/sudo.spec
index 070c5a1..cca9415 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.4p5
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -64,7 +64,7 @@ F_PIE=-fPIE
 F_PIE=-fpie
 %endif
 
-export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie"
+export CFLAGS="$RPM_OPT_FLAGS $F_PIE" LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now"
 
 %configure \
         --prefix=%{_prefix} \
@@ -147,6 +147,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Fri Jun  3 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-4
+- build with RELPRO
+
 * Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.4p5-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
 

From 616f66b6ebb0c243c44231012c63af305a772821 Mon Sep 17 00:00:00 2001
From: Daniel Kopecek <dkopecek@redhat.com>
Date: Thu, 17 May 2012 15:03:57 +0200
Subject: [PATCH 2/2] added patch for CVE-2012-2337

---
 sudo-1.7.4p5-CVE-2012-2337.patch | 27 +++++++++++++++++++++++++++
 sudo.spec                        |  8 +++++++-
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 sudo-1.7.4p5-CVE-2012-2337.patch

diff --git a/sudo-1.7.4p5-CVE-2012-2337.patch b/sudo-1.7.4p5-CVE-2012-2337.patch
new file mode 100644
index 0000000..cc0c7e1
--- /dev/null
+++ b/sudo-1.7.4p5-CVE-2012-2337.patch
@@ -0,0 +1,27 @@
+diff -up sudo-1.7.4p5/match.c.CVE-2012-2337 sudo-1.7.4p5/match.c
+--- sudo-1.7.4p5/match.c.CVE-2012-2337	2012-05-17 14:48:49.570465186 +0200
++++ sudo-1.7.4p5/match.c	2012-05-17 14:53:12.812736038 +0200
+@@ -646,6 +646,7 @@ addr_matches_if(n)
+ 		}
+ 		if (j == sizeof(addr.ip6.s6_addr))
+ 		    return(TRUE);
++		break;
+ #endif
+ 	}
+     }
+@@ -711,6 +712,7 @@ addr_matches_if_netmask(n, m)
+ 	    case AF_INET:
+ 		if ((ifp->addr.ip4.s_addr & mask.ip4.s_addr) == addr.ip4.s_addr)
+ 		    return(TRUE);
++		break;
+ #ifdef HAVE_IN6_ADDR
+ 	    case AF_INET6:
+ 		for (j = 0; j < sizeof(addr.ip6.s6_addr); j++) {
+@@ -719,6 +721,7 @@ addr_matches_if_netmask(n, m)
+ 		}
+ 		if (j == sizeof(addr.ip6.s6_addr))
+ 		    return(TRUE);
++		break;
+ #endif /* HAVE_IN6_ADDR */
+ 	}
+     }
diff --git a/sudo.spec b/sudo.spec
index cca9415..6a5f0fc 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.7.4p5
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: ISC
 Group: Applications/System
 URL: http://www.courtesan.com/sudo/
@@ -31,6 +31,8 @@ Patch3: sudo-1.7.4p3-m4path.patch
 Patch4: sudo-1.7.4p4-getgrouplist-fixed.patch
 # reset HOME when using the `-i' option (#635250)
 Patch5: sudo-1.7.4p4-sudoi.patch
+# CVE-2012-2337
+Patch6: sudo-1.7.4p5-CVE-2012-2337.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -51,6 +53,7 @@ on many different machines.
 %patch3 -p1 -b .m4path
 %patch4 -p1 -b .getgrouplist-fixed
 %patch5 -p0 -b .sudoi
+%patch6 -p1 -b .CVE-2012-2337
 
 %build
 # handle newer autoconf
@@ -147,6 +150,9 @@ rm -rf $RPM_BUILD_ROOT
 /bin/chmod 0440 /etc/sudoers || :
 
 %changelog
+* Thu May 17 2012 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-5
+- added patch for CVE-2012-2337
+
 * Fri Jun  3 2011 Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-4
 - build with RELPRO