From 85e6db019abc18febce7b3725416553bcc130185 Mon Sep 17 00:00:00 2001 From: Jesse Keating Date: Wed, 17 Feb 2010 03:28:27 +0000 Subject: [PATCH 1/3] Initialize branch F-13 for xar --- branch | 1 + 1 file changed, 1 insertion(+) create mode 100644 branch diff --git a/branch b/branch new file mode 100644 index 0000000..baa94ef --- /dev/null +++ b/branch @@ -0,0 +1 @@ +F-13 From 3c24cbe2f0ff2f801d6a46c31485e8865d40c502 Mon Sep 17 00:00:00 2001 From: Matthias Saou Date: Wed, 28 Apr 2010 12:28:58 +0000 Subject: [PATCH 2/3] Update EPEL branches to 1.5.2 and include fix for CVE-2010-0055 to all branches. --- xar-1.5.2-CVE-2010-0055.patch | 49 +++++++++++++++++++++++++++++++++++ xar.spec | 7 ++++- 2 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 xar-1.5.2-CVE-2010-0055.patch diff --git a/xar-1.5.2-CVE-2010-0055.patch b/xar-1.5.2-CVE-2010-0055.patch new file mode 100644 index 0000000..8be4389 --- /dev/null +++ b/xar-1.5.2-CVE-2010-0055.patch @@ -0,0 +1,49 @@ +Index: xar/lib/archive.c +=================================================================== +--- xar/lib/archive.c (revision 224) ++++ xar/lib/archive.c (revision 225) +@@ -330,6 +330,44 @@ + + EVP_DigestFinal(&XAR(ret)->toc_ctx, toccksum, &tlen); + ++ const char *value; ++ uint64_t offset = 0; ++ uint64_t length = tlen; ++ if( xar_prop_get( XAR_FILE(ret) , "checksum/offset", &value) == 0 ) { ++ errno = 0; ++ offset = strtoull( value, (char **)NULL, 10); ++ if( errno != 0 ) { ++ xar_close(ret); ++ return NULL; ++ } ++ } else if( xar_signature_first(ret) != NULL ) { ++ // All archives that have a signature also specify the location ++ // of the checksum. If the location isn't specified, error out. ++ xar_close(ret); ++ return NULL; ++ } ++ ++ XAR(ret)->heap_offset = xar_get_heap_offset(ret) + offset; ++ if( lseek(XAR(ret)->fd, XAR(ret)->heap_offset, SEEK_SET) == -1 ) { ++ xar_close(ret); ++ return NULL; ++ } ++ if( xar_prop_get( XAR_FILE(ret) , "checksum/size", &value) == 0 ) { ++ errno = 0; ++ length = strtoull( value, (char **)NULL, 10); ++ if( errno != 0 ) { ++ xar_close(ret); ++ return NULL; ++ } ++ } else if( xar_signature_first(ret) != NULL ) { ++ xar_close(ret); ++ return NULL; ++ } ++ if( length != tlen ) { ++ xar_close(ret); ++ return NULL; ++ } ++ + xar_read_fd(XAR(ret)->fd, cval, tlen); + XAR(ret)->heap_offset += tlen; + if( memcmp(cval, toccksum, tlen) != 0 ) { diff --git a/xar.spec b/xar.spec index 37f137e..b732621 100644 --- a/xar.spec +++ b/xar.spec @@ -1,12 +1,13 @@ Summary: The eXtensible ARchiver Name: xar Version: 1.5.2 -Release: 5%{?dist} +Release: 6%{?dist} License: BSD Group: Applications/Archiving URL: http://code.google.com/p/xar/ Source: http://xar.googlecode.com/files/xar-%{version}.tar.gz Patch0: xar-1.5-norpath.patch +Patch1: xar-1.5.2-CVE-2010-0055.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root BuildRequires: libxml2-devel BuildRequires: openssl-devel @@ -37,6 +38,7 @@ Development files for the eXtensible ARchiver. %prep %setup -q %patch0 -p1 -b .norpath +%patch1 -p1 -b .CVE-2010-0055 %build @@ -73,6 +75,9 @@ Development files for the eXtensible ARchiver. %changelog +* Wed Apr 28 2010 Matthias Saou 1.5.2-6 +- Include patch to fix CVE-2010-0055 (#570678). + * Fri Aug 21 2009 Tomas Mraz - 1.5.2-5 - rebuilt with new openssl From 40fb4802c88563d7675f55f73598701e2120212d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 29 Jul 2010 15:31:54 +0000 Subject: [PATCH 3/3] dist-git conversion --- .cvsignore => .gitignore | 0 Makefile | 21 --------------------- branch | 1 - 3 files changed, 22 deletions(-) rename .cvsignore => .gitignore (100%) delete mode 100644 Makefile delete mode 100644 branch diff --git a/.cvsignore b/.gitignore similarity index 100% rename from .cvsignore rename to .gitignore diff --git a/Makefile b/Makefile deleted file mode 100644 index bbb4ba8..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: xar -# $Id: Makefile,v 1.1 2007/06/05 23:17:48 tibbs Exp $ -NAME := xar -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/branch b/branch deleted file mode 100644 index baa94ef..0000000 --- a/branch +++ /dev/null @@ -1 +0,0 @@ -F-13