>Number:         19492
>Category:       pkg
>Synopsis:       portable implementation of MD5File() in pkg_install is bad
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Dec 22 04:03:00 PST 2002
>Closed-Date:
>Last-Modified:
>Originator:     Frank Cusack
>Release:        NetBSD 1.6
>Organization:
>Environment:
System: NetBSD moltar.savecore.net 1.6 NetBSD 1.6 (moltar) #16: Sun Nov 17 22:42:13 PST 2002 root@moltar.savecore.net:/usr/src/sys/arch/sparc64/compile/moltar sparc64
Architecture: sparc64
Machine: sparc64
>Description:
	pkgtools/pkg_install was recently updated (2002-12-20 or so) to
	be more portable.  The MD5File compatibility function is bad.
	The documented behavior of MD5File() is not followed wrt the
	second arg, which is allowed to be NULL, (and in fact is NULL
	when called by the pkg_* tools).  The compat. function assumes
	it won't be NULL.
>How-To-Repeat:
	Run `pkg_admin check'.
>Fix:
--- lib/digest.c.orig	Sun Dec 22 03:51:36 2002
+++ lib/digest.c	Sun Dec 22 03:50:57 2002
@@ -83,8 +83,15 @@
 	}
 	(void) pclose(pp);
 	cp = strrchr(in, ' ');
-	(void) strcpy(buf, cp + 1);
-	buf[_MD5_ASCII_BUF_SIZE	- 1] = 0;
+	if (buf)
+		(void) strncpy(buf, cp + 1, _MD5_ASCII_BUF_SIZE);
+	else {
+		buf = malloc(_MD5_ASCII_BUF_SIZE);
+		if (buf == NULL)
+			return NULL;
+		(void) strncpy(buf, cp + 1, _MD5_ASCII_BUF_SIZE);
+	}
+	buf[_MD5_ASCII_BUF_SIZE	- 1] = '\0';
 	return buf;
 }
 #endif
>Release-Note:
>Audit-Trail:
>Unformatted: