CVS commit: pkgsrc/sysutils/file

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Sat Jun 30 09:27:03 UTC 2018

Modified Files:
        pkgsrc/sysutils/file: Makefile distinfo
Added Files:
        pkgsrc/sysutils/file/patches: patch-src_readelf.c

Log Message:
Patch file for CVE-2018-10360.

Patch from Matthias Ferdinand on pkgsrc-users.

The do_core_note function in readelf.c in libmagic.a in file
5.33 allows remote attackers to cause a denial of service
(out-of-bounds read and application crash) via a crafted ELF
file.


To generate a diff of this commit:
cvs rdiff -u -r1.41 -r1.42 pkgsrc/sysutils/file/Makefile
cvs rdiff -u -r1.30 -r1.31 pkgsrc/sysutils/file/distinfo
cvs rdiff -u -r0 -r1.1 pkgsrc/sysutils/file/patches/patch-src_readelf.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/sysutils/file/Makefile
diff -u pkgsrc/sysutils/file/Makefile:1.41 pkgsrc/sysutils/file/Makefile:1.42
--- pkgsrc/sysutils/file/Makefile:1.41  Tue Dec 12 03:11:51 2017
+++ pkgsrc/sysutils/file/Makefile       Sat Jun 30 09:27:02 2018
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.41 2017/12/12 03:11:51 ryoon Exp $
+# $NetBSD: Makefile,v 1.42 2018/06/30 09:27:02 bsiegert Exp $
 
 DISTNAME=              file-5.32
-PKGREVISION=           1
+PKGREVISION=           2
 CATEGORIES=            sysutils
 MASTER_SITES=          ftp://ftp.astron.com/pub/file/
 

Index: pkgsrc/sysutils/file/distinfo
diff -u pkgsrc/sysutils/file/distinfo:1.30 pkgsrc/sysutils/file/distinfo:1.31
--- pkgsrc/sysutils/file/distinfo:1.30  Tue Dec 12 03:11:51 2017
+++ pkgsrc/sysutils/file/distinfo       Sat Jun 30 09:27:02 2018
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.30 2017/12/12 03:11:51 ryoon Exp $
+$NetBSD: distinfo,v 1.31 2018/06/30 09:27:02 bsiegert Exp $
 
 SHA1 (file-5.32.tar.gz) = c2858a8043387d1229d8768ad42762a803d017db
 RMD160 (file-5.32.tar.gz) = b7d41a4c6b2c28d9f202d740e353416e2036c1ef
@@ -6,4 +6,5 @@ SHA512 (file-5.32.tar.gz) = 315343229fa1
 Size (file-5.32.tar.gz) = 797025 bytes
 SHA1 (patch-aa) = dc787ea0d77d7ba88bcb1e17d38b26b13153a1c5
 SHA1 (patch-src_fsmagic.c) = ee770cf37dfdfbc5a7c123d2691312610b76e76e
+SHA1 (patch-src_readelf.c) = 2dca756d757509643f72937595c470378fb4f3d1
 SHA1 (patch-src_softmagic.c) = bd8871c9050ca521f02b62066d0023a5fbb2d168

Added files:

Index: pkgsrc/sysutils/file/patches/patch-src_readelf.c
diff -u /dev/null pkgsrc/sysutils/file/patches/patch-src_readelf.c:1.1
--- /dev/null   Sat Jun 30 09:27:03 2018
+++ pkgsrc/sysutils/file/patches/patch-src_readelf.c    Sat Jun 30 09:27:03 2018
@@ -0,0 +1,24 @@
+$NetBSD: patch-src_readelf.c,v 1.1 2018/06/30 09:27:03 bsiegert Exp $
+
+apply https://github.com/file/file/commit/a642587a9c9e2dd7feacdf513c3643ce26ad3c22
+against https://nvd.nist.gov/vuln/detail/CVE-2018-10360
+
+    ...
+    The do_core_note function in readelf.c in libmagic.a in file
+    5.33 allows remote attackers to cause a denial of service
+    (out-of-bounds read and application crash) via a crafted ELF
+    file.
+    ...
+
+--- src/readelf.c.orig 2017-08-27 07:55:02.000000000 +0000
++++ src/readelf.c
+@@ -824,7 +824,8 @@ do_core_note(struct magic_set *ms, unsig
+ 
+                               cname = (unsigned char *)
+                                   &nbuf[doff + prpsoffsets(i)];
+-                              for (cp = cname; *cp && isprint(*cp); cp++)
++                              for (cp = cname; cp < nbuf + size && *cp
++                                  && isprint(*cp); cp++)
+                                       continue;
+                               /*
+                                * Linux apparently appends a space at the end