[pkgsrc/pkgsrc-2016Q3]: pkgsrc/security/libcrack Pullup ticket #5147 - reques...

[bsiegert <bsiegert%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/39f2c08d8945
branches:  pkgsrc-2016Q3
changeset: 408804:39f2c08d8945
user:      bsiegert <bsiegert%pkgsrc.org@localhost>
date:      Thu Nov 03 19:50:12 2016 +0000

description:
Pullup ticket #5147 - requested by spz
security/libcrack: security fix

Revisions pulled up:
- security/libcrack/Makefile                                    1.19
- security/libcrack/distinfo                                    1.8
- security/libcrack/patches/patch-CVE-2016-6318                 1.1

---
   Module Name: pkgsrc
   Committed By:        spz
   Date:                Sun Oct 30 20:49:58 UTC 2016

   Modified Files:
        pkgsrc/security/libcrack: Makefile distinfo
   Added Files:
        pkgsrc/security/libcrack/patches: patch-CVE-2016-6318

   Log Message:
   add a patch for CVE-2016-6318 from
   https://bugzilla.redhat.com/attachment.cgi?id=1188599

diffstat:

 security/libcrack/Makefile                    |   4 +-
 security/libcrack/distinfo                    |   3 +-
 security/libcrack/patches/patch-CVE-2016-6318 |  89 +++++++++++++++++++++++++++
 3 files changed, 93 insertions(+), 3 deletions(-)

diffs (123 lines):

diff -r 144a0874c9ac -r 39f2c08d8945 security/libcrack/Makefile
--- a/security/libcrack/Makefile        Thu Nov 03 19:02:17 2016 +0000
+++ b/security/libcrack/Makefile        Thu Nov 03 19:50:12 2016 +0000
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.18 2014/10/09 14:06:52 wiz Exp $
+# $NetBSD: Makefile,v 1.18.16.1 2016/11/03 19:50:12 bsiegert Exp $
 #
 
 DISTNAME=      cracklib,2.7
 PKGNAME=       libcrack-2.7
-PKGREVISION=   1
+PKGREVISION=   2
 CATEGORIES=    security
 MASTER_SITES=  http://www.crypticide.com/alecm/security/cracklib/
 
diff -r 144a0874c9ac -r 39f2c08d8945 security/libcrack/distinfo
--- a/security/libcrack/distinfo        Thu Nov 03 19:02:17 2016 +0000
+++ b/security/libcrack/distinfo        Thu Nov 03 19:50:12 2016 +0000
@@ -1,9 +1,10 @@
-$NetBSD: distinfo,v 1.7 2015/11/04 01:17:48 agc Exp $
+$NetBSD: distinfo,v 1.7.8.1 2016/11/03 19:50:12 bsiegert Exp $
 
 SHA1 (cracklib,2.7.tar.gz) = 903bb7e2400c7e486f432aab026dd6584815d2c1
 RMD160 (cracklib,2.7.tar.gz) = 8c1710580ed5778f54d30b709cac0b4b07543aed
 SHA512 (cracklib,2.7.tar.gz) = 2d63ed30d78a8fb07caeb21b2eeeb88941b224fe9c94da6c5eaecc4d23510117c836a373e77dffc1ff827dbd8bc02a07d07434caa4fc39b48d515bef425819e9
 Size (cracklib,2.7.tar.gz) = 21059 bytes
+SHA1 (patch-CVE-2016-6318) = 8cfb44a70c1b9e23a9739edc393fc017a7327902
 SHA1 (patch-aa) = 8119a733f4bdb0a5a41e41ab53e9923564a70855
 SHA1 (patch-ab) = b9a0b5929936a1335f08cab93710bbe66c74183d
 SHA1 (patch-ac) = 43031370c2bb08c7b43c6afad0fabe8060ac66b3
diff -r 144a0874c9ac -r 39f2c08d8945 security/libcrack/patches/patch-CVE-2016-6318
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/security/libcrack/patches/patch-CVE-2016-6318     Thu Nov 03 19:50:12 2016 +0000
@@ -0,0 +1,89 @@
+patch to cracklib 2.7 based on a patch for cracklib 2.9 from
+https://bugzilla.redhat.com/attachment.cgi?id=1188599 :
+
+It is not safe to pass words longer than STRINGSIZE further to cracklib
+so the longbuffer cannot be longer than STRINGSIZE.
+
+--- ./cracklib/fascist.c.orig  1997-12-31 10:26:46.000000000 +0000
++++ ./cracklib/fascist.c       2016-10-27 19:00:46.000000000 +0000
+@@ -490,7 +490,7 @@ FascistGecos(password, uid)
+     char gbuffer[STRINGSIZE];
+     char tbuffer[STRINGSIZE];
+     char *uwords[STRINGSIZE];
+-    char longbuffer[STRINGSIZE * 2];
++    char longbuffer[STRINGSIZE];
+ 
+     if (!(pwp = getpwuid(uid)))
+     {
+@@ -573,38 +573,47 @@ FascistGecos(password, uid)
+     {
+       for (i = 0; i < j; i++)
+       {
+-          strcpy(longbuffer, uwords[i]);
+-          strcat(longbuffer, uwords[j]);
+-
+-          if (GTry(longbuffer, password))
++          if (strlen(uwords[i]) + strlen(uwords[j]) < STRINGSIZE)
+           {
+-              return ("it is derived from your password entry");
+-          }
+-
+-          strcpy(longbuffer, uwords[j]);
+-          strcat(longbuffer, uwords[i]);
++              strcpy(longbuffer, uwords[i]);
++              strcat(longbuffer, uwords[j]);
+ 
+-          if (GTry(longbuffer, password))
+-          {
+-              return ("it's derived from your password entry");
++              if (GTry(longbuffer, password))
++              {
++                  return ("it is derived from your password entry");
++              }
++
++              strcpy(longbuffer, uwords[j]);
++              strcat(longbuffer, uwords[i]);
++
++              if (GTry(longbuffer, password))
++              {
++                  return ("it's derived from your password entry");
++              }
+           }
+ 
+-          longbuffer[0] = uwords[i][0];
+-          longbuffer[1] = '\0';
+-          strcat(longbuffer, uwords[j]);
+-
+-          if (GTry(longbuffer, password))
++          if (strlen(uwords[j]) < STRINGSIZE - 1)
+           {
+-              return ("it is derivable from your password entry");
++              longbuffer[0] = uwords[i][0];
++              longbuffer[1] = '\0';
++              strcat(longbuffer, uwords[j]);
++
++              if (GTry(longbuffer, password))
++              {
++                  return ("it is derivable from your password entry");
++              }
+           }
+ 
+-          longbuffer[0] = uwords[j][0];
+-          longbuffer[1] = '\0';
+-          strcat(longbuffer, uwords[i]);
+-
+-          if (GTry(longbuffer, password))
++          if (strlen(uwords[i]) < STRINGSIZE - 1)
+           {
+-              return ("it's derivable from your password entry");
++              longbuffer[0] = uwords[j][0];
++              longbuffer[1] = '\0';
++              strcat(longbuffer, uwords[i]);
++
++              if (GTry(longbuffer, password))
++              {
++                  return ("it's derivable from your password entry");
++              }
+           }
+       }
+     }