[pkgsrc/trunk]: pkgsrc/misc/screen Add patch fixing root exploit.

[maya <maya%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/35a47a57cd2d
branches:  trunk
changeset: 357635:35a47a57cd2d
user:      maya <maya%pkgsrc.org@localhost>
date:      Wed Jan 25 00:18:02 2017 +0000

description:
Add patch fixing root exploit.
Reported here: https://lists.gnu.org/archive/html/screen-devel/2017-01/msg00025.html

from dholland

diffstat:

 misc/screen/Makefile               |   3 ++-
 misc/screen/distinfo               |   4 ++--
 misc/screen/patches/patch-screen.c |  21 +++++++++++++++++++--
 3 files changed, 23 insertions(+), 5 deletions(-)

diffs (64 lines):

diff -r 41fe5a0fb8d9 -r 35a47a57cd2d misc/screen/Makefile
--- a/misc/screen/Makefile      Tue Jan 24 21:42:26 2017 +0000
+++ b/misc/screen/Makefile      Wed Jan 25 00:18:02 2017 +0000
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.98 2017/01/22 01:43:24 ryoon Exp $
+# $NetBSD: Makefile,v 1.99 2017/01/25 00:18:02 maya Exp $
 
 DISTNAME=      screen-4.5.0
+PKGREVISION=   1
 CATEGORIES=    misc shells
 MASTER_SITES=  ${MASTER_SITE_GNU:=screen/}
 
diff -r 41fe5a0fb8d9 -r 35a47a57cd2d misc/screen/distinfo
--- a/misc/screen/distinfo      Tue Jan 24 21:42:26 2017 +0000
+++ b/misc/screen/distinfo      Wed Jan 25 00:18:02 2017 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.43 2017/01/23 17:58:06 dholland Exp $
+$NetBSD: distinfo,v 1.44 2017/01/25 00:18:02 maya Exp $
 
 SHA1 (screen-4.5.0.tar.gz) = b329f538e7265405a5c14e13520e95ced9d2cb17
 RMD160 (screen-4.5.0.tar.gz) = cb412991fa2e3ffb6e4ec34449176eccb39a24a9
@@ -15,6 +15,6 @@
 SHA1 (patch-an) = bda6c65148410a6c9a13afd8ad34f93e33731552
 SHA1 (patch-ao) = 91eecb62351aff720447eb48ea85aae70b62f9b6
 SHA1 (patch-ap) = 4176e95502754206d6840ce228c61371df947650
-SHA1 (patch-screen.c) = cb4a683f5c5238b176a892086d9295340bddf75b
+SHA1 (patch-screen.c) = 1c6a8af8cbdc66723649a9f6659e963150805b32
 SHA1 (patch-socket.c) = 09683cee3685a5c6d625e86aa97f6a09f4280b56
 SHA1 (patch-tty.sh) = 93b1fe856cf16640295cb822d60118dbd3734602
diff -r 41fe5a0fb8d9 -r 35a47a57cd2d misc/screen/patches/patch-screen.c
--- a/misc/screen/patches/patch-screen.c        Tue Jan 24 21:42:26 2017 +0000
+++ b/misc/screen/patches/patch-screen.c        Wed Jan 25 00:18:02 2017 +0000
@@ -1,8 +1,9 @@
-$NetBSD: patch-screen.c,v 1.1 2017/01/23 17:58:34 dholland Exp $
+$NetBSD: patch-screen.c,v 1.2 2017/01/25 00:18:02 maya Exp $
 
 Use standard headers.
+Don't open user-supplied paths as root.
 
---- screen.c~  2017-01-17 19:28:29.000000000 +0000
+--- screen.c.orig      2017-01-17 19:28:29.000000000 +0000
 +++ screen.c
 @@ -88,6 +88,8 @@
  # include <langinfo.h>
@@ -13,3 +14,19 @@
  #include "screen.h"
  #ifdef HAVE_BRAILLE
  # include "braille.h"
+@@ -674,11 +676,15 @@ int main(int ac, char** av)
+               if (strlen(screenlogfile) > PATH_MAX)
+                 Panic(0, "-L: logfile name too long. (max. %d char)", PATH_MAX);
+ 
++            if (seteuid(getuid()) < 0)
++              Panic(0, "setuid 1");
+               FILE *w_check;
+               if ((w_check = fopen(screenlogfile, "w")) == NULL)
+                 Panic(0, "-L: logfile name access problem");
+               else
+                 fclose(w_check);
++            if (seteuid(0) < 0)
++              Panic(0, "setuid 2");
+             }
+             nwin_options.Lflag = 1;
+             break;