From 9544460de3b7282c473654a2a67586c6645a05c1 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 18 Apr 2014 08:20:52 +0000
Subject: [PATCH] main/a2ps: security fix for CVE-2001-1593 and CVE-2014-0466
ref #2821
---
main/a2ps/APKBUILD | 16 ++++++---
main/a2ps/CVE-2001-1593.patch | 65 +++++++++++++++++++++++++++++++++++
main/a2ps/CVE-2014-0466.patch | 30 ++++++++++++++++
3 files changed, 107 insertions(+), 4 deletions(-)
create mode 100644 main/a2ps/CVE-2001-1593.patch
create mode 100644 main/a2ps/CVE-2014-0466.patch
diff --git a/main/a2ps/APKBUILD b/main/a2ps/APKBUILD
index cdde8b4d7c5e..1767d237dc65 100644
--- a/main/a2ps/APKBUILD
+++ b/main/a2ps/APKBUILD
@@ -1,7 +1,7 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=a2ps
pkgver=4.14
-pkgrel=4
+pkgrel=5
pkgdesc="a2ps is an Any to PostScript filter"
url="http://www.gnu.org/software/a2ps/"
arch="all"
@@ -19,6 +19,8 @@ source="ftp://ftp.gnu.org/gnu/$pkgname/$pkgname-$pkgver.tar.gz
fix-redeclarations.patch
a2ps-automake-1.12.patch
automake.patch
+ CVE-2001-1593.patch
+ CVE-2014-0466.patch
"
prepare() {
@@ -63,7 +65,9 @@ md5sums="781ac3d9b213fa3e1ed0d79f986dc8c7 a2ps-4.14.tar.gz
4b4fbc19a6b79fa64df7e26945fcdcf9 a2ps-4.14-fix-stpcpy-proto.patch
2161408fcb532ac22dba95eb6e60ace6 fix-redeclarations.patch
72e8f0a6cd234945df92549d8a5451f8 a2ps-automake-1.12.patch
-868217fde7f9a4c1350c99431b0c1671 automake.patch"
+868217fde7f9a4c1350c99431b0c1671 automake.patch
+fa3c5f09f47619fbee347256e940fcce CVE-2001-1593.patch
+f1c0a955f604ccf7d592b92d67c7d255 CVE-2014-0466.patch"
sha256sums="f3ae8d3d4564a41b6e2a21f237d2f2b104f48108591e8b83497500182a3ab3a4 a2ps-4.14.tar.gz
5d1b8a8791fa2a36c23f43ef153a724cce1f8eec8fb92ab886f52fae7f8f3be3 a2ps-4.13c-fnmatch-replacement.patch
943739a788db47f10942477754f42c8c9b22cdaad4463bea4103c31a330de76a a2ps-4.13c-emacs.patch
@@ -72,7 +76,9 @@ sha256sums="f3ae8d3d4564a41b6e2a21f237d2f2b104f48108591e8b83497500182a3ab3a4 a2
547a50e7bd577222fac71ce1ab7fd25db2096a8874ae667bd09e118fb39bf5a9 a2ps-4.14-fix-stpcpy-proto.patch
49532bc45d91f198791063f5c0438c163399f8dd8e497e660b2099f24c8914c1 fix-redeclarations.patch
167a4639b008c123b54fe627a6fcbb1db12c37023f5c37a9994f2eeb212b1d55 a2ps-automake-1.12.patch
-ded40b73e44729ebf3cf4777eaea92915dde0429ab8a137ca53358333474f515 automake.patch"
+ded40b73e44729ebf3cf4777eaea92915dde0429ab8a137ca53358333474f515 automake.patch
+fbfeb3d421e81540839e25f7a3efdab977e86e3c5748442eefe4560c85816a12 CVE-2001-1593.patch
+458601076b6e3cc241d121602cc455d2d3ae5fce47eeb57dd56c9acb9995db02 CVE-2014-0466.patch"
sha512sums="fd6ac8ab47d789114c283e8ca508f7f56feabd1a189f4ac772cad9e6be7e3791e210892cfffd04ad1d39efe4b15386b2e61bf4cd56b70ed581c0554f36bfe06f a2ps-4.14.tar.gz
5509ae1277ff1f1f487fb106ed6673eb67fa7d1531a35bfa087f78a0bdb4dc0bf38c69b7fab95161a19406fc1acaef09b22b8a05ef603c6d43a8d7a8c3077b56 a2ps-4.13c-fnmatch-replacement.patch
0ef1a215ecb757e249c4d4bdf9a789419c6cd433f7e330783fef13a0158c57c5c5e6a22526d8abcca0919bdb1dc08337869fdd3f0fe192284ca087eafad322a3 a2ps-4.13c-emacs.patch
@@ -81,4 +87,6 @@ f3dc2698ee989928b3179b65b01bf12d828f4428bd860f6f1a3811daaa9d6256b353c2acb5cd4bf3
605385c355b15f2f8142b4a05390ce131d3f2b7a8d56bf37b70457db64c0ce458778daf05ef015c9059482483907a629f12d210bcaa91cc007af4f708b66b765 a2ps-4.14-fix-stpcpy-proto.patch
08382d49982190779f3070e06af773c0dd730e8f1a81310a537c149a438954e5c4b360c72a908fb50b1fb95fcf4b556c28ffd90932bae81140cab30b3419f364 fix-redeclarations.patch
422dba4b43fb14d68263361dd917a866a9ff033d4a5f60faf668385b80093f7f3f6025de149810f9287790acc07ed5f5feb15c7b23ff083ab74eb21c22bf0f05 a2ps-automake-1.12.patch
-4336ad6b40ecfd16ac01304a4d27b7715e5c19ef3777b57f0ea152fa1a57db476605c330b5c0091dfbf95705e4345806c8393e6c3f3e89d528bd94cc91a9beb9 automake.patch"
+4336ad6b40ecfd16ac01304a4d27b7715e5c19ef3777b57f0ea152fa1a57db476605c330b5c0091dfbf95705e4345806c8393e6c3f3e89d528bd94cc91a9beb9 automake.patch
+22b9e23d74a914a3332615b911c655cf5e63ce445073e2cd7faa353c16b3e9c813cc4f3b20db68795f09da8b5a8952effe4727e6d1a429699ad66487bd2cab32 CVE-2001-1593.patch
+1816c8c98c8902801c5376ed86821b60d67c18fe9f5534936e3fa9ffaae01f1b1f5b4cf84fa176ba30ee7350737fffa3c2e4b60cf03cb9e64bc93487a6448bb1 CVE-2014-0466.patch"
diff --git a/main/a2ps/CVE-2001-1593.patch b/main/a2ps/CVE-2001-1593.patch
new file mode 100644
index 000000000000..cff6225355a5
--- /dev/null
+++ b/main/a2ps/CVE-2001-1593.patch
@@ -0,0 +1,65 @@
+--- a2ps-4.13/lib/routines.c.security Sat Oct 16 05:46:37 1999
++++ a2ps-4.13/lib/routines.c Mon Feb 12 17:45:15 2001
+@@ -242,3 +242,50 @@
+ /* Don't complain if you can't unlink. Who cares of a tmp file? */
+ unlink (filename);
+ }
++
++/*
++ * Securely generate a temp file, and make sure it gets
++ * deleted upon exit.
++ */
++static char ** tempfiles;
++static unsigned ntempfiles;
++
++static void
++cleanup_tempfiles()
++{
++ while (ntempfiles--)
++ unlink(tempfiles[ntempfiles]);
++}
++
++char *
++safe_tempnam(const char *pfx)
++{
++ char *dirname, *filename;
++ int fd;
++
++ if (!(dirname = getenv("TMPDIR")))
++ dirname = "/tmp";
++
++ tempfiles = (char **) realloc(tempfiles,
++ (ntempfiles+1) * sizeof(char *));
++ if (tempfiles == NULL)
++ return NULL;
++
++ filename = malloc(strlen(dirname) + strlen(pfx) + sizeof("/XXXXXX"));
++ if (!filename)
++ return NULL;
++
++ sprintf(filename, "%s/%sXXXXXX", dirname, pfx);
++
++ if ((fd = mkstemp(filename)) < 0) {
++ free(filename);
++ return NULL;
++ }
++ close(fd);
++
++ if (ntempfiles == 0)
++ atexit(cleanup_tempfiles);
++ tempfiles[ntempfiles++] = filename;
++
++ return filename;
++}
+--- a2ps-4.13/lib/routines.h.security Mon Oct 18 21:24:41 1999
++++ a2ps-4.13/lib/routines.h Mon Feb 12 17:39:30 2001
+@@ -255,7 +255,8 @@
+ /* If _STR_ is not defined, give it a tempname in _TMPDIR_ */
+ #define tempname_ensure(Str) \
+ do { \
+- (Str) = (Str) ? (Str) : tempnam (NULL, "a2_"); \
++ (Str) = (Str) ? (Str) : safe_tempnam("a2_"); \
+ } while (0)
++char * safe_tempnam(const char *);
+
+ #endif
diff --git a/main/a2ps/CVE-2014-0466.patch b/main/a2ps/CVE-2014-0466.patch
new file mode 100644
index 000000000000..85199e35b0ff
--- /dev/null
+++ b/main/a2ps/CVE-2014-0466.patch
@@ -0,0 +1,30 @@
+Description: CVE-2014-0466: fixps does not invoke gs with -dSAFER
+ A malicious PostScript file could delete files with the privileges of
+ the invoking user.
+Origin: vendor
+Bug-Debian: http://bugs.debian.org/742902
+Author: Salvatore Bonaccorso <carnil@debian.org>
+Last-Update: 2014-03-28
+
+--- a/contrib/fixps.in
++++ b/contrib/fixps.in
+@@ -389,7 +389,7 @@
+ eval "$command" ;;
+ gs)
+ $verbose "$program: making a full rewrite of the file ($gs)." >&2
+- $gs -q -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;;
++ $gs -q -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;;
+ esac
+ )
+ fi
+--- a/contrib/fixps.m4
++++ b/contrib/fixps.m4
+@@ -307,7 +307,7 @@
+ eval "$command" ;;
+ gs)
+ $verbose "$program: making a full rewrite of the file ($gs)." >&2
+- $gs -q -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;;
++ $gs -q -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;;
+ esac
+ )
+ fi
--
GitLab