[packages/ctorrent] - fix CVE-2009-1759 - rel 3

[baggins]

commit bffb024033a7411e72cb4ca4378b67c3cb9bec6f
Author: Jan Rękorajski <baggins at pld-linux.org>
Date:   Fri Jan 27 23:01:40 2017 +0100

    - fix CVE-2009-1759
    - rel 3

 ctorrent-CVE-2009-1759.patch | 84 ++++++++++++++++++++++++++++++++++++++++++++
 ctorrent.spec                |  4 ++-
 2 files changed, 87 insertions(+), 1 deletion(-)
---
diff --git a/ctorrent.spec b/ctorrent.spec
index bfe8167..c17ec09 100644
--- a/ctorrent.spec
+++ b/ctorrent.spec
@@ -2,12 +2,13 @@ Summary:	Enhanced CTorrent - BitTorrent client written in the C++
 Summary(pl.UTF-8):	Enhanced CTorrent - Klient BitTorrenta napisany w C++
 Name:		ctorrent
 Version:	3.3.2
-Release:	2
+Release:	3
 License:	GPL
 Group:		Applications/Networking
 Source0:	http://www.rahul.net/dholmes/ctorrent/ctorrent-dnh%{version}.tar.gz
 # Source0-md5:	59b23dd05ff70791cd6449effa7fc3b6
 Patch0:		%{name}-m4.patch
+Patch1:		ctorrent-CVE-2009-1759.patch
 URL:		http://www.rahul.net/dholmes/ctorrent/
 BuildRequires:	autoconf >= 2.50
 BuildRequires:	automake
@@ -36,6 +37,7 @@ używa się sieci BitTorrent.
 %prep
 %setup -q -n %{name}-dnh%{version}
 %patch0 -p1
+%patch1 -p0
 
 %build
 %{__aclocal}
diff --git a/ctorrent-CVE-2009-1759.patch b/ctorrent-CVE-2009-1759.patch
new file mode 100644
index 0000000..107c59a
--- /dev/null
+++ b/ctorrent-CVE-2009-1759.patch
@@ -0,0 +1,84 @@
+Index: bencode.h
+===================================================================
+--- bencode.h	(revision 301)
++++ bencode.h	(revision 302)
+@@ -25,7 +25,7 @@
+ size_t decode_list(const char *b,size_t len,const char *keylist);
+ size_t decode_rev(const char *b,size_t len,const char *keylist);
+ size_t decode_query(const char *b,size_t len,const char *keylist,const char **ps,size_t *pi,int64_t *pl,int method);
+-size_t decode_list2path(const char *b, size_t n, char *pathname);
++size_t decode_list2path(const char *b, size_t n, char *pathname, size_t maxlen);
+ size_t bencode_buf(const char *str,size_t len,FILE *fp);
+ size_t bencode_str(const char *str, FILE *fp);
+ size_t bencode_int(const uint64_t integer, FILE *fp);
+Index: bencode.cpp
+===================================================================
+--- bencode.cpp	(revision 301)
++++ bencode.cpp	(revision 302)
+@@ -233,22 +233,28 @@
+   return bencode_end_dict_list(fp);
+ }
+ 
+-size_t decode_list2path(const char *b, size_t n, char *pathname)
++size_t decode_list2path(const char *b, size_t n, char *pathname, size_t maxlen)
+ {
+   const char *pb = b;
+   const char *s = (char *) 0;
++  const char *endmax = pathname + maxlen - 1;
+   size_t r,q;
+ 
+   if( 'l' != *pb ) return 0;
+   pb++;
+   n--;
+   if( !n ) return 0;
+-  for(; n;){
++  while( n && pathname < endmax ){
+     if(!(r = buf_str(pb, n, &s, &q)) ) return 0;
++    if( q >= maxlen ) return 0;
+     memcpy(pathname, s, q);
+     pathname += q;
+-    pb += r; n -= r; 
+-    if( 'e' != *pb ){*pathname = PATH_SP, pathname++;} else break;
++    maxlen -= q;
++    pb += r;
++    n -= r; 
++    if( 'e' == *pb ) break;
++    if( pathname >= endmax ) return 0;
++    *pathname++ = PATH_SP;
+   }
+   *pathname = '\0';
+   return (pb - b + 1);
+Index: btfiles.cpp
+===================================================================
+--- btfiles.cpp	(revision 301)
++++ btfiles.cpp	(revision 302)
+@@ -471,6 +471,8 @@
+     BTFILE *pbf_last = (BTFILE*) 0; 
+     BTFILE *pbf = (BTFILE*) 0;
+     size_t dl;
++    unsigned long nfiles = 0;
++
+     if( decode_query(metabuf,metabuf_len,"info|length",
+                     (const char**) 0,(size_t*) 0,(int64_t*) 0,QUERY_LONG) )
+       return -1;
+@@ -524,12 +526,18 @@
+ #ifndef WINDOWS
+       if( !pbf ) return -1;
+ #endif
++      nfiles++;
+       pbf->bf_length = t;
+       m_total_files_length += t;
+       r = decode_query(p, dl, "path", (const char **)0, &n, (int64_t*)0,
+                        QUERY_POS);
+-      if( !r ) return -1;
+-      if(!decode_list2path(p + r, n, path)) return -1;
++      if( !r || !decode_list2path(p + r, n, path, sizeof(path)) ){
++        CONSOLE.Warning(1,
++          "error, invalid path in torrent data for file %lu at offset %llu",
++          nfiles, m_total_files_length - t);
++        delete pbf;
++        return -1;
++      }
+ 
+       int f_conv;
+       char *tmpfn = new char[strlen(path)*2+5];
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/ctorrent.git/commitdiff/bffb024033a7411e72cb4ca4378b67c3cb9bec6f