[packages/ftplib] Up to 4.0.1
arekm
arekm at pld-linux.org
Wed Oct 14 21:43:56 CEST 2026
commit 01b8b8db44947d5aeb1cc08de419363444d1afec
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Wed Oct 14 21:38:39 2026 +0200
Up to 4.0.1
Fixes CVE-2007-1485. Enable 64-bit file sizes.
ftplib-CVE-2007-1485.patch | 26 +++++++++++++++++
ftplib-accept-rv.patch | 12 ++++++++
ftplib-ascii-readline.patch | 31 +++++++++++++++++++++
ftplib-ldflags.patch | 29 +++++++++++++++++++
ftplib-uint64.patch | 68 +++++++++++++++++++++++++++++++++++++++++++++
ftplib.spec | 44 ++++++++++++++++++-----------
6 files changed, 194 insertions(+), 16 deletions(-)
---
diff --git a/ftplib.spec b/ftplib.spec
index 08120d8..daa3c8b 100644
--- a/ftplib.spec
+++ b/ftplib.spec
@@ -1,13 +1,19 @@
Summary: ftplib - set of routines that implement the FTP protocol
Summary(pl.UTF-8): ftplib - zbiór funkcji implementujących protokół FTP
Name: ftplib
-Version: 3.1.1
-Release: 2
-License: LGPL v2+
+Version: 4.0.1
+Release: 1
+License: Artistic 2.0
Group: Libraries
-Source0: http://nbpfaus.net/~pfau/ftplib/%{name}-3.1-1.tar.gz
-# Source0-md5: 763be9c7e7b110776f88521a558dbc55
-URL: http://nbpfaus.net/~pfau/ftplib/
+Source0: https://nbpfaus.net/~pfau/ftplib/%{name}-4.0-1.tar.gz
+# Source0-md5: 2bb35d21e1647c54032f63f59dfc24e7
+Patch0: %{name}-ldflags.patch
+# https://salsa.debian.org/debian/ftplib/-/raw/master/debian/patches/fix-ascii-read-without-eol
+Patch1: %{name}-ascii-readline.patch
+Patch2: %{name}-CVE-2007-1485.patch
+Patch3: %{name}-uint64.patch
+Patch4: %{name}-accept-rv.patch
+URL: https://nbpfaus.net/~pfau/ftplib/
BuildRoot: %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
%description
@@ -16,7 +22,7 @@ allow applications to create and access remote files through function
calls instead of needing to fork and exec an interactive ftp client
program.
-ftplib has been built and tested on Linux, VMS, OSF/1 and Windows NT.
+ftplib has been built and tested on Linux, Mac OS X and OpenVMS.
%description -l pl.UTF-8
ftplib to zbiór funkcji implementujących protokół FTP. Pozwalają one
@@ -24,7 +30,7 @@ aplikacjom tworzyć i pobierać zdalne pliki poprzez wywołania funkcji
zamiast wykonywania fork i uruchamiania interaktywnego klienta ftp.
Biblioteka ftplib została zbudowana i przetestowana na Linuksie,
-VMS-ie, OSF/1 oraz Windows NT.
+Mac OS X oraz OpenVMS.
%package devel
Summary: Header files for ftplib library
@@ -51,20 +57,26 @@ Static ftplib library.
Statyczna biblioteka ftplib.
%prep
-%setup -q -n %{name}-3.1-1
+%setup -q -n %{name}-4.0-1
+%patch -P0 -p1
+%patch -P1 -p1
+%patch -P2 -p1
+%patch -P3 -p1
+%patch -P4 -p1
%build
-%{__make} -C src \
+%{__make} -C src qftp libftp.so libftp.a \
CC="%{__cc}" \
- DEBUG="%{rpmcflags}"
+ DEBUG="%{rpmcflags} %{rpmcppflags}" \
+ LDFLAGS="%{rpmldflags}"
%install
rm -rf $RPM_BUILD_ROOT
install -d $RPM_BUILD_ROOT{%{_bindir},%{_libdir},%{_includedir}}
-install src/libftp.so.3.1 $RPM_BUILD_ROOT%{_libdir}
-ln -sf libftp.so.3.1 $RPM_BUILD_ROOT%{_libdir}/libftp.so.3
-ln -sf libftp.so.3.1 $RPM_BUILD_ROOT%{_libdir}/libftp.so
+install src/libftp.so.4.0 $RPM_BUILD_ROOT%{_libdir}
+ln -sf libftp.so.4.0 $RPM_BUILD_ROOT%{_libdir}/libftp.so.4
+ln -sf libftp.so.4.0 $RPM_BUILD_ROOT%{_libdir}/libftp.so
install src/libftp.a $RPM_BUILD_ROOT%{_libdir}
install src/ftplib.h $RPM_BUILD_ROOT%{_includedir}
install src/qftp $RPM_BUILD_ROOT%{_bindir}
@@ -77,10 +89,10 @@ rm -rf $RPM_BUILD_ROOT
%files
%defattr(644,root,root,755)
-%doc CHANGES NOTES README.ftplib_v3.1 README.qftp TODO additional_rfcs
+%doc CHANGES LICENSE README.ftplib-4.0-1 README.qftp additional_rfcs
%attr(755,root,root) %{_bindir}/qftp
%attr(755,root,root) %{_libdir}/libftp.so.*.*
-%attr(755,root,root) %ghost %{_libdir}/libftp.so.3
+%attr(755,root,root) %ghost %{_libdir}/libftp.so.4
%files devel
%defattr(644,root,root,755)
diff --git a/ftplib-CVE-2007-1485.patch b/ftplib-CVE-2007-1485.patch
new file mode 100644
index 0000000..28f2219
--- /dev/null
+++ b/ftplib-CVE-2007-1485.patch
@@ -0,0 +1,26 @@
+# CVE-2007-1485: -m umask and $USER overflow fixed-size buffers in qftp
+--- a/src/qftp.c
++++ b/src/qftp.c
+@@ -126,10 +126,11 @@
+ perror("gethostname");
+ exit(EX_NETDB);
+ }
+- if ((u != NULL) && (h != NULL))
++ h[sizeof(h) - 1] = '\0';
++ if (u != NULL)
+ {
+ static char xxx[256];
+- sprintf(xxx,"%s@%s",u,h);
++ snprintf(xxx,sizeof(xxx),"%s@%s",u,h);
+ pass = xxx;
+ }
+ }
+@@ -347,7 +348,7 @@
+ void set_umask(char *m)
+ {
+ char buf[80];
+- sprintf(buf,"umask %s", m);
++ snprintf(buf,sizeof(buf),"umask %s", m);
+ ftp_connect();
+ FtpSite(buf, conn);
+ }
diff --git a/ftplib-accept-rv.patch b/ftplib-accept-rv.patch
new file mode 100644
index 0000000..70e0dd7
--- /dev/null
+++ b/ftplib-accept-rv.patch
@@ -0,0 +1,12 @@
+# FtpAcceptConnection returned uninitialized rv when select() woke up for neither socket
+--- a/src/ftplib.c
++++ b/src/ftplib.c
+@@ -845,7 +845,7 @@
+ int i;
+ struct timeval tv;
+ fd_set mask;
+- int rv;
++ int rv = 0;
+
+ FD_ZERO(&mask);
+ FD_SET(nControl->handle, &mask);
diff --git a/ftplib-ascii-readline.patch b/ftplib-ascii-readline.patch
new file mode 100644
index 0000000..d1c661b
--- /dev/null
+++ b/ftplib-ascii-readline.patch
@@ -0,0 +1,31 @@
+From: =?utf-8?q?Rapha=C3=ABl_Hertzog?= <hertzog at debian.org>
+Date: Thu, 21 Jul 2016 11:51:53 +0200
+Subject: Fix reading FTP data is ASCII mode
+
+In ASCII mode, if you don't have a line in the next block that you're
+trying to read, then ftplib would set the first character to '\0'.
+
+Upstream probably intented to return an empty string when requesting
+to read only 1 character since that doesn't make much sense when the
+EOL delimiter is 2 characters already (\r\n). However, due to the
+way data is read, max can be set to 1 just after having read max-1
+legitimate bytes and we should not be overwriting the first byte.
+
+Last-Update: 2016-07-21
+
+---
+ src/ftplib.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/src/ftplib.c b/src/ftplib.c
+index b05a953..b1906bf 100644
+--- a/src/ftplib.c
++++ b/src/ftplib.c
+@@ -268,7 +268,6 @@ static int readline(char *buf,int max,netbuf *ctl)
+ }
+ if (max == 1)
+ {
+- *buf = '\0';
+ break;
+ }
+ if (ctl->cput == ctl->cget)
diff --git a/ftplib-ldflags.patch b/ftplib-ldflags.patch
new file mode 100644
index 0000000..65b963c
--- /dev/null
+++ b/ftplib-ldflags.patch
@@ -0,0 +1,29 @@
+# upstream Makefile ignores LDFLAGS when linking libftp.so
+--- ftplib-4.0-1.orig/src/Makefile
++++ ftplib-4.0-1/src/Makefile
+@@ -15,7 +15,7 @@
+ SOURCES = qftp.c ftplib.c
+
+ CFLAGS = -Wall $(DEBUG) -I. $(INCLUDES) $(DEFINES) -Wno-unused-variable -D_FILE_OFFSET_BITS=64 -D__unix__
+-LDFLAGS = -L.
++LDFLAGS =
+ DEPFLAGS =
+
+ all : $(TARGETS)
+@@ -59,14 +59,14 @@
+ ar -rcs $@ $<
+
+ libftp.so.$(SOVERSION): ftplib.o
+- $(CC) -shared -Wl,-soname,libftp.so.$(SONAME) -lc -o $@ $<
++ $(CC) $(LDFLAGS) -shared -Wl,-soname,libftp.so.$(SONAME) -o $@ $< -lc
+
+ libftp.so: libftp.so.$(SOVERSION)
+ ln -sf $< libftp.so.$(SONAME)
+ ln -sf $< $@
+
+ qftp : qftp.o libftp.so ftplib.h
+- $(CC) $(LDFLAGS) -o $@ $< -lftp
++ $(CC) $(LDFLAGS) -o $@ $< -L. -lftp
+
+ ifeq (.depend,$(wildcard .depend))
+ include .depend
diff --git a/ftplib-uint64.patch b/ftplib-uint64.patch
new file mode 100644
index 0000000..09c7cff
--- /dev/null
+++ b/ftplib-uint64.patch
@@ -0,0 +1,68 @@
+# glibc never defines __UINT64_MAX, so 64-bit sizes (fsz_t, FtpSizeLong) were never enabled
+--- a/src/ftplib.c
++++ b/src/ftplib.c
+@@ -51,8 +51,8 @@
+ #define BUILDING_LIBRARY
+ #include "ftplib.h"
+
+-#if defined(__UINT64_MAX) && !defined(PRIu64)
+-#if ULONG_MAX == __UINT32_MAX
++#if defined(UINT64_MAX) && !defined(PRIu64)
++#if ULONG_MAX == UINT32_MAX
+ #define PRIu64 "llu"
+ #else
+ #define PRIu64 "lu"
+@@ -1328,7 +1328,7 @@
+ return rv;
+ }
+
+-#if defined(__UINT64_MAX)
++#if defined(UINT64_MAX)
+ /*
+ * FtpSizeLong - determine the size of a remote file
+ *
+--- a/src/ftplib.h
++++ b/src/ftplib.h
+@@ -62,7 +62,7 @@
+ extern "C" {
+ #endif
+
+-#if defined(__UINT64_MAX)
++#if defined(UINT64_MAX)
+ typedef uint64_t fsz_t;
+ #else
+ typedef uint32_t fsz_t;
+@@ -101,7 +101,7 @@
+ GLOBALREF int FtpNlst(const char *output, const char *path, netbuf *nControl);
+ GLOBALREF int FtpDir(const char *output, const char *path, netbuf *nControl);
+ GLOBALREF int FtpSize(const char *path, unsigned int *size, char mode, netbuf *nControl);
+-#if defined(__UINT64_MAX)
++#if defined(UINT64_MAX)
+ GLOBALREF int FtpSizeLong(const char *path, fsz_t *size, char mode, netbuf *nControl);
+ #endif
+ GLOBALREF int FtpModDate(const char *path, char *dt, int max, netbuf *nControl);
+--- a/src/qftp.c
++++ b/src/qftp.c
+@@ -53,11 +53,11 @@
+
+ #define DIRBUF_SIZE 1024 /* for wildcard processing */
+
+-#if defined(__UINT64_MAX)
++#if defined(UINT64_MAX)
+ #if defined(PRIu64)
+ #define PRIFSZ PRIu64
+ #else
+-#if ULONG_MAX == __UINT32_MAX
++#if ULONG_MAX == UINT32_MAX
+ #define PRIFSZ "llu"
+ #else
+ #define PRIFSZ "lu"
+@@ -298,7 +298,7 @@
+ {
+ struct REMFILE *f = filelist;
+ filelist = f->next;
+-#if defined(__UINT64_MAX)
++#if defined(UINT64_MAX)
+ if (!FtpSizeLong(f->fnm, &fsz, mode, conn))
+ #else
+ if (!FtpSize(f->fnm, &fsz, mode, conn))
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/ftplib.git/commitdiff/01b8b8db44947d5aeb1cc08de419363444d1afec
More information about the pld-cvs-commit
mailing list