head 1.2; access; symbols pkgsrc-2026Q1:1.2.0.106 pkgsrc-2026Q1-base:1.2 pkgsrc-2025Q4:1.2.0.104 pkgsrc-2025Q4-base:1.2 pkgsrc-2025Q3:1.2.0.102 pkgsrc-2025Q3-base:1.2 pkgsrc-2025Q2:1.2.0.100 pkgsrc-2025Q2-base:1.2 pkgsrc-2025Q1:1.2.0.98 pkgsrc-2025Q1-base:1.2 pkgsrc-2024Q4:1.2.0.96 pkgsrc-2024Q4-base:1.2 pkgsrc-2024Q3:1.2.0.94 pkgsrc-2024Q3-base:1.2 pkgsrc-2024Q2:1.2.0.92 pkgsrc-2024Q2-base:1.2 pkgsrc-2024Q1:1.2.0.90 pkgsrc-2024Q1-base:1.2 pkgsrc-2023Q4:1.2.0.88 pkgsrc-2023Q4-base:1.2 pkgsrc-2023Q3:1.2.0.86 pkgsrc-2023Q3-base:1.2 pkgsrc-2023Q2:1.2.0.84 pkgsrc-2023Q2-base:1.2 pkgsrc-2023Q1:1.2.0.82 pkgsrc-2023Q1-base:1.2 pkgsrc-2022Q4:1.2.0.80 pkgsrc-2022Q4-base:1.2 pkgsrc-2022Q3:1.2.0.78 pkgsrc-2022Q3-base:1.2 pkgsrc-2022Q2:1.2.0.76 pkgsrc-2022Q2-base:1.2 pkgsrc-2022Q1:1.2.0.74 pkgsrc-2022Q1-base:1.2 pkgsrc-2021Q4:1.2.0.72 pkgsrc-2021Q4-base:1.2 pkgsrc-2021Q3:1.2.0.70 pkgsrc-2021Q3-base:1.2 pkgsrc-2021Q2:1.2.0.68 pkgsrc-2021Q2-base:1.2 pkgsrc-2021Q1:1.2.0.66 pkgsrc-2021Q1-base:1.2 pkgsrc-2020Q4:1.2.0.64 pkgsrc-2020Q4-base:1.2 pkgsrc-2020Q3:1.2.0.62 pkgsrc-2020Q3-base:1.2 pkgsrc-2020Q2:1.2.0.58 pkgsrc-2020Q2-base:1.2 pkgsrc-2020Q1:1.2.0.38 pkgsrc-2020Q1-base:1.2 pkgsrc-2019Q4:1.2.0.60 pkgsrc-2019Q4-base:1.2 pkgsrc-2019Q3:1.2.0.56 pkgsrc-2019Q3-base:1.2 pkgsrc-2019Q2:1.2.0.54 pkgsrc-2019Q2-base:1.2 pkgsrc-2019Q1:1.2.0.52 pkgsrc-2019Q1-base:1.2 pkgsrc-2018Q4:1.2.0.50 pkgsrc-2018Q4-base:1.2 pkgsrc-2018Q3:1.2.0.48 pkgsrc-2018Q3-base:1.2 pkgsrc-2018Q2:1.2.0.46 pkgsrc-2018Q2-base:1.2 pkgsrc-2018Q1:1.2.0.44 pkgsrc-2018Q1-base:1.2 pkgsrc-2017Q4:1.2.0.42 pkgsrc-2017Q4-base:1.2 pkgsrc-2017Q3:1.2.0.40 pkgsrc-2017Q3-base:1.2 pkgsrc-2017Q2:1.2.0.36 pkgsrc-2017Q2-base:1.2 pkgsrc-2017Q1:1.2.0.34 pkgsrc-2017Q1-base:1.2 pkgsrc-2016Q4:1.2.0.32 pkgsrc-2016Q4-base:1.2 pkgsrc-2016Q3:1.2.0.30 pkgsrc-2016Q3-base:1.2 pkgsrc-2016Q2:1.2.0.28 pkgsrc-2016Q2-base:1.2 pkgsrc-2016Q1:1.2.0.26 pkgsrc-2016Q1-base:1.2 pkgsrc-2015Q4:1.2.0.24 pkgsrc-2015Q4-base:1.2 pkgsrc-2015Q3:1.2.0.22 pkgsrc-2015Q3-base:1.2 pkgsrc-2015Q2:1.2.0.20 pkgsrc-2015Q2-base:1.2 pkgsrc-2015Q1:1.2.0.18 pkgsrc-2015Q1-base:1.2 pkgsrc-2014Q4:1.2.0.16 pkgsrc-2014Q4-base:1.2 pkgsrc-2014Q3:1.2.0.14 pkgsrc-2014Q3-base:1.2 pkgsrc-2014Q2:1.2.0.12 pkgsrc-2014Q2-base:1.2 pkgsrc-2014Q1:1.2.0.10 pkgsrc-2014Q1-base:1.2 pkgsrc-2013Q4:1.2.0.8 pkgsrc-2013Q4-base:1.2 pkgsrc-2013Q3:1.2.0.6 pkgsrc-2013Q3-base:1.2 pkgsrc-2013Q2:1.2.0.4 pkgsrc-2013Q2-base:1.2 pkgsrc-2013Q1:1.2.0.2 pkgsrc-2013Q1-base:1.2 pkgsrc-2012Q4:1.1.0.44 pkgsrc-2012Q4-base:1.1 pkgsrc-2012Q3:1.1.0.42 pkgsrc-2012Q3-base:1.1 pkgsrc-2012Q2:1.1.0.40 pkgsrc-2012Q2-base:1.1 pkgsrc-2012Q1:1.1.0.38 pkgsrc-2012Q1-base:1.1 pkgsrc-2011Q4:1.1.0.36 pkgsrc-2011Q4-base:1.1 pkgsrc-2011Q3:1.1.0.34 pkgsrc-2011Q3-base:1.1 pkgsrc-2011Q2:1.1.0.32 pkgsrc-2011Q2-base:1.1 pkgsrc-2011Q1:1.1.0.30 pkgsrc-2011Q1-base:1.1 pkgsrc-2010Q4:1.1.0.28 pkgsrc-2010Q4-base:1.1 pkgsrc-2010Q3:1.1.0.26 pkgsrc-2010Q3-base:1.1 pkgsrc-2010Q2:1.1.0.24 pkgsrc-2010Q2-base:1.1 pkgsrc-2010Q1:1.1.0.22 pkgsrc-2010Q1-base:1.1 pkgsrc-2009Q4:1.1.0.20 pkgsrc-2009Q4-base:1.1 pkgsrc-2009Q3:1.1.0.18 pkgsrc-2009Q3-base:1.1 pkgsrc-2009Q2:1.1.0.16 pkgsrc-2009Q2-base:1.1 pkgsrc-2009Q1:1.1.0.14 pkgsrc-2009Q1-base:1.1 pkgsrc-2008Q4:1.1.0.12 pkgsrc-2008Q4-base:1.1 pkgsrc-2008Q3:1.1.0.10 pkgsrc-2008Q3-base:1.1 cube-native-xorg:1.1.0.8 cube-native-xorg-base:1.1 pkgsrc-2008Q2:1.1.0.6 pkgsrc-2008Q2-base:1.1 cwrapper:1.1.0.4 pkgsrc-2008Q1:1.1.0.2; locks; strict; comment @# @; 1.2 date 2013.02.22.21.20.28; author jperkin; state Exp; branches; next 1.1; 1.1 date 2008.06.01.21.46.37; author dholland; state Exp; branches 1.1.2.1; next ; 1.1.2.1 date 2008.06.01.21.46.37; author tron; state dead; branches; next 1.1.2.2; 1.1.2.2 date 2008.06.02.09.40.37; author tron; state Exp; branches; next ; desc @@ 1.2 log @Update pkgsrc patch to support SunOS as well as BSD. @ text @$NetBSD: patch-ac,v 1.1 2008/06/01 21:46:37 dholland Exp $ --- uulib/uunconc.c.orig 2004-03-01 22:52:27.000000000 +0000 +++ uulib/uunconc.c @@@@ -49,6 +49,11 @@@@ #include #endif +#ifdef __sun +#define _PATH_TMP "/tmp/" +#else +#include +#endif #include #include #include @@@@ -1306,6 +1311,7 @@@@ UUDecode (uulist *data) { int state=BEGIN, part=-1, res=0, hb; long rsize, dsize, numbytes; + int dataoutfd; FILE *datain, *dataout; unsigned char r[8]; char *mode, *ntmp; @@@@ -1329,13 +1335,13 @@@@ UUDecode (uulist *data) else mode = "wb"; /* otherwise in binary */ - if ((data->binfile = tempnam (NULL, "uu")) == NULL) { + if ((data->binfile = strdup (_PATH_TMP "uu.XXXXXX")) == NULL) { UUMessage (uunconc_id, __LINE__, UUMSG_ERROR, uustring (S_NO_TEMP_NAME)); return UURET_NOMEM; } - if ((dataout = fopen (data->binfile, mode)) == NULL) { + if ((dataoutfd = mkstemp (data->binfile)) < 0) { /* * we couldn't create a temporary file. Usually this means that TMP * and TEMP aren't set @@@@ -1348,6 +1354,19 @@@@ UUDecode (uulist *data) uu_errno = errno; return UURET_IOERR; } + + /* file now safely exists, reopen it using the right mode */ + close (dataoutfd); + if ((dataout = fopen (data->binfile, mode)) < 0) { + UUMessage (uunconc_id, __LINE__, UUMSG_ERROR, + uustring (S_WR_ERR_TARGET), + data->binfile, strerror (uu_errno = errno)); + _FP_free (data->binfile); + data->binfile = NULL; + uu_errno = errno; + return UURET_IOERR; + } + /* * we don't have begin lines in Base64 or plain text files. */ @@@@ -1496,7 +1515,7 @@@@ UUDecode (uulist *data) */ if (data->uudet == BH_ENCODED && data->binfile) { - if ((ntmp = tempnam (NULL, "uu")) == NULL) { + if ((ntmp = strdup (_PATH_TMP "uu.XXXXXX")) == NULL) { UUMessage (uunconc_id, __LINE__, UUMSG_ERROR, uustring (S_NO_TEMP_NAME)); progress.action = 0; @@@@ -1510,6 +1529,17 @@@@ UUDecode (uulist *data) free (ntmp); return UURET_IOERR; } + if ((dataoutfd = mkstemp (ntmp)) < 0) { + UUMessage (uunconc_id, __LINE__, UUMSG_ERROR, + uustring (S_NOT_OPEN_TARGET), + ntmp, strerror (uu_errno = errno)); + progress.action = 0; + fclose (datain); + free (ntmp); + return UURET_IOERR; + } + /* file now safely exists; reopen it with the right mode */ + close (dataoutfd); if ((dataout = fopen (ntmp, "wb")) == NULL) { UUMessage (uunconc_id, __LINE__, UUMSG_ERROR, uustring (S_NOT_OPEN_TARGET), @ 1.1 log @Fix insecure-temporary-files, as reported in Debian bug 480972. PKGREVISION++. @ text @d1 1 a1 1 $NetBSD$ d3 3 a5 3 --- uulib/uunconc.c.orig 2004-03-01 17:52:27.000000000 -0500 +++ uulib/uunconc.c 2008-06-01 17:05:57.000000000 -0400 @@@@ -49,6 +49,7 @@@@ d9 3 d13 1 d17 1 a17 1 @@@@ -1306,6 +1307,7 @@@@ d25 1 a25 1 @@@@ -1329,13 +1331,13 @@@@ d41 1 a41 1 @@@@ -1348,6 +1350,19 @@@@ d61 1 a61 1 @@@@ -1496,7 +1511,7 @@@@ d70 1 a70 1 @@@@ -1510,6 +1525,17 @@@@ @ 1.1.2.1 log @file patch-ac was added on branch pkgsrc-2008Q1 on 2008-06-02 09:40:36 +0000 @ text @d1 83 @ 1.1.2.2 log @Pullup ticket #2406 - requested by dholland Security patch for uulib Revisions pulled up: - converters/uulib/Makefile 1.42 - converters/uulib/distinfo 1.10 - converters/uulib/patches/patch-ab 1.3 - converters/uulib/patches/patch-ac 1.1 --- Module Name: pkgsrc Committed By: dholland Date: Sun Jun 1 21:46:37 UTC 2008 Modified Files: pkgsrc/converters/uulib: Makefile distinfo Added Files: pkgsrc/converters/uulib/patches: patch-ab patch-ac Log Message: Fix insecure-temporary-files, as reported in Debian bug 480972. PKGREVISION++. @ text @a0 83 $NetBSD: patch-ac,v 1.1 2008/06/01 21:46:37 dholland Exp $ --- uulib/uunconc.c.orig 2004-03-01 17:52:27.000000000 -0500 +++ uulib/uunconc.c 2008-06-01 17:05:57.000000000 -0400 @@@@ -49,6 +49,7 @@@@ #include #endif +#include #include #include #include @@@@ -1306,6 +1307,7 @@@@ { int state=BEGIN, part=-1, res=0, hb; long rsize, dsize, numbytes; + int dataoutfd; FILE *datain, *dataout; unsigned char r[8]; char *mode, *ntmp; @@@@ -1329,13 +1331,13 @@@@ else mode = "wb"; /* otherwise in binary */ - if ((data->binfile = tempnam (NULL, "uu")) == NULL) { + if ((data->binfile = strdup (_PATH_TMP "uu.XXXXXX")) == NULL) { UUMessage (uunconc_id, __LINE__, UUMSG_ERROR, uustring (S_NO_TEMP_NAME)); return UURET_NOMEM; } - if ((dataout = fopen (data->binfile, mode)) == NULL) { + if ((dataoutfd = mkstemp (data->binfile)) < 0) { /* * we couldn't create a temporary file. Usually this means that TMP * and TEMP aren't set @@@@ -1348,6 +1350,19 @@@@ uu_errno = errno; return UURET_IOERR; } + + /* file now safely exists, reopen it using the right mode */ + close (dataoutfd); + if ((dataout = fopen (data->binfile, mode)) < 0) { + UUMessage (uunconc_id, __LINE__, UUMSG_ERROR, + uustring (S_WR_ERR_TARGET), + data->binfile, strerror (uu_errno = errno)); + _FP_free (data->binfile); + data->binfile = NULL; + uu_errno = errno; + return UURET_IOERR; + } + /* * we don't have begin lines in Base64 or plain text files. */ @@@@ -1496,7 +1511,7 @@@@ */ if (data->uudet == BH_ENCODED && data->binfile) { - if ((ntmp = tempnam (NULL, "uu")) == NULL) { + if ((ntmp = strdup (_PATH_TMP "uu.XXXXXX")) == NULL) { UUMessage (uunconc_id, __LINE__, UUMSG_ERROR, uustring (S_NO_TEMP_NAME)); progress.action = 0; @@@@ -1510,6 +1525,17 @@@@ free (ntmp); return UURET_IOERR; } + if ((dataoutfd = mkstemp (ntmp)) < 0) { + UUMessage (uunconc_id, __LINE__, UUMSG_ERROR, + uustring (S_NOT_OPEN_TARGET), + ntmp, strerror (uu_errno = errno)); + progress.action = 0; + fclose (datain); + free (ntmp); + return UURET_IOERR; + } + /* file now safely exists; reopen it with the right mode */ + close (dataoutfd); if ((dataout = fopen (ntmp, "wb")) == NULL) { UUMessage (uunconc_id, __LINE__, UUMSG_ERROR, uustring (S_NOT_OPEN_TARGET), @