head 1.2; access; symbols pkgsrc-2013Q2:1.2.0.10 pkgsrc-2013Q2-base:1.2 pkgsrc-2012Q4:1.2.0.8 pkgsrc-2012Q4-base:1.2 pkgsrc-2011Q4:1.2.0.6 pkgsrc-2011Q4-base:1.2 pkgsrc-2011Q2:1.2.0.4 pkgsrc-2011Q2-base:1.2 pkgsrc-2009Q4:1.2.0.2 pkgsrc-2009Q4-base:1.2 pkgsrc-2009Q3:1.1.0.40 pkgsrc-2009Q3-base:1.1 pkgsrc-2009Q2:1.1.0.38 pkgsrc-2009Q2-base:1.1 pkgsrc-2009Q1:1.1.0.36 pkgsrc-2009Q1-base:1.1 pkgsrc-2008Q4:1.1.0.34 pkgsrc-2008Q4-base:1.1 pkgsrc-2008Q3:1.1.0.32 pkgsrc-2008Q3-base:1.1 cube-native-xorg:1.1.0.30 cube-native-xorg-base:1.1 pkgsrc-2008Q2:1.1.0.28 pkgsrc-2008Q2-base:1.1 cwrapper:1.1.0.26 pkgsrc-2008Q1:1.1.0.24 pkgsrc-2008Q1-base:1.1 pkgsrc-2007Q4:1.1.0.22 pkgsrc-2007Q4-base:1.1 pkgsrc-2007Q3:1.1.0.20 pkgsrc-2007Q3-base:1.1 pkgsrc-2007Q2:1.1.0.18 pkgsrc-2007Q2-base:1.1 pkgsrc-2007Q1:1.1.0.16 pkgsrc-2007Q1-base:1.1 pkgsrc-2006Q4:1.1.0.14 pkgsrc-2006Q4-base:1.1 pkgsrc-2006Q3:1.1.0.12 pkgsrc-2006Q3-base:1.1 pkgsrc-2006Q2:1.1.0.10 pkgsrc-2006Q2-base:1.1 pkgsrc-2006Q1:1.1.0.8 pkgsrc-2006Q1-base:1.1 pkgsrc-2005Q4:1.1.0.6 pkgsrc-2005Q4-base:1.1 pkgsrc-2005Q3:1.1.0.4 pkgsrc-2005Q3-base:1.1 pkgsrc-2005Q2:1.1.0.2 pkgsrc-2005Q2-base:1.1; locks; strict; comment @# @; 1.2 date 2009.12.16.20.07.33; author joerg; state dead; branches; next 1.1; 1.1 date 2005.06.14.18.10.37; author jlam; state Exp; branches; next ; desc @@ 1.2 log @Retire old xpm package. Replaced by x11/libXpm. @ text @$NetBSD: patch-ap,v 1.1 2005/06/14 18:10:37 jlam Exp $ --- lib/WrFFrI.c.orig 1998-03-19 14:51:00.000000000 -0500 +++ lib/WrFFrI.c @@@@ -37,6 +37,8 @@@@ * Lorens Younes (d93-hyo@@nada.kth.se) 4/96 */ +/* October 2004, source code review by Thomas Biege */ + #include "XpmI.h" #if !defined(NO_ZPIPE) && defined(WIN32) # define popen _popen @@@@ -97,7 +99,7 @@@@ XpmWriteFileFromXpmImage(filename, image XpmInfo *info; { xpmData mdata; - char *name, *dot, *s, new_name[BUFSIZ]; + char *name, *dot, *s, new_name[BUFSIZ] = {0}; int ErrorStatus; /* open file to write */ @@@@ -119,8 +121,9 @@@@ XpmWriteFileFromXpmImage(filename, image name++; #endif /* let's try to make a valid C syntax name */ - if (dot = index(name, '.')) { - strcpy(new_name, name); + if (index(name, '.')) { + strncpy(new_name, name, sizeof(new_name)); + new_name[sizeof(new_name)-1] = 0; /* change '.' to '_' */ name = s = new_name; while (dot = index(s, '.')) { @@@@ -130,7 +133,8 @@@@ XpmWriteFileFromXpmImage(filename, image } if (dot = index(name, '-')) { if (name != new_name) { - strcpy(new_name, name); + strncpy(new_name, name, sizeof(new_name)); + new_name[sizeof(new_name)-1] = 0; name = new_name; } /* change '-' to '_' */ @@@@ -247,6 +251,8 @@@@ WritePixels(file, width, height, cpp, pi unsigned int x, y, h; h = height - 1; + if (cpp != 0 && width >= (UINT_MAX - 3)/cpp) + return XpmNoMemory; p = buf = (char *) XpmMalloc(width * cpp + 3); if (!buf) return (XpmNoMemory); @@@@ -297,6 +303,11 @@@@ WriteExtensions(file, ext, num) /* * open the given file to be written as an xpmData which is returned */ +#ifndef NO_ZPIPE + FILE *s_popen(char *cmd, const char *type); +#else +# define s_popen popen +#endif static int OpenWriteFile(filename, mdata) char *filename; @@@@ -312,16 +323,23 @@@@ OpenWriteFile(filename, mdata) mdata->type = XPMFILE; } else { #ifndef NO_ZPIPE - int len = strlen(filename); + size_t len = strlen(filename); + + if(len == 0 || + filename[0] == '/' || + strstr(filename, "../") != NULL || + filename[len-1] == '/') + return(XpmOpenFailed); + if (len > 2 && !strcmp(".Z", filename + (len - 2))) { - sprintf(buf, "compress > \"%s\"", filename); - if (!(mdata->stream.file = popen(buf, "w"))) + snprintf(buf, sizeof(buf), "compress > \"%s\"", filename); + if (!(mdata->stream.file = s_popen(buf, "w"))) return (XpmOpenFailed); mdata->type = XPMPIPE; } else if (len > 3 && !strcmp(".gz", filename + (len - 3))) { - sprintf(buf, "gzip -q > \"%s\"", filename); - if (!(mdata->stream.file = popen(buf, "w"))) + snprintf(buf, sizeof(buf), "gzip -q > \"%s\"", filename); + if (!(mdata->stream.file = s_popen(buf, "w"))) return (XpmOpenFailed); mdata->type = XPMPIPE; @@@@ -352,7 +370,7 @@@@ xpmDataClose(mdata) break; #ifndef NO_ZPIPE case XPMPIPE: - pclose(mdata->stream.file); + fclose(mdata->stream.file); break; #endif } @ 1.1 log @Apply fixes derived from the HEAD branch of X.Org (6.8.99) to address problems noted in CAN-2004-0914: Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple integer overflows, (2) out-of-bounds memory accesses, (3) directory traversal, (4) shell metacharacter, (5) endless loops, and (6) memory leaks, which could allow remote attackers to obtain sensitive information, cause a denial of service (application crash), or execute arbitary code via a certain XPM image file. Bump PKGREVISION to 4. Since this is a security-related fix, also bump the BUILDLINK_RECOMMENDED version for this package. @ text @d1 1 a1 1 $NetBSD$ @