Fix buffer overflow in rc parse routine. #340905

(Portage version: 2.2.0_alpha29/cvs/Linux x86_64)

3 files changed, 61 insertions, 2 deletions

diff --git a/app-editors/dav/ChangeLog b/app-editors/dav/ChangeLog
index 29ed1ecf091b..b20dbfcd8423 100644
--- a/app-editors/dav/ChangeLog
+++ b/app-editors/dav/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for app-editors/dav
-# Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-editors/dav/ChangeLog,v 1.13 2010/04/05 04:06:56 abcd Exp $
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/app-editors/dav/ChangeLog,v 1.14 2011/04/05 18:20:51 signals Exp $
+
+*dav-0.8.5-r1 (05 Apr 2011)
+
+  05 Apr 2011; Kevin McCarthy <signals@gentoo.org> +dav-0.8.5-r1.ebuild,
+  +files/dav-0.8.5-davrc-buffer-overflow.patch:
+  Fix buffer overflow in rc parse routine. #340905
 
   05 Apr 2010; Jonathan Callen <abcd@gentoo.org> dav-0.8.5.ebuild:
   Bump to EAPI=3, add prefix keywords
diff --git a/app-editors/dav/dav-0.8.5-r1.ebuild b/app-editors/dav/dav-0.8.5-r1.ebuild
new file mode 100644
index 000000000000..be5606e2057b
--- /dev/null
+++ b/app-editors/dav/dav-0.8.5-r1.ebuild
@@ -0,0 +1,42 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-editors/dav/dav-0.8.5-r1.ebuild,v 1.1 2011/04/05 18:20:51 signals Exp $
+
+EAPI="3"
+
+inherit eutils toolchain-funcs
+
+DESCRIPTION="A minimal console text editor"
+HOMEPAGE="http://dav-text.sourceforge.net/"
+
+# The maintainer does not keep sourceforge's mirrors up-to-date,
+# so we point to the website's store of files.
+SRC_URI="http://dav-text.sourceforge.net/files/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~ppc ~x86 ~amd64-linux ~x86-linux ~ppc-macos"
+IUSE=""
+
+DEPEND="sys-libs/ncurses"
+RDEPEND="${DEPEND}"
+
+src_prepare() {
+	epatch "${FILESDIR}"/${P}-asneeded.patch \
+		"${FILESDIR}"/${P}-davrc-buffer-overflow.patch
+}
+
+src_configure() { :; }
+
+src_compile() {
+	emake CFLAGS="${CFLAGS}" \
+		LDFLAGS="${LDFLAGS} -lncurses" \
+		CC="$(tc-getCC)" \
+		|| die "emake failed"
+}
+
+src_install() {
+	# no ./configure and doesn't hardcode /usr, so ED is fine
+	emake DESTDIR="${ED}" install || die
+	dodoc README
+}
diff --git a/app-editors/dav/files/dav-0.8.5-davrc-buffer-overflow.patch b/app-editors/dav/files/dav-0.8.5-davrc-buffer-overflow.patch
new file mode 100644
index 000000000000..a32e78ebc818
--- /dev/null
+++ b/app-editors/dav/files/dav-0.8.5-davrc-buffer-overflow.patch
@@ -0,0 +1,11 @@
+--- dav-0.8.5.orig/main.c	2011-01-29 14:16:53.537725568 -0500
++++ dav-0.8.5/main.c	2011-01-29 14:20:45.139125094 -0500
+@@ -327,7 +327,7 @@
+ void loadSettings()
+ {
+   int l;
+-  char s[80];
++  char s[200];
+   char home[80];
+   char *r;
+   char *c;