Fix for bug #358611 (possible buffer overrun in SQLDriverConnect).

Thanks to Alexandr Tiurin <arcam@fromru.com> for the patch and the
updated ebuild.

(Portage version: 2.1.9.45/cvs/Linux i686)

3 files changed, 85 insertions, 1 deletions

diff --git a/dev-db/unixODBC/ChangeLog b/dev-db/unixODBC/ChangeLog
index 5b20d90f5f48..977a12553ec8 100644
--- a/dev-db/unixODBC/ChangeLog
+++ b/dev-db/unixODBC/ChangeLog
@@ -1,6 +1,15 @@
 # ChangeLog for dev-db/unixODBC
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-db/unixODBC/ChangeLog,v 1.92 2011/04/06 12:58:18 cbrannon Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-db/unixODBC/ChangeLog,v 1.93 2011/04/06 14:29:51 cbrannon Exp $
+
+*unixODBC-2.3.0-r1 (06 Apr 2011)
+
+  06 Apr 2011; Christopher Brannon <cbrannon@gentoo.org>
+  +unixODBC-2.3.0-r1.ebuild, +files/unixODBC-2.3.0-sqldriverconnect.patch:
+  Fix for bug #358611.
+
+  Thanks to Alexandr Tiurin <arcarm@fromru.com> for the patch and the
+  updated ebuild.
 
   06 Apr 2011; Christopher Brannon <cbrannon@gentoo.org> metadata.xml:
   Added myself as maintainer (this was maintainer-needed).
diff --git a/dev-db/unixODBC/files/unixODBC-2.3.0-sqldriverconnect.patch b/dev-db/unixODBC/files/unixODBC-2.3.0-sqldriverconnect.patch
new file mode 100644
index 000000000000..abcce61106d6
--- /dev/null
+++ b/dev-db/unixODBC/files/unixODBC-2.3.0-sqldriverconnect.patch
@@ -0,0 +1,27 @@
+http://bugs.gentoo.org/show_bug.cgi?id=358611
+--- unixODBC-2.3.0.orig/DriverManager/SQLDriverConnect.c	2011-04-02 21:56:19.889301819 +0400
++++ unixODBC-2.3.0/DriverManager/SQLDriverConnect.c	2011-04-02 21:58:37.129102095 +0400
+@@ -639,7 +639,7 @@
+ {
+     DMHDBC connection = (DMHDBC)hdbc;
+     struct con_struct con_struct;
+-    char *driver, *dsn = NULL, *filedsn, *tsavefile, savefile[ 128 ];
++    char *driver, *dsn = NULL, *filedsn, *tsavefile, savefile[ INI_MAX_PROPERTY_VALUE + 1 ];
+     char lib_name[ INI_MAX_PROPERTY_VALUE + 1 ];
+     char driver_name[ INI_MAX_PROPERTY_VALUE + 1 ];
+     SQLRETURN ret_from_connect;
+@@ -944,7 +944,13 @@
+     tsavefile = __get_attribute_value( &con_struct, "SAVEFILE" );
+     if ( tsavefile )
+     {
+-        strcpy( savefile, tsavefile );
++        if ( strlen( tsavefile ) > INI_MAX_PROPERTY_VALUE ) {
++            memcpy( savefile, tsavefile, INI_MAX_PROPERTY_VALUE );
++            savefile[ INI_MAX_PROPERTY_VALUE ] = '\0';
++        }
++        else {
++            strcpy( savefile, tsavefile );
++        }
+     }
+     else
+     {
diff --git a/dev-db/unixODBC/unixODBC-2.3.0-r1.ebuild b/dev-db/unixODBC/unixODBC-2.3.0-r1.ebuild
new file mode 100644
index 000000000000..71b0cd30d644
--- /dev/null
+++ b/dev-db/unixODBC/unixODBC-2.3.0-r1.ebuild
@@ -0,0 +1,48 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-db/unixODBC/unixODBC-2.3.0-r1.ebuild,v 1.1 2011/04/06 14:29:51 cbrannon Exp $
+
+EAPI=3
+inherit libtool eutils
+
+DESCRIPTION="A complete ODBC driver manager"
+HOMEPAGE="http://www.unixodbc.org/"
+SRC_URI="mirror://sourceforge/unixodbc/${P}.tar.gz"
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x86-fbsd ~x86-freebsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris"
+IUSE="+minimal odbcmanual static-libs"
+
+RDEPEND=">=sys-devel/libtool-2.2.6b
+	>=sys-libs/readline-6.0_p4
+	>=sys-libs/ncurses-5.6-r2"
+DEPEND="${RDEPEND}
+	sys-devel/flex"
+
+src_prepare() {
+	epatch "${FILESDIR}/${P}-sqldriverconnect.patch"
+	elibtoolize
+}
+
+src_configure() {
+	econf \
+		--sysconfdir="${EPREFIX}/etc/${PN}" \
+		--disable-dependency-tracking \
+		$(use_enable static-libs static) \
+		$(use_enable !minimal drivers) \
+		$(use_enable !minimal driver-conf)
+}
+
+src_install() {
+	emake DESTDIR="${D}" install || die
+	dodoc AUTHORS ChangeLog NEWS README || die
+
+	if use prefix; then
+		dodoc README* || die
+	fi
+
+	if use odbcmanual; then
+		dohtml -a css,gif,html,sql,vsd -r doc/* || die
+	fi
+}