Add fix for CVE-2007-3999 #214208 by Robert Buchholz.

(Portage version: 2.2_pre5)

3 files changed, 79 insertions, 2 deletions

diff --git a/net-libs/libtirpc/ChangeLog b/net-libs/libtirpc/ChangeLog
index 045566eb748a..57e4bf7cd188 100644
--- a/net-libs/libtirpc/ChangeLog
+++ b/net-libs/libtirpc/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for net-libs/libtirpc
-# Copyright 1999-2007 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-libs/libtirpc/ChangeLog,v 1.1 2007/12/29 08:58:18 vapier Exp $
+# Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/net-libs/libtirpc/ChangeLog,v 1.2 2008/05/11 14:31:07 vapier Exp $
+
+*libtirpc-0.1.7-r1 (11 May 2008)
+
+  11 May 2008; Mike Frysinger <vapier@gentoo.org>
+  +files/libtirpc-0.1.7-CVE-2007-3999.patch, +libtirpc-0.1.7-r1.ebuild:
+  Add fix for CVE-2007-3999 #214208 by Robert Buchholz.
 
 *libtirpc-0.1.7 (29 Dec 2007)
 
diff --git a/net-libs/libtirpc/files/libtirpc-0.1.7-CVE-2007-3999.patch b/net-libs/libtirpc/files/libtirpc-0.1.7-CVE-2007-3999.patch
new file mode 100644
index 000000000000..b9a7aa4f21f1
--- /dev/null
+++ b/net-libs/libtirpc/files/libtirpc-0.1.7-CVE-2007-3999.patch
@@ -0,0 +1,35 @@
+commit 3cf1a3ce1a409e647f9b8ca4497c26e6d066f293
+Author: Steve Dickson <steved@redhat.com>
+Date:   Thu Jan 24 15:01:22 2008 -0500
+
+    Protect from buffer overflow in the GSS code.
+    
+    Signed-off-by: Steve Dickson <steved@redhat.com>
+
+diff -up libtirpc-0.1.7/src/svc_auth_gss.c.orig libtirpc-0.1.7/src/svc_auth_gss.c
+--- libtirpc-0.1.7/src/svc_auth_gss.c.orig	2008-01-24 14:41:21.000000000 -0500
++++ libtirpc-0.1.7/src/svc_auth_gss.c	2008-01-24 14:59:31.000000000 -0500
+@@ -294,6 +294,15 @@ svcauth_gss_validate(struct svc_rpc_gss_
+ 	memset(rpchdr, 0, sizeof(rpchdr));
+ 
+ 	/* XXX - Reconstruct RPC header for signing (from xdr_callmsg). */
++	oa = &msg->rm_call.cb_cred;
++	if (oa->oa_length > MAX_AUTH_BYTES)
++		return (FALSE);
++	
++	/* 8 XDR units from the IXDR macro calls. */
++	if (sizeof(rpchdr) < (8 * BYTES_PER_XDR_UNIT +
++			RNDUP(oa->oa_length)))
++		return (FALSE);
++
+ 	buf = (int32_t *)rpchdr;
+ 	IXDR_PUT_LONG(buf, msg->rm_xid);
+ 	IXDR_PUT_ENUM(buf, msg->rm_direction);
+@@ -301,7 +310,6 @@ svcauth_gss_validate(struct svc_rpc_gss_
+ 	IXDR_PUT_LONG(buf, msg->rm_call.cb_prog);
+ 	IXDR_PUT_LONG(buf, msg->rm_call.cb_vers);
+ 	IXDR_PUT_LONG(buf, msg->rm_call.cb_proc);
+-	oa = &msg->rm_call.cb_cred;
+ 	IXDR_PUT_ENUM(buf, oa->oa_flavor);
+ 	IXDR_PUT_LONG(buf, oa->oa_length);
+ 	if (oa->oa_length) {
diff --git a/net-libs/libtirpc/libtirpc-0.1.7-r1.ebuild b/net-libs/libtirpc/libtirpc-0.1.7-r1.ebuild
new file mode 100644
index 000000000000..58680cc91fdc
--- /dev/null
+++ b/net-libs/libtirpc/libtirpc-0.1.7-r1.ebuild
@@ -0,0 +1,36 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-libs/libtirpc/libtirpc-0.1.7-r1.ebuild,v 1.1 2008/05/11 14:31:07 vapier Exp $
+
+DESCRIPTION="Transport Independent RPC library (SunRPC replacement)"
+HOMEPAGE="http://libtirpc.sourceforge.net/"
+SRC_URI="http://nfsv4.bullopensource.org/tarballs/tirpc/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+DEPEND=""
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+	epatch "${FILESDIR}"/${P}-CVE-2007-3999.patch #214208
+	sed -i \
+		-e 's:/etc/netconfig:$(DESTDIR)/etc/netconfig:' \
+		Makefile.in
+	emake -s distclean || die
+}
+
+src_compile() {
+	# gss stuff needs updating to latest API
+	econf --disable-gss || die
+	emake || die
+}
+
+src_install() {
+	dodir /etc
+	emake install DESTDIR="${D}" || die
+	dodoc AUTHORS ChangeLog NEWS README THANKS TODO
+}