[Midnightbsd-cvs] mports: net/rsync: Obtained from:

[laffer1 at midnightbsd.org]

Log Message:
-----------
Obtained from:	http://www.suse.de/~krahmer/rsync-2.6.9-fname-obo.diff
Security:	CVE-2007-4091
Security:	http://www.novell.com/linux/security/advisories/2007_17_sr.html

Modified Files:
--------------
    mports/net/rsync:
        Makefile (r1.4 -> r1.5)

Added Files:
-----------
    mports/net/rsync/files:
        patch-CVE-2007-4091 (r1.1)

-------------- next part --------------
Index: Makefile
===================================================================
RCS file: /home/cvs/mports/net/rsync/Makefile,v
retrieving revision 1.4
retrieving revision 1.5
diff -Lnet/rsync/Makefile -Lnet/rsync/Makefile -u -r1.4 -r1.5
--- net/rsync/Makefile
+++ net/rsync/Makefile
@@ -8,6 +8,7 @@
 
 PORTNAME=	rsync
 PORTVERSION=	2.6.9
+PORTREVISION=	2
 CATEGORIES=	net ipv6
 MASTER_SITES=	http://rsync.samba.org/ftp/%SUBDIR%/ \
 		ftp://ftp.samba.org/pub/%SUBDIR%/ \
--- /dev/null
+++ net/rsync/files/patch-CVE-2007-4091
@@ -0,0 +1,60 @@
+--- sender.c	2006-09-20 03:53:32.000000000 +0200
++++ sender.c	2007-07-25 15:33:05.000000000 +0200
+@@ -123,6 +123,7 @@
+ 	char fname[MAXPATHLEN];
+ 	struct file_struct *file;
+ 	unsigned int offset;
++	size_t l = 0;
+ 
+ 	if (ndx < 0 || ndx >= the_file_list->count)
+ 		return;
+@@ -133,6 +134,20 @@
+ 				    file->dir.root, "/", NULL);
+ 	} else
+ 		offset = 0;
++
++	l = offset + 1;
++	if (file) {
++		if (file->dirname)
++			l += strlen(file->dirname);
++		if (file->basename)
++			l += strlen(file->basename);
++	}
++
++	if (l >= sizeof(fname)) {
++		rprintf(FERROR, "Overlong pathname\n");
++		exit_cleanup(RERR_FILESELECT);
++	}
++
+ 	f_name(file, fname + offset);
+ 	if (remove_source_files) {
+ 		if (do_unlink(fname) == 0) {
+@@ -224,6 +239,7 @@
+ 	enum logcode log_code = log_before_transfer ? FLOG : FINFO;
+ 	int f_xfer = write_batch < 0 ? batch_fd : f_out;
+ 	int i, j;
++	size_t l = 0;
+ 
+ 	if (verbose > 2)
+ 		rprintf(FINFO, "send_files starting\n");
+@@ -259,6 +275,20 @@
+ 				fname[offset++] = '/';
+ 		} else
+ 			offset = 0;
++
++		l = offset + 1;
++		if (file) {
++			if (file->dirname)
++				l += strlen(file->dirname);
++			if (file->basename)
++				l += strlen(file->basename);
++		}
++
++		if (l >= sizeof(fname)) {
++			rprintf(FERROR, "Overlong pathname\n");
++			exit_cleanup(RERR_FILESELECT);
++		}
++
+ 		fname2 = f_name(file, fname + offset);
+ 
+ 		if (verbose > 2)