head	1.2;
access;
symbols
	pkgsrc-2013Q2:1.2.0.54
	pkgsrc-2013Q2-base:1.2
	pkgsrc-2012Q4:1.2.0.52
	pkgsrc-2012Q4-base:1.2
	pkgsrc-2011Q4:1.2.0.50
	pkgsrc-2011Q4-base:1.2
	pkgsrc-2011Q2:1.2.0.48
	pkgsrc-2011Q2-base:1.2
	pkgsrc-2009Q4:1.2.0.46
	pkgsrc-2009Q4-base:1.2
	pkgsrc-2008Q4:1.2.0.44
	pkgsrc-2008Q4-base:1.2
	pkgsrc-2008Q3:1.2.0.42
	pkgsrc-2008Q3-base:1.2
	cube-native-xorg:1.2.0.40
	cube-native-xorg-base:1.2
	pkgsrc-2008Q2:1.2.0.38
	pkgsrc-2008Q2-base:1.2
	pkgsrc-2008Q1:1.2.0.36
	pkgsrc-2008Q1-base:1.2
	pkgsrc-2007Q4:1.2.0.34
	pkgsrc-2007Q4-base:1.2
	pkgsrc-2007Q3:1.2.0.32
	pkgsrc-2007Q3-base:1.2
	pkgsrc-2007Q2:1.2.0.30
	pkgsrc-2007Q2-base:1.2
	pkgsrc-2007Q1:1.2.0.28
	pkgsrc-2007Q1-base:1.2
	pkgsrc-2006Q4:1.2.0.26
	pkgsrc-2006Q4-base:1.2
	pkgsrc-2006Q3:1.2.0.24
	pkgsrc-2006Q3-base:1.2
	pkgsrc-2006Q2:1.2.0.22
	pkgsrc-2006Q2-base:1.2
	pkgsrc-2006Q1:1.2.0.20
	pkgsrc-2006Q1-base:1.2
	pkgsrc-2005Q4:1.2.0.18
	pkgsrc-2005Q4-base:1.2
	pkgsrc-2005Q3:1.2.0.16
	pkgsrc-2005Q3-base:1.2
	pkgsrc-2005Q2:1.2.0.14
	pkgsrc-2005Q2-base:1.2
	pkgsrc-2005Q1:1.2.0.12
	pkgsrc-2005Q1-base:1.2
	pkgsrc-2004Q4:1.2.0.10
	pkgsrc-2004Q4-base:1.2
	pkgsrc-2004Q3:1.2.0.8
	pkgsrc-2004Q3-base:1.2
	pkgsrc-2004Q2:1.2.0.6
	pkgsrc-2004Q2-base:1.2
	pkgsrc-2004Q1:1.2.0.4
	pkgsrc-2004Q1-base:1.2
	pkgsrc-2003Q4:1.2.0.2
	pkgsrc-2003Q4-base:1.2;
locks; strict;
comment	@# @;


1.2
date	2003.01.02.09.12.32;	author skrll;	state dead;
branches;
next	1.1;

1.1
date	2002.12.04.21.20.07;	author skrll;	state Exp;
branches;
next	;


desc
@@


1.2
log
@Update KDE to the 3.0.5a distribution. Packages are numbered 3.0.5.1 or
1.0.5.1 accordingly.

Fixes and changes are:

Multiple vulnerabilities.

kdelibs
	KHTML : Fixed several crashes and misrenderings.
	rlogin.protocol: fixed command execution in specially crafted
	urls.

kdebase
	KAddressbook: Don't squeeze columns on startup/properly restore
	column width settings.

kdenetwork
	lisa, reslisa: Fixed several security vulnerabilities.

kdesdk
	Cervisia: Show long lines in diff view always completely.
@
text
@$NetBSD: patch-aq,v 1.1 2002/12/04 21:20:07 skrll Exp $

--- lanbrowsing/lisa/netmanager.cpp.orig	Sat Feb  2 22:27:59 2002
+++ lanbrowsing/lisa/netmanager.cpp
@@@@ -27,6 +27,7 @@@@
 #include <strings.h>
 #include <errno.h>
 #include <string.h>
+#include <pwd.h>
 
 #ifndef AF_LOCAL
 #define AF_LOCAL AF_UNIX
@@@@ -70,7 +71,7 @@@@ NetManager::NetManager(int& rawSocketFD,
 
 NetManager::~NetManager()
 {
-   mgetDebug()<<"netknife destructor ..."<<std::endl;
+   mgetDebug()<<"NetManager destructor ..."<<std::endl;
    if (m_receiveBuffer!=0) delete [] m_receiveBuffer;
    ::close(m_listenFD);
    ::close(m_bcFD);
@@@@ -131,14 +132,28 @@@@ int NetManager::prepare()
       m_listenFD=::socket(AF_LOCAL, SOCK_STREAM, 0);
       //m_listenFD=::socket(AF_LOCAL, SOCK_STREAM, IPPROTO_TCP);
       MyString socketName("/tmp/resLisa-");
-      socketName+=getenv("LOGNAME");
+      struct passwd *user = getpwuid( getuid() );
+      if ( user )
+         socketName+=user->pw_name;
+      else
+         //should never happen
+         socketName+="???";
       ::unlink(socketName.data());
       sockaddr_un serverAddr;
-//      bzero((char*)&serverAddr, sizeof(serverAddr));
+      if (socketName.length() >= sizeof(serverAddr.sun_path))
+      {
+         std::cout<<"NetManager::prepare: your user name  \""<<user->pw_name<<"\" is too long, exiting."<<std::endl;
+         return 0;
+      }
       memset((void*)&serverAddr, 0, sizeof(serverAddr));
-      serverAddr.sun_family      = AF_LOCAL;
-      strcpy(serverAddr.sun_path,socketName.data());
-      ::bind(m_listenFD,(sockaddr*) &serverAddr,sizeof(serverAddr));
+      serverAddr.sun_family=AF_LOCAL;
+      strncpy(serverAddr.sun_path,socketName.data(),sizeof(serverAddr.sun_path));
+      result=::bind(m_listenFD,(sockaddr*) &serverAddr,sizeof(serverAddr));
+      if (result!=0)
+      {
+         std::cout<<"NetManager::prepare: bind (UNIX socket) failed, errno: "<<errno<<std::endl;
+         return 0;
+      }
    }
    else
    {
@@@@ -148,7 +163,7 @@@@ int NetManager::prepare()
       {
          std::cout<<"NetManager::prepare: socket(TCP) failed, errno: "<<errno<<std::endl;
          return 0;
-      };
+      }
 
       sockaddr_in serverAddress;
 //      bzero((char*)&serverAddress, sizeof(serverAddress));
@@@@ -654,6 +669,10 @@@@ int NetManager::readDataFromFD(int fd)
    m_receivedBytes+=result;
    if (m_receiveBuffer!=0) delete [] m_receiveBuffer;
    m_receiveBuffer=newBuf;
+   // too much data - abort at 2MB to avoid memory exhaustion
+   if (m_receivedBytes>2*1024*1024)
+     return 0;
+
    return 1;
 };
 
@@@@ -665,14 +684,15 @@@@ int NetManager::processScanResults()
 
    char *tmpBuf=m_receiveBuffer;
    int bytesLeft=m_receivedBytes;
-   int tmpIP;
    mgetDebug()<<"m_receivedBytes: "<<m_receivedBytes<<" bytesLeft: "<<bytesLeft<<std::endl;
    //this should be large enough for a name
    //and the stuff which is inserted into the buffer
-   //comes only from ourselves
+   //comes only from ourselves ... or attackers :-(
    char tmpName[1024*4];
    while (bytesLeft>0)
    {
+      int tmpIP=2;  // well, some impossible IP address, 0 and 1 are already used for the last line of output
+      tmpName[0]='\0';
       if ((memchr(tmpBuf,0,bytesLeft)==0) || (memchr(tmpBuf,int('\n'),bytesLeft)==0))
       {
          delete newNodes;
@@@@ -687,14 +707,16 @@@@ int NetManager::processScanResults()
          return 0;
       };
       //mgetDebug()<<"NetManager::processScanResults: processing -"<<tmpBuf;
-      sscanf(tmpBuf,"%u %s\n",&tmpIP,tmpName);
       //since we check for 0 and \n with memchr() we can be sure
       //at this point that tmpBuf is correctly terminated
       int length=strlen(tmpBuf)+1;
+      if (length<(4*1024))
+         sscanf(tmpBuf,"%u %s\n",&tmpIP,tmpName);
+
       bytesLeft-=length;
       tmpBuf+=length;
       mgetDebug()<<"length: "<<length<<" bytesLeft: "<<bytesLeft<<std::endl;
-      if ((bytesLeft==0) && (strstr(tmpName,"succeeded")!=0) && ((tmpIP==0) ||(tmpIP==1)))
+      if ((bytesLeft==0) && ((tmpIP==0) ||(tmpIP==1)) && (strstr(tmpName,"succeeded")!=0))
       {
          mgetDebug()<<"NetManager::processScanResults: succeeded :-)"<<std::endl;
          delete hostList;
@@@@ -712,7 +734,7 @@@@ int NetManager::processScanResults()
 
          return 1;
       }
-      else
+      else if (tmpIP!=2)
       {
          //mgetDebug()<<"NetManager::processScanResults: adding host: "<<tmpName<<" with ip: "<<tmpIP<<std::endl;
          newNodes->append(Node(tmpName,tmpIP));
@


1.1
log
@Bring in the patches that fix the recent security problem.

PKGREVISION++
@
text
@d1 1
a1 1
$NetBSD$
@