head 1.1; access; symbols pkgsrc-2026Q1:1.1.0.176 pkgsrc-2026Q1-base:1.1 pkgsrc-2025Q4:1.1.0.174 pkgsrc-2025Q4-base:1.1 pkgsrc-2025Q3:1.1.0.172 pkgsrc-2025Q3-base:1.1 pkgsrc-2025Q2:1.1.0.170 pkgsrc-2025Q2-base:1.1 pkgsrc-2025Q1:1.1.0.168 pkgsrc-2025Q1-base:1.1 pkgsrc-2024Q4:1.1.0.166 pkgsrc-2024Q4-base:1.1 pkgsrc-2024Q3:1.1.0.164 pkgsrc-2024Q3-base:1.1 pkgsrc-2024Q2:1.1.0.162 pkgsrc-2024Q2-base:1.1 pkgsrc-2024Q1:1.1.0.160 pkgsrc-2024Q1-base:1.1 pkgsrc-2023Q4:1.1.0.158 pkgsrc-2023Q4-base:1.1 pkgsrc-2023Q3:1.1.0.156 pkgsrc-2023Q3-base:1.1 pkgsrc-2023Q2:1.1.0.154 pkgsrc-2023Q2-base:1.1 pkgsrc-2023Q1:1.1.0.152 pkgsrc-2023Q1-base:1.1 pkgsrc-2022Q4:1.1.0.150 pkgsrc-2022Q4-base:1.1 pkgsrc-2022Q3:1.1.0.148 pkgsrc-2022Q3-base:1.1 pkgsrc-2022Q2:1.1.0.146 pkgsrc-2022Q2-base:1.1 pkgsrc-2022Q1:1.1.0.144 pkgsrc-2022Q1-base:1.1 pkgsrc-2021Q4:1.1.0.142 pkgsrc-2021Q4-base:1.1 pkgsrc-2021Q3:1.1.0.140 pkgsrc-2021Q3-base:1.1 pkgsrc-2021Q2:1.1.0.138 pkgsrc-2021Q2-base:1.1 pkgsrc-2021Q1:1.1.0.136 pkgsrc-2021Q1-base:1.1 pkgsrc-2020Q4:1.1.0.134 pkgsrc-2020Q4-base:1.1 pkgsrc-2020Q3:1.1.0.132 pkgsrc-2020Q3-base:1.1 pkgsrc-2020Q2:1.1.0.128 pkgsrc-2020Q2-base:1.1 pkgsrc-2020Q1:1.1.0.108 pkgsrc-2020Q1-base:1.1 pkgsrc-2019Q4:1.1.0.130 pkgsrc-2019Q4-base:1.1 pkgsrc-2019Q3:1.1.0.126 pkgsrc-2019Q3-base:1.1 pkgsrc-2019Q2:1.1.0.124 pkgsrc-2019Q2-base:1.1 pkgsrc-2019Q1:1.1.0.122 pkgsrc-2019Q1-base:1.1 pkgsrc-2018Q4:1.1.0.120 pkgsrc-2018Q4-base:1.1 pkgsrc-2018Q3:1.1.0.118 pkgsrc-2018Q3-base:1.1 pkgsrc-2018Q2:1.1.0.116 pkgsrc-2018Q2-base:1.1 pkgsrc-2018Q1:1.1.0.114 pkgsrc-2018Q1-base:1.1 pkgsrc-2017Q4:1.1.0.112 pkgsrc-2017Q4-base:1.1 pkgsrc-2017Q3:1.1.0.110 pkgsrc-2017Q3-base:1.1 pkgsrc-2017Q2:1.1.0.106 pkgsrc-2017Q2-base:1.1 pkgsrc-2017Q1:1.1.0.104 pkgsrc-2017Q1-base:1.1 pkgsrc-2016Q4:1.1.0.102 pkgsrc-2016Q4-base:1.1 pkgsrc-2016Q3:1.1.0.100 pkgsrc-2016Q3-base:1.1 pkgsrc-2016Q2:1.1.0.98 pkgsrc-2016Q2-base:1.1 pkgsrc-2016Q1:1.1.0.96 pkgsrc-2016Q1-base:1.1 pkgsrc-2015Q4:1.1.0.94 pkgsrc-2015Q4-base:1.1 pkgsrc-2015Q3:1.1.0.92 pkgsrc-2015Q3-base:1.1 pkgsrc-2015Q2:1.1.0.90 pkgsrc-2015Q2-base:1.1 pkgsrc-2015Q1:1.1.0.88 pkgsrc-2015Q1-base:1.1 pkgsrc-2014Q4:1.1.0.86 pkgsrc-2014Q4-base:1.1 pkgsrc-2014Q3:1.1.0.84 pkgsrc-2014Q3-base:1.1 pkgsrc-2014Q2:1.1.0.82 pkgsrc-2014Q2-base:1.1 pkgsrc-2014Q1:1.1.0.80 pkgsrc-2014Q1-base:1.1 pkgsrc-2013Q4:1.1.0.78 pkgsrc-2013Q4-base:1.1 pkgsrc-2013Q3:1.1.0.76 pkgsrc-2013Q3-base:1.1 pkgsrc-2013Q2:1.1.0.74 pkgsrc-2013Q2-base:1.1 pkgsrc-2013Q1:1.1.0.72 pkgsrc-2013Q1-base:1.1 pkgsrc-2012Q4:1.1.0.70 pkgsrc-2012Q4-base:1.1 pkgsrc-2012Q3:1.1.0.68 pkgsrc-2012Q3-base:1.1 pkgsrc-2012Q2:1.1.0.66 pkgsrc-2012Q2-base:1.1 pkgsrc-2012Q1:1.1.0.64 pkgsrc-2012Q1-base:1.1 pkgsrc-2011Q4:1.1.0.62 pkgsrc-2011Q4-base:1.1 pkgsrc-2011Q3:1.1.0.60 pkgsrc-2011Q3-base:1.1 pkgsrc-2011Q2:1.1.0.58 pkgsrc-2011Q2-base:1.1 pkgsrc-2011Q1:1.1.0.56 pkgsrc-2011Q1-base:1.1 pkgsrc-2010Q4:1.1.0.54 pkgsrc-2010Q4-base:1.1 pkgsrc-2010Q3:1.1.0.52 pkgsrc-2010Q3-base:1.1 pkgsrc-2010Q2:1.1.0.50 pkgsrc-2010Q2-base:1.1 pkgsrc-2010Q1:1.1.0.48 pkgsrc-2010Q1-base:1.1 pkgsrc-2009Q4:1.1.0.46 pkgsrc-2009Q4-base:1.1 pkgsrc-2009Q3:1.1.0.44 pkgsrc-2009Q3-base:1.1 pkgsrc-2009Q2:1.1.0.42 pkgsrc-2009Q2-base:1.1 pkgsrc-2009Q1:1.1.0.40 pkgsrc-2009Q1-base:1.1 pkgsrc-2008Q4:1.1.0.38 pkgsrc-2008Q4-base:1.1 pkgsrc-2008Q3:1.1.0.36 pkgsrc-2008Q3-base:1.1 cube-native-xorg:1.1.0.34 cube-native-xorg-base:1.1 pkgsrc-2008Q2:1.1.0.32 pkgsrc-2008Q2-base:1.1 cwrapper:1.1.0.30 pkgsrc-2008Q1:1.1.0.28 pkgsrc-2008Q1-base:1.1 pkgsrc-2007Q4:1.1.0.26 pkgsrc-2007Q4-base:1.1 pkgsrc-2007Q3:1.1.0.24 pkgsrc-2007Q3-base:1.1 pkgsrc-2007Q2:1.1.0.22 pkgsrc-2007Q2-base:1.1 pkgsrc-2007Q1:1.1.0.20 pkgsrc-2007Q1-base:1.1 pkgsrc-2006Q4:1.1.0.18 pkgsrc-2006Q4-base:1.1 pkgsrc-2006Q3:1.1.0.16 pkgsrc-2006Q3-base:1.1 pkgsrc-2006Q2:1.1.0.14 pkgsrc-2006Q2-base:1.1 pkgsrc-2006Q1:1.1.0.12 pkgsrc-2006Q1-base:1.1 pkgsrc-2005Q4:1.1.0.10 pkgsrc-2005Q4-base:1.1 pkgsrc-2005Q3:1.1.0.8 pkgsrc-2005Q3-base:1.1 pkgsrc-2005Q2:1.1.0.6 pkgsrc-2005Q2-base:1.1 pkgsrc-2005Q1:1.1.0.4 pkgsrc-2005Q1-base:1.1 pkgsrc-2004Q4:1.1.0.2; locks; strict; comment @# @; 1.1 date 2005.01.21.14.42.10; author wiz; state Exp; branches 1.1.2.1; next ; 1.1.2.1 date 2005.01.21.14.42.10; author salo; state dead; branches; next 1.1.2.2; 1.1.2.2 date 2005.01.21.15.32.27; author salo; state Exp; branches; next ; desc @@ 1.1 log @Add two patches from RedHat, fixing CAN-2004-0947 and CAN-2004-1027. Bump PKGREVISION. @ text @$NetBSD$ --- unarj.c.orig 2002-06-05 12:28:06.000000000 +0200 +++ unarj.c @@@@ -213,7 +213,7 @@@@ static uchar arj_flags; static short method; static uint file_mode; static ulong time_stamp; -static short entry_pos; +static ushort entry_pos; static ushort host_data; static uchar *get_ptr; static UCRC file_crc; @@@@ -231,6 +231,8 @@@@ static UCRC crctable[UCHAR_MAX + 1]; /* Functions */ +void copy_path_relative(char *dest, char *src, size_t len); + static void make_crctable() { @@@@ -604,6 +606,7 @@@@ char *name; error(M_BADHEADR, ""); crc = CRC_MASK; + memset(header, 0, sizeof(header)); fread_crc(header, (int) headersize, fd); header_crc = fget_crc(fd); if ((crc ^ CRC_MASK) != header_crc) @@@@ -628,9 +631,13 @@@@ char *name; if (origsize < 0 || compsize < 0) error(M_HEADRCRC, ""); + if(first_hdr_size > headersize-2) /* need two \0 for file and comment */ + error(M_BADHEADR, ""); hdr_filename = (char *)&header[first_hdr_size]; strncopy(filename, hdr_filename, sizeof(filename)); + if(entry_pos >= strlen(filename)) + error(M_BADHEADR, ""); if (host_os != OS) strparity((uchar *)filename); if ((arj_flags & PATHSYM_FLAG) != 0) @@@@ -727,11 +734,11 @@@@ extract() no_output = 0; if (command == 'E') - strcpy(name, &filename[entry_pos]); + copy_path_relative(name, &filename[entry_pos], sizeof(name)); else { strcpy(name, DEFAULT_DIR); - strcat(name, filename); + copy_path_relative(name+strlen(name), filename, sizeof(name)-strlen(name)); } if (host_os != OS) @ 1.1.2.1 log @file patch-ad was added on branch pkgsrc-2004Q4 on 2005-01-21 14:42:10 +0000 @ text @d1 58 @ 1.1.2.2 log @Pullup ticket 240 - requested by Thomas Klausner security fix for unarj Revisions pulled up: - pkgsrc/archivers/unarj/Makefile 1.18-1.19 - pkgsrc/archivers/unarj/PLIST 1.2 - pkgsrc/archivers/unarj/distinfo 1.3-1.4 - pkgsrc/archivers/unarj/files/Makefile 1.1-1.2 - pkgsrc/archivers/unarj/patches/patch-aa 1.6 - pkgsrc/archivers/unarj/patches/patch-ab 1.4 - pkgsrc/archivers/unarj/patches/patch-ad 1.1 Module Name: pkgsrc Committed By: wiz Date: Fri Jan 21 14:30:05 UTC 2005 Modified Files: pkgsrc/archivers/unarj: Makefile PLIST distinfo Log Message: Update to 2.65. (Documented) changes: UNARJ 2.65 - Fixed table boundaries per suggestion of UNARJ 2.63 - Added additional header data checks. UNARJ 2.61 - Added chapter and encryption information. --- Module Name: pkgsrc Committed By: wiz Date: Fri Jan 21 14:30:32 UTC 2005 Added Files: pkgsrc/archivers/unarj/files: Makefile Log Message: Add Makefile, since distfiles comes without one. -- Module Name: pkgsrc Committed By: wiz Date: Fri Jan 21 14:41:16 UTC 2005 Modified Files: pkgsrc/archivers/unarj/patches: patch-aa Log Message: regen with correct offsets -- Module Name: pkgsrc Committed By: wiz Date: Fri Jan 21 14:42:10 UTC 2005 Modified Files: pkgsrc/archivers/unarj: Makefile distinfo pkgsrc/archivers/unarj/files: Makefile Added Files: pkgsrc/archivers/unarj/patches: patch-ab patch-ad Log Message: Add two patches from RedHat, fixing CAN-2004-0947 and CAN-2004-1027. Bump PKGREVISION. @ text @a0 58 $NetBSD: patch-ad,v 1.1.2.1 2005/01/21 15:32:27 salo Exp $ --- unarj.c.orig 2002-06-05 12:28:06.000000000 +0200 +++ unarj.c @@@@ -213,7 +213,7 @@@@ static uchar arj_flags; static short method; static uint file_mode; static ulong time_stamp; -static short entry_pos; +static ushort entry_pos; static ushort host_data; static uchar *get_ptr; static UCRC file_crc; @@@@ -231,6 +231,8 @@@@ static UCRC crctable[UCHAR_MAX + 1]; /* Functions */ +void copy_path_relative(char *dest, char *src, size_t len); + static void make_crctable() { @@@@ -604,6 +606,7 @@@@ char *name; error(M_BADHEADR, ""); crc = CRC_MASK; + memset(header, 0, sizeof(header)); fread_crc(header, (int) headersize, fd); header_crc = fget_crc(fd); if ((crc ^ CRC_MASK) != header_crc) @@@@ -628,9 +631,13 @@@@ char *name; if (origsize < 0 || compsize < 0) error(M_HEADRCRC, ""); + if(first_hdr_size > headersize-2) /* need two \0 for file and comment */ + error(M_BADHEADR, ""); hdr_filename = (char *)&header[first_hdr_size]; strncopy(filename, hdr_filename, sizeof(filename)); + if(entry_pos >= strlen(filename)) + error(M_BADHEADR, ""); if (host_os != OS) strparity((uchar *)filename); if ((arj_flags & PATHSYM_FLAG) != 0) @@@@ -727,11 +734,11 @@@@ extract() no_output = 0; if (command == 'E') - strcpy(name, &filename[entry_pos]); + copy_path_relative(name, &filename[entry_pos], sizeof(name)); else { strcpy(name, DEFAULT_DIR); - strcat(name, filename); + copy_path_relative(name+strlen(name), filename, sizeof(name)-strlen(name)); } if (host_os != OS) @