head	1.2;
access;
symbols
	pkgsrc-2013Q2:1.2.0.10
	pkgsrc-2013Q2-base:1.2
	pkgsrc-2012Q4:1.2.0.8
	pkgsrc-2012Q4-base:1.2
	pkgsrc-2011Q4:1.2.0.6
	pkgsrc-2011Q4-base:1.2
	pkgsrc-2011Q2:1.2.0.4
	pkgsrc-2011Q2-base:1.2
	pkgsrc-2009Q4:1.2.0.2
	pkgsrc-2009Q4-base:1.2
	pkgsrc-2009Q3:1.1.0.40
	pkgsrc-2009Q3-base:1.1
	pkgsrc-2009Q2:1.1.0.38
	pkgsrc-2009Q2-base:1.1
	pkgsrc-2009Q1:1.1.0.36
	pkgsrc-2009Q1-base:1.1
	pkgsrc-2008Q4:1.1.0.34
	pkgsrc-2008Q4-base:1.1
	pkgsrc-2008Q3:1.1.0.32
	pkgsrc-2008Q3-base:1.1
	cube-native-xorg:1.1.0.30
	cube-native-xorg-base:1.1
	pkgsrc-2008Q2:1.1.0.28
	pkgsrc-2008Q2-base:1.1
	cwrapper:1.1.0.26
	pkgsrc-2008Q1:1.1.0.24
	pkgsrc-2008Q1-base:1.1
	pkgsrc-2007Q4:1.1.0.22
	pkgsrc-2007Q4-base:1.1
	pkgsrc-2007Q3:1.1.0.20
	pkgsrc-2007Q3-base:1.1
	pkgsrc-2007Q2:1.1.0.18
	pkgsrc-2007Q2-base:1.1
	pkgsrc-2007Q1:1.1.0.16
	pkgsrc-2007Q1-base:1.1
	pkgsrc-2006Q4:1.1.0.14
	pkgsrc-2006Q4-base:1.1
	pkgsrc-2006Q3:1.1.0.12
	pkgsrc-2006Q3-base:1.1
	pkgsrc-2006Q2:1.1.0.10
	pkgsrc-2006Q2-base:1.1
	pkgsrc-2006Q1:1.1.0.8
	pkgsrc-2006Q1-base:1.1
	pkgsrc-2005Q4:1.1.0.6
	pkgsrc-2005Q4-base:1.1
	pkgsrc-2005Q3:1.1.0.4
	pkgsrc-2005Q3-base:1.1
	pkgsrc-2005Q2:1.1.0.2
	pkgsrc-2005Q2-base:1.1;
locks; strict;
comment	@# @;


1.2
date	2009.12.16.20.07.33;	author joerg;	state dead;
branches;
next	1.1;

1.1
date	2005.06.14.18.10.37;	author jlam;	state Exp;
branches;
next	;


desc
@@


1.2
log
@Retire old xpm package. Replaced by x11/libXpm.
@
text
@$NetBSD: patch-an,v 1.1 2005/06/14 18:10:37 jlam Exp $

--- lib/RdFToI.c.orig	1998-03-19 14:51:00.000000000 -0500
+++ lib/RdFToI.c
@@@@ -32,6 +32,8 @@@@
 *  Developed by Arnaud Le Hors                                                *
 \*****************************************************************************/
 
+/* October 2004, source code review by Thomas Biege <thomas@@suse.de> */
+
 #include "XpmI.h"
 #include <sys/stat.h>
 #if !defined(NO_ZPIPE) && defined(WIN32)
@@@@ -122,6 +124,12 @@@@ XpmReadFileToXpmImage(filename, image, i
 /*
  * open the given file to be read as an xpmData which is returned.
  */
+#ifndef NO_ZPIPE
+	FILE *s_popen(char *cmd, const char *type);
+#else
+#	define s_popen popen
+#endif
+
 static int
 OpenReadFile(filename, mdata)
     char *filename;
@@@@ -139,17 +147,21 @@@@ OpenReadFile(filename, mdata)
 	mdata->type = XPMFILE;
     } else {
 #ifndef NO_ZPIPE
-	int len = strlen(filename);
+	size_t len = strlen(filename);
+
+	if(len == 0                        ||
+	   filename[len-1] == '/')
+		return(XpmOpenFailed);
 	if ((len > 2) && !strcmp(".Z", filename + (len - 2))) {
 	    mdata->type = XPMPIPE;
-	    sprintf(buf, "uncompress -c \"%s\"", filename);
-	    if (!(mdata->stream.file = popen(buf, "r")))
+	    snprintf(buf, sizeof(buf), "uncompress -c \"%s\"", filename);
+	    if (!(mdata->stream.file = s_popen(buf, "r")))
 		return (XpmOpenFailed);
 
 	} else if ((len > 3) && !strcmp(".gz", filename + (len - 3))) {
 	    mdata->type = XPMPIPE;
-	    sprintf(buf, "gunzip -qc \"%s\"", filename);
-	    if (!(mdata->stream.file = popen(buf, "r")))
+	    snprintf(buf, sizeof(buf), "gunzip -qc \"%s\"", filename);
+	    if (!(mdata->stream.file = s_popen(buf, "r")))
 		return (XpmOpenFailed);
 
 	} else {
@@@@ -157,19 +169,19 @@@@ OpenReadFile(filename, mdata)
 	    if (!(compressfile = (char *) XpmMalloc(len + 4)))
 		return (XpmNoMemory);
 
-	    sprintf(compressfile, "%s.Z", filename);
+	    snprintf(compressfile, len+4, "%s.Z", filename);
 	    if (!stat(compressfile, &status)) {
-		sprintf(buf, "uncompress -c \"%s\"", compressfile);
-		if (!(mdata->stream.file = popen(buf, "r"))) {
+		snprintf(buf, sizeof(buf), "uncompress -c \"%s\"", compressfile);
+		if (!(mdata->stream.file = s_popen(buf, "r"))) {
 		    XpmFree(compressfile);
 		    return (XpmOpenFailed);
 		}
 		mdata->type = XPMPIPE;
 	    } else {
-		sprintf(compressfile, "%s.gz", filename);
+		snprintf(compressfile, len+4, "%s.gz", filename);
 		if (!stat(compressfile, &status)) {
-		    sprintf(buf, "gunzip -c \"%s\"", compressfile);
-		    if (!(mdata->stream.file = popen(buf, "r"))) {
+		    snprintf(buf, sizeof(buf), "gunzip -c \"%s\"", compressfile);
+		    if (!(mdata->stream.file = s_popen(buf, "r"))) {
 			XpmFree(compressfile);
 			return (XpmOpenFailed);
 		    }
@@@@ -215,7 +227,7 @@@@ xpmDataClose(mdata)
 	break;
 #ifndef NO_ZPIPE
     case XPMPIPE:
-	pclose(mdata->stream.file);
+	fclose(mdata->stream.file);
 	break;
 #endif
     }
@


1.1
log
@Apply fixes derived from the HEAD branch of X.Org (6.8.99) to address
problems noted in CAN-2004-0914:

    Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as
    used in XFree86 and other packages, include (1) multiple integer
    overflows, (2) out-of-bounds memory accesses, (3) directory
    traversal, (4) shell metacharacter, (5) endless loops, and (6)
    memory leaks, which could allow remote attackers to obtain
    sensitive information, cause a denial of service (application
    crash), or execute arbitary code via a certain XPM image file.

Bump PKGREVISION to 4.  Since this is a security-related fix, also
bump the BUILDLINK_RECOMMENDED version for this package.
@
text
@d1 1
a1 1
$NetBSD$
@