summaryrefslogtreecommitdiff
path: root/recipes/ctorrent
diff options
context:
space:
mode:
authorHolger Hans Peter Freyther <zecke@selfish.org>2010-03-16 16:26:28 +0800
committerHolger Hans Peter Freyther <zecke@selfish.org>2010-03-16 16:26:28 +0800
commit0f2f85bac90c4aa498ab77d5cfef19aaa581afce (patch)
tree12aaa0e5f4e3452490d15b7821a7ffec47435f0e /recipes/ctorrent
parent9d5cc61a1f2ed61433541abfcbbbe5e4cb3bf0d6 (diff)
ctorrent-3.3.1: Apply patch from the bugtracker...
Apparently this should fix CVE-2009-1759.
Diffstat (limited to 'recipes/ctorrent')
-rw-r--r--recipes/ctorrent/ctorrent_3.3.1.bb4
-rw-r--r--recipes/ctorrent/files/CVE-2009-1759.patch88
2 files changed, 91 insertions, 1 deletions
diff --git a/recipes/ctorrent/ctorrent_3.3.1.bb b/recipes/ctorrent/ctorrent_3.3.1.bb
index 91a1fac181..ae189af36f 100644
--- a/recipes/ctorrent/ctorrent_3.3.1.bb
+++ b/recipes/ctorrent/ctorrent_3.3.1.bb
@@ -2,6 +2,8 @@ require ctorrent.inc
DESCRIPTION += "This is the Enhanced version from the dtorrent project"
-SRC_URI = "${SOURCEFORGE_MIRROR}/dtorrent/ctorrent-dnh${PV}.tar.gz"
+SRC_URI = "${SOURCEFORGE_MIRROR}/dtorrent/ctorrent-dnh${PV}.tar.gz \
+ file://CVE-2009-1759.patch;patch=1;pnum=0 "
S = "${WORKDIR}/${PN}-dnh${PV}"
+PR="r1"
diff --git a/recipes/ctorrent/files/CVE-2009-1759.patch b/recipes/ctorrent/files/CVE-2009-1759.patch
new file mode 100644
index 0000000000..2f61c92852
--- /dev/null
+++ b/recipes/ctorrent/files/CVE-2009-1759.patch
@@ -0,0 +1,88 @@
+CVE-2009-1759
+
+http://sourceforge.net/tracker/?func=detail&aid=2782875&group_id=202532&atid=981959
+
+Index: bencode.h
+===================================================================
+--- bencode.h (revision 301)
++++ bencode.h (revision 302)
+@@ -25,7 +25,7 @@
+ size_t decode_list(const char *b,size_t len,const char *keylist);
+ size_t decode_rev(const char *b,size_t len,const char *keylist);
+ size_t decode_query(const char *b,size_t len,const char *keylist,const char **ps,size_t *pi,int64_t *pl,int method);
+-size_t decode_list2path(const char *b, size_t n, char *pathname);
++size_t decode_list2path(const char *b, size_t n, char *pathname, size_t maxlen);
+ size_t bencode_buf(const char *str,size_t len,FILE *fp);
+ size_t bencode_str(const char *str, FILE *fp);
+ size_t bencode_int(const uint64_t integer, FILE *fp);
+Index: bencode.cpp
+===================================================================
+--- bencode.cpp (revision 301)
++++ bencode.cpp (revision 302)
+@@ -233,22 +233,28 @@
+ return bencode_end_dict_list(fp);
+ }
+
+-size_t decode_list2path(const char *b, size_t n, char *pathname)
++size_t decode_list2path(const char *b, size_t n, char *pathname, size_t maxlen)
+ {
+ const char *pb = b;
+ const char *s = (char *) 0;
++ const char *endmax = pathname + maxlen - 1;
+ size_t r,q;
+
+ if( 'l' != *pb ) return 0;
+ pb++;
+ n--;
+ if( !n ) return 0;
+- for(; n;){
++ while( n && pathname < endmax ){
+ if(!(r = buf_str(pb, n, &s, &q)) ) return 0;
++ if( q >= maxlen ) return 0;
+ memcpy(pathname, s, q);
+ pathname += q;
+- pb += r; n -= r;
+- if( 'e' != *pb ){*pathname = PATH_SP, pathname++;} else break;
++ maxlen -= q;
++ pb += r;
++ n -= r;
++ if( 'e' == *pb ) break;
++ if( pathname >= endmax ) return 0;
++ *pathname++ = PATH_SP;
+ }
+ *pathname = '\0';
+ return (pb - b + 1);
+Index: btfiles.cpp
+===================================================================
+--- btfiles.cpp (revision 301)
++++ btfiles.cpp (revision 302)
+@@ -471,6 +471,8 @@
+ BTFILE *pbf_last = (BTFILE*) 0;
+ BTFILE *pbf = (BTFILE*) 0;
+ size_t dl;
++ unsigned long nfiles = 0;
++
+ if( decode_query(metabuf,metabuf_len,"info|length",
+ (const char**) 0,(size_t*) 0,(int64_t*) 0,QUERY_LONG) )
+ return -1;
+@@ -524,12 +526,18 @@
+ #ifndef WINDOWS
+ if( !pbf ) return -1;
+ #endif
++ nfiles++;
+ pbf->bf_length = t;
+ m_total_files_length += t;
+ r = decode_query(p, dl, "path", (const char **)0, &n, (int64_t*)0,
+ QUERY_POS);
+- if( !r ) return -1;
+- if(!decode_list2path(p + r, n, path)) return -1;
++ if( !r || !decode_list2path(p + r, n, path, sizeof(path)) ){
++ CONSOLE.Warning(1,
++ "error, invalid path in torrent data for file %lu at offset %llu",
++ nfiles, m_total_files_length - t);
++ delete pbf;
++ return -1;
++ }
+
+ int f_conv;
+ char *tmpfn = new char[strlen(path)*2+5];