Add patch to fix possible buffer overflows; thanks to Tim Sammut (underling) for reporting in bug #349567.

(Portage version: 2.2.0_alpha10/cvs/Linux x86_64)

3 files changed, 82 insertions, 2 deletions

diff --git a/dev-libs/opensc/ChangeLog b/dev-libs/opensc/ChangeLog
index 02036cd82d41..297d921ac450 100644
--- a/dev-libs/opensc/ChangeLog
+++ b/dev-libs/opensc/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for dev-libs/opensc
 # Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-libs/opensc/ChangeLog,v 1.102 2010/11/29 13:43:03 flameeyes Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/opensc/ChangeLog,v 1.103 2010/12/26 17:28:31 flameeyes Exp $
+
+*opensc-0.11.13-r2 (26 Dec 2010)
+
+  26 Dec 2010; Diego E. Pettenò <flameeyes@gentoo.org>
+  -opensc-0.11.13-r1.ebuild, +opensc-0.11.13-r2.ebuild,
+  +files/opensc-0.11.13-overflows.patch:
+  Add patch to fix possible buffer overflows; thanks to Tim Sammut (underling)
+  for reporting in bug #349567.
 
 *opensc-0.11.13-r1 (29 Nov 2010)
 
diff --git a/dev-libs/opensc/files/opensc-0.11.13-overflows.patch b/dev-libs/opensc/files/opensc-0.11.13-overflows.patch
new file mode 100644
index 000000000000..3b83e2d45f37
--- /dev/null
+++ b/dev-libs/opensc/files/opensc-0.11.13-overflows.patch
@@ -0,0 +1,71 @@
+--- a/src/libopensc/internal.h
++++ b/src/libopensc/internal.h
+@@ -49,6 +49,13 @@ extern "C" {
+ #define sleep(t)	Sleep((t) * 1000)
+ #endif
+ 
++#ifndef MAX
++#define MAX(x, y) (((x) > (y)) ? (x) : (y))
++#endif
++#ifndef MIN
++#define MIN(x, y) (((x) < (y)) ? (x) : (y))
++#endif
++
+ struct sc_atr_table {
+ 	/* The atr fields are required to
+ 	 * be in aa:bb:cc hex format. */
+--- a/src/libopensc/muscle.c
++++ b/src/libopensc/muscle.c
+@@ -31,13 +31,6 @@
+ #define MSC_DSA_PUBLIC		0x04
+ #define MSC_DSA_PRIVATE 	0x05
+ 
+-#ifndef MAX
+-#define MAX(x, y) (((x) > (y)) ? (x) : (y))
+-#endif
+-#ifndef MIN
+-#define MIN(x, y) (((x) < (y)) ? (x) : (y))
+-#endif
+-
+ static msc_id inputId = { { 0xFF, 0xFF, 0xFF, 0xFF } };
+ static msc_id outputId = { { 0xFF, 0xFF, 0xFF, 0xFE } };
+ 
+--- a/src/libopensc/card-acos5.c
++++ b/src/libopensc/card-acos5.c
+@@ -138,8 +138,8 @@ static int acos5_get_serialnr(sc_card_t * card, sc_serial_number_t * serial)
+ 	/*
+ 	 * Cache serial number.
+ 	 */
+-	memcpy(card->serialnr.value, apdu.resp, apdu.resplen);
+-	card->serialnr.len = apdu.resplen;
++	memcpy(card->serialnr.value, apdu.resp, MIN(apdu.resplen, SC_MAX_SERIALNR));
++	card->serialnr.len = MIN(apdu.resplen, SC_MAX_SERIALNR);
+ 
+ 	/*
+ 	 * Copy and return serial number.
+--- a/src/libopensc/card-atrust-acos.c
++++ b/src/libopensc/card-atrust-acos.c
+@@ -842,8 +842,8 @@ static int acos_get_serialnr(sc_card_t *card, sc_serial_number_t *serial)
+ 	if (apdu.sw1 != 0x90 || apdu.sw2 != 0x00)
+ 		return SC_ERROR_INTERNAL;
+ 	/* cache serial number */
+-	memcpy(card->serialnr.value, apdu.resp, apdu.resplen);
+-	card->serialnr.len = apdu.resplen;
++	memcpy(card->serialnr.value, apdu.resp, MIN(apdu.resplen, SC_MAX_SERIALNR));
++	card->serialnr.len = MIN(apdu.resplen, SC_MAX_SERIALNR);
+ 	/* copy and return serial number */
+ 	memcpy(serial, &card->serialnr, sizeof(*serial));
+ 	return SC_SUCCESS;
+--- a/src/libopensc/card-starcos.c
++++ b/src/libopensc/card-starcos.c
+@@ -1279,8 +1279,8 @@ static int starcos_get_serialnr(sc_card_t *card, sc_serial_number_t *serial)
+ 	if (apdu.sw1 != 0x90 || apdu.sw2 != 0x00)
+ 		return SC_ERROR_INTERNAL;
+ 	/* cache serial number */
+-	memcpy(card->serialnr.value, apdu.resp, apdu.resplen);
+-	card->serialnr.len = apdu.resplen;
++	memcpy(card->serialnr.value, apdu.resp, MIN(apdu.resplen, SC_MAX_SERIALNR));
++	card->serialnr.len = MIN(apdu.resplen, SC_MAX_SERIALNR);
+ 	/* copy and return serial number */
+ 	memcpy(serial, &card->serialnr, sizeof(*serial));
+ 	return SC_SUCCESS;
diff --git a/dev-libs/opensc/opensc-0.11.13-r1.ebuild b/dev-libs/opensc/opensc-0.11.13-r2.ebuild
index e342c041576a..6ad29aec7797 100644
--- a/dev-libs/opensc/opensc-0.11.13-r1.ebuild
+++ b/dev-libs/opensc/opensc-0.11.13-r2.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2010 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/dev-libs/opensc/opensc-0.11.13-r1.ebuild,v 1.1 2010/11/29 13:43:03 flameeyes Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/opensc/opensc-0.11.13-r2.ebuild,v 1.1 2010/12/26 17:28:31 flameeyes Exp $
 
 EAPI="2"
 
@@ -36,6 +36,7 @@ pkg_setup() {
 
 src_prepare() {
 	epatch "${FILESDIR}"/${P}+pcsc-lite-1.6.2.patch
+	epatch "${FILESDIR}"/${P}-overflows.patch
 
 	eautoreconf
 }