pkgsrc-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[pkgsrc/pkgsrc-2005Q3]: pkgsrc/multimedia/mpeg_encode Pullup ticket 802 - req...
details: https://anonhg.NetBSD.org/pkgsrc/rev/bb2d92f0c2b7
branches: pkgsrc-2005Q3
changeset: 499570:bb2d92f0c2b7
user: snj <snj%pkgsrc.org@localhost>
date: Sat Oct 08 05:56:40 2005 +0000
description:
Pullup ticket 802 - requested by Lubomir Sedlacik
security fix for mpeg_encode
Revisions pulled up:
- pkgsrc/multimedia/mpeg_encode/Makefile 1.9
- pkgsrc/multimedia/mpeg_encode/distinfo 1.4
- pkgsrc/multimedia/mpeg_encode/patches/patch-ae 1.2
- pkgsrc/multimedia/mpeg_encode/patches/patch-ah 1.1
- pkgsrc/multimedia/mpeg_encode/patches/patch-ai 1.1
- pkgsrc/multimedia/mpeg_encode/patches/patch-aj 1.1
- pkgsrc/multimedia/mpeg_encode/patches/patch-ak 1.1
- pkgsrc/multimedia/mpeg_encode/patches/patch-al 1.1
- pkgsrc/multimedia/mpeg_encode/patches/patch-am 1.1
- pkgsrc/multimedia/mpeg_encode/patches/patch-an 1.1
Module Name: pkgsrc
Committed By: salo
Date: Wed Oct 5 11:45:46 UTC 2005
Modified Files:
pkgsrc/multimedia/mpeg_encode: Makefile distinfo
pkgsrc/multimedia/mpeg_encode/patches: patch-ae
Added Files:
pkgsrc/multimedia/mpeg_encode/patches: patch-ah patch-ai patch-aj
patch-ak patch-al patch-am patch-an
Log Message:
Security fixes for SA17008:
"Vulnerabilities in Berkeley MPEG Tools can be exploited by malicious, local
users to perform certain actions on a vulnerable system with escalated
privileges. The vulnerabilities are caused due to temporary files being
created insecurely in "/tmp."
http://secunia.com/advisories/17008/
http://www.gentoo.org/security/en/glsa/glsa-200510-02.xml
Patches from Gentoo.
diffstat:
multimedia/mpeg_encode/Makefile | 4 +-
multimedia/mpeg_encode/distinfo | 11 ++++++-
multimedia/mpeg_encode/patches/patch-ae | 6 ++--
multimedia/mpeg_encode/patches/patch-ah | 46 ++++++++++++++++++++++++++++++
multimedia/mpeg_encode/patches/patch-ai | 22 ++++++++++++++
multimedia/mpeg_encode/patches/patch-aj | 44 +++++++++++++++++++++++++++++
multimedia/mpeg_encode/patches/patch-ak | 44 +++++++++++++++++++++++++++++
multimedia/mpeg_encode/patches/patch-al | 31 ++++++++++++++++++++
multimedia/mpeg_encode/patches/patch-am | 46 ++++++++++++++++++++++++++++++
multimedia/mpeg_encode/patches/patch-an | 49 +++++++++++++++++++++++++++++++++
10 files changed, 296 insertions(+), 7 deletions(-)
diffs (truncated from 362 to 300 lines):
diff -r 6d5cb5e9e935 -r bb2d92f0c2b7 multimedia/mpeg_encode/Makefile
--- a/multimedia/mpeg_encode/Makefile Fri Oct 07 09:59:32 2005 +0000
+++ b/multimedia/mpeg_encode/Makefile Sat Oct 08 05:56:40 2005 +0000
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.8 2005/06/17 04:49:47 jlam Exp $
+# $NetBSD: Makefile,v 1.8.4.1 2005/10/08 05:56:40 snj Exp $
#
DISTNAME= mpeg_encode-1.5b-src
PKGNAME= ${DISTNAME:S/-src//}
-PKGREVISION= 2
+PKGREVISION= 3
CATEGORIES= multimedia net
MASTER_SITES= ftp://mm-ftp.cs.berkeley.edu/pub/multimedia/mpeg/encode/
diff -r 6d5cb5e9e935 -r bb2d92f0c2b7 multimedia/mpeg_encode/distinfo
--- a/multimedia/mpeg_encode/distinfo Fri Oct 07 09:59:32 2005 +0000
+++ b/multimedia/mpeg_encode/distinfo Sat Oct 08 05:56:40 2005 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.3 2005/04/06 16:30:18 wiz Exp $
+$NetBSD: distinfo,v 1.3.4.1 2005/10/08 05:56:40 snj Exp $
SHA1 (mpeg_encode-1.5b-src.tar.gz) = 853cd175f73b8064ce28deb256e4b81159a684ed
RMD160 (mpeg_encode-1.5b-src.tar.gz) = 24c0a1090076630c292936639c5fb275778f6470
@@ -7,5 +7,12 @@
SHA1 (patch-ab) = f2cdf02d49b726b4fb7fb210074e7ba53b9b380b
SHA1 (patch-ac) = 8f89257bd93584cd028b659bb8c3379d713339da
SHA1 (patch-ad) = 670a244680d09cb9f558a8777ec8f189145342f8
-SHA1 (patch-ae) = e591c1399d51175295731b2c8947c03c19ede486
+SHA1 (patch-ae) = 414b8c45c65892b9e161c285c5c0327103f8f474
SHA1 (patch-ag) = 8cc4ffab9263f33e4a7da6779cdbbb59d010b475
+SHA1 (patch-ah) = 3df51a25ecc5abdb1821958183e087a9a9345e8a
+SHA1 (patch-ai) = 62f74749d2d4652222c1d0d96c1136af25ffae2e
+SHA1 (patch-aj) = 56031b467679ce4e2ae6bcddbdb129cd8cead479
+SHA1 (patch-ak) = f28929b16bb804c691565adbe3f4c1814154ced7
+SHA1 (patch-al) = be13795b7db10224974f222ce174fb1305d0e582
+SHA1 (patch-am) = 983546e7384fc96f0f182ae23bf5ddd19f7a0008
+SHA1 (patch-an) = 69e70b75b558637b3a2afb612871f7d4a8538c92
diff -r 6d5cb5e9e935 -r bb2d92f0c2b7 multimedia/mpeg_encode/patches/patch-ae
--- a/multimedia/mpeg_encode/patches/patch-ae Fri Oct 07 09:59:32 2005 +0000
+++ b/multimedia/mpeg_encode/patches/patch-ae Sat Oct 08 05:56:40 2005 +0000
@@ -1,7 +1,7 @@
-$NetBSD: patch-ae,v 1.1.1.1 2004/02/24 21:47:25 jmmv Exp $
+$NetBSD: patch-ae,v 1.1.1.1.14.1 2005/10/08 05:56:40 snj Exp $
---- convert/jmovie2jpeg.c.orig 1995-01-20 00:29:24.000000000 +0000
-+++ convert/jmovie2jpeg.c
+--- ../convert/jmovie2jpeg.c.orig 1995-01-20 00:29:24.000000000 +0000
++++ ../convert/jmovie2jpeg.c
@@ -283,12 +283,12 @@ static char inbuffer[300000] = {
if (fread (&(image_offset),sizeof(int),1,inFile) != 1)
{
diff -r 6d5cb5e9e935 -r bb2d92f0c2b7 multimedia/mpeg_encode/patches/patch-ah
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/multimedia/mpeg_encode/patches/patch-ah Sat Oct 08 05:56:40 2005 +0000
@@ -0,0 +1,46 @@
+$NetBSD: patch-ah,v 1.1.2.2 2005/10/08 05:56:40 snj Exp $
+
+Fix for SA17008, from Gentoo.
+
+--- ../convert/eyuvtojpeg.c.orig 1995-04-14 23:16:52.000000000 +0200
++++ ../convert/eyuvtojpeg.c 2005-10-05 13:20:02.000000000 +0200
+@@ -24,6 +24,7 @@
+ *==============*/
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <unistd.h>
+ #include <malloc.h>
+
+ typedef unsigned char uint8;
+@@ -46,8 +47,9 @@
+ void main(int argc, char **argv)
+ {
+ FILE *fpointer;
+- char command[256];
+- char src[256], dest[256];
++ char command[4096];
++ char src[4096], dest[4096], tempfile[4096];
++ int ret;
+
+ if ((strcmp(argv[1],"-?") == 0) ||
+ (strcmp(argv[1],"-h") == 0) ||
+@@ -98,13 +100,16 @@
+ YUVtoPPM();
+
+ fprintf(stdout, "Writing PPM\n");
+- fpointer = fopen("/tmp/foobar", "w");
++ sprintf(tempfile, "%s.tmp", dest);
++ fpointer = fopen(tempfile, "w");
+ WritePPM(fpointer);
+ fclose(fpointer);
+
+ fprintf(stdout, "Converting to JPEG %s\n", dest);
+- sprintf(command, "cjpeg /tmp/foobar > %s", dest);
+- system(command);
++ sprintf(command, "cjpeg %s > %s", tempfile, dest);
++ ret = system(command);
++ unlink(tempfile);
++ return ret;
+ }
+
+
diff -r 6d5cb5e9e935 -r bb2d92f0c2b7 multimedia/mpeg_encode/patches/patch-ai
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/multimedia/mpeg_encode/patches/patch-ai Sat Oct 08 05:56:40 2005 +0000
@@ -0,0 +1,22 @@
+$NetBSD: patch-ai,v 1.1.2.2 2005/10/08 05:56:40 snj Exp $
+
+Fix for SA17008, from Gentoo.
+
+--- ../convert/eyuvtoppm.c.orig 1995-04-14 23:16:52.000000000 +0200
++++ ../convert/eyuvtoppm.c 2005-10-05 13:16:27.000000000 +0200
+@@ -99,13 +99,9 @@
+ fpointer = fopen(dest, "w");
+ if (fpointer == NULL) {
+ fprintf(stderr, "Problems opening %s!\n", dest);
+- fprintf(stderr, "Trying /tmp/foobar instead\n");
+- strcpy(dest, "/tmp/foobar");
+- fpointer = fopen(dest, "w");
+- if (fpointer == NULL) {
+- fprintf(stderr, "Nope, exiting.\n");
++ perror("");
+ exit(1);
+- }}
++ }
+
+ WritePPM(fpointer);
+ fclose(fpointer);
diff -r 6d5cb5e9e935 -r bb2d92f0c2b7 multimedia/mpeg_encode/patches/patch-aj
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/multimedia/mpeg_encode/patches/patch-aj Sat Oct 08 05:56:40 2005 +0000
@@ -0,0 +1,44 @@
+$NetBSD: patch-aj,v 1.1.2.2 2005/10/08 05:56:40 snj Exp $
+
+Fix for SA17008, from Gentoo.
+
+--- ../convert/vidtoeyuv.c.orig 1995-01-20 04:25:39.000000000 +0100
++++ ../convert/vidtoeyuv.c 2005-10-05 13:16:27.000000000 +0200
+@@ -125,9 +125,9 @@
+ XImage *ximage;
+ char *tdata;
+ char *obase;
+- char ofname[256];
++ char ofname[4096], tempfile[4096];
+ int height, width;
+- char command[256];
++ char command[4096];
+ int nth;
+
+ if ((argc != 7) && (argc != 8))usage (argv[0]);
+@@ -223,9 +223,11 @@
+
+
+ sprintf(ofname, "%s%d.yuv", obase, i);
+- outFile = fopen("/tmp/foobar", "w");
++ sprintf(tempfile, "%s%d.yuv.tmp", obase, i);
++ outFile = fopen(tempfile, "w");
+ if (!outFile) {
+ perror("Couldn't open output file.");
++ exit(1);
+ }
+
+ for (r=0; r<height; r++) {
+@@ -241,9 +243,10 @@
+
+ free(tdata);
+
+- sprintf(command, "rawtoppm %d %d < /tmp/foobar | ppmtoyuv > %s",
+- width, height, ofname);
++ sprintf(command, "rawtoppm %d %d < %s | ppmtoyuv > %s",
++ width, height, tempfile, ofname);
+ system(command);
++ unlink(tempfile);
+
+ for (j=0; j<nth-1; j++) {
+ if (read (fd, &image, sizeof(image)) != sizeof(image)) {
diff -r 6d5cb5e9e935 -r bb2d92f0c2b7 multimedia/mpeg_encode/patches/patch-ak
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/multimedia/mpeg_encode/patches/patch-ak Sat Oct 08 05:56:40 2005 +0000
@@ -0,0 +1,44 @@
+$NetBSD: patch-ak,v 1.1.2.2 2005/10/08 05:56:40 snj Exp $
+
+Fix for SA17008, from Gentoo.
+
+--- ../convert/vidtojpeg.c.orig 1995-01-20 04:25:40.000000000 +0100
++++ ../convert/vidtojpeg.c 2005-10-05 13:16:27.000000000 +0200
+@@ -123,9 +123,9 @@
+ XImage *ximage;
+ char *tdata;
+ char *obase;
+- char ofname[256];
++ char ofname[4096], tempfile[4096];
+ int height, width;
+- char command[256];
++ char command[4096];
+
+
+ if ((argc != 7) && (argc != 8))usage (argv[0]);
+@@ -221,9 +221,11 @@
+
+
+ sprintf(ofname, "%s.%d.jpeg", obase, i);
+- outFile = fopen("/tmp/foobar", "w");
++ sprintf(tempfile, "%s.%d.jpeg.tmp", obase, i);
++ outFile = fopen(tempfile, "w");
+ if (!outFile) {
+ perror("Couldn't open output file.");
++ exit(1);
+ }
+
+ for (r=0; r<height; r++) {
+@@ -239,9 +241,10 @@
+
+ free(tdata);
+
+- sprintf(command, "rawtoppm %d %d < /tmp/foobar | cjpeg > %s",
+- width, height, ofname);
++ sprintf(command, "rawtoppm %d %d < %s | cjpeg > %s",
++ width, height, tempfile, ofname);
+ system(command);
++ unlink(tempfile);
+ }
+ }
+
diff -r 6d5cb5e9e935 -r bb2d92f0c2b7 multimedia/mpeg_encode/patches/patch-al
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/multimedia/mpeg_encode/patches/patch-al Sat Oct 08 05:56:40 2005 +0000
@@ -0,0 +1,31 @@
+$NetBSD: patch-al,v 1.1.2.2 2005/10/08 05:56:40 snj Exp $
+
+Fix for SA17008, from Gentoo.
+
+--- ../convert/vidtoppm.c.orig 1995-01-20 04:25:40.000000000 +0100
++++ ../convert/vidtoppm.c 2005-10-05 13:16:27.000000000 +0200
+@@ -220,9 +220,11 @@
+
+
+ sprintf(ofname, "%s%d.ppm", obase, i);
+- outFile = fopen("/tmp/foobar", "w");
++ sprintf(tempfile, "%s%d.ppm.tmp", obase, i);
++ outFile = fopen(tempfile, "w");
+ if (!outFile) {
+ perror("Couldn't open output file.");
++ exit(1);
+ }
+
+ for (r=0; r<height; r++) {
+@@ -238,8 +240,9 @@
+
+ free(tdata);
+
+- sprintf(command, "rawtoppm %d %d < /tmp/foobar > %s",
+- width, height, ofname);
++ sprintf(command, "rawtoppm %d %d < %s > %s",
++ width, height, tempfile, ofname);
+ system(command);
++ unlink(tempfile);
+ }
+ }
diff -r 6d5cb5e9e935 -r bb2d92f0c2b7 multimedia/mpeg_encode/patches/patch-am
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/multimedia/mpeg_encode/patches/patch-am Sat Oct 08 05:56:40 2005 +0000
@@ -0,0 +1,46 @@
+$NetBSD: patch-am,v 1.1.2.2 2005/10/08 05:56:40 snj Exp $
+
+Fix for SA17008, from Gentoo.
+
+--- parallel.c.orig 1995-08-16 20:22:11.000000000 +0200
++++ parallel.c 2005-10-05 13:25:40.000000000 +0200
+@@ -586,6 +586,8 @@
+ * SIDE EFFECTS: none
+ *
+ *===========================================================================*/
++/* internal hook into the ReadFrame function */
++void _ReadFrame(MpegFrame *frame, char *fileName, FILE *fileHook, char *conversion, boolean addPath);
+ void
+ GetRemoteFrame(frame, frameNumber)
+ MpegFrame *frame;
+@@ -615,8 +617,13 @@
+
+ if ( frameNumber != -1 ) {
+ if ( separateConversion ) {
+- sprintf(fileName, "/tmp/foobar%d", machineNumber);
+- filePtr = fopen(fileName, "wb");
++ int fd;
++ snprintf(fileName, sizeof(fileName), "/tmp/mpeg_encode_foobar%dXXXXXX", machineNumber);
++ fd = mkstemp(fileName);
++ if (fd == -1 || (filePtr = fdopen(fd, "wb")) == NULL) {
++ perror("ERROR: mpeg_encode->GetRemoteFrame");
++ exit(1);
++ }
+
+ /* read in stuff, SafeWrite to file, perform local conversion */
+ do {
+@@ -628,10 +635,12 @@
+ fwrite(smallBuffer, 1, numBytes, filePtr);
+ } while ( numBytes == 1000 );
+ fflush(filePtr);
+- fclose(filePtr);
++ rewind(filePtr);
Home |
Main Index |
Thread Index |
Old Index