[pkgsrc/trunk]: pkgsrc/security/gnupg2 "While fixing a bug reported by Hugh W...

[shannonjr <shannonjr%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/21b8cbe1111f
branches:  trunk
changeset: 521917:21b8cbe1111f
user:      shannonjr <shannonjr%pkgsrc.org@localhost>
date:      Mon Nov 27 20:37:20 2006 +0000

description:
"While fixing a bug reported by Hugh Warrington, a buffer overflow has
been identified in all released GnuPG versions.  Exploiting this
overflow seems to be possible.  Apply the following patch to GnuPG."
2006-11-27  Werner Koch  <wk%g10code.com@localhost>

gnupg2 has been patched accordingly.

diffstat:

 security/gnupg2/distinfo         |   3 ++-
 security/gnupg2/patches/patch-ag |  13 +++++++++++++
 2 files changed, 15 insertions(+), 1 deletions(-)

diffs (31 lines):

diff -r 09807b34a459 -r 21b8cbe1111f security/gnupg2/distinfo
--- a/security/gnupg2/distinfo  Mon Nov 27 20:37:10 2006 +0000
+++ b/security/gnupg2/distinfo  Mon Nov 27 20:37:20 2006 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.1.1.1 2006/11/17 12:13:11 shannonjr Exp $
+$NetBSD: distinfo,v 1.2 2006/11/27 20:37:20 shannonjr Exp $
 
 SHA1 (gnupg-2.0.0.tar.bz2) = c335957368ea88bcb658922e7d3aae7e3ac6896d
 RMD160 (gnupg-2.0.0.tar.bz2) = 739e303f1380ec9cb5c3a248179001700efe6f2e
@@ -13,3 +13,4 @@
 SHA1 (patch-ab) = 501bce9a8474ac37a8e01eceae9b52f0e87868d5
 SHA1 (patch-ac) = ca9e1044a0eb8d3e25cd9c20174047a96038c236
 SHA1 (patch-af) = 04fdcbf19c4d530fc735c04dd785c07692d8b96d
+SHA1 (patch-ag) = 4fa09f0357ac2b5f2602ae0fbee91f4ff26eab20
diff -r 09807b34a459 -r 21b8cbe1111f security/gnupg2/patches/patch-ag
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/security/gnupg2/patches/patch-ag  Mon Nov 27 20:37:20 2006 +0000
@@ -0,0 +1,13 @@
+$NetBSD: patch-ag,v 1.1 2006/11/27 20:37:20 shannonjr Exp $
+
+--- ./g10/openfile.c.orig      2006-09-14 08:18:39.000000000 -0600
++++ ./g10/openfile.c
+@@ -145,7 +145,7 @@ ask_outfile_name( const char *name, size
+ 
+     s = _("Enter new filename");
+ 
+-    n = strlen(s) + namelen + 10;
++    n = strlen(s) + (defname?strlen (defname):0) + 10;
+     defname = name && namelen? make_printable_string( name, namelen, 0): NULL;
+     prompt = xmalloc(n);
+     if( defname )