| 20 | | Most of this stuff is readily available for you at the [http://infrastructure.fedoraproject.org/ Fedora Infrastructure] repos, because they still use a certain amount of EL5 builders. Be warned, however, that you need a certain amount of knowledge to go this route, so if you don't mind accidentally blowing up your machine, just go ahead. |
| | 19 | Most of this stuff is readily available for you at the [http://infrastructure.fedoraproject.org/ Fedora Infrastructure] repos, because they still use a certain number of EL5 builders. Be warned, however, that you need a certain amount of knowledge to go this route, so if you don't mind accidentally blowing up your machine, just go ahead. |
| 99 | | --- mc-temp/contrib/dist/redhat/mc.spec.in 2009-07-04 00:57:19.000000000 +0400 |
| 100 | | +++ mc-temp/contrib/dist/redhat/mc.spec.in 2009-07-04 00:53:46.000000000 +0400 |
| 101 | | @@ -22,7 +22,7 @@ |
| 102 | | Source0: mc-%{ver}.tar.gz |
| 103 | | URL: http://www.midnight-commander.org/ |
| 104 | | BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) |
| 105 | | -BuildRequires: glib2-devel e2fsprogs-devel slang-devel |
| 106 | | +BuildRequires: glib2-devel e2fsprogs-devel slang-devel pcre-devel |
| | 102 | diff -up glib-2.12.3/glib/gbase64.c.CVE-2008-4316 glib-2.12.3/glib/gbase64.c |
| | 103 | --- glib-2.12.3/glib/gbase64.c.CVE-2008-4316 2006-07-05 12:42:18.000000000 -0400 |
| | 104 | +++ glib-2.12.3/glib/gbase64.c 2009-03-09 11:48:11.161822330 -0400 |
| | 105 | @@ -54,8 +54,9 @@ static const char base64_alphabet[] = |
| | 106 | * |
| | 107 | * The output buffer must be large enough to fit all the data that will |
| | 108 | * be written to it. Due to the way base64 encodes you will need |
| | 109 | - * at least: @len * 4 / 3 + 6 bytes. If you enable line-breaking you will |
| | 110 | - * need at least: @len * 4 / 3 + @len * 4 / (3 * 72) + 7 bytes. |
| | 111 | + * at least: (@len / 3 + 1) * 4 + 4 bytes (+ 4 may be needed in case of |
| | 112 | + * non-zero state). If you enable line-breaking you will need at least: |
| | 113 | + * ((@len / 3 + 1) * 4 + 4) / 72 + 1 bytes of extra space. |
| | 114 | * |
| | 115 | * @break_lines is typically used when putting base64-encoded data in emails. |
| | 116 | * It breaks the lines at 72 columns instead of putting all of the text on |
| | 117 | @@ -220,8 +221,13 @@ g_base64_encode (const guchar *data, |
| | 118 | gint state = 0, outlen; |
| | 119 | gint save = 0; |
| 108 | | %description |
| 109 | | GNU Midnight Commander is a visual file manager. It's a feature rich |
| | 121 | - /* We can use a smaller limit here, since we know the saved state is 0 */ |
| | 122 | - out = g_malloc (len * 4 / 3 + 4); |
| | 123 | + /* We can use a smaller limit here, since we know the saved state is 0, |
| | 124 | + +1 is needed for trailing \0, also check for unlikely integer overflow */ |
| | 125 | + if (len >= ((G_MAXSIZE - 1) / 4 - 1) * 3) |
| | 126 | + g_error ("%s: input too large for Base64 encoding (%"G_GSIZE_FORMAT" chars)", |
| | 127 | + G_STRLOC, len); |
| | 128 | + |
| | 129 | + out = g_malloc ((len / 3 + 1) * 4 + 1); |
| | 130 | outlen = g_base64_encode_step (data, len, FALSE, out, &state, &save); |
| | 131 | outlen += g_base64_encode_close (FALSE, |
| | 132 | out + outlen, |
| | 133 | @@ -264,7 +270,8 @@ static const unsigned char mime_base64_r |
| | 134 | * |
| | 135 | * The output buffer must be large enough to fit all the data that will |
| | 136 | * be written to it. Since base64 encodes 3 bytes in 4 chars you need |
| | 137 | - * at least: @len * 3 / 4 bytes. |
| | 138 | + * at least: (@len / 4) * 3 + 3 bytes (+ 3 may be needed in case of non-zero |
| | 139 | + * state). |
| | 140 | * |
| | 141 | * Return value: The number of bytes of output that was written |
| | 142 | * |
| | 143 | @@ -338,12 +345,15 @@ g_base64_decode (const gchar *text, |
| | 144 | gsize *out_len) |
| | 145 | { |
| | 146 | guchar *ret; |
| | 147 | - gint inlen, state = 0; |
| | 148 | + gsize inlen; |
| | 149 | + gint state = 0; |
| | 150 | guint save = 0; |
| | 151 | |
| | 152 | inlen = strlen (text); |
| | 153 | - ret = g_malloc0 (inlen * 3 / 4); |
| | 154 | - |
| | 155 | + /* We can use a smaller limit here, since we know the saved state is 0, |
| | 156 | + +1 used to avoid calling g_malloc0(0), and hence retruning NULL */ |
| | 157 | + ret = g_malloc0 ((inlen / 4) * 3 + 1); |
| | 158 | + |
| | 159 | *out_len = g_base64_decode_step (text, inlen, ret, &state, &save); |
| | 160 | |
| | 161 | return ret; |
