net-ftp/pure-ftpd: Security revbump for CVE-2020-9365

Bug: https://bugs.gentoo.org/711124
Package-Manager: Portage-2.3.91, Repoman-2.3.20
Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>

3 files changed, 210 insertions, 0 deletions

diff --git a/net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-diraliases_uninitialized_pointer.patch b/net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-diraliases_uninitialized_pointer.patch
new file mode 100644
index 000000000000..7e29934caf5d
--- /dev/null
+++ b/net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-diraliases_uninitialized_pointer.patch
@@ -0,0 +1,31 @@
+From 8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa Mon Sep 17 00:00:00 2001
+From: Frank Denis <github@pureftpd.org>
+Date: Tue, 18 Feb 2020 18:36:58 +0100
+Subject: [PATCH] diraliases: always set the tail of the list to NULL
+
+Spotted and reported by Antonio Norales from GitHub Security Labs.
+Thanks!
+---
+ src/diraliases.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/diraliases.c b/src/diraliases.c
+index 4002a36..fb70273 100644
+--- a/src/diraliases.c
++++ b/src/diraliases.c
+@@ -93,7 +93,6 @@ int init_aliases(void)
+                 (tail->dir = strdup(dir)) == NULL) {
+                 die_mem();
+             }
+-            tail->next = NULL;
+         } else {
+             DirAlias *curr;
+ 
+@@ -105,6 +104,7 @@ int init_aliases(void)
+             tail->next = curr;
+             tail = curr;
+         }
++        tail->next = NULL;
+     }
+     fclose(fp);
+     aliases_up++;
diff --git a/net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-pure_strcmp_OOB_read.patch b/net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-pure_strcmp_OOB_read.patch
new file mode 100644
index 000000000000..4ed197e46d35
--- /dev/null
+++ b/net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-pure_strcmp_OOB_read.patch
@@ -0,0 +1,27 @@
+From 36c6d268cb190282a2c17106acfd31863121b58e Mon Sep 17 00:00:00 2001
+From: Frank Denis <github@pureftpd.org>
+Date: Mon, 24 Feb 2020 15:19:43 +0100
+Subject: [PATCH] pure_strcmp(): len(s2) can be > len(s1)
+
+Reported by Antonio Morales from GitHub Security Labs, thanks!
+---
+ src/utils.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/src/utils.c b/src/utils.c
+index f41492d..a7f0381 100644
+--- a/src/utils.c
++++ b/src/utils.c
+@@ -45,5 +45,11 @@ int pure_memcmp(const void * const b1_, const void * const b2_, size_t len)
+ 
+ int pure_strcmp(const char * const s1, const char * const s2)
+ {
+-    return pure_memcmp(s1, s2, strlen(s1) + 1U);
++    const size_t s1_len = strlen(s1);
++    const size_t s2_len = strlen(s2);
++
++    if (s1_len != s2_len) {
++        return -1;
++    }
++    return pure_memcmp(s1, s2, s1_len);
+ }
diff --git a/net-ftp/pure-ftpd/pure-ftpd-1.0.49-r2.ebuild b/net-ftp/pure-ftpd/pure-ftpd-1.0.49-r2.ebuild
new file mode 100644
index 000000000000..9ca535572cfc
--- /dev/null
+++ b/net-ftp/pure-ftpd/pure-ftpd-1.0.49-r2.ebuild
@@ -0,0 +1,152 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit flag-o-matic
+
+DESCRIPTION="Fast, production-quality, standard-conformant FTP server"
+HOMEPAGE="http://www.pureftpd.org/"
+if [[ "${PV}" == 9999 ]] ; then
+	inherit autotools git-r3
+	EGIT_REPO_URI="https://github.com/jedisct1/pure-ftpd.git"
+else
+	SRC_URI="ftp://ftp.pureftpd.org/pub/${PN}/releases/${P}.tar.bz2
+		http://download.pureftpd.org/pub/${PN}/releases/${P}.tar.bz2"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+fi
+
+LICENSE="BSD"
+SLOT="0"
+
+IUSE="anondel anonperm anonren anonres caps implicittls ldap libressl mysql noiplog pam paranoidmsg postgres resolveids selinux ssl sysquota vchroot xinetd"
+
+REQUIRED_USE="implicittls? ( ssl )"
+
+DEPEND="caps? ( sys-libs/libcap )
+	ldap? ( >=net-nds/openldap-2.0.25 )
+	mysql? ( || (
+		dev-db/mariadb-connector-c
+		dev-db/mysql-connector-c
+	) )
+	pam? ( sys-libs/pam )
+	postgres? ( dev-db/postgresql:= )
+	ssl? (
+		!libressl? ( >=dev-libs/openssl-0.9.6g:0=[-bindist] )
+		libressl? ( dev-libs/libressl:= )
+	)
+	sysquota? ( sys-fs/quota[-rpc] )
+	xinetd? ( virtual/inetd )"
+
+RDEPEND="${DEPEND}
+	dev-libs/libsodium:=
+	net-ftp/ftpbase
+	selinux? ( sec-policy/selinux-ftp )"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.0.28-pam.patch"
+
+	# https://bugs.gentoo.org/711124
+	"${FILESDIR}/${P}-diraliases_uninitialized_pointer.patch"
+	"${FILESDIR}/${P}-pure_strcmp_OOB_read.patch"
+)
+
+src_prepare() {
+	default
+	[[ "${PV}" == 9999 ]] && eautoreconf
+}
+
+src_configure() {
+	# adjust max user length to something more appropriate
+	# for virtual hosts. See bug #62472 for details.
+	sed -e "s:# define MAX_USER_LENGTH 32U:# define MAX_USER_LENGTH 127U:" \
+		-i "${S}/src/ftpd.h" || die "sed failed"
+
+	# Those features are only configurable like this, see bug #179375.
+	use anondel && append-cppflags -DANON_CAN_DELETE
+	use anonperm && append-cppflags -DANON_CAN_CHANGE_PERMS
+	use anonren && append-cppflags -DANON_CAN_RENAME
+	use anonres && append-cppflags -DANON_CAN_RESUME
+	use resolveids && append-cppflags -DALWAYS_RESOLVE_IDS
+
+	# Do not auto-use SSP -- let the user select this.
+	export ax_cv_check_cflags___fstack_protector_all=no
+
+	local myeconfargs=(
+		--enable-largefile
+		# Required for correct pid file location.
+		# pure-ftpd appends "/run/pure-ftpd.pid" to the localstatedir
+		# path, and tries to write to that file even when being
+		# started in foreground. So we need to pin this to /
+		--localstatedir="${EPREFIX}"/
+		--with-altlog
+		--with-cookie
+		--with-diraliases
+		--with-extauth
+		--with-ftpwho
+		--with-language=${PUREFTPD_LANG:=english}
+		--with-peruserlimits
+		--with-privsep
+		--with-puredb
+		--with-quotas
+		--with-ratios
+		--with-throttling
+		--with-uploadscript
+		--with-virtualhosts
+		$(use_with ldap)
+		$(use_with mysql)
+		$(use_with pam)
+		$(use_with paranoidmsg)
+		$(use_with postgres pgsql)
+		$(use_with ssl tls)
+		$(use_with implicittls)
+		$(use_with vchroot virtualchroot)
+		$(use_with sysquota sysquotas)
+		$(usex caps '' '--without-capabilities')
+		$(usex noiplog '--without-iplogging' '')
+		$(usex xinetd '' '--without-inetd')
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	local DOCS=( AUTHORS ChangeLog FAQ HISTORY README* NEWS )
+
+	default
+
+	newinitd "${FILESDIR}/pure-ftpd.rc11" ${PN}
+	newconfd "${FILESDIR}/pure-ftpd.conf_d-3" ${PN}
+
+	if use implicittls ; then
+		sed -i '/^SERVER/s@21@990@' "${ED}"/etc/conf.d/${PN} \
+			|| die "Adjusting default server port for implicittls usage failed!"
+	fi
+
+	keepdir /var/lib/run/${PN}
+
+	if use xinetd ; then
+		insinto /etc/xinetd.d
+		newins "${FILESDIR}/pure-ftpd.xinetd" ${PN}
+	fi
+
+	if use ldap ; then
+		insinto /etc/openldap/schema
+		doins pureftpd.schema
+		insinto /etc/openldap
+		insopts -m 0600
+		doins pureftpd-ldap.conf
+	fi
+}
+
+pkg_postinst() {
+	if [[ -z "${REPLACING_VERSIONS}" ]]; then
+		# This is a new installation
+		elog
+		elog "Before starting Pure-FTPd, you have to edit the /etc/conf.d/pure-ftpd file!"
+		elog
+		ewarn "It's *really* important to read the README provided with Pure-FTPd!"
+		ewarn "Check out http://download.pureftpd.org/pub/pure-ftpd/doc/README for general info"
+		ewarn "and http://download.pureftpd.org/pub/pure-ftpd/doc/README.TLS for SSL/TLS info."
+		ewarn
+	fi
+}