Fix security bug #230075.

Package-Manager: portage-2.2_rc1/cvs/Linux 2.6.25-gentoo-r3 x86_64

4 files changed, 81 insertions, 2 deletions

diff --git a/net-p2p/linuxdcpp/ChangeLog b/net-p2p/linuxdcpp/ChangeLog
index f780b4f47b8d..d9c59b09af51 100644
--- a/net-p2p/linuxdcpp/ChangeLog
+++ b/net-p2p/linuxdcpp/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for net-p2p/linuxdcpp
 # Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-p2p/linuxdcpp/ChangeLog,v 1.25 2008/05/02 16:07:19 armin76 Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-p2p/linuxdcpp/ChangeLog,v 1.26 2008/06/29 18:46:01 coldwind Exp $
+
+*linuxdcpp-1.0.1-r1 (29 Jun 2008)
+
+  29 Jun 2008; Santiago M. Mola <coldwind@gentoo.org>
+  +files/linuxdcpp-1.0.1-fix-remote-vulnerability.patch,
+  +linuxdcpp-1.0.1-r1.ebuild:
+  Fix security bug #230075.
 
   02 May 2008; Raúl Porcel <armin76@gentoo.org> linuxdcpp-1.0.1.ebuild:
   Fix SRC_URI, bug #218657
diff --git a/net-p2p/linuxdcpp/Manifest b/net-p2p/linuxdcpp/Manifest
index 8963f246ae5b..e1e9be601f3d 100644
--- a/net-p2p/linuxdcpp/Manifest
+++ b/net-p2p/linuxdcpp/Manifest
@@ -1,5 +1,7 @@
+AUX linuxdcpp-1.0.1-fix-remote-vulnerability.patch 477 RMD160 ebae519df7ece754f3206c214d1662dd351679c0 SHA1 5094c1da73582b31db28078c924f0f083971b378 SHA256 ebb4fbdb4b291f26f0df76caa302fc3565454c43e418caeb2c1a1579f7d3b49e
 DIST linuxdcpp-1.0.1.tar.bz2 282410 RMD160 daaac78b0e7bd73cccd81f23d1983814937f930b SHA1 0da46e3c1920f8d898852a2abeb197609fe35ae7 SHA256 647448d41e8b24219bda4f286e2e6bef0eb956bd4f51e12cced18e3e94de1b38
+EBUILD linuxdcpp-1.0.1-r1.ebuild 1296 RMD160 40408e0607a3e4e8cc184049f88faec02d492fe3 SHA1 6d9012a76d4d38e8a41722ee8127889036431a92 SHA256 6b9e795ab1d07aee90c9141376ef2aead0f7c90ce471e66997d67950ac38023f
 EBUILD linuxdcpp-1.0.1.ebuild 1190 RMD160 19aa34862d6c173d076127ddcffb95fb73f234fe SHA1 191dc37481ab50158e171c661382e4b4efc34a49 SHA256 b86f590d9152e0b5ccdb42c5a6e2b952ad7834416fd38da7d33b527bc35121fc
 EBUILD linuxdcpp-9999.ebuild 1284 RMD160 c2537dc188ef6b5e01d1e0f7e9265350697ef66c SHA1 f71857349670ee27043f72288f9a3f38e1a8237a SHA256 074abf8f2c8dc310cebe670998e45ad3e58e5c9d4ad0a1432019733ff7d17604
-MISC ChangeLog 3709 RMD160 4ab12dbf926fa315c1636329029599d403a5489a SHA1 b38d9827723aa141ef28e65c06b2390803feac8d SHA256 91b7454561bb2ce8eec1c91840e93655cd52bdfca75f734b2a1f4fae96a9a847
+MISC ChangeLog 3915 RMD160 d39c56183178ebf83484e8cb4dc3b76570638e5d SHA1 f198689aa12ee2a7b5157136173e3421d18f89ea SHA256 aa30d6a49c0138424a1fd7b0110720cb2eebaf4a794e6304ad9855ddb860a4a4
 MISC metadata.xml 160 RMD160 828887200387b28c37fc97111fc6bc3a0a2fcccd SHA1 813ef5bc57f6a8d95e7cab7a745a2a824858f49c SHA256 fe06593409e7f28665c032001005e94cb650299711a0af7f1a558bdb56c4004f
diff --git a/net-p2p/linuxdcpp/files/linuxdcpp-1.0.1-fix-remote-vulnerability.patch b/net-p2p/linuxdcpp/files/linuxdcpp-1.0.1-fix-remote-vulnerability.patch
new file mode 100644
index 000000000000..91f164a37d18
--- /dev/null
+++ b/net-p2p/linuxdcpp/files/linuxdcpp-1.0.1-fix-remote-vulnerability.patch
@@ -0,0 +1,15 @@
+http://bugs.gentoo.org/show_bug.cgi?id=230075
+Security bug, fixed upstream.
+--- client/ShareManager.cpp	13 Oct 2007 21:56:55 -0000	1.14
++++ client/ShareManager.cpp	29 Jun 2008 15:34:36 -0000	1.15
+@@ -926,6 +926,10 @@
+ 			}
+ 			j = i + 1;
+ 		}
++
++		if(it == directories.end())
++			return NULL;
++
+ 		for(ShareManager::Directory::MapIter it2 = it->second->directories.begin(); it2 != it->second->directories.end(); ++it2) {
+ 			it2->second->toXml(sos, indent, tmp, recurse);
+ 		}
diff --git a/net-p2p/linuxdcpp/linuxdcpp-1.0.1-r1.ebuild b/net-p2p/linuxdcpp/linuxdcpp-1.0.1-r1.ebuild
new file mode 100644
index 000000000000..704601f69773
--- /dev/null
+++ b/net-p2p/linuxdcpp/linuxdcpp-1.0.1-r1.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-p2p/linuxdcpp/linuxdcpp-1.0.1-r1.ebuild,v 1.1 2008/06/29 18:46:01 coldwind Exp $
+
+inherit eutils
+
+DESCRIPTION="Direct connect client, looks and works like famous DC++"
+HOMEPAGE="http://linuxdcpp.berlios.de"
+SRC_URI="mirror://berlios/${PN}/${P}.tar.bz2"
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86 ~x86-fbsd"
+IUSE="debug"
+
+RDEPEND=">=gnome-base/libglade-2.4
+	>=x11-libs/gtk+-2.6
+	app-arch/bzip2
+	dev-libs/openssl"
+DEPEND="${RDEPEND}
+	media-libs/fontconfig
+	>=dev-util/scons-0.96
+	dev-util/pkgconfig"
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+	epatch "${FILESDIR}"/${P}-fix-remote-vulnerability.patch
+}
+
+src_compile() {
+	local myconf=""
+	use debug && myconf="${myconf} debug=1"
+
+	scons ${myconf} ${MAKEOPTS} CXXFLAGS="${CXXFLAGS}" PREFIX=/usr || die "scons failed"
+}
+
+src_install() {
+	insinto /usr/share/${PN}
+	doins -r ${PN} pixmaps glade
+
+	dodoc Readme.txt Changelog.txt Credits.txt
+
+	dosym /usr/share/${PN}/${PN} /usr/bin/${PN}
+	fperms +x /usr/share/${PN}/${PN}
+
+	doicon pixmaps/${PN}.png
+
+	make_desktop_entry ${PN} "${PN}" ${PN}
+}
+
+pkg_postinst() {
+	elog
+	elog "After adding first directory to shares you might need to restart linuxdcpp."
+	elog
+}