From 63f04fe52f98ac40e538a4f685314e15dccbe017 Mon Sep 17 00:00:00 2001 From: Jaroslav Škarvada Date: Nov 21 2017 19:23:41 +0000 Subject: Renamed loadbuf-fix patch to CVE-2017-16844, because it got CVE number --- diff --git a/procmail-3.22-CVE-2017-16844.patch b/procmail-3.22-CVE-2017-16844.patch new file mode 100644 index 0000000..5e610d7 --- /dev/null +++ b/procmail-3.22-CVE-2017-16844.patch @@ -0,0 +1,13 @@ +diff --git a/src/formisc.c b/src/formisc.c +index 5c2869d..54fd013 100644 +--- a/src/formisc.c ++++ b/src/formisc.c +@@ -103,7 +103,7 @@ void loadsaved(sp)const struct saved*const sp; /* load some saved text */ + } + /* append to buf */ + void loadbuf(text,len)const char*const text;const size_t len; +-{ if(buffilled+len>buflen) /* buf can't hold the text */ ++{ while(buffilled+len>buflen) /* buf can't hold the text */ + buf=realloc(buf,buflen+=Bsize); + tmemmove(buf+buffilled,text,len);buffilled+=len; + } diff --git a/procmail-3.22-loadbuf-fix.patch b/procmail-3.22-loadbuf-fix.patch deleted file mode 100644 index 5e610d7..0000000 --- a/procmail-3.22-loadbuf-fix.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/src/formisc.c b/src/formisc.c -index 5c2869d..54fd013 100644 ---- a/src/formisc.c -+++ b/src/formisc.c -@@ -103,7 +103,7 @@ void loadsaved(sp)const struct saved*const sp; /* load some saved text */ - } - /* append to buf */ - void loadbuf(text,len)const char*const text;const size_t len; --{ if(buffilled+len>buflen) /* buf can't hold the text */ -+{ while(buffilled+len>buflen) /* buf can't hold the text */ - buf=realloc(buf,buflen+=Bsize); - tmemmove(buf+buffilled,text,len);buffilled+=len; - } diff --git a/procmail.spec b/procmail.spec index 93bb27a..2470e4c 100644 --- a/procmail.spec +++ b/procmail.spec @@ -8,7 +8,7 @@ Summary: Mail processing program Name: procmail Version: 3.22 -Release: 44%{?dist} +Release: 45%{?dist} License: GPLv2+ or Artistic Group: Applications/Internet # Source: ftp://ftp.procmail.org/pub/procmail/procmail-%{version}.tar.gz @@ -26,7 +26,7 @@ Patch5: procmail-3.22-ipv6.patch Patch6: procmail-3.22-getline.patch Patch7: procmail-3.22-CVE-2014-3618.patch Patch8: procmail-3.22-crash-fix.patch -Patch9: procmail-3.22-loadbuf-fix.patch +Patch9: procmail-3.22-CVE-2017-16844.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) %description @@ -47,7 +47,7 @@ forward certain incoming mail automatically to someone. %patch6 -p1 -b .getline %patch7 -p1 -b .CVE-2014-3618 %patch8 -p1 -b .crash-fix -%patch9 -p1 -b .loadbuf-fix +%patch9 -p1 -b .CVE-2017-16844 find examples -type f | xargs chmod 644 @@ -83,6 +83,9 @@ rm -rf ${RPM_BUILD_ROOT} %{_mandir}/man[15]/* %changelog +* Tue Nov 21 2017 Jaroslav Škarvada - 3.22-45 +- Renamed loadbuf-fix patch to CVE-2017-16844, because it got CVE number + * Tue Oct 10 2017 Jaroslav Škarvada - 3.22-44 - Fixed possible buffer overflow in loadbuf function Resolves: rhbz#1500071