From 75481a0633fcc70133fa60e885d794e058634508 Mon Sep 17 00:00:00 2001
From: Petr Písař <ppisar@redhat.com>
Date: Jul 04 2017 14:43:48 +0000
Subject: Check for failures when reading edquota input


---

diff --git a/quota-4.03-quotaops-check-return-code-of-fgets-calls.patch b/quota-4.03-quotaops-check-return-code-of-fgets-calls.patch
new file mode 100644
index 0000000..c6be882
--- /dev/null
+++ b/quota-4.03-quotaops-check-return-code-of-fgets-calls.patch
@@ -0,0 +1,73 @@
+From a431ffcc27b364b7cc2b280ad33873e0157e7e99 Mon Sep 17 00:00:00 2001
+From: "Dmitry V. Levin" <ldv@altlinux.org>
+Date: Thu, 18 May 2017 12:29:50 +0300
+Subject: [PATCH] quotaops: check return code of fgets calls
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+fgets can return NULL anytime, do not ignore it.
+
+Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ quotaops.c | 28 ++++++++++++++++++++--------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+diff --git a/quotaops.c b/quotaops.c
+index 5e6026e..6f245b7 100644
+--- a/quotaops.c
++++ b/quotaops.c
+@@ -330,8 +330,12 @@ int readprivs(struct dquot *qlist, int infd)
+ 	/*
+ 	 * Discard title lines, then read lines to process.
+ 	 */
+-	fgets(line, sizeof(line), fd);
+-	fgets(line, sizeof(line), fd);
++	if (!fgets(line, sizeof(line), fd) ||
++	    !fgets(line, sizeof(line), fd)) {
++		errstr(_("Bad format: two title lines assumed\n"));
++		fclose(fd);
++		return -1;
++	}
+ 
+ 	while (fgets(line, sizeof(line), fd)) {
+ 		cnt = sscanf(line, "%s %s %s %s %s %s %s",
+@@ -481,9 +485,13 @@ int readindividualtimes(struct dquot *qlist, int infd)
+ 	/*
+ 	 * Discard title lines, then read lines to process.
+ 	 */
+-	fgets(line, sizeof(line), fd);
+-	fgets(line, sizeof(line), fd);
+-	fgets(line, sizeof(line), fd);
++	if (!fgets(line, sizeof(line), fd) ||
++	    !fgets(line, sizeof(line), fd) ||
++	    !fgets(line, sizeof(line), fd)) {
++		errstr(_("Bad format: three title lines assumed\n"));
++		fclose(fd);
++		return -1;
++	}
+ 
+ 	time(&now);
+ 	while (fgets(line, sizeof(line), fd)) {
+@@ -583,9 +591,13 @@ int readtimes(struct quota_handle **handles, int infd)
+ 	/*
+ 	 * Discard three title lines, then read lines to process.
+ 	 */
+-	fgets(line, sizeof(line), fd);
+-	fgets(line, sizeof(line), fd);
+-	fgets(line, sizeof(line), fd);
++	if (!fgets(line, sizeof(line), fd) ||
++	    !fgets(line, sizeof(line), fd) ||
++	    !fgets(line, sizeof(line), fd)) {
++		errstr(_("Bad format: three title lines assumed\n"));
++		fclose(fd);
++		return -1;
++	}
+ 
+ 	while (fgets(line, sizeof(line), fd)) {
+ 		cnt = sscanf(line, "%s %d %s %d %s", fsp, &btime, bunits, &itime, iunits);
+-- 
+2.9.4
+
diff --git a/quota.spec b/quota.spec
index 1d3a2f9..f2de8f8 100644
--- a/quota.spec
+++ b/quota.spec
@@ -62,6 +62,8 @@ Patch10:    quota-4.03-quotacheck-fix-ask_yn-UB-when-fgets-returns-NULL.patch
 # Check for setuid and setgid calls failure in edquota tool,
 # in upstream after 4.03
 Patch11:    quota-4.03-quotaops-check-setgid-setuid-return-code.patch
+# Check for failures when reading edquota input, in upstream after 4.03
+Patch12:    quota-4.03-quotaops-check-return-code-of-fgets-calls.patch
 BuildRequires: autoconf
 BuildRequires: automake
 BuildRequires: bash
@@ -180,6 +182,7 @@ Linux/UNIX environment.
 %patch9 -p1
 %patch10 -p1
 %patch11 -p1
+%patch12 -p1
 # Unpack forgotten LDAP scripts
 tar -xzkf %{SOURCE5}
 # Regenerate build scripts, also because of Respect-enviroment-CFLAGS.patch
@@ -297,6 +300,7 @@ make check
 - Fix a race between checking for and opening a directory to be scanned
 - Fix an undefined behavior on parsing yes-no answer
 - Check for setuid and setgid calls failure in edquota tool
+- Check for failures when reading edquota input
 
 * Thu Nov 10 2016 Petr Pisar <ppisar@redhat.com> - 1:4.03-4
 - Fix checking a block read error (upstream bug #123)