parent
555cdc75e0
commit
953fec896d
1
.gitignore
vendored
1
.gitignore
vendored
@ -1,3 +1,4 @@
|
||||
iniparser3.0b.tar.gz
|
||||
/iniparser-3.0.tar.gz
|
||||
/iniparser-3.1.tar.gz
|
||||
/iniparser-4.0-git-e24843b.tar.xz
|
||||
|
@ -1,40 +0,0 @@
|
||||
From 654ea5fae25f0863d958e3ecd0bc0672603e0b4c Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schneider <asn@samba.org>
|
||||
Date: Fri, 10 Jan 2014 11:15:43 +0100
|
||||
Subject: [PATCH] Fix crash with crafted ini files.
|
||||
|
||||
If the key or value is bigger than 1024 we will end up in a buffer
|
||||
overflow. The overflow is caught by _FORTIFY_SOURCE, so it's definitely
|
||||
DoS-only. Curiously, because of ample space in the stack frame, it does
|
||||
not result in a crash without _FORTIFY_SOURCE in all cases.
|
||||
|
||||
Signed-off-by: Andreas Schneider <asn@samba.org>
|
||||
---
|
||||
src/iniparser.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/iniparser.c b/src/iniparser.c
|
||||
index 4430032..18dbbbe 100644
|
||||
--- a/src/iniparser.c
|
||||
+++ b/src/iniparser.c
|
||||
@@ -633,7 +633,7 @@ dictionary * iniparser_load(const char * ininame)
|
||||
char line [ASCIILINESZ+1] ;
|
||||
char section [ASCIILINESZ+1] ;
|
||||
char key [ASCIILINESZ+1] ;
|
||||
- char tmp [ASCIILINESZ+1] ;
|
||||
+ char tmp [(ASCIILINESZ * 2) + 1] ;
|
||||
char val [ASCIILINESZ+1] ;
|
||||
|
||||
int last=0 ;
|
||||
@@ -699,7 +699,7 @@ dictionary * iniparser_load(const char * ininame)
|
||||
break ;
|
||||
|
||||
case LINE_VALUE:
|
||||
- sprintf(tmp, "%s:%s", section, key);
|
||||
+ snprintf(tmp, sizeof(tmp), "%s:%s", section, key);
|
||||
errs = dictionary_set(dict, tmp, val) ;
|
||||
break ;
|
||||
|
||||
--
|
||||
1.8.4.2
|
||||
|
@ -2,15 +2,15 @@
|
||||
%bcond_with testsuite
|
||||
|
||||
Name: iniparser
|
||||
Version: 3.1
|
||||
Release: 7%{?dist}
|
||||
Version: 4.0
|
||||
Release: 1.20160821git%{?dist}
|
||||
Summary: C library for parsing "INI-style" files
|
||||
|
||||
Group: System Environment/Libraries
|
||||
License: MIT
|
||||
URL: http://ndevilla.free.fr/%{name}/
|
||||
Source0: http://ndevilla.free.fr/%{name}/%{name}-%{version}.tar.gz
|
||||
Patch0: iniparser-3.1-Fix-crash-with-crafted-ini-files.patch
|
||||
URL: https://github.com/ndevilla/%{name}
|
||||
#Source0: %{name}-%{version}.tar.xz
|
||||
Source0: %{name}-%{version}-git-e24843b.tar.xz
|
||||
|
||||
%description
|
||||
iniParser is an ANSI C library to parse "INI-style" files, often used to
|
||||
@ -27,8 +27,7 @@ documentation for %{name}. If you like to develop programs using %{name},
|
||||
you will need to install %{name}-devel.
|
||||
|
||||
%prep
|
||||
%setup -q -n %{name}
|
||||
%patch0 -p1 -b .iniparser-3.1-Fix-crash-with-crafted-ini-files.patch
|
||||
%setup -q
|
||||
|
||||
%build
|
||||
# remove library rpath from Makefile
|
||||
@ -36,7 +35,7 @@ sed -i 's|-Wl,-rpath -Wl,/usr/lib||g' Makefile
|
||||
sed -i 's|-Wl,-rpath,/usr/lib||g' Makefile
|
||||
# set the CFLAGS to Fedora standard
|
||||
sed -i 's|^CFLAGS|CFLAGS = %{optflags} -fPIC\nNOCFLAGS|' Makefile
|
||||
make %{?_smp_mflags} libiniparser.so
|
||||
make %{?_smp_mflags}
|
||||
|
||||
%install
|
||||
# iniParser doesn't have a 'make install' of its own :(
|
||||
@ -58,14 +57,22 @@ make check
|
||||
%postun -p /sbin/ldconfig
|
||||
|
||||
%files
|
||||
%doc README LICENSE
|
||||
%doc README.md INSTALL AUTHORS
|
||||
%{!?_licensedir:%global license %%doc}
|
||||
%license LICENSE
|
||||
%{_libdir}/libiniparser.so.0
|
||||
|
||||
%files devel
|
||||
%{!?_licensedir:%global license %%doc}
|
||||
%license LICENSE
|
||||
%{_libdir}/libiniparser.so
|
||||
%{_includedir}/*.h
|
||||
|
||||
%changelog
|
||||
* Sun Aug 21 2016 Jaromír Cápík <jaromir.capik@email.cz> - 4.0-1.20160821git
|
||||
- Update to 4.0 [git e24843b] (#1346451)
|
||||
- Spec file maintenance
|
||||
|
||||
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 3.1-7
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user