Bug #515361 tftp FORTIFY_SOURCE strcpy crash

tftp-hpa-0.49-fortify-strcpy-crash.patch

@@ -0,0 +1,26 @@
+diff -urN tftp-hpa-0.49.orig/tftp/tftp.c tftp-hpa-0.49/tftp/tftp.c
+--- tftp-hpa-0.49.orig/tftp/tftp.c	2008-10-20 18:08:31.000000000 -0400
++++ tftp-hpa-0.49/tftp/tftp.c	2009-08-05 09:47:18.072585848 -0400
+@@ -279,15 +279,16 @@
+             struct tftphdr *tp, const char *mode)
+ {
+     char *cp;
++    size_t len;
+ 
+     tp->th_opcode = htons((u_short) request);
+     cp = (char *)&(tp->th_stuff);
+-    strcpy(cp, name);
+-    cp += strlen(name);
+-    *cp++ = '\0';
+-    strcpy(cp, mode);
+-    cp += strlen(mode);
+-    *cp++ = '\0';
++    len = strlen(name) + 1;
++    memcpy(cp, name, len);
++    cp += len;
++    len = strlen(mode) + 1;
++    memcpy(cp, mode, len);
++    cp += len;
+     return (cp - (char *)tp);
+ }
+ 

tftp.spec

@@ -1,7 +1,7 @@
 Summary: The client for the Trivial File Transfer Protocol (TFTP)
 Name: tftp
 Version: 0.49
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: BSD
 Group: Applications/Internet
 Source0: http://www.kernel.org/pub/software/network/tftp/tftp-hpa-%{version}.tar.bz2
@@ -11,6 +11,7 @@ Patch0: tftp-0.40-remap.patch
 Patch2: tftp-hpa-0.39-tzfix.patch
 Patch3: tftp-0.42-tftpboot.patch
 Patch4: tftp-0.49-chk_retcodes.patch
+Patch5: tftp-hpa-0.49-fortify-strcpy-crash.patch
 
 BuildRequires: tcp_wrappers-devel readline-devel
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -43,6 +44,7 @@ enabled unless it is expressly needed.  The TFTP server is run from
 %patch2 -p1 -b .tzfix
 %patch3 -p1 -b .tftpboot
 %patch4 -p1 -b .chk_retcodes
+%patch5 -p1 -b .fortify-strcpy-crash
 
 %build
 
@@ -88,6 +90,9 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_mandir}/man8/*
 
 %changelog
+* Wed Aug 05 2009 Warren Togami <wtogami@redhat.com> - 0.49-5
+- Bug #515361 tftp FORTIFY_SOURCE strcpy crash 
+
 * Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.49-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild