Patch to fix MSN vulnerability, should fix Bug #60034

5 files changed, 154 insertions, 1 deletions

diff --git a/net-im/gaim/ChangeLog b/net-im/gaim/ChangeLog
index 1f8e3dddbc37..a6dd31a88eed 100644
--- a/net-im/gaim/ChangeLog
+++ b/net-im/gaim/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for net-im/gaim
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-im/gaim/ChangeLog,v 1.212 2004/08/06 13:59:29 rizzo Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-im/gaim/ChangeLog,v 1.213 2004/08/11 19:32:19 rizzo Exp $
+
+*gaim-0.81-r1 (11 Aug 2004)
+
+  11 Aug 2004; Don Seiler <rizzo@gentoo.org> +files/gaim-0.81_msn-slp.diff,
+  +gaim-0.81-r1.ebuild:
+  Patch to fix MSN vulnerability, should fix Bug #60034
 
 *gaim-0.81 (06 Aug 2004)
 
diff --git a/net-im/gaim/Manifest b/net-im/gaim/Manifest
index 2d0ea58f7e52..26d78cf2b442 100644
--- a/net-im/gaim/Manifest
+++ b/net-im/gaim/Manifest
@@ -2,8 +2,11 @@ MD5 bb5be1801b6cdc73f04629e42969cb91 ChangeLog 34450
 MD5 102df79aad1bbdb48989b3bb91d5b110 gaim-0.81.ebuild 3462
 MD5 aa2bd01ed3b53a41dd82677362df7309 gaim-0.80.ebuild 3677
 MD5 19b3cafbbe380403d46cccc45a984b80 metadata.xml 481
+MD5 e08066615f98b12b2a4140de6a115220 gaim-0.81-r1.ebuild 3505
 MD5 ed679fa262748c5626af4d9dcfd4b278 files/digest-gaim-0.81 63
+MD5 f5e49af4d75a79ea4a5142affb1daf1a files/gaim-0.81_msn-slp.diff 1263
 MD5 afc682711efed5d09a9229bd06a7a13b files/gaim-0.76-xinput.patch 644
+MD5 ed679fa262748c5626af4d9dcfd4b278 files/digest-gaim-0.81-r1 63
 MD5 7a5f5d2d68f003ca4e2b61935ca40ea1 files/digest-gaim-0.80 63
 MD5 12944fad880bbec0f05c539550fa5dd4 files/gaim-0.81cvs-gtkblist_dnd.diff 1516
 MD5 d37f310f1242f44dab25d3aa42c8836d files/gaim-0.81cvs-icon_scaling.diff 3999
diff --git a/net-im/gaim/files/digest-gaim-0.81-r1 b/net-im/gaim/files/digest-gaim-0.81-r1
new file mode 100644
index 000000000000..0f0ac7561307
--- /dev/null
+++ b/net-im/gaim/files/digest-gaim-0.81-r1
@@ -0,0 +1 @@
+MD5 ee3460363f51ad24db1c5697d1da3c1b gaim-0.81.tar.bz2 4588215
diff --git a/net-im/gaim/files/gaim-0.81_msn-slp.diff b/net-im/gaim/files/gaim-0.81_msn-slp.diff
new file mode 100644
index 000000000000..f58cadd8bd4b
--- /dev/null
+++ b/net-im/gaim/files/gaim-0.81_msn-slp.diff
@@ -0,0 +1,24 @@
+Index: slp.c
+===================================================================
+RCS file: /cvsroot/gaim/gaim/src/protocols/msn/slp.c,v
+retrieving revision 1.7
+retrieving revision 1.8
+diff -u -d -p -r1.7 -r1.8
+--- slp.c	15 Jun 2004 02:37:25 -0000	1.7
++++ slp.c	11 Aug 2004 18:05:10 -0000	1.8
+@@ -645,8 +645,12 @@ msn_slp_sip_recv(MsnSlpLink *slplink, co
+ 			if ((c = strchr(status, '\r')) || (c = strchr(status, '\n')) ||
+ 				(c = strchr(status, '\0')))
+ 			{
+-				strncpy(temp, status, c - status);
+-				temp[c - status] = '\0';
++				size_t offset =  c - status;
++				if (offset >= sizeof(temp))
++					offset = sizeof(temp) - 1;
++		      
++				strncpy(temp, status, offset);
++				temp[offset] = '\0';
+ 			}
+ 
+ 			gaim_debug_error("msn", "Received non-OK result: %s\n", temp);
+
diff --git a/net-im/gaim/gaim-0.81-r1.ebuild b/net-im/gaim/gaim-0.81-r1.ebuild
new file mode 100644
index 000000000000..05f22c596779
--- /dev/null
+++ b/net-im/gaim/gaim-0.81-r1.ebuild
@@ -0,0 +1,119 @@
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-im/gaim/gaim-0.81-r1.ebuild,v 1.1 2004/08/11 19:32:19 rizzo Exp $
+
+inherit flag-o-matic eutils gcc
+use debug && inherit debug
+
+IUSE="nls perl spell nas debug crypt cjk gnutls silc evo krb4"
+
+DESCRIPTION="GTK Instant Messenger client"
+HOMEPAGE="http://gaim.sourceforge.net/"
+SRC_URI="mirror://sourceforge/gaim/${P}.tar.bz2"
+
+SLOT="0"
+LICENSE="GPL-2"
+KEYWORDS="~x86 ~sparc ~amd64 ~ppc ~alpha ~ia64 ~mips ~hppa"
+
+DEPEND=">=x11-libs/gtk+-2.0
+	>=dev-libs/glib-2.0
+	nas? ( >=media-libs/nas-1.4.1-r1 )
+	sys-devel/gettext
+	media-libs/libao
+	>=media-libs/audiofile-0.2.0
+	perl? ( >=dev-lang/perl-5.8.2-r1
+			!<dev-perl/ExtUtils-MakeMaker-6.17 )
+	spell? ( >=app-text/gtkspell-2.0.2 )
+	dev-libs/nss
+	gnutls? ( net-libs/gnutls )
+	krb4? ( app-crypt/mit-krb5 )
+	silc? ( >=net-im/silc-toolkit-0.9.12-r2 )
+	evo? ( mail-client/evolution )"
+
+PDEPEND="crypt? ( >=x11-plugins/gaim-encryption-2.28 )"
+
+print_gaim_warning() {
+	ewarn
+	ewarn "If you are merging ${P} from an earlier version, you will need"
+	ewarn "to re-merge any plugins like gaim-encryption or gaim-snpp."
+	ewarn
+	ewarn "If you experience problems with gaim, file them as bugs with"
+	ewarn "Gentoo's bugzilla, http://bugs.gentoo.org.  DO NOT report them"
+	ewarn "as bugs with gaim's sourceforge tracker, and by all means DO NOT"
+	ewarn "seek help in #gaim."
+	ewarn
+	ewarn "Be sure to USE=\"debug\" and include a backtrace for any seg"
+	ewarn "faults, see http://gaim.sourceforge.net/gdb.php for details on"
+	ewarn "backtraces."
+	ewarn
+	ewarn "Please read the gaim FAQ at http://gaim.sourceforge.net/faq.php"
+	ewarn
+	einfo
+	einfo "Note that we are now filtering all unstable flags in C[XX]FLAGS."
+	einfo
+	for TICKER in 1 2 3 4 5; do
+		# Double beep here.
+		echo -ne "\a" ; sleep 0.1 &>/dev/null ; sleep 0,1 &>/dev/null
+		echo -ne "\a" ; sleep 1
+	done
+	sleep 3
+}
+
+pkg_setup() {
+	print_gaim_warning
+}
+
+src_unpack() {
+	unpack ${A}
+	cd ${S}
+	use cjk && epatch ${FILESDIR}/gaim-0.76-xinput.patch
+	cd src/protocols/msn/
+	epatch ${FILESDIR}/gaim-0.81_msn-slp.diff
+}
+
+src_compile() {
+	# Stabilize things, for your own good
+	strip-flags
+	replace-flags -O? -O2
+
+	# -msse2 doesn't play nice on gcc 3.2
+	[ "`gcc-version`" == "3.2" ] && filter-flags -msse2
+
+	local myconf
+	use perl || myconf="${myconf} --disable-perl"
+	use spell || myconf="${myconf} --disable-gtkspell"
+	use nls  || myconf="${myconf} --disable-nls"
+	use nas && myconf="${myconf} --enable-nas" || myconf="${myconf} --disable-nas"
+	use evo || myconf="${myconf} --disable-gevolution"
+	use krb4 && myconf="${myconf} --with-krb4=/usr"
+
+	if use gnutls ; then
+		myconf="${myconf} --with-gnutls-includes=/usr/include/gnutls"
+		myconf="${myconf} --with-gnutls-libs=/usr/lib"
+	else
+		myconf="${myconf} --enable-gnutls=no"
+	fi
+
+	if use silc ; then
+		myconf="${myconf} --with-silc-includes=/usr/include/silc-toolkit"
+		myconf="${myconf} --with-silc-libs=/usr/lib"
+	fi
+
+	myconf="${myconf} --with-nspr-includes=/usr/include/nspr"
+	myconf="${myconf} --with-nss-includes=/usr/include/nss"
+	myconf="${myconf} --with-nspr-libs=/usr/lib"
+	myconf="${myconf} --with-nss-libs=/usr/lib"
+
+	econf ${myconf} || die "Configuration failed"
+
+	emake || MAKEOPTS="${MAKEOPTS} -j1" emake || die "Make failed"
+}
+
+src_install() {
+	make install DESTDIR=${D} || die "Install failed"
+	dodoc ABOUT-NLS AUTHORS COPYING HACKING INSTALL NEWS PROGRAMMING_NOTES README ChangeLog VERSION
+}
+
+pkg_postinst() {
+	print_gaim_warning
+}