ryan77627/guix
1
0
Fork 0
mirror of https://git.in.rschanz.org/ryan77627/guix.git synced 2024-12-24 05:18:07 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: ntfs-3g: Fix CVE-2017-0358.

Browse source 
* gnu/packages/linux.scm (ntfs-3g)[source]: Add patch.
* gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
This commit is contained in:
Kei Kebreau 2017-02-09 22:27:51 -05:00
parent b2b02ba3ef
commit 1a82ba660e
No known key found for this signature in database
GPG key ID: E6A5EE3C19467A0D
3 changed files with 45 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
gnu/local.mk
View file

@ -4,7 +4,7 @@
# Copyright © 2016 Mathieu Lirzin <mthl@gnu.org>
# Copyright © 2013, 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
# Copyright © 2016 Chris Marusich <cmmarusich@gmail.com>
# Copyright © 2016 Kei Kebreau <kei@openmailbox.org>
# Copyright © 2016, 2017 Kei Kebreau <kei@openmailbox.org>
# Copyright © 2016 Rene Saavedra <rennes@openmailbox.org>
# Copyright © 2016 Adonay "adfeno" Felipe Nogueira <https://libreplanet.org/wiki/User:Adfeno> <adfeno@openmailbox.org>
# Copyright © 2016, 2017 Ricardo Wurmus <rekado@elephly.net>
@ -777,6 +777,7 @@ dist_patch_DATA = \
%D%/packages/patches/ninja-zero-mtime.patch \
%D%/packages/patches/node-9077.patch \
%D%/packages/patches/nss-pkgconfig.patch \
%D%/packages/patches/ntfs-3g-CVE-2017-0358.patch \
%D%/packages/patches/nvi-assume-preserve-path.patch \
%D%/packages/patches/nvi-dbpagesize-binpower.patch \
%D%/packages/patches/nvi-db4.patch \

1
gnu/packages/linux.scm
View file

@ -2908,6 +2908,7 @@ (define-public ntfs-3g
(base32
"180y5y09h30ryf2vim8j30a2npwz1iv9ly5yjmh3wjdkwh2jrdyp"))
(modules '((guix build utils)))
(patches (search-patches "ntfs-3g-CVE-2017-0358.patch"))
(snippet
;; Install under $prefix.
'(substitute* '("src/Makefile.in" "ntfsprogs/Makefile.in")

42
gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch Normal file
View file

@ -0,0 +1,42 @@
Fix CVE-2017-0358:
http://seclists.org/oss-sec/2017/q1/259
This patch was copied from the above URL.
diff -ur ntfs-3g.old/src/lowntfs-3g.c ntfs-3g/src/lowntfs-3g.c
--- ntfs-3g.old/src/lowntfs-3g.c 2017-02-09 15:01:04.074331542 -0500
+++ ntfs-3g/src/lowntfs-3g.c 2017-02-09 15:06:35.757580937 -0500
@@ -3827,13 +3827,14 @@
struct stat st;
pid_t pid;
const char *cmd = "/sbin/modprobe";
+ char *env = (char*)NULL;
struct timespec req = { 0, 100000000 }; /* 100 msec */
fuse_fstype fstype;
if (!stat(cmd, &st) && !geteuid()) {
pid = fork();
if (!pid) {
- execl(cmd, cmd, "fuse", NULL);
+ execle(cmd, cmd, "fuse", NULL, &env);
_exit(1);
} else if (pid != -1)
waitpid(pid, NULL, 0);
diff -ur ntfs-3g.old/src/ntfs-3g.c ntfs-3g/src/ntfs-3g.c
--- ntfs-3g.old/src/ntfs-3g.c 2017-02-09 15:01:04.074331542 -0500
+++ ntfs-3g/src/ntfs-3g.c 2017-02-09 15:06:26.077252571 -0500
@@ -3612,13 +3612,14 @@
struct stat st;
pid_t pid;
const char *cmd = "/sbin/modprobe";
+ char *env = (char*)NULL;
struct timespec req = { 0, 100000000 }; /* 100 msec */
fuse_fstype fstype;
if (!stat(cmd, &st) && !geteuid()) {
pid = fork();
if (!pid) {
- execl(cmd, cmd, "fuse", NULL);
+ execle(cmd, cmd, "fuse", NULL, &env);
_exit(1);
} else if (pid != -1)
waitpid(pid, NULL, 0);