gentoo auto-resync : 14:03:2023 - 00:16:42

3 files changed, 103 insertions, 0 deletions

diff --git a/dev-libs/confuse/Manifest b/dev-libs/confuse/Manifest
index d2662033f9b0..197126fc6fc5 100644
--- a/dev-libs/confuse/Manifest
+++ b/dev-libs/confuse/Manifest
@@ -1,4 +1,6 @@
+AUX confuse-3.3-fix-CVE-2022-40320.patch 1137 BLAKE2B 6fb44768b35dee93ecf03859cc0c925072ef7e8506e91869d9436b7627d9c8d5c9e4608e47479e6ba67ccf98db9b29c1563511b2186ed6ac89563a03c9a75f0c SHA512 0fc8484484ea04906f9196df59bafc9739ed99b785fb001847b9d2d13a6055029debc793b28a0fea67be10534d1dc0d1c3c6bc8c7d28bf0eada8a0aa2bc15226
 DIST confuse-3.3.tar.xz 485140 BLAKE2B 41f426544341966e4a4148c40951dd7f6771b70b182e9ab9f19ce9be781c3ca42c86615f48e91f3997c8e0654111de2360a09c070afc21047b6edb4a8187755f SHA512 93cc62d98166199315f65a2f6f540a9c0d33592b69a2c6a57fd17f132aecc6ece39b9813b96c9a49ae2b66a99b7eba1188a9ce9e360e1c5fb4b973619e7088a0
 EBUILD confuse-3.3-r1.ebuild 1247 BLAKE2B a30d67299d61093a3863dc48e414b2e833bef615674191939d111633bae67c348b101fb5eac00fa48f25d94c34567acfdf60bbc520a8e3b3f63e3c8610ba8f33 SHA512 15f301f21c9e40285cd7a3252c1d761e1fb637f428210139456722ef37d44674da9d2f794ee95552196829dcfcbb4c23be4a59761f5fedeaf26ee28cc8b2c260
+EBUILD confuse-3.3-r2.ebuild 1453 BLAKE2B d623811b160e20e650a679b0b57c2c20dcb68164b0a9ad430a0ccdba586a41c0638b1b8ee4793e82fc920392f7bf1a7e90297edca2df1dae7730c3b1eb9abe53 SHA512 a6c40e6bd845dcf66b2f212b0dd96fff019c379214227dc2eb733b80a5665df082f30cfa810284e128989ffffffec923a5edf5a1378038e64d88801850519c48
 EBUILD confuse-3.3.ebuild 1162 BLAKE2B 867decdf55291a7acf6bf2cc5b557adcd5b2d18e50b116193aaa93532820e07212bf694dbcc4c42d42edbe00cc718b6f50cbd46f0153a4614c44b08828e6aa6c SHA512 6824fbbd39fef2b209d76e92dc4ab35947e4af35d82bef885e8717a4724d36ba634a7c3e7819aa78292f098f0c536a85773c2a4dd5bfc37b5c3fe78d65d1a8ca
 MISC metadata.xml 324 BLAKE2B 4b07d6e5ec2bd4a458f3441b4da7653d4d92b2a3d9ddf451976baac0e0631de0d66fd2fd3812447bf18c91c752e0ae84cd82a476a54af2c57999b92934d52fba SHA512 bd23cabb445578fab14d5eed7d112cf8f75c6be6b3879b56edbeeef69070beef42a6a2f6cf40f0406fdeaf38e46dcd3a4f27ef4bc14e09fc1c95c48492724854
diff --git a/dev-libs/confuse/confuse-3.3-r2.ebuild b/dev-libs/confuse/confuse-3.3-r2.ebuild
new file mode 100644
index 000000000000..57c0210569c8
--- /dev/null
+++ b/dev-libs/confuse/confuse-3.3-r2.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+inherit multilib-minimal flag-o-matic
+
+DESCRIPTION="a configuration file parser library"
+HOMEPAGE="https://github.com/martinh/libconfuse"
+SRC_URI="https://github.com/martinh/libconfuse/releases/download/v${PV}/${P}.tar.xz"
+
+LICENSE="ISC"
+SLOT="0/2.1.0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x86-solaris"
+
+IUSE="nls static-libs"
+
+BDEPEND="
+	sys-devel/flex
+	sys-devel/libtool
+	virtual/pkgconfig
+	nls? ( sys-devel/gettext )
+"
+RDEPEND="
+	nls? ( virtual/libintl[${MULTILIB_USEDEP}] )
+"
+
+PATCHES=(
+	# Upstream commit to fix CVE-2022-40320:
+	# https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b
+	"${FILESDIR}"/confuse-3.3-fix-CVE-2022-40320.patch
+)
+
+DOCS=( AUTHORS )
+
+src_prepare() {
+	default
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	# https://github.com/libconfuse/libconfuse/pull/167
+	append-lfs-flags
+
+	# examples are normally compiled but not installed. They
+	# fail during a mingw crosscompile.
+	local ECONF_SOURCE=${BUILD_DIR}
+	econf \
+		--enable-shared \
+		--disable-examples \
+		$(use_enable nls) \
+		$(use_enable static-libs static)
+}
+
+multilib_src_install_all() {
+	doman doc/man/man3/*.3
+	dodoc -r doc/html
+
+	docinto examples
+	dodoc examples/*.{c,conf}
+
+	find "${D}" -name '*.la' -delete || die
+}
diff --git a/dev-libs/confuse/files/confuse-3.3-fix-CVE-2022-40320.patch b/dev-libs/confuse/files/confuse-3.3-fix-CVE-2022-40320.patch
new file mode 100644
index 000000000000..478c8556fe59
--- /dev/null
+++ b/dev-libs/confuse/files/confuse-3.3-fix-CVE-2022-40320.patch
@@ -0,0 +1,39 @@
+https://bugs.gentoo.org/901089
+https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b
+
+(Rebased by Vaibhav Rustagi <vaibhavrustagi@google.com>)
+
+From d73777c2c3566fb2647727bb56d9a2295b81669b Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Fri, 2 Sep 2022 16:12:46 +0200
+Subject: [PATCH] Fix #163: unterminated username used with getpwnam()
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+--- a/src/confuse.c
++++ b/src/confuse.c
+@@ -1863,18 +1863,20 @@ DLLIMPORT char *cfg_tilde_expand(const char *filename)
+ 			passwd = getpwuid(geteuid());
+ 			file = filename + 1;
+ 		} else {
+-			/* ~user or ~user/path */
+-			char *user;
++			char *user; /* ~user or ~user/path */
++			size_t len;
+ 
+ 			file = strchr(filename, '/');
+ 			if (file == 0)
+ 				file = filename + strlen(filename);
+ 
+-			user = malloc(file - filename);
++			len = file - filename - 1;
++			user = malloc(len + 1);
+ 			if (!user)
+ 				return NULL;
+ 
+-			strncpy(user, filename + 1, file - filename - 1);
++			strncpy(user, &filename[1], len);
++			user[len] = 0;
+ 			passwd = getpwnam(user);
+ 			free(user);
+ 		}
+