--- fastjar-0.98.orig/jartool.c +++ fastjar-0.98/jartool.c @@ -790,6 +790,7 @@ progname, jarfile); return 1; } + ze->filename[len] = '\0'; len = UNPACK_UB4(header, CEN_EFLEN); len += UNPACK_UB4(header, CEN_COMLEN); if (lseek (fd, len, SEEK_CUR) == -1) @@ -1257,7 +1258,7 @@ exit_on_error("write"); /* write the file name to the zip file */ - if (1 == write(jfd, fname, file_name_length)) + if (-1 == write(jfd, fname, file_name_length)) exit_on_error("write"); if(verbose){ @@ -1730,7 +1731,17 @@ struct stat sbuf; int depth = 0; - tmp_buff = malloc(sizeof(char) * strlen((const char *)filename)); + if(*filename == '/'){ + fprintf(stderr, "Absolute path names are not allowed.\n"); + exit(EXIT_FAILURE); + } + + tmp_buff = malloc(strlen((const char *)filename)); + + if(tmp_buff == NULL) { + fprintf(stderr, "Out of memory.\n"); + exit(EXIT_FAILURE); + } for(;;){ const ub1 *idx = (const unsigned char *)strchr((const char *)start, '/'); @@ -1738,25 +1749,28 @@ if(idx == NULL) break; else if(idx == start){ + tmp_buff[idx - filename] = '/'; start++; continue; } - start = idx + 1; - strncpy(tmp_buff, (const char *)filename, (idx - filename)); - tmp_buff[(idx - filename)] = '\0'; + memcpy(tmp_buff + (start - filename), (const char *)start, (idx - start)); + tmp_buff[idx - filename] = '\0'; #ifdef DEBUG printf("checking the existance of %s\n", tmp_buff); #endif - if(strcmp(tmp_buff, "..") == 0){ + if(idx - start == 2 && memcmp(start, "..", 2) == 0){ --depth; if (depth < 0){ fprintf(stderr, "Traversal to parent directories during unpacking!\n"); exit(EXIT_FAILURE); } - } else if (strcmp(tmp_buff, ".") != 0) + } else if (idx - start != 1 || *start != '.') ++depth; + + start = idx + 1; + if(stat(tmp_buff, &sbuf) < 0){ if(errno != ENOENT) exit_on_error("stat"); @@ -1765,6 +1779,7 @@ #ifdef DEBUG printf("Directory exists\n"); #endif + tmp_buff[idx - filename] = '/'; continue; }else { fprintf(stderr, "Hmmm.. %s exists but isn't a directory!\n", @@ -1781,10 +1796,11 @@ if(verbose && handle) printf("%10s: %s/\n", "created", tmp_buff); + tmp_buff[idx - filename] = '/'; } /* only a directory */ - if(strlen((const char *)start) == 0) + if(*start == '\0') dir = TRUE; #ifdef DEBUG @@ -1792,7 +1808,7 @@ #endif /* If the entry was just a directory, don't write to file, etc */ - if(strlen((const char *)start) == 0) + if(*start == '\0') f_fd = -1; free(tmp_buff); @@ -1876,7 +1892,8 @@ exit(EXIT_FAILURE); } - close(f_fd); + if (f_fd != -1) + close(f_fd); if(verbose && dir == FALSE && handle) printf("%10s: %s\n", --- fastjar-0.98.orig/debian/rules +++ fastjar-0.98/debian/rules @@ -0,0 +1,78 @@ +#!/usr/bin/make -f +# -*- makefile -*- + +# Uncomment this to turn on verbose mode. +#export DH_VERBOSE=1 + + +# These are used for cross-compiling and for saving the configure script +# from having to guess our platform (since we know it already) +DEB_HOST_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE) +DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE) + + +CFLAGS = -Wall -g + +ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS))) + CFLAGS += -O0 +else + CFLAGS += -O2 +endif + +config.status: configure + dh_testdir + rm -rf build + mkdir -p build + cd build && ../configure \ + --host=$(DEB_HOST_GNU_TYPE) \ + --build=$(DEB_BUILD_GNU_TYPE) \ + --prefix=/usr \ + --mandir=\$${prefix}/share/man \ + --infodir=\$${prefix}/share/info \ + CFLAGS="$(CFLAGS)" LDFLAGS="-Wl,-z,defs" + +build: build-stamp + +build-stamp: config.status + dh_testdir + $(MAKE) -C build + touch $@ + +clean: + dh_testdir + dh_testroot + rm -f build-stamp + rm -rf build + dh_clean + +install: build + dh_testdir + dh_testroot + dh_clean -k + dh_installdirs + $(MAKE) -C build install DESTDIR=$(CURDIR)/debian/fastjar + rm -f debian/fastjar/usr/share/info/dir* + + +# Build architecture-independent files here. +binary-indep: build install +# We have nothing to do by default. + +# Build architecture-dependent files here. +binary-arch: build install + dh_testdir + dh_testroot + dh_installchangelogs ChangeLog + dh_installdocs + dh_installexamples + dh_strip + dh_compress + dh_fixperms + dh_installdeb + dh_shlibdeps + dh_gencontrol + dh_md5sums + dh_builddeb + +binary: binary-indep binary-arch +.PHONY: build clean binary-indep binary-arch binary install --- fastjar-0.98.orig/debian/postinst +++ fastjar-0.98/debian/postinst @@ -0,0 +1,6 @@ +#! /bin/sh -e + +update-alternatives --quiet --install /usr/bin/jar jar /usr/bin/fastjar 100 \ + --slave /usr/share/man/man1/jar.1.gz jar.1.gz /usr/share/man/man1/fastjar.1.gz + +#DEBHELPER# --- fastjar-0.98.orig/debian/prerm +++ fastjar-0.98/debian/prerm @@ -0,0 +1,5 @@ +#! /bin/sh -e + +update-alternatives --quiet --remove jar /usr/bin/fastjar + +#DEBHELPER# --- fastjar-0.98.orig/debian/changelog +++ fastjar-0.98/debian/changelog @@ -0,0 +1,92 @@ +fastjar (2:0.98-1ubuntu0.10.04.1) lucid-security; urgency=low + + * SECURITY UPDATE: directory traversal vulnerabilities (LP: #540575) + - jartool.c (extract_jar): Fix up checks for traversal to parent + directories, disallow absolute paths, make the code slightly more + efficient. (patch from trunk) + - CVE-2010-0831 + * Additional patches from the trunk: + - jartool.c (read_entries): Properly zero-terminate filename. + - jartool.c (add_file_to_jar): Fix write return value check. + + -- Marc Deslauriers Fri, 18 Jun 2010 08:20:03 -0400 + +fastjar (2:0.98-1build1) lucid; urgency=low + + * rebuild rest of main for armel armv7/thumb2 optimization; + UbuntuSpec:mobile-lucid-arm-gcc-v7-thumb2 + + -- Alexander Sack Fri, 05 Mar 2010 04:14:39 +0100 + +fastjar (2:0.98-1) unstable; urgency=low + + * New upstream release. + * Bump policy version to 3.8.3. + + -- Matthias Klose Wed, 09 Sep 2009 11:45:33 +0200 + +fastjar (2:0.97-3) unstable; urgency=low + + * Fix segfault in jartool.c (Arthur Loiret). + * Revert the previous change. + + -- Matthias Klose Sat, 10 Jan 2009 12:43:59 +0100 + +fastjar (2:0.97-2) unstable; urgency=medium + + * Build with -O0 on ia64 (segfaults with -O1 and higher). + + -- Matthias Klose Fri, 09 Jan 2009 14:51:04 +0100 + +fastjar (2:0.97-1) unstable; urgency=low + + * New upstream release. + + -- Matthias Klose Tue, 11 Nov 2008 05:58:19 +0100 + +fastjar (2:0.95-4) unstable; urgency=high + + * Fix reallocation for command line expansion (Xerxes Ranby). + Closes: #499015. + + -- Matthias Klose Sun, 21 Sep 2008 20:20:48 +0000 + +fastjar (2:0.95-3) unstable; urgency=medium + + * fastjar: Only create META-INF dir when a new manifest is created, + not on updates (Dalibor Topic). Closes: #489418. LP: #267177. + + -- Matthias Klose Mon, 15 Sep 2008 18:48:18 +0000 + +fastjar (2:0.95-2) unstable; urgency=medium + + * Implement @file support. + * Implement proper directory extracting (Joshua Sumali). + * fastjar can now be used to build openjdk-6/cacao-oj6. + + -- Matthias Klose Tue, 12 Aug 2008 12:20:25 +0000 + +fastjar (2:0.95-1) unstable; urgency=low + + * Upload to unstable. + + -- Matthias Klose Tue, 24 Apr 2007 00:23:33 +0200 + +fastjar (2:0.95-0) experimental; urgency=low + + * fastjar-0.95 release. + + -- Matthias Klose Tue, 13 Feb 2007 02:24:35 +0100 + +fastjar (2:0.95~pre1-1build1) feisty; urgency=low + + * Upload to feisty (package still in the Debian NEW queue). + + -- Matthias Klose Mon, 12 Feb 2007 23:58:20 +0000 + +fastjar (2:0.95~pre1-1) experimental; urgency=low + + * Initial release; fastjar isn't built from the GCC sources anymore. + Packaged from the savannah repository. + + -- Matthias Klose Mon, 12 Feb 2007 23:49:06 +0100 --- fastjar-0.98.orig/debian/compat +++ fastjar-0.98/debian/compat @@ -0,0 +1 @@ +5 --- fastjar-0.98.orig/debian/copyright +++ fastjar-0.98/debian/copyright @@ -0,0 +1,34 @@ +This package was debianized by Matthias Klose on +Mon, 12 Feb 2007 23:49:06 +0100. + +It was downloaded from http://download.savannah.nongnu.org/releases/fastjar/ +Snapshots are built from the CVS repository. + +Upstream Author: Bryan Burns and Cory Jon Hollingsworth + +Copyright: Copyright (C) 2002, 2004, 2005, 2006 Free Software Foundation + Copyright (C) 1999, 2000, 2001 Bryan Burns + Copyright (C) 2007 Dalibor Topic + +License: + + This program is free software; you can redistribute it and/or + modify it under the terms of the GNU General Public License + as published by the Free Software Foundation; either version 2 + of the License, or (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, + Boston, MA 02110-1301, USA. + +On Debian GNU/Linux systems, the complete text of the GNU General +Public License is in `/usr/share/common-licenses/GPL'. + +The Debian packaging is (C) 2007, Matthias Klose and +is licensed under the GPL, see `/usr/share/common-licenses/GPL'. --- fastjar-0.98.orig/debian/watch +++ fastjar-0.98/debian/watch @@ -0,0 +1,3 @@ +# Compulsory line, this is a version 3 file +version=3 +http://download.savannah.nongnu.org/releases/fastjar/fastjar-(.*)\.tar\.gz --- fastjar-0.98.orig/debian/control +++ fastjar-0.98/debian/control @@ -0,0 +1,14 @@ +Source: fastjar +Section: misc +Priority: extra +Maintainer: Ubuntu Core Developers +XSBC-Original-Maintainer: Matthias Klose +Build-Depends: debhelper (>= 5), texinfo, zlib1g-dev +Standards-Version: 3.8.3 + +Package: fastjar +Architecture: any +Depends: dpkg (>= 1.15.4) | install-info, ${shlibs:Depends}, ${misc:Depends} +Description: Jar creation utility + Replacement for Suns .jar creation program. It is written in C + instead of java and is tons faster.