rpms/vixie-cron/devel vixie-cron-4.1-_37-limits.patch, NONE, 1.1 vixie-cron-4.1-_38-CAN-2005-1038.patch, NONE, 1.1 vixie-cron.spec, 1.47, 1.48

[fedora-cvs-commits at redhat.com]

Update of /cvs/dist/rpms/vixie-cron/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv16639

Modified Files:
	vixie-cron.spec 
Added Files:
	vixie-cron-4.1-_37-limits.patch 
	vixie-cron-4.1-_38-CAN-2005-1038.patch 
Log Message:
fix bugs 154922(CAN-2005-1038) and 154575

vixie-cron-4.1-_37-limits.patch:
 macros.h |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

--- NEW FILE vixie-cron-4.1-_37-limits.patch ---
--- vixie-cron-4.1/macros.h.limits	2004-07-21 09:31:55.000000000 -0400
+++ vixie-cron-4.1/macros.h	2005-04-14 18:11:35.475147000 -0400
@@ -44,11 +44,11 @@
 #define STDERR		2	/*   stderr's? */
 #define ERROR_EXIT	1	/* exit() with this will scare the shell */
 #define	OK_EXIT		0	/* exit() with this is considered 'normal' */
-#define	MAX_FNAME	100	/* max length of internally generated fn */
-#define	MAX_COMMAND	1000	/* max length of internally generated cmd */
-#define	MAX_ENVSTR	1000	/* max length of envvar=value\0 strings */
-#define	MAX_TEMPSTR	100	/* obvious */
-#define	MAX_UNAME	33	/* max length of username, should be overkill */
+#define	MAX_FNAME	PATH_MAX/* max length of internally generated fn */
+#define	MAX_COMMAND	131072	/* max length of internally generated cmd (max sh cmd line length) */
+#define	MAX_ENVSTR	131072	/* max length of envvar=value\0 strings */
+#define	MAX_TEMPSTR	131072	/* obvious */
+#define	MAX_UNAME	256	/* max length of username  */
 #define	ROOT_UID	0	/* don't change this, it really must be root */
 #define	ROOT_USER	"root"	/* ditto */
 

vixie-cron-4.1-_38-CAN-2005-1038.patch:
 crontab.c |   17 ++++++++++++++++-
 1 files changed, 16 insertions(+), 1 deletion(-)

--- NEW FILE vixie-cron-4.1-_38-CAN-2005-1038.patch ---
--- vixie-cron-4.1/crontab.c.CAN-2005-1038	2005-04-14 18:39:04.356618000 -0400
+++ vixie-cron-4.1/crontab.c	2005-04-14 18:43:50.262425000 -0400
@@ -488,7 +488,7 @@
 	(void)signal(SIGHUP, SIG_DFL);
 	(void)signal(SIGINT, SIG_DFL);
 	(void)signal(SIGQUIT, SIG_DFL);      
-	if (stat(Filename, &statbuf) < 0) {
+	if (lstat(Filename, &statbuf) < 0) {
 		perror("fstat");
 		goto fatal;
 	}
@@ -497,6 +497,21 @@
 			ProgramName);
 		goto remove;
 	}
+
+	if (  (!S_ISREG(statbuf.st_mode))
+	    ||(S_ISLNK(statbuf.st_mode))
+	    ||(S_ISDIR(statbuf.st_mode))
+            ||(S_ISCHR(statbuf.st_mode))
+	    ||(S_ISBLK(statbuf.st_mode))
+            ||(S_ISFIFO(statbuf.st_mode))
+	    ||(S_ISSOCK(statbuf.st_mode))
+	    )
+	{
+	    fprintf(stderr, "%s: illegal crontab\n",
+			ProgramName);
+		goto remove;	    
+	}
+
 	fprintf(stderr, "%s: installing new crontab\n", ProgramName);
         fclose(NewCrontab);
 	NewCrontab=fopen(Filename,"r+");


Index: vixie-cron.spec
===================================================================
RCS file: /cvs/dist/rpms/vixie-cron/devel/vixie-cron.spec,v
retrieving revision 1.47
retrieving revision 1.48
diff -u -r1.47 -r1.48
--- vixie-cron.spec	8 Apr 2005 16:22:42 -0000	1.47
+++ vixie-cron.spec	14 Apr 2005 23:01:25 -0000	1.48
@@ -7,7 +7,7 @@
 Summary: The Vixie cron daemon for executing specified programs at set times.
 Name: vixie-cron
 Version: 4.1
-Release: 32_FC4
+Release: 33
 Epoch:   1
 License: distributable
 Group:   System Environment/Base
@@ -51,6 +51,8 @@
 Patch34: vixie-cron-4.1-_34-pam_fail_close_session.patch
 Patch35: vixie-cron-4.1-_35-crontab-job-control.patch
 Patch36: vixie-cron-4.1-_36-pam_close_fork_fail.patch
+Patch37: vixie-cron-4.1-_37-limits.patch
+Patch38: vixie-cron-4.1-_38-CAN-2005-1038.patch
 
 Buildroot: %{_tmppath}/%{name}-%{version}-root
 Requires: sysklogd >= 1.3.33-6, bash >= 2.0
@@ -118,6 +120,8 @@
 %patch34 -p1 -b .pam_fail_close_session
 %patch35 -p1 -b .job_control
 %patch36 -p1 -b .pam_close_fork_fail
+%patch37 -p1 -b .limits
+%patch38 -p1 -b .CAN-2005-1038
 
 %build
 make RPM_OPT_FLAGS="$RPM_OPT_FLAGS"
@@ -175,6 +179,12 @@
 %config(noreplace) /etc/sysconfig/crond
 
 %changelog
+* Thu Apr 14 2005 Jason Vas Dias <jvdias at redhat.com> - 4.1-33_FC4
+- fix bug 154922 / CAN-2005-1038: check that new crontab is 
+      regular file after editor session ends.
+- fix bug 154575: use PATH_MAX (4096) as max filename length; also make 
+      limits on command line and env.var. lengths sensible (131072).
+
 * Fri Apr 08 2005 Jason Vas Dias <jvdias at redhat.com> - 4.1-32_FC4
 - do pam_close_session and pam_setcred(pamh, PAM_DELETE_CRED)
 - if fork fails