rpms/openmotif/FC-4 openMotif-2.2.3-CVE-2005-3964.patch, NONE, 1.1 openmotif.spec, 1.31, 1.32

[fedora-cvs-commits at redhat.com]

Author: twoerner

Update of /cvs/dist/rpms/openmotif/FC-4
In directory cvs.devel.redhat.com:/tmp/cvs-serv19760

Modified Files:
	openmotif.spec 
Added Files:
	openMotif-2.2.3-CVE-2005-3964.patch 
Log Message:
[tw]
- fixed CVE-2005-3964: libUil buffer overflows (#174815)



openMotif-2.2.3-CVE-2005-3964.patch:
 UilDiags.c  |    4 ++--
 UilSrcSrc.c |    3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

--- NEW FILE openMotif-2.2.3-CVE-2005-3964.patch ---
--- openMotif-2.2.3/clients/uil/UilSrcSrc.c.CVE-2005-3964	2002-01-10 21:55:47.000000000 +0100
+++ openMotif-2.2.3/clients/uil/UilSrcSrc.c	2005-12-22 18:21:04.000000000 +0100
@@ -631,7 +631,8 @@
 
     /* place the file name in the expanded_name buffer */
 
-    strcpy(buffer, c_file_name);
+    strncpy(buffer, c_file_name, 256);
+    buffer[255] = '\0';
 
 /*    Determine if this is the main file or an include file.  */
 
--- openMotif-2.2.3/clients/uil/UilDiags.c.CVE-2005-3964	2005-12-22 18:17:10.000000000 +0100
+++ openMotif-2.2.3/clients/uil/UilDiags.c	2005-12-22 18:17:14.000000000 +0100
@@ -293,12 +293,12 @@
     va_start(ap, l_start_column);
 
 #ifndef NO_MESSAGE_CATALOG
-    vsprintf( msg_buffer, 
+    vsnprintf( msg_buffer, 132,
 	      catgets(uil_catd, UIL_SET1, msg_cat_table[ message_number ],
 		      diag_rz_msg_table[ message_number ].ac_text), 
 	     ap );
 #else
-    vsprintf( msg_buffer, 
+    vsnprintf( msg_buffer, 132,
 	      diag_rz_msg_table[ message_number ].ac_text, 
 	      ap );
 #endif


Index: openmotif.spec
===================================================================
RCS file: /cvs/dist/rpms/openmotif/FC-4/openmotif.spec,v
retrieving revision 1.31
retrieving revision 1.32
diff -u -r1.31 -r1.32
--- openmotif.spec	2 Sep 2005 15:23:51 -0000	1.31
+++ openmotif.spec	29 Mar 2006 14:01:08 -0000	1.32
@@ -3,7 +3,7 @@
 Summary: Open Motif runtime libraries and executables.
 Name: openmotif
 Version: 2.2.3
-Release: 10.FC4.1
+Release: 10.FC4.2
 License: Open Group Public License
 Group: System Environment/Libraries
 Source:  %{intern_name}-%{version}.tar.gz
@@ -39,6 +39,7 @@
 Patch40: openMotif-2.2.3-motifzone_1202.patch
 Patch41: openMotif-2.2.3-CAN-2005-0605.patch
 Patch42: openMotif-2.2.3-mrm.patch
+Patch43: openMotif-2.2.3-CVE-2005-3964.patch
 
 Conflicts: lesstif <= 0.92.32-6
 
@@ -83,6 +84,7 @@
 %patch40 -p1 -b .motifzone_1202
 %patch41 -p1 -b .CAN-2005-0605
 %patch42 -p1 -b .mrm
+%patch43 -p1 -b .CVE-2005-3964
 
 for i in doc/man/man3/{XmColumn,XmDataField}.3; do
 	iconv -f windows-1252 -t utf-8 < "$i" > "${i}_"
@@ -165,6 +167,9 @@
 %{prefix}/man/man5/*
 
 %changelog
+* Wed Mar 29 2006 Thomas Woerner <twoerner at redhat.com> 2.2.3-10.FC4.2
+- fixed CVE-2005-3964: libUil buffer overflows (#174815)
+
 * Fri Sep  2 2005 Thomas Woerner <twoerner at redhat.com> 2.2.3-10.FC4.1
 - fixed mrm initialization error in MrmOpenHierarchyPerDisplay (#167094)
   Thanks to Arjan van de Ven for the patch.