rpms/xsupplicant/FC-3 xsupplicant-1.2.2-buf.patch, NONE, 1.1 xsupplicant.spec, 1.13, 1.14

[Hans de Goede (jwrdegoede)]

Author: jwrdegoede

Update of /cvs/extras/rpms/xsupplicant/FC-3
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv20833

Modified Files:
	xsupplicant.spec 
Added Files:
	xsupplicant-1.2.2-buf.patch 
Log Message:
fix a possible bufferoverflow bz 170045

xsupplicant-1.2.2-buf.patch:

--- NEW FILE xsupplicant-1.2.2-buf.patch ---
--- xsupplicant-1.2.2/src/cardif/linux/cardif_linux.c.buf	2006-01-03 08:38:37.000000000 +0100
+++ xsupplicant-1.2.2/src/cardif/linux/cardif_linux.c	2006-01-03 08:40:18.000000000 +0100
@@ -806,7 +806,9 @@
   sockData = thisint->sockData;
 
   errno = 0;
-  resultsize = 1550;
+  resultsize = 1520; /* was 1550 but this can cause a bufoverflow, upstream
+                        has changed this to 1520 in CVS, so we fix this
+                        the same way */
 
   newsize = recvfrom(sockData->sockInt, resultframe, resultsize, 0, 0, 0);
   if (newsize <= 0)


Index: xsupplicant.spec
===================================================================
RCS file: /cvs/extras/rpms/xsupplicant/FC-3/xsupplicant.spec,v
retrieving revision 1.13
retrieving revision 1.14
diff -u -r1.13 -r1.14
--- xsupplicant.spec	15 Nov 2005 19:50:05 -0000	1.13
+++ xsupplicant.spec	3 Jan 2006 14:57:42 -0000	1.14
@@ -1,7 +1,7 @@
 Name:		xsupplicant
 Summary:	Open Source Implementation of IEEE 802.1x
 Version:	1.2.2
-Release:	6%{?dist}
+Release:	7%{?dist}
 License:	GPL
 Group:		System Environment/Base
 URL:		http://www.open1x.org/
@@ -10,6 +10,7 @@
 BuildRequires:	openssl-devel, bison, flex, openjade, lynx, jadetex
 BuildRequires:	docbook-dtds, docbook-style-dsssl, wireless-tools
 Patch0:		xsupplicant-1.2.1-docsfix.patch
+Patch1:		xsupplicant-1.2.2-buf.patch
 
 %description
 This software allows a GNU/Linux or BSD workstation to authenticate with
@@ -20,6 +21,7 @@
 %prep
 %setup -q
 %patch0 -p1
+%patch1 -p1
 
 perl -pi.orig -e 's|/lib\b|/%{_lib}|g' configure*
 
@@ -50,6 +52,9 @@
 %{_sbindir}/xsupplicant
 
 %changelog
+* Tue Jan  3 2006 Hans de Goede <j.w.r.degoede at hhs.nl> 1.2.2-7
+- fix a possible bufferoverflow bz 170045
+
 * Tue Nov  5 2005 Tom "spot" Callaway <tcallawa at redhat.com> 1.2.2-6
 - compile fix (FC-4 + only)