rpms/centericq/FC-5 centericq-ijhook.patch, NONE, 1.1 centericq-libjab-segv.patch, NONE, 1.1 centericq.spec, 1.25, 1.26

[Andreas Bierfert (awjb)]

Author: awjb

Update of /cvs/extras/rpms/centericq/FC-5
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv16891/FC-5

Modified Files:
	centericq.spec 
Added Files:
	centericq-ijhook.patch centericq-libjab-segv.patch 
Log Message:
- fix CVE-2007-160 (#227791)


centericq-ijhook.patch:

--- NEW FILE centericq-ijhook.patch ---
--- centericq-4.21.0.old/src/hooks/ljhook.cc	2005-01-07 02:27:04.000000000 +0100
+++ centericq-4.21.0/src/hooks/ljhook.cc	2007-01-08 18:53:28.776790056 +0100
@@ -667,21 +667,21 @@
 		friendof.push_back(in->first);
 
 		if(!foempty) {
 		    bd = (string) "http://" + conf.getourid(proto).server + "/users/" + in->first;
 
-		    sprintf(buf, _("The user %s (%s) has added you to his/her friend list\n\nJournal address: %s"),
+		    snprintf(buf, sizeof(buf), _("The user %s (%s) has added you to his/her friend list\n\nJournal address: %s"),
 			in->first.c_str(), in->second.c_str(), bd.c_str());
 
 		    em.store(imnotification(self, buf));
 		}
 	    }
 
 	    for(il = friendof.begin(); il != friendof.end(); ) {
 		if(nfriendof.find(*il) == nfriendof.end()) {
 		    bd = (string) "http://" + conf.getourid(proto).server + "/users/" + *il;
-		    sprintf(buf, _("The user %s has removed you from his/her friend list\n\nJournal address: %s"),
+		    snprintf(buf, sizeof(buf), _("The user %s has removed you from his/her friend list\n\nJournal address: %s"),
 			il->c_str(), bd.c_str());
 		    em.store(imnotification(self, buf));
 		    friendof.erase(il);
 		    il = friendof.begin();
 		} else {


centericq-libjab-segv.patch:

--- NEW FILE centericq-libjab-segv.patch ---
--- centericq-4.21.0/libjabber-0.1/jconn.c	2007-01-16 07:55:04.023053568 +0100
+++ centericq-4.21.0.new/libjabber-0.1/jconn.c	2007-01-16 07:57:27.081305408 +0100
@@ -167,12 +167,15 @@
     x = jutil_header(NS_CLIENT, j->user->server);
     t = xmlnode2str(x);
     /* this is ugly, we can create the string here instead of jutil_header */
     /* what do you think about it? -madcat */
     t2 = strstr(t,"/>");
+    if (t2 != NULL)
+      {
     *t2++ = '>';
     *t2 = '\0';
+      }
     jab_send_raw(j,"<?xml version='1.0'?>");
     jab_send_raw(j,t);
     xmlnode_free(x);
 
     j->state = JCONN_STATE_ON;
--- centericq-4.21.0/libjabber-0.1/xstream.c	2002-11-19 15:26:34.000000000 +0100
+++ centericq-4.21.0.new/libjabber-0.1/xstream.c	2007-01-16 07:57:35.915962336 +0100
@@ -208,12 +208,15 @@
 
     s = spool_new(xmlnode_pool(x));
     spooler(s,"<?xml version='1.0'?>",xmlnode2str(x),s);
     head = spool_print(s);
     fixr = strstr(head,"/>");
+    if (fixr != NULL)
+      {
     *fixr = '>';
     ++fixr;
     *fixr = '\0';
+      }
 
     return head;
 }
 


Index: centericq.spec
===================================================================
RCS file: /cvs/extras/rpms/centericq/FC-5/centericq.spec,v
retrieving revision 1.25
retrieving revision 1.26
diff -u -r1.25 -r1.26
--- centericq.spec	11 Nov 2006 16:29:03 -0000	1.25
+++ centericq.spec	10 Feb 2007 07:18:10 -0000	1.26
@@ -1,6 +1,6 @@
 Name:           centericq
 Version:        4.21.0
-Release:        7%{?dist}
+Release:        8%{?dist}
 
 Summary:        Text mode menu- and window-driven IM
 
@@ -21,6 +21,12 @@
 # and see http://www.gentoo.org/security/en/glsa/glsa-200512-11.xml 
 # and redhat bugzilla #176451
 Patch6:         centericq-4.21.0-kkstrtext.patch
+# and more security +)
+# CVE-2007-0160
+# http://mailman.linuxpl.org/pipermail/cicq/2007-January/004866.html
+# see redhat bugzilla #227791
+Patch7:         centericq-ijhook.patch
+Patch8:         centericq-libjab-segv.patch
 
 ## feature fixes
 # Fix libmsn 
@@ -59,6 +65,8 @@
 %patch4 -p1
 %patch5 -p1
 %patch6 -p1
+%patch7 -p1
+%patch8 -p1
 %patch100 -p1
 %patch101 -p1
 %patch102 -p1
@@ -98,6 +106,10 @@
 %exclude %{_includedir}/msn
 
 %changelog
+* Sat Feb 10 2007 Andreas Bierfert <andreas.bierfert[AT]lowlatency.de>
+4.21.0-8
+- fix CVE-2007-160 (#227791)
+
 * Thu Mar 02 2006 Andreas Bierfert <andreas.bierfert[AT]lowlatency.de>
 4.21.0-7
 - fix #183623: ask before quit