svn commit: r421128 - in branches/2016Q3/x11/kdelibs4: . files
Tobias C. Berner
tcberner at FreeBSD.org
Tue Aug 30 18:10:35 UTC 2016
Author: tcberner
Date: Tue Aug 30 18:10:34 2016
New Revision: 421128
URL: https://svnweb.freebsd.org/changeset/ports/421128
Log:
MFH: r420994
Add upstream patch for a security issue in karchive:
Directory traversal vulnerability in KArchive before 5.24, as
used in KDE Frameworks, allows remote attackers to write to
arbitrary files via a ../ (dot dot slash) in a filename in an
archive file, related to KNewsstuff downloads.
Review the patch is from: https://git.reviewboard.kde.org/r/128749/
Original KF5 review: https://git.reviewboard.kde.org/r/128185/
CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6232
Approved by: rakuco (mentor)
Security: 4472ab39-6c66-11e6-9ca5-50e549ebab6c, CVE-2016-6232
Approved by: ports-secteam (junovitch), rakuco (mentor)
Added:
branches/2016Q3/x11/kdelibs4/files/patch-git_dd1c2da
- copied unchanged from r420994, head/x11/kdelibs4/files/patch-git_dd1c2da
Modified:
branches/2016Q3/x11/kdelibs4/Makefile
Directory Properties:
branches/2016Q3/ (props changed)
Modified: branches/2016Q3/x11/kdelibs4/Makefile
==============================================================================
--- branches/2016Q3/x11/kdelibs4/Makefile Tue Aug 30 18:07:59 2016 (r421127)
+++ branches/2016Q3/x11/kdelibs4/Makefile Tue Aug 30 18:10:34 2016 (r421128)
@@ -3,7 +3,7 @@
PORTNAME= kdelibs
PORTVERSION= ${KDE4_KDELIBS_VERSION}
-PORTREVISION= 6
+PORTREVISION= 7
CATEGORIES= x11 kde
MASTER_SITES= KDE/${KDE4_APPLICATIONS_BRANCH}/applications/${KDE4_APPLICATIONS_VERSION}/src
DIST_SUBDIR= KDE/${PORTVERSION}
Copied: branches/2016Q3/x11/kdelibs4/files/patch-git_dd1c2da (from r420994, head/x11/kdelibs4/files/patch-git_dd1c2da)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ branches/2016Q3/x11/kdelibs4/files/patch-git_dd1c2da Tue Aug 30 18:10:34 2016 (r421128, copy of r420994, head/x11/kdelibs4/files/patch-git_dd1c2da)
@@ -0,0 +1,44 @@
+From dd1c2da9d26fd4cfc7fe0a25f413e536d56cf2db Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid at kde.org>
+Date: Fri, 26 Aug 2016 00:30:34 +0200
+Subject: [PATCH] Backport karchive fix for out of directory files
+
+REVIEW: 128749
+---
+ kdecore/io/karchive.cpp | 15 +++++++++++++--
+
+diff --git kdecore/io/karchive.cpp kdecore/io/karchive.cpp
+index eb0bf2e..d3f8c67 100644
+--- kdecore/io/karchive.cpp
++++ kdecore/io/karchive.cpp
+@@ -800,6 +800,7 @@ static bool sortByPosition( const KArchiveFile* file1, const KArchiveFile* file2
+ void KArchiveDirectory::copyTo(const QString& dest, bool recursiveCopy ) const
+ {
+ QDir root;
++ const QString destDir(QDir(dest).absolutePath()); // get directory path without any "." or ".."
+
+ QList<const KArchiveFile*> fileList;
+ QMap<qint64, QString> fileToDir;
+@@ -809,10 +810,20 @@ void KArchiveDirectory::copyTo(const QString& dest, bool recursiveCopy ) const
+ QStack<QString> dirNameStack;
+
+ dirStack.push( this ); // init stack at current directory
+- dirNameStack.push( dest ); // ... with given path
++ dirNameStack.push( destDir ); // ... with given path
+ do {
+ const KArchiveDirectory* curDir = dirStack.pop();
+- const QString curDirName = dirNameStack.pop();
++
++ // extract only to specified folder if it is located within archive's extraction folder
++ // otherwise put file under root position in extraction folder
++ QString curDirName = dirNameStack.pop();
++ if (!QDir(curDirName).absolutePath().startsWith(destDir)) {
++ qWarning() << "Attempted export into folder" << curDirName
++ << "which is outside of the extraction root folder" << destDir << "."
++ << "Changing export of contained files to extraction root folder.";
++ curDirName = destDir;
++ }
++
+ root.mkdir(curDirName);
+
+ const QStringList dirEntries = curDir->entries();
More information about the svn-ports-all
mailing list