Hello community, here is the log from the commit of package fastjar for openSUSE:Factory checked in at 2017-05-31 13:30:15 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/fastjar (Old) and /work/SRC/openSUSE:Factory/.fastjar.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "fastjar" Wed May 31 13:30:15 2017 rev:20 rq:496810 version:0.98 Changes: -------- --- /work/SRC/openSUSE:Factory/fastjar/fastjar.changes 2015-04-21 10:45:48.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.fastjar.new/fastjar.changes 2017-05-31 13:30:16.315880634 +0200 @@ -1,0 +2,11 @@ +Fri May 19 14:14:56 UTC 2017 - tchvatal@suse.com + +- Apply patches from debian to be up-par: + * fix-update-mode.diff + * jartool.diff +- Remove patch fastjar-0.98-fix.patch + * Merged in jartool.diff +- Remove patch fastjar-0.98-directory-traversal.patch + * Merged in jartool.diff + +------------------------------------------------------------------- Old: ---- fastjar-0.98-directory-traversal.patch fastjar-0.98-fix.patch New: ---- fix-update-mode.diff jartool.diff ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ fastjar.spec ++++++ --- /var/tmp/diff_new_pack.UGfDW8/_old 2017-05-31 13:30:16.991785363 +0200 +++ /var/tmp/diff_new_pack.UGfDW8/_new 2017-05-31 13:30:16.995784799 +0200 @@ -1,7 +1,7 @@ # # spec file for package fastjar # -# Copyright (c) 2015 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -19,7 +19,7 @@ Name: fastjar Version: 0.98 Release: 0 -Summary: The fastjar Java package archiver +Summary: Java package archiver License: GPL-2.0+ Group: Development/Languages/Java Url: http://savannah.nongnu.org/projects/fastjar/ @@ -27,12 +27,11 @@ # Current signing key has expired #Source1: http://download.savannah.gnu.org/releases/%{name}/%{name}-%{version}.tar.gz.sig #Source2: http://savannah.nongnu.org/project/memberlist-gpgkeys.php?group=%{name}&download=1#/%{name}.keyring -Patch0: fastjar-0.98-fix.patch -Patch1: fastjar-0.98-directory-traversal.patch +Patch2: fix-update-mode.diff +Patch3: jartool.diff BuildRequires: zlib-devel -Requires(preun): %{install_info_prereq} Requires(post): %{install_info_prereq} -Provides: libgcj:%{_bindir}/fastjar +Requires(preun): %{install_info_prereq} BuildRoot: %{_tmppath}/%{name}-%{version}-build %description @@ -42,28 +41,27 @@ %prep %setup -q -%patch0 -%patch1 -p1 -b .directory-traversal +%autopatch -p1 %build %configure make %{?_smp_mflags} %install -make DESTDIR=%{buildroot} install %{?_smp_mflags} +%make_install %post -%install_info --info-dir=%{_infodir} %{_infodir}/%{name}.info.gz +%install_info --info-dir=%{_infodir} %{_infodir}/%{name}.info%{ext_info} %preun -%install_info_delete --info-dir=%{_infodir} %{_infodir}/%{name}.info.gz +%install_info_delete --info-dir=%{_infodir} %{_infodir}/%{name}.info%{ext_info} %files %defattr(-,root,root) %doc AUTHORS README NEWS ChangeLog -%{_mandir}/man1/fastjar.1.gz -%{_mandir}/man1/grepjar.1.gz -%{_infodir}/fastjar.info.gz +%{_mandir}/man1/fastjar.1%{ext_man} +%{_mandir}/man1/grepjar.1%{ext_man} +%{_infodir}/fastjar.info%{ext_info} %{_bindir}/fastjar %{_bindir}/grepjar ++++++ fix-update-mode.diff ++++++ Index: b/compress.c =================================================================== --- a/compress.c +++ b/compress.c @@ -86,6 +86,10 @@ write_data (int fd, void *buf, size_t le exit(EXIT_FAILURE); } } + else if (!next && here + len >= end_of_entries) + { + end_of_entries = here + len; + } } return write (fd, buf, len); Index: b/jartool.c =================================================================== --- a/jartool.c +++ b/jartool.c @@ -1273,15 +1273,18 @@ int add_file_to_jar(int jfd, int ffd, co compress_file(ffd, jfd, ze, existing); } else { /* If we are not writing the last entry, make space for it. */ - if (existing && existing->next_entry) + if (existing) { - if (ze->usize > existing->usize) + if (existing->next_entry) { - if (shift_down (jfd, existing->next_entry->offset, - ze->usize - existing->usize, existing->next_entry)) + if (ze->usize > existing->usize) { - fprintf (stderr, "%s: %s\n", progname, strerror (errno)); - return 1; + if (shift_down (jfd, existing->next_entry->offset, + ze->usize - existing->usize, existing->next_entry)) + { + fprintf (stderr, "%s: %s\n", progname, strerror (errno)); + return 1; + } } } } ++++++ jartool.diff ++++++ --- fastjar-0.98.orig/jartool.c +++ fastjar-0.98/jartool.c @@ -790,6 +790,7 @@ int read_entries (int fd) progname, jarfile); return 1; } + ze->filename[len] = '\0'; len = UNPACK_UB4(header, CEN_EFLEN); len += UNPACK_UB4(header, CEN_COMLEN); if (lseek (fd, len, SEEK_CUR) == -1) @@ -1257,7 +1258,7 @@ int add_file_to_jar(int jfd, int ffd, co exit_on_error("write"); /* write the file name to the zip file */ - if (1 == write(jfd, fname, file_name_length)) + if (-1 == write(jfd, fname, file_name_length)) exit_on_error("write"); if(verbose){ @@ -1730,7 +1731,17 @@ int extract_jar(int fd, const char **fil struct stat sbuf; int depth = 0; - tmp_buff = malloc(sizeof(char) * strlen((const char *)filename)); + if(*filename == '/'){ + fprintf(stderr, "Absolute path names are not allowed.\n"); + exit(EXIT_FAILURE); + } + + tmp_buff = malloc(strlen((const char *)filename)); + + if(tmp_buff == NULL) { + fprintf(stderr, "Out of memory.\n"); + exit(EXIT_FAILURE); + } for(;;){ const ub1 *idx = (const unsigned char *)strchr((const char *)start, '/'); @@ -1738,25 +1749,28 @@ int extract_jar(int fd, const char **fil if(idx == NULL) break; else if(idx == start){ + tmp_buff[idx - filename] = '/'; start++; continue; } - start = idx + 1; - strncpy(tmp_buff, (const char *)filename, (idx - filename)); - tmp_buff[(idx - filename)] = '\0'; + memcpy(tmp_buff + (start - filename), (const char *)start, (idx - start)); + tmp_buff[idx - filename] = '\0'; #ifdef DEBUG printf("checking the existance of %s\n", tmp_buff); #endif - if(strcmp(tmp_buff, "..") == 0){ + if(idx - start == 2 && memcmp(start, "..", 2) == 0){ --depth; if (depth < 0){ fprintf(stderr, "Traversal to parent directories during unpacking!\n"); exit(EXIT_FAILURE); } - } else if (strcmp(tmp_buff, ".") != 0) + } else if (idx - start != 1 || *start != '.') ++depth; + + start = idx + 1; + if(stat(tmp_buff, &sbuf) < 0){ if(errno != ENOENT) exit_on_error("stat"); @@ -1765,6 +1779,7 @@ int extract_jar(int fd, const char **fil #ifdef DEBUG printf("Directory exists\n"); #endif + tmp_buff[idx - filename] = '/'; continue; }else { fprintf(stderr, "Hmmm.. %s exists but isn't a directory!\n", @@ -1781,10 +1796,11 @@ int extract_jar(int fd, const char **fil if(verbose && handle) printf("%10s: %s/\n", "created", tmp_buff); + tmp_buff[idx - filename] = '/'; } /* only a directory */ - if(strlen((const char *)start) == 0) + if(*start == '\0') dir = TRUE; #ifdef DEBUG @@ -1792,7 +1808,7 @@ int extract_jar(int fd, const char **fil #endif /* If the entry was just a directory, don't write to file, etc */ - if(strlen((const char *)start) == 0) + if(*start == '\0') f_fd = -1; free(tmp_buff); @@ -1876,7 +1892,8 @@ int extract_jar(int fd, const char **fil exit(EXIT_FAILURE); } - close(f_fd); + if (f_fd != -1) + close(f_fd); if(verbose && dir == FALSE && handle) printf("%10s: %s\n",