[gentoo-commits] repo/gentoo:master commit in: dev-db/unixODBC/files/, dev-db/unixODBC/

[Patrice Clement]

commit:     af28844cc92f8edd1fcd049e357d169a3dddc176
Author:     Michael Vetter <jubalh <AT> iodoru <DOT> org>
AuthorDate: Tue Feb 27 16:04:39 2018 +0000
Commit:     Patrice Clement <monsieurp <AT> gentoo <DOT> org>
CommitDate: Tue Feb 27 22:41:35 2018 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=af28844c

dev-db/unixODBC: add fix against CVE-2018-7485.

Adding a patch based on
https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f

Without the changes for 2.3.6 in ChangeLog and configure.ac.

Package-Manager: Portage-2.3.19, Repoman-2.3.6
Closes: https://github.com/gentoo/gentoo/pull/7300

 .../files/unixODBC-2.3.5-CVE-2018-7485.patch       | 135 +++++++++++++++++++++
 dev-db/unixODBC/unixODBC-2.3.5-r1.ebuild           |  65 ++++++++++
 2 files changed, 200 insertions(+)

diff --git a/dev-db/unixODBC/files/unixODBC-2.3.5-CVE-2018-7485.patch b/dev-db/unixODBC/files/unixODBC-2.3.5-CVE-2018-7485.patch
new file mode 100644
index 00000000000..2c4178cda48
--- /dev/null
+++ b/dev-db/unixODBC/files/unixODBC-2.3.5-CVE-2018-7485.patch
@@ -0,0 +1,135 @@
+From 45ef78e037f578b15fc58938a3a3251655e71d6f Mon Sep 17 00:00:00 2001
+From: Nick Gorham <nick@×××××××××××.org>
+Date: Mon, 8 Jan 2018 11:12:39 +0000
+Subject: [PATCH] New Pre Source
+
+diff --git a/DriverManager/SQLGetDiagRecW.c b/DriverManager/SQLGetDiagRecW.c
+index a6368d7..be89120 100644
+--- a/DriverManager/SQLGetDiagRecW.c
++++ b/DriverManager/SQLGetDiagRecW.c
+@@ -98,6 +98,8 @@
+ 
+ static char const rcsid[]= "$RCSfile: SQLGetDiagRecW.c,v $";
+ 
++extern int __is_env( EHEAD * head );        /* in SQLGetDiagRec.c */
++
+ static SQLRETURN extract_sql_error_rec_w( EHEAD *head,
+         SQLWCHAR *sqlstate,
+         SQLINTEGER rec_number,
+diff --git a/DriverManager/SQLSetDescField.c b/DriverManager/SQLSetDescField.c
+index 333d786..0e2f67c 100644
+--- a/DriverManager/SQLSetDescField.c
++++ b/DriverManager/SQLSetDescField.c
+@@ -306,7 +306,7 @@ SQLRETURN SQLSetDescField( SQLHDESC descriptor_handle,
+         return function_return_nodrv( SQL_HANDLE_DESC, descriptor, SQL_ERROR );
+     }
+ 
+-    if ( field_identifier == SQL_DESC_COUNT && (SQLINTEGER)value < 0 )
++    if ( field_identifier == SQL_DESC_COUNT && (intptr_t)value < 0 )
+     {
+         __post_internal_error( &descriptor -> error,
+                 ERROR_07009, NULL,
+@@ -315,9 +315,9 @@ SQLRETURN SQLSetDescField( SQLHDESC descriptor_handle,
+         return function_return_nodrv( SQL_HANDLE_DESC, descriptor, SQL_ERROR );
+     }
+     
+-    if ( field_identifier == SQL_DESC_PARAMETER_TYPE && value != SQL_PARAM_INPUT
+-        && value != SQL_PARAM_OUTPUT && value != SQL_PARAM_INPUT_OUTPUT &&
+-        value != SQL_PARAM_INPUT_OUTPUT_STREAM && value != SQL_PARAM_OUTPUT_STREAM )
++    if ( field_identifier == SQL_DESC_PARAMETER_TYPE && (intptr_t)value != SQL_PARAM_INPUT
++        && (intptr_t)value != SQL_PARAM_OUTPUT && (intptr_t)value != SQL_PARAM_INPUT_OUTPUT &&
++        (intptr_t)value != SQL_PARAM_INPUT_OUTPUT_STREAM && (intptr_t)value != SQL_PARAM_OUTPUT_STREAM )
+     {
+         __post_internal_error( &descriptor -> error,
+                 ERROR_HY105, NULL,
+diff --git a/DriverManager/SQLSetDescFieldW.c b/DriverManager/SQLSetDescFieldW.c
+index 5e066ac..45125ff 100644
+--- a/DriverManager/SQLSetDescFieldW.c
++++ b/DriverManager/SQLSetDescFieldW.c
+@@ -288,7 +288,7 @@ SQLRETURN SQLSetDescFieldW( SQLHDESC descriptor_handle,
+         return function_return_nodrv( SQL_HANDLE_DESC, descriptor, SQL_ERROR );
+     }
+ 
+-    if ( field_identifier == SQL_DESC_COUNT && (SQLINTEGER)value < 0 )
++    if ( field_identifier == SQL_DESC_COUNT && (intptr_t)value < 0 )
+     {
+         __post_internal_error( &descriptor -> error,
+                 ERROR_07009, NULL,
+@@ -297,9 +297,9 @@ SQLRETURN SQLSetDescFieldW( SQLHDESC descriptor_handle,
+         return function_return_nodrv( SQL_HANDLE_DESC, descriptor, SQL_ERROR );
+     }
+ 
+-    if ( field_identifier == SQL_DESC_PARAMETER_TYPE && value != SQL_PARAM_INPUT
+-        && value != SQL_PARAM_OUTPUT && value != SQL_PARAM_INPUT_OUTPUT &&
+-        value != SQL_PARAM_INPUT_OUTPUT_STREAM && value != SQL_PARAM_OUTPUT_STREAM )
++    if ( field_identifier == SQL_DESC_PARAMETER_TYPE && (intptr_t)value != SQL_PARAM_INPUT
++        && (intptr_t)value != SQL_PARAM_OUTPUT && (intptr_t)value != SQL_PARAM_INPUT_OUTPUT &&
++        (intptr_t)value != SQL_PARAM_INPUT_OUTPUT_STREAM && (intptr_t)value != SQL_PARAM_OUTPUT_STREAM )
+     {
+         __post_internal_error( &descriptor -> error,
+                 ERROR_HY105, NULL,
+diff --git a/exe/iusql.c b/exe/iusql.c
+index aac5329..484a889 100644
+--- a/exe/iusql.c
++++ b/exe/iusql.c
+@@ -413,7 +413,6 @@ static int ExecuteSQL( SQLHDBC hDbc, char *szSQL, char cDelimiter, int bColumnNa
+             if ( bVerbose ) DumpODBCLog( hEnv, hDbc, hStmt );
+             fprintf( stderr, "[ISQL]ERROR: Could not SQLExecDirect\n" );
+             SQLFreeStmt( hStmt, SQL_DROP );
+-            free(szSepLine);
+             return 0;
+         }
+     }
+diff --git a/odbcinst/SQLCreateDataSource.c b/odbcinst/SQLCreateDataSource.c
+index a9fa735..83a1e9e 100644
+--- a/odbcinst/SQLCreateDataSource.c
++++ b/odbcinst/SQLCreateDataSource.c
+@@ -26,7 +26,7 @@ char* _multi_string_alloc_and_copy( LPCWSTR in )
+ 
+     if ( !in )
+     {
+-        return in;
++        return NULL;
+     }
+ 
+     while ( in[ len ] != 0 || in[ len + 1 ] != 0 )
+@@ -55,7 +55,7 @@ char* _single_string_alloc_and_copy( LPCWSTR in )
+ 
+     if ( !in )
+     {
+-        return in;
++        return NULL;
+     }
+ 
+     while ( in[ len ] != 0 )
+@@ -83,7 +83,7 @@ SQLWCHAR* _multi_string_alloc_and_expand( LPCSTR in )
+ 
+     if ( !in )
+     {
+-        return in;
++        return NULL;
+     }
+     
+     while ( in[ len ] != 0 || in[ len + 1 ] != 0 )
+@@ -112,7 +112,7 @@ SQLWCHAR* _single_string_alloc_and_expand( LPCSTR in )
+ 
+     if ( !in )
+     {
+-        return in;
++        return NULL;
+     }
+ 
+     while ( in[ len ] != 0 )
+diff --git a/odbcinst/SQLWriteFileDSN.c b/odbcinst/SQLWriteFileDSN.c
+index c2f987b..e225796 100644
+--- a/odbcinst/SQLWriteFileDSN.c
++++ b/odbcinst/SQLWriteFileDSN.c
+@@ -21,7 +21,7 @@ BOOL SQLWriteFileDSN(			LPCSTR	pszFileName,
+ 
+ 	if ( pszFileName[0] == '/' )
+ 	{
+-		strncpy( szFileName, sizeof(szFileName) - 5, pszFileName );
++		strncpy( szFileName, pszFileName, sizeof(szFileName) - 5 );
+ 	}
+ 	else
+ 	{	

diff --git a/dev-db/unixODBC/unixODBC-2.3.5-r1.ebuild b/dev-db/unixODBC/unixODBC-2.3.5-r1.ebuild
new file mode 100644
index 00000000000..502428bed7f
--- /dev/null
+++ b/dev-db/unixODBC/unixODBC-2.3.5-r1.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+inherit libtool ltprune multilib-minimal
+
+DESCRIPTION="A complete ODBC driver manager"
+HOMEPAGE="http://www.unixodbc.org/"
+SRC_URI="ftp://ftp.unixodbc.org/pub/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="+minimal odbcmanual static-libs unicode"
+
+RDEPEND="
+	|| (
+		dev-libs/libltdl:0[${MULTILIB_USEDEP}]
+		>=sys-devel/libtool-2.4.2-r1[${MULTILIB_USEDEP}]
+	)
+	>=sys-libs/readline-6.2_p5-r1:0=[${MULTILIB_USEDEP}]
+	>=sys-libs/ncurses-5.9-r3:0=[${MULTILIB_USEDEP}]
+	>=virtual/libiconv-0-r1[${MULTILIB_USEDEP}]
+"
+DEPEND="${RDEPEND}
+	sys-devel/flex
+"
+
+MULTILIB_CHOST_TOOLS=( /usr/bin/odbc_config )
+MULTILIB_WRAPPED_HEADERS=( /usr/include/unixodbc_conf.h )
+
+PATCHES=(
+	"${FILESDIR}/${PN}-2.3.5-CVE-2018-7485.patch"
+)
+
+multilib_src_configure() {
+	# --enable-driver-conf is --enable-driverc as per configure.in
+	myeconfargs=(
+		--sysconfdir="${EPREFIX}"/etc/${PN}
+		--disable-static
+		--enable-iconv
+		--enable-shared
+		$(use_enable static-libs static)
+		$(use_enable !minimal drivers)
+		$(use_enable !minimal driverc)
+		$(use_with unicode iconv-char-enc UTF8)
+		$(use_with unicode iconv-ucode-enc UTF16LE)
+	)
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+
+	if use odbcmanual ; then
+		# We could simply run "make install-html" if we'd not had 
+		# out-of-source builds here.
+		docinto html
+		dodoc -r doc/.
+		find "${ED%/}/usr/share/doc/${PF}/html" -name "Makefile*" -delete || die
+	fi
+
+	use prefix && dodoc README*
+	prune_libtool_files
+}