summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--gnu/local.mk1
-rw-r--r--gnu/packages/compression.scm1
-rw-r--r--gnu/packages/patches/sharutils-CVE-2018-1000097.patch21
3 files changed, 23 insertions, 0 deletions
diff --git a/gnu/local.mk b/gnu/local.mk
index 713d9ae118..0bdfc521c2 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1093,6 +1093,7 @@ dist_patch_DATA = \
%D%/packages/patches/sdl-libx11-1.6.patch \
%D%/packages/patches/seq24-rename-mutex.patch \
%D%/packages/patches/shadow-CVE-2018-7169.patch \
+ %D%/packages/patches/sharutils-CVE-2018-1000097.patch \
%D%/packages/patches/shishi-fix-libgcrypt-detection.patch \
%D%/packages/patches/slim-session.patch \
%D%/packages/patches/slim-config.patch \
diff --git a/gnu/packages/compression.scm b/gnu/packages/compression.scm
index f312e47177..562a2bf8b7 100644
--- a/gnu/packages/compression.scm
+++ b/gnu/packages/compression.scm
@@ -533,6 +533,7 @@ decompressors when faced with corrupted input.")
(method url-fetch)
(uri (string-append "mirror://gnu/sharutils/sharutils-"
version ".tar.xz"))
+ (patches (search-patches "sharutils-CVE-2018-1000097.patch"))
(sha256
(base32
"16isapn8f39lnffc3dp4dan05b7x6mnc76v6q5nn8ysxvvvwy19b"))))
diff --git a/gnu/packages/patches/sharutils-CVE-2018-1000097.patch b/gnu/packages/patches/sharutils-CVE-2018-1000097.patch
new file mode 100644
index 0000000000..8d58218184
--- /dev/null
+++ b/gnu/packages/patches/sharutils-CVE-2018-1000097.patch
@@ -0,0 +1,21 @@
+Fix CVE-2018-1000097:
+
+https://security-tracker.debian.org/tracker/CVE-2018-1000097
+https://nvd.nist.gov/vuln/detail/CVE-2018-1000097
+
+Patch taken from upstream bug report:
+https://lists.gnu.org/archive/html/bug-gnu-utils/2018-02/msg00005.html
+
+diff --git a/src/unshar.c b/src/unshar.c
+index 80bc3a9..0fc3773 100644
+--- a/src/unshar.c
++++ b/src/unshar.c
+@@ -240,7 +240,7 @@ find_archive (char const * name, FILE * file, off_t start)
+ off_t position = ftello (file);
+
+ /* Read next line, fail if no more and no previous process. */
+- if (!fgets (rw_buffer, BUFSIZ, file))
++ if (!fgets (rw_buffer, rw_base_size, file))
+ {
+ if (!start)
+ error (0, 0, _("Found no shell commands in %s"), name);