Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (bad4e383a9d3ac851559bf58aa141413da045d32)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (bad4e383a9d3ac851559bf58aa141413da045d32)
  • Date: Mon, 6 Jul 2015 14:36:39 +0000

GIT changes to master grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

crypto/cyrus-sasl/BUILD | 8 +-
crypto/cyrus-sasl/CONFIGURE | 20 +++--
crypto/cyrus-sasl/DEPENDS | 11 ++-
crypto/cyrus-sasl/DETAILS | 28 ++++----
crypto/cyrus-sasl/FINAL | 2
crypto/cyrus-sasl/HISTORY | 17 ++++
crypto/cyrus-sasl/PRE_BUILD | 6 +
crypto/cyrus-sasl/cve-2013-4122.patch | 116
++++++++++++++++++++++++++++++++++
crypto/cyrus-sasl/db5.patch | 24 -------
crypto/cyrus-sasl/imap-logout.patch | 48 ++++++++++++++
crypto/cyrus-sasl/imap-loop.patch | 89 ++++++++++++++++++++++++++
crypto/cyrus-sasl/ldapdb-buffer.patch | 10 ++
crypto/cyrus-sasl/size_t.patch | 12 +++
13 files changed, 337 insertions(+), 54 deletions(-)

New commits:
commit bad4e383a9d3ac851559bf58aa141413da045d32
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

cyrus-sasl: => 2.1.26 [security]

diff --git a/crypto/cyrus-sasl/BUILD b/crypto/cyrus-sasl/BUILD
index 49df187..dedf6d4 100755
--- a/crypto/cyrus-sasl/BUILD
+++ b/crypto/cyrus-sasl/BUILD
@@ -10,17 +10,17 @@ OPTS="$OPTS \
$CS_PLAIN \
$CS_LOGIN \
$CS_CRAM \
+ $CS_SCRAM \
$CS_DIGEST \
$CS_OTP \
$CS_SRP \
+ $CS_PASSDSS \
$CS_ANON \
$CS_NTLM \
$CS_APOP \
- --disable-sample \
-"
+ --enable-static \
+ --disable-sample" &&

-sedit 's|extern sasl_global_callbacks_t global_callbacks;||g'
lib/saslint.h &&
-sedit 's|^\(sasl_global_callbacks_t\s\+global_callbacks;\)|static \1|g'
lib/server.c &&
make_single &&
default_build &&

diff --git a/crypto/cyrus-sasl/CONFIGURE b/crypto/cyrus-sasl/CONFIGURE
index bc24be8c..9148322 100755
--- a/crypto/cyrus-sasl/CONFIGURE
+++ b/crypto/cyrus-sasl/CONFIGURE
@@ -1,15 +1,15 @@
message "Cyrus-SASL supports lots of authentication mechanisms, devided into
3 main categories:" &&
-message "plaintext (LOGIN, PLAIN), shared secret (DIGEST-MD5, CRAM-MD5) and
Kerberos (KERBEROS_V4, GSSAPI)" &&
+message "password verification (LOGIN, PLAIN), shared secret (DIGEST-MD5,
CRAM-MD5) and Kerberos (KERBEROS_V4, GSSAPI)" &&
message "To avoid getting lost in configuring SASL, please choose *only* the
mechanisms" &&
message "you are actually planning to use." &&
-config_query CS_PLAINTEXT "Enable plaintext mechanisms?" n &&
-config_query CS_SHARED "Enable shared secret mechanisms?" n &&
+config_query CS_PLAINTEXT "Enable password verification (plaintext)
mechanisms?" y &&
+config_query CS_SHARED "Enable shared secret mechanisms?" y &&
config_query CS_KERBEROS "Enable kerberos mechanisms?" n &&

# Some lonely options, doesn't fit with anything else
-config_query_option CS_ANON "Enable ANONYMOUS authentication? (you really
don't want this)" n "--enable-anon" "--disable-anon" &&
+config_query_option CS_ANON "Enable ANONYMOUS authentication? (you really
don't want this)" y "--enable-anon" "--disable-anon" &&
config_query_option CS_NTLM "Enable NTLM authentication? (unsupported)" n
"--enable-ntlm" "--disable-ntlm" &&
-config_query_option CS_APOP "Enable APOP authentication?" n
"--enable-checkapop" "--disable-checkapop" &&
+config_query_option CS_APOP "Enable APOP authentication?" y
"--enable-checkapop" "--disable-checkapop" &&

if [ "$CS_PLAINTEXT" == "n" ] && [ "$CS_SHARED" == "n" ] && [ "$CS_KERBEROS"
== "n" ]; then
message "You didn't select any authentication mechanism!" &&
@@ -37,14 +37,16 @@ persistent_add CS_MECH &&

if [ "$CS_PLAINTEXT" == "y" ]; then
message "Plaintext by itself is not secure for obvious reasons," &&
- message " but it can be usefull in combination with something like TLS" &&
+ message "but it can be useful in combination with something like TLS" &&
config_query_option CS_PLAIN "Enable PLAIN authentication?" y
"--enable-plain" "--disable-plain" &&
config_query_option CS_LOGIN "Enable LOGIN authentication? (unsupported)"
n "--enable-login" "--disable-login"
elif [ "$CS_SHARED" == "y" ]; then
- config_query_option CS_CRAM "Enable CRAM-MD5 authentication?" n
"--enable-cram" "--disable-cram" &&
- config_query_option CS_DIGEST "Enable DIGEST-MD5 authentication?" n
"--enable-digest" "--disable-digest" &&
+ config_query_option CS_CRAM "Enable CRAM-MD5 authentication?" y
"--enable-cram" "--disable-cram" &&
+ config_query_option CS_SCRAM "Enable SCRAM authentication?" y
"--enable-scram" "--disable-scram" &&
+ config_query_option CS_DIGEST "Enable DIGEST-MD5 authentication?" y
"--enable-digest" "--disable-digest" &&
config_query_option CS_OTP "Enable One-Time-Password authentication?" y
"--enable-otp" "--disable-otp" &&
- config_query_option CS_SRP "Enable SRP authentication?" y "--enable-srp"
"--disable-srp"
+ config_query_option CS_SRP "Enable SRP authentication?" n "--enable-srp"
"--disable-srp" &&
+ config_query_option CS_PASSDSS "Enable PASSDSS authentication
(${PROBLEM_COLOR}experimental${QUERY_COLOR})?" n "--enable-passdss"
"--disable-passdss"
elif [ "$CS_KERBEROS" == "y" ]; then
true
# deferred until DEPENDS to let sorcery manage options
diff --git a/crypto/cyrus-sasl/DEPENDS b/crypto/cyrus-sasl/DEPENDS
index 66f2dec..454b982 100755
--- a/crypto/cyrus-sasl/DEPENDS
+++ b/crypto/cyrus-sasl/DEPENDS
@@ -2,13 +2,17 @@ depends automake &&
depends autoconf &&
depends e2fsprogs &&
depends groff &&
-depends libmcrypt &&

optional_depends SSL \
"--with-openssl=$INSTALL_ROOT/usr" \
'--without-openssl' \
'for OpenSSL' &&

+optional_depends JDK \
+ "--enable-java --with-javabase=$INSTALL_ROOT/usr/lib/j2sdk"
\
+ "--disable-java" \
+ "to compile Java support" &&
+
if [[ "$CS_KERBEROS" == 'y' ]]; then
optional_depends krb5 \
"--enable-gssapi=$INSTALL_ROOT/usr" \
@@ -35,6 +39,11 @@ if [[ "$CS_MECH" =~ 'auxprop' ]]; then
gdbm) depends gdbm '--with-dblib=gdbm' ;;
esac &&

+ optional_depends openldap \
+ "--with-ldap=$INSTALL_ROOT/usr --enable-ldapdb" \
+ "--without-ldap --disable-ldapdb" \
+ "auxprop LDAP backend" &&
+
optional_depends sqlite \
"--enable-sql --with-sqlite3=$INSTALL_ROOT/usr"\
'--without-sqlite3' \
diff --git a/crypto/cyrus-sasl/DETAILS b/crypto/cyrus-sasl/DETAILS
index d1d1c7a..1faee6b 100755
--- a/crypto/cyrus-sasl/DETAILS
+++ b/crypto/cyrus-sasl/DETAILS
@@ -1,16 +1,14 @@
SPELL=cyrus-sasl
- VERSION=2.1.25
- SECURITY_PATCH=1
+ VERSION=2.1.26
+ SECURITY_PATCH=2
SOURCE=$SPELL-$VERSION.tar.gz
- SOURCE2=$SOURCE.sig
+ SOURCE_URL[0]=ftp://ftp.cyrusimap.org/$SPELL/$SOURCE
+ SOURCE_URL[1]=ftp://ftp.cyrusimap.org/$SPELL/OLD-VERSIONS/$SOURCE
+
SOURCE_HASH=sha512:78819cb9bb38bea4537d6770d309deeeef09ff44a67526177609d3e1257ff4334d2b5e5131d5a1e4dea7430d8db1918ea9d171f0dee38b5e8337f4b72ed068f0
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
- SOURCE_URL[0]=ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/$SOURCE
-
SOURCE_URL[1]=ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/OLD-VERSIONS/sasl/$SOURCE
- SOURCE2_URL[0]=${SOURCE_URL[0]}.sig
- SOURCE_GPG=6581B5F1.gpg:$SOURCE2:UPSTREAM_KEY
- SOURCE2_IGNORE=signature
+ DOCS="doc/*.txt doc/*.html doc/TODO"
LICENSE[0]=BSD
- WEB_SITE=http://cyrusimap.web.cmu.edu/
+ WEB_SITE=https://cyrusimap.org/
ENTERED=20020717
SHORT="Cyrus SASL (RFC 2222) Library"
cat << EOF
@@ -19,11 +17,13 @@ side to provide authentication. See RFC 2222 for more
information.
The following mechanisms are included in this distribution:
* ANONYMOUS
* CRAM-MD5
+* DIGEST-MD5
+* EXTERNAL
+* GSSAPI (MIT Kerberos 5, Heimdal Kerberos 5 or CyberSafe)
* KERBEROS_V4
+* LOGIN
+* NTLM (requires OpenSSL libcrypto)
+* OTP (requires OpenSSL libcrypto)
* PLAIN
-* CRAM-MD5 (deprecated)
-* GSSAPI (MIT Kerberos 5 or Heimdal Kerberos 5)
-* DIGEST-MD5
-* LOGIN (unsupported)
-* SRP (unsupported, may not work)
+* SRP (work in progress; requires OpenSSL libcrypto)
EOF
diff --git a/crypto/cyrus-sasl/FINAL b/crypto/cyrus-sasl/FINAL
index abc0084..3158b2c 100755
--- a/crypto/cyrus-sasl/FINAL
+++ b/crypto/cyrus-sasl/FINAL
@@ -1,3 +1,3 @@
-if [ -f $INSTALL_ROOT/etc/sysconfig/saslauthd ] && echo $OPTS | grep -q --
'--with-pam'; then
+if [ -f $INSTALL_ROOT/etc/sysconfig/saslauthd ] && is_depends_enabled $SPELL
linux-pam; then
sedit "s:shadow:pam:" $INSTALL_ROOT/etc/sysconfig/saslauthd
fi
diff --git a/crypto/cyrus-sasl/HISTORY b/crypto/cyrus-sasl/HISTORY
index 88c3fcc..50c8374 100644
--- a/crypto/cyrus-sasl/HISTORY
+++ b/crypto/cyrus-sasl/HISTORY
@@ -1,3 +1,20 @@
+2015-07-06 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 2.1.26; gpg -> hash; SECURITY_PATCH++;
+ updated long desc; updated source urls
+ * BUILD: dropped dirty hacks; enable static libs
+ * DEPENDS: dropped senseless libmcrypt dependency; added Java support;
+ add auxprop LDAP support
+ * CONFIGURE: fixed defaults as per upstream definition; added SCRAM
and
+ PASSDSS authentication support; corrected a typo; rephrased
+ description -- plaintext -> password verification as per official
docs
+ * FINAL: more accurate dependency check
+ * PRE_BUILD: apply patches
+ * size_t.patch, imap-loop.patch: backported patches from Gentoo
+ (#458790, #510320)
+ * imap-logout.patch, ldapdb-buffer.patch: backported patches from
Debian
+ * cve-2013-4122.patch: added, to fix CVE-2013-4122
+ * db5.patch: dropped, fixed by upstream
+
2014-10-24 Vlad Glagolev <stealth AT sourcemage.org>
* DEPENDS: use SSL provider

diff --git a/crypto/cyrus-sasl/PRE_BUILD b/crypto/cyrus-sasl/PRE_BUILD
index fc26314..2112b7e 100755
--- a/crypto/cyrus-sasl/PRE_BUILD
+++ b/crypto/cyrus-sasl/PRE_BUILD
@@ -1,5 +1,9 @@
default_pre_build &&
cd "$SOURCE_DIRECTORY" &&

+patch -p1 < $SPELL_DIRECTORY/cve-2013-4122.patch &&
+patch -p1 < $SPELL_DIRECTORY/imap-logout.patch &&
+patch -p1 < $SPELL_DIRECTORY/ldapdb-buffer.patch &&
+patch -p0 < $SPELL_DIRECTORY/imap-loop.patch &&
+patch -p0 < $SPELL_DIRECTORY/size_t.patch &&
patch -p0 < $SPELL_DIRECTORY/sqlite.patch
-patch -p1 < "$SPELL_DIRECTORY/db5.patch"
diff --git a/crypto/cyrus-sasl/cve-2013-4122.patch
b/crypto/cyrus-sasl/cve-2013-4122.patch
new file mode 100644
index 0000000..09c9ce8
--- /dev/null
+++ b/crypto/cyrus-sasl/cve-2013-4122.patch
@@ -0,0 +1,116 @@
+From dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d Mon Sep 17 00:00:00 2001
+From: mancha <mancha1 AT hush.com>
+Date: Thu, 11 Jul 2013 09:08:07 +0000
+Subject: Handle NULL returns from glibc 2.17+ crypt()
+
+Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL
+(w/ NULL return) if the salt violates specifications. Additionally,
+on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords
+passed to crypt() fail with EPERM (w/ NULL return).
+
+When using glibc's crypt(), check return value to avoid a possible
+NULL pointer dereference.
+
+Patch by mancha1 AT hush.com.
+---
+diff --git a/pwcheck/pwcheck_getpwnam.c b/pwcheck/pwcheck_getpwnam.c
+index 4b34222..400289c 100644
+--- a/pwcheck/pwcheck_getpwnam.c
++++ b/pwcheck/pwcheck_getpwnam.c
+@@ -32,6 +32,7 @@ char *userid;
+ char *password;
+ {
+ char* r;
++ char* crpt_passwd;
+ struct passwd *pwd;
+
+ pwd = getpwnam(userid);
+@@ -41,7 +42,7 @@ char *password;
+ else if (pwd->pw_passwd[0] == '*') {
+ r = "Account disabled";
+ }
+- else if (strcmp(pwd->pw_passwd, crypt(password, pwd->pw_passwd)) != 0) {
++ else if (!(crpt_passwd = crypt(password, pwd->pw_passwd)) ||
strcmp(pwd->pw_passwd, (const char *)crpt_passwd) != 0) {
+ r = "Incorrect password";
+ }
+ else {
+diff --git a/pwcheck/pwcheck_getspnam.c b/pwcheck/pwcheck_getspnam.c
+index 2b11286..6d607bb 100644
+--- a/pwcheck/pwcheck_getspnam.c
++++ b/pwcheck/pwcheck_getspnam.c
+@@ -32,13 +32,15 @@ char *userid;
+ char *password;
+ {
+ struct spwd *pwd;
++ char *crpt_passwd;
+
+ pwd = getspnam(userid);
+ if (!pwd) {
+ return "Userid not found";
+ }
+
+- if (strcmp(pwd->sp_pwdp, crypt(password, pwd->sp_pwdp)) != 0) {
++ crpt_passwd = crypt(password, pwd->sp_pwdp);
++ if (!crpt_passwd || strcmp(pwd->sp_pwdp, (const char *)crpt_passwd) !=
0) {
+ return "Incorrect password";
+ }
+ else {
+diff --git a/saslauthd/auth_getpwent.c b/saslauthd/auth_getpwent.c
+index fc8029d..d4ebe54 100644
+--- a/saslauthd/auth_getpwent.c
++++ b/saslauthd/auth_getpwent.c
+@@ -77,6 +77,7 @@ auth_getpwent (
+ {
+ /* VARIABLES */
+ struct passwd *pw; /* pointer to passwd file
entry */
++ char *crpt_passwd; /* encrypted password */
+ int errnum;
+ /* END VARIABLES */
+
+@@ -105,7 +106,8 @@ auth_getpwent (
+ }
+ }
+
+- if (strcmp(pw->pw_passwd, (const char *)crypt(password,
pw->pw_passwd))) {
++ crpt_passwd = crypt(password, pw->pw_passwd);
++ if (!crpt_passwd || strcmp(pw->pw_passwd, (const char *)crpt_passwd)) {
+ if (flags & VERBOSE) {
+ syslog(LOG_DEBUG, "DEBUG: auth_getpwent: %s: invalid password",
login);
+ }
+diff --git a/saslauthd/auth_shadow.c b/saslauthd/auth_shadow.c
+index 677131b..1988afd 100644
+--- a/saslauthd/auth_shadow.c
++++ b/saslauthd/auth_shadow.c
+@@ -210,8 +210,8 @@ auth_shadow (
+ RETURN("NO Insufficient permission to access NIS authentication
database (saslauthd)");
+ }
+
+- cpw = strdup((const char *)crypt(password, sp->sp_pwdp));
+- if (strcmp(sp->sp_pwdp, cpw)) {
++ cpw = crypt(password, sp->sp_pwdp);
++ if (!cpw || strcmp(sp->sp_pwdp, (const char *)cpw)) {
+ if (flags & VERBOSE) {
+ /*
+ * This _should_ reveal the SHADOW_PW_LOCKED prefix to an
+@@ -221,10 +221,8 @@ auth_shadow (
+ syslog(LOG_DEBUG, "DEBUG: auth_shadow: pw mismatch: '%s' != '%s'",
+ sp->sp_pwdp, cpw);
+ }
+- free(cpw);
+ RETURN("NO Incorrect password");
+ }
+- free(cpw);
+
+ /*
+ * The following fields will be set to -1 if:
+@@ -286,7 +284,7 @@ auth_shadow (
+ RETURN("NO Invalid username");
+ }
+
+- if (strcmp(upw->upw_passwd, crypt(password, upw->upw_passwd)) != 0) {
++ if (!(cpw = crypt(password, upw->upw_passwd)) ||
(strcmp(upw->upw_passwd, (const char *)cpw) != 0)) {
+ if (flags & VERBOSE) {
+ syslog(LOG_DEBUG, "auth_shadow: pw mismatch: %s != %s",
+ password, upw->upw_passwd);
+--
+cgit v0.9.0.2
diff --git a/crypto/cyrus-sasl/db5.patch b/crypto/cyrus-sasl/db5.patch
deleted file mode 100644
index 5228240..0000000
--- a/crypto/cyrus-sasl/db5.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-Author: Ondřej Surý <ondrej AT debian.org>
-Description: Support newer Berkeley DB versions
---- a/sasldb/db_berkeley.c
-+++ b/sasldb/db_berkeley.c
-@@ -101,7 +101,7 @@ static int berkeleydb_open(const sasl_ut
- ret = db_create(mbdb, NULL, 0);
- if (ret == 0 && *mbdb != NULL)
- {
--#if DB_VERSION_MAJOR == 4 && DB_VERSION_MINOR >= 1
-+#if (DB_VERSION_MAJOR > 4) || ((DB_VERSION_MAJOR == 4) && (DB_VERSION_MINOR
>= 1))
- ret = (*mbdb)->open(*mbdb, NULL, path, NULL, DB_HASH, flags, 0660);
- #else
- ret = (*mbdb)->open(*mbdb, path, NULL, DB_HASH, flags, 0660);
---- a/utils/dbconverter-2.c
-+++ b/utils/dbconverter-2.c
-@@ -214,7 +214,7 @@ static int berkeleydb_open(const char *p
- ret = db_create(mbdb, NULL, 0);
- if (ret == 0 && *mbdb != NULL)
- {
--#if DB_VERSION_MAJOR == 4 && DB_VERSION_MINOR >= 1
-+#if (DB_VERSION_MAJOR > 4) || ((DB_VERSION_MAJOR == 4) && (DB_VERSION_MINOR
>= 1))
- ret = (*mbdb)->open(*mbdb, NULL, path, NULL, DB_HASH, DB_CREATE,
0664);
- #else
- ret = (*mbdb)->open(*mbdb, path, NULL, DB_HASH, DB_CREATE, 0664);
diff --git a/crypto/cyrus-sasl/imap-logout.patch
b/crypto/cyrus-sasl/imap-logout.patch
new file mode 100644
index 0000000..d8b4b6e
--- /dev/null
+++ b/crypto/cyrus-sasl/imap-logout.patch
@@ -0,0 +1,48 @@
+--- cyrus-sasl2.orig/saslauthd/auth_rimap.c
++++ cyrus-sasl2/saslauthd/auth_rimap.c
+@@ -90,6 +90,7 @@ static struct addrinfo *ai = NULL; /* re
+ service we connect to. */
+ #define TAG "saslauthd" /* IMAP command tag */
+ #define LOGIN_CMD (TAG " LOGIN ") /* IMAP login command (with tag) */
++#define LOGOUT_CMD (TAG " LOGOUT ") /* IMAP logout command (with tag)*/
+ #define NETWORK_IO_TIMEOUT 30 /* network I/O timeout (seconds) */
+ #define RESP_LEN 1000 /* size of read response buffer */
+
+@@ -307,10 +308,12 @@ auth_rimap (
+ int s=-1; /* socket to remote auth host
*/
+ struct addrinfo *r; /* remote socket address info
*/
+ struct iovec iov[5]; /* for sending LOGIN command */
++ struct iovec iov2[2]; /* for sending LOGOUT command */
+ char *qlogin; /* pointer to "quoted" login */
+ char *qpass; /* pointer to "quoted" password */
+ char *c; /* scratch pointer */
+ int rc; /* return code scratch area */
++ int rcl; /* return code scratch area */
+ char rbuf[RESP_LEN]; /* response read buffer */
+ char hbuf[NI_MAXHOST], pbuf[NI_MAXSERV];
+ int saved_errno;
+@@ -505,6 +508,24 @@ auth_rimap (
+ }
+ }
+ }
++
++ /* close remote imap */
++ iov2[0].iov_base = LOGOUT_CMD;
++ iov2[0].iov_len = sizeof(LOGOUT_CMD) - 1;
++ iov2[1].iov_base = "\r\n";
++ iov2[1].iov_len = sizeof("\r\n") - 1;
++
++ if (flags & VERBOSE) {
++ syslog(LOG_DEBUG, "auth_rimap: sending %s%s %s",
++ LOGOUT_CMD, qlogin, qpass);
++ }
++ alarm(NETWORK_IO_TIMEOUT);
++ rcl = retry_writev(s, iov2, 2);
++ alarm(0);
++ if (rcl == -1) {
++ syslog(LOG_WARNING, "auth_rimap: writev logout: %m");
++ }
++
+ (void) close(s); /* we're done with the remote */
+ if (rc == -1) {
+ syslog(LOG_WARNING, "auth_rimap: read (response): %m");
diff --git a/crypto/cyrus-sasl/imap-loop.patch
b/crypto/cyrus-sasl/imap-loop.patch
new file mode 100644
index 0000000..4da6189
--- /dev/null
+++ b/crypto/cyrus-sasl/imap-loop.patch
@@ -0,0 +1,89 @@
+--- saslauthd/auth_rimap.c 2012-10-12 14:05:48.000000000 +0000
++++ saslauthd/auth_rimap.c 2014-05-15 05:23:02.000000000 +0000
+@@ -371,7 +371,7 @@
+ if ( rc>0 ) {
+ /* check if there is more to read */
+ fd_set perm;
+- int fds, ret;
++ int fds, ret, loopc;
+ struct timeval timeout;
+
+ FD_ZERO(&perm);
+@@ -380,6 +380,7 @@
+
+ timeout.tv_sec = 1;
+ timeout.tv_usec = 0;
++ loopc = 0;
+ while( select (fds, &perm, NULL, NULL, &timeout ) >0 ) {
+ if ( FD_ISSET(s, &perm) ) {
+ ret = read(s, rbuf+rc, sizeof(rbuf)-rc);
+@@ -387,6 +388,14 @@
+ rc = ret;
+ break;
+ } else {
++ if (ret == 0) {
++ loopc += 1;
++ } else {
++ loopc = 0;
++ }
++ if (loopc > sizeof(rbuf)) { // arbitrary chosen value
++ break;
++ }
+ rc += ret;
+ }
+ }
+@@ -484,7 +493,7 @@
+ if ( rc>0 ) {
+ /* check if there is more to read */
+ fd_set perm;
+- int fds, ret;
++ int fds, ret, loopc;
+ struct timeval timeout;
+
+ FD_ZERO(&perm);
+@@ -493,6 +502,7 @@
+
+ timeout.tv_sec = 1;
+ timeout.tv_usec = 0;
++ loopc = 0;
+ while( select (fds, &perm, NULL, NULL, &timeout ) >0 ) {
+ if ( FD_ISSET(s, &perm) ) {
+ ret = read(s, rbuf+rc, sizeof(rbuf)-rc);
+@@ -500,6 +510,14 @@
+ rc = ret;
+ break;
+ } else {
++ if (ret == 0) {
++ loopc += 1;
++ } else {
++ loopc = 0;
++ }
++ if (loopc > sizeof(rbuf)) { // arbitrary chosen value
++ break;
++ }
+ rc += ret;
+ }
+ }
+--- lib/checkpw.c 2012-01-27 23:31:36.000000000 +0000
++++ lib/checkpw.c 2014-05-15 05:19:35.000000000 +0000
+@@ -587,16 +587,14 @@
+ /* Timeout. */
+ errno = ETIMEDOUT;
+ return -1;
+- case +1:
+- if (FD_ISSET(fd, &rfds)) {
+- /* Success, file descriptor is readable. */
+- return 0;
+- }
+- return -1;
+ case -1:
+ if (errno == EINTR || errno == EAGAIN)
+ continue;
+ default:
++ if (FD_ISSET(fd, &rfds)) {
++ /* Success, file descriptor is readable. */
++ return 0;
++ }
+ /* Error catch-all. */
+ return -1;
+ }
diff --git a/crypto/cyrus-sasl/ldapdb-buffer.patch
b/crypto/cyrus-sasl/ldapdb-buffer.patch
new file mode 100644
index 0000000..af38218
--- /dev/null
+++ b/crypto/cyrus-sasl/ldapdb-buffer.patch
@@ -0,0 +1,10 @@
+--- cyrus-sasl2.orig/plugins/ldapdb.c
++++ cyrus-sasl2/plugins/ldapdb.c
+@@ -406,6 +406,7 @@ ldapdb_canon_server(void *glob_context,
+ if ( len > out_max )
+ len = out_max;
+ memcpy(out, bvals[0]->bv_val, len);
++ out[len] = '\0';
+ *out_ulen = len;
+ ber_bvecfree(bvals);
+ }
diff --git a/crypto/cyrus-sasl/size_t.patch b/crypto/cyrus-sasl/size_t.patch
new file mode 100644
index 0000000..7f50ce6
--- /dev/null
+++ b/crypto/cyrus-sasl/size_t.patch
@@ -0,0 +1,12 @@
+--- include/sasl.h.orig 2012-10-12 17:05:48.000000000 +0300
++++ include/sasl.h 2013-02-23 16:56:44.648786268 +0200
+@@ -121,6 +121,9 @@
+ #ifndef SASL_H
+ #define SASL_H 1
+
++/* stddef.h to get size_t defined */
++#include <stddef.h>
++
+ /* Keep in sync with win32/common.mak */
+ #define SASL_VERSION_MAJOR 2
+ #define SASL_VERSION_MINOR 1



  • [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (bad4e383a9d3ac851559bf58aa141413da045d32), Vlad Glagolev, 07/06/2015

Archive powered by MHonArc 2.6.24.

Top of Page