Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (0e174dfa8967f8614c2e656b556f407f16ea5fab)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (0e174dfa8967f8614c2e656b556f407f16ea5fab)
  • Date: Sun, 28 Aug 2022 03:24:44 +0000

GIT changes to master grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

wm-addons/alock/DETAILS | 1 +
wm-addons/alock/HISTORY | 5 ++++-
wm-addons/alock/PRE_BUILD | 2 ++
wm-addons/alock/crypt-h.patch | 21 +++++++++++++++++++++
wm-addons/alock/crypt.patch | 29 +++++++++++++++++++++++++++++
5 files changed, 57 insertions(+), 1 deletion(-)

New commits:
commit 0e174dfa8967f8614c2e656b556f407f16ea5fab
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

alock: security update

diff --git a/wm-addons/alock/DETAILS b/wm-addons/alock/DETAILS
index 786e4db..b28af85 100755
--- a/wm-addons/alock/DETAILS
+++ b/wm-addons/alock/DETAILS
@@ -1,5 +1,6 @@
SPELL=alock
VERSION=2.5.0
+ SECURITY_PATCH=1
SOURCE=${SPELL}-${VERSION}.tar.gz

SOURCE_URL[0]=https://github.com/Arkq/${SPELL}/archive/refs/tags/v${VERSION}.tar.gz

SOURCE_HASH=sha512:52e6776fa4a15dc3971bbe394e5ad762e600d4c1789aa05609166963497245648d5dcfc9e874e8b7e62bc7979d7948e8092acdf433bfc575b02be03047fb1c9d
diff --git a/wm-addons/alock/HISTORY b/wm-addons/alock/HISTORY
index 1737c64..3e42b13 100644
--- a/wm-addons/alock/HISTORY
+++ b/wm-addons/alock/HISTORY
@@ -1,5 +1,8 @@
2022-08-27 Vlad Glagolev <stealth AT sourcemage.org>
- * DETAILS: correct license to MIT
+ * DETAILS: SECURITY_PATCH=1, correct license to MIT
+ * PRE_BUILD: apply patches
+ * crypt-h.patch: added, to fix a security issue on modern systems
+ * crypt.h: added, to fix a potential security issue

2022-08-25 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 2.5.0
diff --git a/wm-addons/alock/PRE_BUILD b/wm-addons/alock/PRE_BUILD
index 067c14e..15fe54b 100755
--- a/wm-addons/alock/PRE_BUILD
+++ b/wm-addons/alock/PRE_BUILD
@@ -1,6 +1,8 @@
default_pre_build &&
cd "${SOURCE_DIRECTORY}" &&

+patch -p1 < "${SPELL_DIRECTORY}/crypt.patch" &&
+patch -p1 < "${SPELL_DIRECTORY}/crypt-h.patch" &&
patch -p1 < "${SPELL_DIRECTORY}/procps-328.patch" &&

autoreconf -fi
diff --git a/wm-addons/alock/crypt-h.patch b/wm-addons/alock/crypt-h.patch
new file mode 100644
index 0000000..ae73f3b
--- /dev/null
+++ b/wm-addons/alock/crypt-h.patch
@@ -0,0 +1,21 @@
+From 5770e518db21e9e1d74cd04f8d6dc26b7695656b Mon Sep 17 00:00:00 2001
+From: nic <nic AT boet.cc>
+Date: Wed, 7 Oct 2020 15:14:42 -0500
+Subject: [PATCH] implicit declaration of function crypt
+
+---
+ src/auth_passwd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/auth_passwd.c b/src/auth_passwd.c
+index 7b2fe21..0af2ded 100644
+--- a/src/auth_passwd.c
++++ b/src/auth_passwd.c
+@@ -17,6 +17,7 @@
+ #include "alock.h"
+
+ #include <string.h>
++#include <crypt.h>
+ #include <unistd.h>
+ #include <errno.h>
+ #include <grp.h>
diff --git a/wm-addons/alock/crypt.patch b/wm-addons/alock/crypt.patch
new file mode 100644
index 0000000..e9047fd
--- /dev/null
+++ b/wm-addons/alock/crypt.patch
@@ -0,0 +1,29 @@
+From b22a460def5f066227ec1486ffcf642bc1dd3315 Mon Sep 17 00:00:00 2001
+From: Vlad Glagolev <scm AT vaygr.net>
+Date: Sat, 27 Aug 2022 23:06:05 +0000
+Subject: [PATCH] Check crypt() value to avoid possible NULL ptr dereference
+
+---
+ src/auth_passwd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/auth_passwd.c b/src/auth_passwd.c
+index 0af2ded..7c4dd43 100644
+--- a/src/auth_passwd.c
++++ b/src/auth_passwd.c
+@@ -65,13 +65,14 @@ static int module_init(Display *display) {
+ }
+
+ static int module_authenticate(const char *pass) {
++ char *cpw;
+
+ if (pass == NULL || pwd_entry == NULL)
+ return -1;
+
+ /* Simpler, and should work with crypt() algorithms using longer
+ * salt strings (like the md5-based one on freebsd). --marekm */
+- return strcmp(crypt(pass, pwd_entry->pw_passwd), pwd_entry->pw_passwd);
++ return !(cpw = crypt(pass, pwd_entry->pw_passwd)) ||
strcmp(pwd_entry->pw_passwd, (const char *)cpw) != 0;
+ }
+
+



  • [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (0e174dfa8967f8614c2e656b556f407f16ea5fab), Vlad Glagolev, 08/27/2022

Archive powered by MHonArc 2.6.24.

Top of Page