Your message dated Tue, 17 Feb 2015 23:47:47 +0100
with message-id <[email protected]>
and subject line Re: Bug#778653: unblock: procmail/3.22-24
has caused the Debian Bug report #778653,
regarding unblock: procmail/3.22-24
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
778653: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778653
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
User: [email protected]
Usertags: unblock
Please unblock package procmail. It fixes several heap overflows
and memory corruptions spotted in recent fuzzing attempts (one
has been assigned CVE-2014-9681).
unblock procmail/3.22-24
Cheers,
Moritz
debdiff:
diff -Nru procmail-3.22/debian/changelog procmail-3.22/debian/changelog
--- procmail-3.22/debian/changelog 2014-09-04 12:08:43.000000000 +0200
+++ procmail-3.22/debian/changelog 2015-02-11 16:44:51.000000000 +0100
@@ -1,3 +1,23 @@
+procmail (3.22-24) unstable; urgency=medium
+
+ * Fix two memory corruption problems in formail. Closes: #769937.
+ Reported by Jakub Wilk. Patch by Jan Darmochwal. Thanks a lot.
+ The problems are the following:
+ - Off-by-one heap overflow when parsing addresses that have left angle
+ bracket, then a comma, but no right angle bracket: <[email protected],
+ - Off-by-one heap overflow when parsing addresses that end with
+ backslash: <[email protected]\
+
+ -- Santiago Vila <[email protected]> Wed, 11 Feb 2015 16:41:40 +0100
+
+procmail (3.22-23) unstable; urgency=medium
+
+ * Fixed heap overflow in procmail that made it to segfault on
+ some unusual (but legit) .procmailrc files. Closes: #771958.
+ Thanks a lot to Tero Marttila.
+
+ -- Santiago Vila <[email protected]> Wed, 03 Dec 2014 23:51:52 +0100
+
procmail (3.22-22) unstable; urgency=high
* Fixed heap overflow in formail that made it to crash on messages
diff -Nru procmail-3.22/debian/patches/28 procmail-3.22/debian/patches/28
--- procmail-3.22/debian/patches/28 1970-01-01 01:00:00.000000000 +0100
+++ procmail-3.22/debian/patches/28 2014-12-03 23:47:51.000000000 +0100
@@ -0,0 +1,23 @@
+From: Tero Marttila <[email protected]>
+Subject: Fix off-by-one error that makes procmail to segfault on certain
.procmailrc files
+
+--- a/src/cstdio.c
++++ b/src/cstdio.c
+@@ -144,7 +144,7 @@
+ { case '\n':case EOF:*q='\0';
+ return overflow?-1:p!=q; /* did we read anything at all? */
+ }
+- if(q==end) /* check here so that a trailing backslash won't be
lost */
++ if(q>=end) /* check here so that a trailing backslash won't be
lost */
+ q=p,overflow=1;
+ *q++=i;
+ }
+@@ -199,7 +199,7 @@
+ if(*(target=strchr(target,'\0')-1)=='\\')
+ { if(chp2!=target) /* non-empty line? */
+ target++; /* then preserve the backslash */
+- if(target>end-2) /* space enough for getbl? */
++ if(target>=end-2) /* space enough for getbl? */
+ target=end-linebuf,overflow=1; /* toss what we have */
+ continue;
+ }
diff -Nru procmail-3.22/debian/patches/29 procmail-3.22/debian/patches/29
--- procmail-3.22/debian/patches/29 1970-01-01 01:00:00.000000000 +0100
+++ procmail-3.22/debian/patches/29 2015-02-11 16:19:46.000000000 +0100
@@ -0,0 +1,25 @@
+From: Jan Darmochwal <[email protected]>
+Subject: formail memory corruption fixes
+
+--- a/src/formail.c
++++ b/src/formail.c
+@@ -219,7 +219,7 @@
+ if(i>=0&&(i!=maxindex(sest)||fldp==rdheader)) /* found
anything? */
+ { char*saddr;char*tmp; /* determine the weight */
+
nowm=areply&&headreply?headreply==1?sest[i].wrepl:sest[i].wrrepl:i;chp+=j;
+- tmp=malloc(j=fldp->Tot_len-j);tmemmove(tmp,chp,j);(chp=tmp)[j-1]='\0';
++ tmp=malloc((j=fldp->Tot_len-j) +
1);tmemmove(tmp,chp,j);(chp=tmp)[j-1]='\0';
+ if(sest[i].head==From_)
+ { char*pastad;
+ if(strchr(saddr=chp,'\n')) /* multiple From_ lines */
+--- a/src/formisc.c
++++ b/src/formisc.c
+@@ -66,7 +66,7 @@
+ retz: *target='\0';
+ ret: return start;
+ }
+- if(*start=='\\')
++ if(*start=='\\' && *(start + 1))
+ *target++='\\',start++;
+ hitspc=2;
+ goto normal; /* normal word */
diff -Nru procmail-3.22/debian/patches/series
procmail-3.22/debian/patches/series
--- procmail-3.22/debian/patches/series 2014-09-04 12:00:00.000000000 +0200
+++ procmail-3.22/debian/patches/series 2015-02-11 16:19:45.000000000 +0100
@@ -26,3 +26,5 @@
25
26
27
+28
+29
-- System Information:
Debian Release: 8.0
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 3.16.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
--- End Message ---
--- Begin Message ---
Le 2015-02-17 23:40, Moritz Muehlenhoff a écrit :
Package: release.debian.org
Severity: normal
User: [email protected]
Usertags: unblock
Please unblock package procmail. It fixes several heap overflows
and memory corruptions spotted in recent fuzzing attempts (one
has been assigned CVE-2014-9681).
unblock procmail/3.22-24
Unblocked.
Cheers.
--
Mehdi
--- End Message ---
