upstream/311296-rand-mktemp.patch: more random file creation in /tmp, see CVE CAN...

diff --git a/debian/changelog b/debian/changelog
index fd58a545e80eda014b4af5b2794e47f041b38949..6c4784b56ebbf54cd619d723e53294fe84fbcbcc 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -24,6 +24,8 @@ mutt (1.5.20-7) unstable; urgency=low
     + upstream/383769-score-match.patch: match full name with ~F, same as
       mutt-ng (Closes: 383769)
     + upstream/547739-manual-typos.patch: typos in manual.txt (Closes: 547739)
+    + upstream/311296-rand-mktemp.patch: more random file creation in /tmp, see
+      CVE CAN-2005-2351 (Closes: 311296)
     + debian-specific/Muttrc: set time_inc to be 250ms (Closes: 537746)
   * debian/control: 
     + bumping Standards-Version to 3.8.4, nothing to be done

diff --git a/debian/patches/series b/debian/patches/series
index 764f675e5c3d54dfe1c4aee7c2b5e753b89cb3e0..0389f2faffa55f93cafaa0633aff36ca0dd66ab2 100644 (file)
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -58,6 +58,7 @@ upstream/528233-readonly-open.patch
 upstream/228671-pipe-mime.patch
 upstream/383769-score-match.patch
 upstream/547739-manual-typos.patch
+upstream/311296-rand-mktemp.patch
 
 misc/hyphen-as-minus.patch
 #misc/manpage-typos.patch

diff --git a/debian/patches/upstream/311296-rand-mktemp.patch b/debian/patches/upstream/311296-rand-mktemp.patch
new file mode 100644 (file)
index 0000000..e65b879
--- /dev/null
+++ b/debian/patches/upstream/311296-rand-mktemp.patch
@@ -0,0 +1,19 @@
+More random file creation in /tmp to prevent DOS, see CVE CAN-2005-2351 and
+upstream http://bugs.mutt.org/3158
+
+--- a/muttlib.c
++++ b/muttlib.c
+@@ -748,7 +748,12 @@
+ 
+ void _mutt_mktemp (char *s, const char *src, int line)
+ {
+-  snprintf (s, _POSIX_PATH_MAX, "%s/mutt-%s-%d-%d-%d", NONULL (Tempdir), NONULL(Hostname), (int) getuid(), (int) getpid (), Counter++);
++  long sek;
++
++  time(&sek);
++  srand(sek);
++  snprintf (s, _POSIX_PATH_MAX, "%s/mutt-%s-%d-%d-%d%x%x", NONULL (Tempdir), NONULL(Hostname), (int) getuid(), (int) getpid (),
++            Counter++, (unsigned int) rand(), (unsigned int) rand());
+   dprint (3, (debugfile, "%s:%d: mutt_mktemp returns \"%s\".\n", src, line, s));
+   unlink (s);
+ }