From owner-svn-ports-all@freebsd.org Tue Aug 30 18:10:35 2016 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 8CBF3BC9E6D; Tue, 30 Aug 2016 18:10:35 +0000 (UTC) (envelope-from tcberner@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 690DC1C3; Tue, 30 Aug 2016 18:10:35 +0000 (UTC) (envelope-from tcberner@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u7UIAYL4090801; Tue, 30 Aug 2016 18:10:34 GMT (envelope-from tcberner@FreeBSD.org) Received: (from tcberner@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u7UIAYvg090799; Tue, 30 Aug 2016 18:10:34 GMT (envelope-from tcberner@FreeBSD.org) Message-Id: <201608301810.u7UIAYvg090799@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: tcberner set sender to tcberner@FreeBSD.org using -f From: "Tobias C. Berner" Date: Tue, 30 Aug 2016 18:10:34 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Subject: svn commit: r421128 - in branches/2016Q3/x11/kdelibs4: . files X-SVN-Group: ports-branches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Aug 2016 18:10:35 -0000 Author: tcberner Date: Tue Aug 30 18:10:34 2016 New Revision: 421128 URL: https://svnweb.freebsd.org/changeset/ports/421128 Log: MFH: r420994 Add upstream patch for a security issue in karchive: Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads. Review the patch is from: https://git.reviewboard.kde.org/r/128749/ Original KF5 review: https://git.reviewboard.kde.org/r/128185/ CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6232 Approved by: rakuco (mentor) Security: 4472ab39-6c66-11e6-9ca5-50e549ebab6c, CVE-2016-6232 Approved by: ports-secteam (junovitch), rakuco (mentor) Added: branches/2016Q3/x11/kdelibs4/files/patch-git_dd1c2da - copied unchanged from r420994, head/x11/kdelibs4/files/patch-git_dd1c2da Modified: branches/2016Q3/x11/kdelibs4/Makefile Directory Properties: branches/2016Q3/ (props changed) Modified: branches/2016Q3/x11/kdelibs4/Makefile ============================================================================== --- branches/2016Q3/x11/kdelibs4/Makefile Tue Aug 30 18:07:59 2016 (r421127) +++ branches/2016Q3/x11/kdelibs4/Makefile Tue Aug 30 18:10:34 2016 (r421128) @@ -3,7 +3,7 @@ PORTNAME= kdelibs PORTVERSION= ${KDE4_KDELIBS_VERSION} -PORTREVISION= 6 +PORTREVISION= 7 CATEGORIES= x11 kde MASTER_SITES= KDE/${KDE4_APPLICATIONS_BRANCH}/applications/${KDE4_APPLICATIONS_VERSION}/src DIST_SUBDIR= KDE/${PORTVERSION} Copied: branches/2016Q3/x11/kdelibs4/files/patch-git_dd1c2da (from r420994, head/x11/kdelibs4/files/patch-git_dd1c2da) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ branches/2016Q3/x11/kdelibs4/files/patch-git_dd1c2da Tue Aug 30 18:10:34 2016 (r421128, copy of r420994, head/x11/kdelibs4/files/patch-git_dd1c2da) @@ -0,0 +1,44 @@ +From dd1c2da9d26fd4cfc7fe0a25f413e536d56cf2db Mon Sep 17 00:00:00 2001 +From: Albert Astals Cid +Date: Fri, 26 Aug 2016 00:30:34 +0200 +Subject: [PATCH] Backport karchive fix for out of directory files + +REVIEW: 128749 +--- + kdecore/io/karchive.cpp | 15 +++++++++++++-- + +diff --git kdecore/io/karchive.cpp kdecore/io/karchive.cpp +index eb0bf2e..d3f8c67 100644 +--- kdecore/io/karchive.cpp ++++ kdecore/io/karchive.cpp +@@ -800,6 +800,7 @@ static bool sortByPosition( const KArchiveFile* file1, const KArchiveFile* file2 + void KArchiveDirectory::copyTo(const QString& dest, bool recursiveCopy ) const + { + QDir root; ++ const QString destDir(QDir(dest).absolutePath()); // get directory path without any "." or ".." + + QList fileList; + QMap fileToDir; +@@ -809,10 +810,20 @@ void KArchiveDirectory::copyTo(const QString& dest, bool recursiveCopy ) const + QStack dirNameStack; + + dirStack.push( this ); // init stack at current directory +- dirNameStack.push( dest ); // ... with given path ++ dirNameStack.push( destDir ); // ... with given path + do { + const KArchiveDirectory* curDir = dirStack.pop(); +- const QString curDirName = dirNameStack.pop(); ++ ++ // extract only to specified folder if it is located within archive's extraction folder ++ // otherwise put file under root position in extraction folder ++ QString curDirName = dirNameStack.pop(); ++ if (!QDir(curDirName).absolutePath().startsWith(destDir)) { ++ qWarning() << "Attempted export into folder" << curDirName ++ << "which is outside of the extraction root folder" << destDir << "." ++ << "Changing export of contained files to extraction root folder."; ++ curDirName = destDir; ++ } ++ + root.mkdir(curDirName); + + const QStringList dirEntries = curDir->entries();