Add patches for two longstanding security issues in bitchx:

 - CVE-2007-5839: e_hostname uses mktempnam in an unsafe manner.
 - CVE-2007-4584: p_mode classic buffer overflow using a static string.

2 files changed, 99 insertions, 0 deletions

diff --git a/chat/bitchx/patches/patch-ag b/chat/bitchx/patches/patch-ag
new file mode 100644
index 00000000000..db447e09726
--- /dev/null
+++ b/chat/bitchx/patches/patch-ag
@@ -0,0 +1,40 @@
+$NetBSD: patch-ag,v 1.3 2008/07/06 05:16:50 tonnerre Exp $
+
+--- source/parse.c.orig	2008-07-06 06:24:53.000000000 +0200
++++ source/parse.c
+@@ -1413,10 +1413,11 @@ static	void p_mode(char *from, char **Ar
+ 	char	*channel;
+ 	char	*line;
+ 	int	flag;
++	size_t	linelen;
+ 	
+ 	ChannelList *chan = NULL;
+ 	ChannelList *chan2 = get_server_channels(from_server);
+-	char buffer[BIG_BUFFER_SIZE+1];		
++	char *buffer;
+ 	char *smode;
+ #ifdef COMPRESS_MODES
+ 	char *tmpbuf = NULL;
+@@ -1432,7 +1433,13 @@ static	void p_mode(char *from, char **Ar
+ 	set_display_target(channel, LOG_CRAP);
+ 	if (channel && line)
+ 	{
+-		strcpy(buffer, line);
++		buffer = malloc(linelen = strlen(line));
++		if (!buffer)
++		{
++			perror("malloc");
++			return;
++		}
++		strncpy(buffer, line, linelen);
+ 		if (get_int_var(MODE_STRIPPER_VAR))
+ 			strip_modes(from,channel,line);
+ 		if (is_channel(channel))
+@@ -1486,6 +1493,7 @@ static	void p_mode(char *from, char **Ar
+ 			do_logchannel(LOG_MODE_USER, chan, "%s %s %s", from, channel, line);
+ 		}
+ 		update_all_status(current_window, NULL, 0);
++		free(buffer);
+ 	}
+ #ifdef GUI
+ 	gui_update_nicklist(channel);
diff --git a/chat/bitchx/patches/patch-ah b/chat/bitchx/patches/patch-ah
new file mode 100644
index 00000000000..0ccc33901ab
--- /dev/null
+++ b/chat/bitchx/patches/patch-ah
@@ -0,0 +1,59 @@
+$NetBSD: patch-ah,v 1.3 2008/07/06 05:16:50 tonnerre Exp $
+
+--- source/commands.c.orig	2003-06-11 09:00:41.000000000 +0200
++++ source/commands.c
+@@ -2617,7 +2617,6 @@ BUILT_IN_COMMAND(e_hostname)
+ #if !defined(__linux__) && !defined(BSD) && !defined(__EMX__)
+ 		bitchsay("Local Host Name is [%s]", (LocalHostName)? LocalHostName: hostname);
+ #elif defined(old_hostname)
+-		char filename[81];
+ 		char comm[200];
+ 		FILE *fptr;
+ 		char *p = NULL, *q;
+@@ -2632,34 +2631,29 @@ BUILT_IN_COMMAND(e_hostname)
+ #endif
+ #endif
+ 
+-		tmpnam(filename);
+ #if defined(_BSDI_VERSION) && _BSDI_VERSION < 199701
+ 		if (!(p = path_search("netstat", "/sbin:/usr/sbin:/bin:/usr/bin")))
+ 		{
+ 			yell("No Netstat to be found");
+ 			return;
+ 		}
+-		sprintf(comm, "%s -in >%s", p, filename);
++		sprintf(comm, "%s -in", p);
+ #elif defined(__EMX__)
+-		sprintf(comm, "netstat -a > %s", filename);
++		sprintf(comm, "netstat -a");
+ #else
+ 		if (!(p = path_search("ifconfig", "/sbin:/usr/sbin:/bin:/usr/bin")))
+ 		{
+ 			yell("Can't find ifconfig");
+ 			return;
+ 		}
+-                sprintf(comm, "%s -a >%s", p, filename);
++                sprintf(comm, "%s -a", p);
+ #endif
+-		system(comm);
+ 
+ #ifdef __EMXPM__
+ 		pm_seticon(last_input_screen);
+ #endif
+-		if ((fptr = fopen(filename, "r")) == NULL)
+-		{
+-			unlink(filename);
++		if ((fptr = popen(comm, "r")) == NULL)
+ 			return;
+-		}
+ #if defined(_BSDI_VERSION) && _BSDI_VERSION < 199701
+ 		fgets(comm, 200, fptr);
+ 		fgets(comm, 200, fptr);
+@@ -2777,7 +2771,6 @@ BUILT_IN_COMMAND(e_hostname)
+ 			}
+ 		}
+ 		fclose(fptr);
+-		unlink(filename);
+ 		for (new = virtuals, i = 1; virtuals; i++)
+ 		{
+ 			new = virtuals;