PKGREVISION++

Fix for CVE 2009-4016

6 files changed, 135 insertions, 3 deletions

diff --git a/chat/ircd-hybrid/Makefile b/chat/ircd-hybrid/Makefile
index a34819129ba..217ed8f48a2 100644
--- a/chat/ircd-hybrid/Makefile
+++ b/chat/ircd-hybrid/Makefile
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.40 2008/10/30 23:22:59 adrianp Exp $
+# $NetBSD: Makefile,v 1.41 2010/02/04 20:14:00 adrianp Exp $
 
 DISTNAME=	ircd-hybrid-7.2.3
-PKGREVISION=	2
+PKGREVISION=	3
 CATEGORIES=	chat
 MASTER_SITES=	${MASTER_SITE_SOURCEFORGE:=ircd-hybrid/}
 EXTRACT_SUFX=	.tgz
diff --git a/chat/ircd-hybrid/distinfo b/chat/ircd-hybrid/distinfo
index b6a68f36277..907c44b76ca 100644
--- a/chat/ircd-hybrid/distinfo
+++ b/chat/ircd-hybrid/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.10 2007/10/14 18:34:42 adrianp Exp $
+$NetBSD: distinfo,v 1.11 2010/02/04 20:14:00 adrianp Exp $
 
 SHA1 (ircd-hybrid-7.2.3.tgz) = f8a61e5500d28a4b4cded5f096c3627c2e5f01a0
 RMD160 (ircd-hybrid-7.2.3.tgz) = 58bec65da2492480b9a4e86777c6c19a4b568408
@@ -8,3 +8,7 @@ SHA1 (patch-ab) = fde28c63ac049475ce1c4035958d430ac3b6934c
 SHA1 (patch-ac) = 14707da3e2418be7c3e42e61854b662aeda097fb
 SHA1 (patch-ad) = 04cb6e2339f2ac0be734510a9040985a3d57ba54
 SHA1 (patch-ae) = 888cfb10f3637daac29f7e9a71865a5d2ed93024
+SHA1 (patch-af) = 98f8e425e935f468de1ae3b29e4a81e8188f90a8
+SHA1 (patch-ag) = 34e4e1d6af0398f893916b8daef666103cb4d005
+SHA1 (patch-ah) = 398bff5e39ce04eccd959b612c84282c26e02224
+SHA1 (patch-ai) = 85e2f0650e22d8b948f65f66c6f35a9465f07b53
diff --git a/chat/ircd-hybrid/patches/patch-af b/chat/ircd-hybrid/patches/patch-af
new file mode 100644
index 00000000000..47e27359af7
--- /dev/null
+++ b/chat/ircd-hybrid/patches/patch-af
@@ -0,0 +1,18 @@
+$NetBSD: patch-af,v 1.3 2010/02/04 20:14:01 adrianp Exp $
+
+--- contrib/spy_links_notice.c.orig	2007-02-28 04:17:48.000000000 +0000
++++ contrib/spy_links_notice.c
+@@ -61,10 +61,9 @@ show_links(va_list args)
+ 
+   if (IsClient(source_p))
+     sendto_realops_flags(UMODE_SPY, L_ALL,
+-                         "LINKS '%s' requested by %s (%s@%s) [%s]",
+-                         parv[1] ? parv[1] : "", source_p->name,
+-			 source_p->username, source_p->host,
+-			 source_p->servptr->name);
++                         "links requested by %s (%s@%s) [%s]",
++                         source_p->name, source_p->username,
++			 source_p->host, source_p->servptr->name);
+ 
+   return pass_callback(prev_hook, source_p, parc, parv);
+ }
diff --git a/chat/ircd-hybrid/patches/patch-ag b/chat/ircd-hybrid/patches/patch-ag
new file mode 100644
index 00000000000..26617355630
--- /dev/null
+++ b/chat/ircd-hybrid/patches/patch-ag
@@ -0,0 +1,17 @@
+$NetBSD: patch-ag,v 1.3 2010/02/04 20:14:01 adrianp Exp $
+
+--- include/irc_string.h.orig	2007-02-28 04:17:43.000000000 +0000
++++ include/irc_string.h
+@@ -99,12 +99,6 @@ extern char *basename(char *);
+ #endif
+ 
+ /*
+- * clean_string - cleanup control and high ascii characters
+- * -Dianora
+- */
+-extern char *clean_string(char *, const unsigned char *, size_t);
+-
+-/*
+  * strip_tabs - convert tabs to spaces
+  * - jdc
+  */
diff --git a/chat/ircd-hybrid/patches/patch-ah b/chat/ircd-hybrid/patches/patch-ah
new file mode 100644
index 00000000000..e8fde771151
--- /dev/null
+++ b/chat/ircd-hybrid/patches/patch-ah
@@ -0,0 +1,42 @@
+$NetBSD: patch-ah,v 1.1 2010/02/04 20:14:01 adrianp Exp $
+
+--- modules/m_links.c.orig	2007-02-28 04:17:53.000000000 +0000
++++ modules/m_links.c
+@@ -83,15 +83,11 @@ do_links(struct Client *source_p, int pa
+ {
+   if (IsOper(source_p) || !ConfigServerHide.flatten_links)
+   {
+-    char *mask = (parc > 2 ? parv[2] : parv[1]);
++    const char *mask = (parc > 2 ? parv[2] : parv[1]);
+     const char *me_name, *nick, *p;
+     struct Client *target_p;
+-    char clean_mask[2 * HOSTLEN + 4];
+     dlink_node *ptr;
+ 
+-    if (!EmptyString(mask))    /* only necessary if there is a mask */
+-      mask = collapse(clean_string(clean_mask, (const unsigned char*) mask, 2 * HOSTLEN));
+-
+     me_name = ID_or_name(&me, source_p->from);
+     nick = ID_or_name(source_p, source_p->from);
+ 
+@@ -125,7 +121,8 @@ do_links(struct Client *source_p, int pa
+                me_name, nick,
+                EmptyString(mask) ? "*" : mask);
+   }
+-  else {
++  else
++  {
+     /*
+      * Print our own info so at least it looks like a normal links
+      * then print out the file (which may or may not be empty)
+@@ -162,8 +159,8 @@ m_links(struct Client *client_p, struct 
+                me.name, source_p->name);
+     return;
+   }
+-  else
+-    last_used = CurrentTime;
++
++  last_used = CurrentTime;
+ 
+   if (!ConfigServerHide.flatten_links)
+   {
diff --git a/chat/ircd-hybrid/patches/patch-ai b/chat/ircd-hybrid/patches/patch-ai
new file mode 100644
index 00000000000..e2840abd21d
--- /dev/null
+++ b/chat/ircd-hybrid/patches/patch-ai
@@ -0,0 +1,51 @@
+$NetBSD: patch-ai,v 1.1 2010/02/04 20:14:01 adrianp Exp $
+
+--- src/irc_string.c.orig	2007-02-28 04:17:46.000000000 +0000
++++ src/irc_string.c
+@@ -70,46 +70,6 @@ myctime(time_t value)
+ }
+ 
+ /*
+- * clean_string - clean up a string possibly containing garbage
+- *
+- * *sigh* Before the kiddies find this new and exciting way of 
+- * annoying opers, lets clean up what is sent to local opers
+- * -Dianora
+- */
+-char *
+-clean_string(char* dest, const unsigned char* src, size_t len)
+-{
+-  char* d    = dest; 
+-  assert(0 != dest);
+-  assert(0 != src);
+-
+-  if(dest == NULL || src == NULL)
+-    return NULL;
+-    
+-  len -= 3;  /* allow for worst case, '^A\0' */
+-
+-  while (*src && (len > 0))
+-  {
+-    if (*src & 0x80)             /* if high bit is set */
+-    {
+-      *d++ = '.';
+-      --len;
+-    }
+-    else if (!IsPrint(*src))       /* if NOT printable */
+-    {
+-      *d++ = '^';
+-      --len;
+-      *d++ = 0x40 + *src;   /* turn it into a printable */
+-    }
+-    else
+-      *d++ = *src;
+-    ++src, --len;
+-  }
+-  *d = '\0';
+-  return dest;
+-}
+-
+-/*
+  * strip_tabs(dst, src, length)
+  *
+  *   Copies src to dst, while converting all \t (tabs) into spaces.